132 lines
3.5 KiB
Bash
Executable File
132 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set +x
|
|
set -Eeuo pipefail
|
|
|
|
WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
WM_ROOT_DIR="$(cd "$WM_DEPLOY_DIR/.." && pwd)"
|
|
config_token_file="${WATERMAPS_GITEA_CONFIG_TOKEN_FILE:-$WM_DEPLOY_DIR/.gitea-actions-config-token}"
|
|
registry_token_file="${WATERMAPS_GITEA_REGISTRY_TOKEN_FILE:-$WM_DEPLOY_DIR/.gitea-registry-publish-token}"
|
|
gitea_url="${WATERMAPS_GITEA_URL:-https://gitea.incoso.eu}"
|
|
repository="${WATERMAPS_GITEA_REPOSITORY:-kevin_janssen/watermaps}"
|
|
|
|
jq_command="$(command -v jq 2>/dev/null || true)"
|
|
if [[ -z "$jq_command" && -x "$WM_ROOT_DIR/.tools/bin/jq" ]]; then
|
|
jq_command="$WM_ROOT_DIR/.tools/bin/jq"
|
|
fi
|
|
[[ -n "$jq_command" ]] || {
|
|
printf 'jq fehlt; bitte jq installieren oder unter .tools/bin/jq bereitstellen.\n' >&2
|
|
exit 1
|
|
}
|
|
|
|
cleanup_secrets() {
|
|
unset config_token registry_token token_payload
|
|
}
|
|
trap cleanup_secrets EXIT
|
|
|
|
read_secret_file() {
|
|
local label="$1"
|
|
local path="$2"
|
|
local mode
|
|
local value
|
|
|
|
[[ -f "$path" && ! -L "$path" ]] || {
|
|
printf '%s fehlt oder ist keine reguläre Datei: %s\n' "$label" "$path" >&2
|
|
return 1
|
|
}
|
|
mode="$(stat --format=%a -- "$path")"
|
|
[[ "$mode" == "600" ]] || {
|
|
printf '%s muss Dateimodus 600 haben (chmod 600 %s; aktuell: %s).\n' \
|
|
"$label" "$path" "$mode" >&2
|
|
return 1
|
|
}
|
|
|
|
value="$(<"$path")"
|
|
[[ -n "$value" && "$value" != *[[:space:]]* ]] || {
|
|
printf '%s ist leer oder enthält Leerzeichen beziehungsweise Zeilenumbrüche.\n' \
|
|
"$label" >&2
|
|
return 1
|
|
}
|
|
printf '%s' "$value"
|
|
}
|
|
|
|
config_token="$(
|
|
read_secret_file \
|
|
"Lokaler Gitea-Konfigurations-PAT" \
|
|
"$config_token_file"
|
|
)"
|
|
registry_token="$(
|
|
read_secret_file \
|
|
"Gitea-Registry-Publish-PAT" \
|
|
"$registry_token_file"
|
|
)"
|
|
[[ ! "$config_token_file" -ef "$registry_token_file" ]] || {
|
|
printf 'Konfigurations- und Registry-PAT müssen in zwei getrennten Dateien liegen.\n' >&2
|
|
exit 1
|
|
}
|
|
[[ "$config_token" != "$registry_token" ]] || {
|
|
printf 'Konfigurations- und Registry-PAT müssen zwei unterschiedliche Tokens sein.\n' >&2
|
|
exit 1
|
|
}
|
|
[[ "$repository" =~ ^([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+)$ ]] || {
|
|
printf 'Ungültiges Gitea-Repository: %s\n' "$repository" >&2
|
|
exit 1
|
|
}
|
|
registry_username="${BASH_REMATCH[1]}"
|
|
[[ "$gitea_url" =~ ^https://[^/?#]+(:[0-9]+)?$ ]] || {
|
|
printf 'Die Gitea-URL muss eine HTTPS-Origin ohne Pfad sein: %s\n' "$gitea_url" >&2
|
|
exit 1
|
|
}
|
|
|
|
api_request() {
|
|
local method="$1"
|
|
local endpoint="$2"
|
|
local payload="${3:-}"
|
|
local auth_header="Authorization: token $config_token"
|
|
local args=(
|
|
--proto '=https'
|
|
--tlsv1.2
|
|
--fail
|
|
--silent
|
|
--show-error
|
|
--connect-timeout 10
|
|
--max-time 30
|
|
--request "$method"
|
|
--header @/dev/fd/3
|
|
)
|
|
if [[ -n "$payload" ]]; then
|
|
args+=(
|
|
--header "Content-Type: application/json"
|
|
--data-binary @/dev/fd/4
|
|
)
|
|
curl "${args[@]}" "$gitea_url/api/v1/$endpoint" \
|
|
3<<<"$auth_header" \
|
|
4<<<"$payload"
|
|
else
|
|
curl "${args[@]}" "$gitea_url/api/v1/$endpoint" \
|
|
3<<<"$auth_header"
|
|
fi
|
|
}
|
|
|
|
username_payload="$(
|
|
printf '%s' "$registry_username" |
|
|
"$jq_command" --raw-input --slurp '{data: .}'
|
|
)"
|
|
token_payload="$(
|
|
printf '%s' "$registry_token" |
|
|
"$jq_command" --raw-input --slurp '{data: .}'
|
|
)"
|
|
api_request \
|
|
PUT \
|
|
"repos/$repository/actions/secrets/REGISTRY_USERNAME" \
|
|
"$username_payload" \
|
|
>/dev/null
|
|
api_request \
|
|
PUT \
|
|
"repos/$repository/actions/secrets/REGISTRY_TOKEN" \
|
|
"$token_payload" \
|
|
>/dev/null
|
|
|
|
unset config_token registry_token token_payload
|
|
printf 'Gitea Actions Registry-Secrets wurden für %s aktualisiert.\n' "$repository"
|