Automate immutable production deployments

2026-07-29 13:00:50 +02:00
parent 2e84f4eae4
commit 2064570913
34 changed files with 1779 additions and 215 deletions
@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+
+set +x
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WM_ROOT_DIR="$(cd "$WM_DEPLOY_DIR/.." && pwd)"
+config_token_file="${WATERMAPS_GITEA_CONFIG_TOKEN_FILE:-$WM_DEPLOY_DIR/.gitea-actions-config-token}"
+registry_token_file="${WATERMAPS_GITEA_REGISTRY_TOKEN_FILE:-$WM_DEPLOY_DIR/.gitea-registry-publish-token}"
+gitea_url="${WATERMAPS_GITEA_URL:-https://gitea.incoso.eu}"
+repository="${WATERMAPS_GITEA_REPOSITORY:-kevin_janssen/watermaps}"
+
+jq_command="$(command -v jq 2>/dev/null || true)"
+if [[ -z "$jq_command" && -x "$WM_ROOT_DIR/.tools/bin/jq" ]]; then
+  jq_command="$WM_ROOT_DIR/.tools/bin/jq"
+fi
+[[ -n "$jq_command" ]] || {
+  printf 'jq fehlt; bitte jq installieren oder unter .tools/bin/jq bereitstellen.\n' >&2
+  exit 1
+}
+
+cleanup_secrets() {
+  unset config_token registry_token token_payload
+}
+trap cleanup_secrets EXIT
+
+read_secret_file() {
+  local label="$1"
+  local path="$2"
+  local mode
+  local value
+
+  [[ -f "$path" && ! -L "$path" ]] || {
+    printf '%s fehlt oder ist keine reguläre Datei: %s\n' "$label" "$path" >&2
+    return 1
+  }
+  mode="$(stat --format=%a -- "$path")"
+  [[ "$mode" == "600" ]] || {
+    printf '%s muss Dateimodus 600 haben (chmod 600 %s; aktuell: %s).\n' \
+      "$label" "$path" "$mode" >&2
+    return 1
+  }
+
+  value="$(<"$path")"
+  [[ -n "$value" && "$value" != *[[:space:]]* ]] || {
+    printf '%s ist leer oder enthält Leerzeichen beziehungsweise Zeilenumbrüche.\n' \
+      "$label" >&2
+    return 1
+  }
+  printf '%s' "$value"
+}
+
+config_token="$(
+  read_secret_file \
+    "Lokaler Gitea-Konfigurations-PAT" \
+    "$config_token_file"
+)"
+registry_token="$(
+  read_secret_file \
+    "Gitea-Registry-Publish-PAT" \
+    "$registry_token_file"
+)"
+[[ ! "$config_token_file" -ef "$registry_token_file" ]] || {
+  printf 'Konfigurations- und Registry-PAT müssen in zwei getrennten Dateien liegen.\n' >&2
+  exit 1
+}
+[[ "$config_token" != "$registry_token" ]] || {
+  printf 'Konfigurations- und Registry-PAT müssen zwei unterschiedliche Tokens sein.\n' >&2
+  exit 1
+}
+[[ "$repository" =~ ^([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+)$ ]] || {
+  printf 'Ungültiges Gitea-Repository: %s\n' "$repository" >&2
+  exit 1
+}
+registry_username="${BASH_REMATCH[1]}"
+[[ "$gitea_url" =~ ^https://[^/?#]+(:[0-9]+)?$ ]] || {
+  printf 'Die Gitea-URL muss eine HTTPS-Origin ohne Pfad sein: %s\n' "$gitea_url" >&2
+  exit 1
+}
+
+api_request() {
+  local method="$1"
+  local endpoint="$2"
+  local payload="${3:-}"
+  local auth_header="Authorization: token $config_token"
+  local args=(
+    --proto '=https'
+    --tlsv1.2
+    --fail
+    --silent
+    --show-error
+    --connect-timeout 10
+    --max-time 30
+    --request "$method"
+    --header @/dev/fd/3
+  )
+  if [[ -n "$payload" ]]; then
+    args+=(
+      --header "Content-Type: application/json"
+      --data-binary @/dev/fd/4
+    )
+    curl "${args[@]}" "$gitea_url/api/v1/$endpoint" \
+      3<<<"$auth_header" \
+      4<<<"$payload"
+  else
+    curl "${args[@]}" "$gitea_url/api/v1/$endpoint" \
+      3<<<"$auth_header"
+  fi
+}
+
+username_payload="$(
+  printf '%s' "$registry_username" |
+    "$jq_command" --raw-input --slurp '{data: .}'
+)"
+token_payload="$(
+  printf '%s' "$registry_token" |
+    "$jq_command" --raw-input --slurp '{data: .}'
+)"
+api_request \
+  PUT \
+  "repos/$repository/actions/secrets/REGISTRY_USERNAME" \
+  "$username_payload" \
+  >/dev/null
+api_request \
+  PUT \
+  "repos/$repository/actions/secrets/REGISTRY_TOKEN" \
+  "$token_payload" \
+  >/dev/null
+
+unset config_token registry_token token_payload
+printf 'Gitea Actions Registry-Secrets wurden für %s aktualisiert.\n' "$repository"