Restore Gitea deployment workflow

2026-06-21 15:43:35 +00:00
parent e6e6cc5144
commit 3472d06a70
3 changed files with 423 additions and 0 deletions
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${BAO_ADDR:?BAO_ADDR is required}"
+: "${BAO_ROLE_ID:?BAO_ROLE_ID is required}"
+: "${BAO_SECRET_ID:?BAO_SECRET_ID is required}"
+: "${OPENBAO_APP:?OPENBAO_APP is required}"
+
+output="${OPENBAO_ENV_FILE:-.openbao-env}"
+payload="$(mktemp)"
+merged="$(mktemp)"
+trap 'rm -f "$payload" "$merged"' EXIT
+
+export BAO_ADDR
+BAO_TOKEN="$(bao write -field=token auth/approle/login role_id="$BAO_ROLE_ID" secret_id="$BAO_SECRET_ID")"
+export BAO_TOKEN
+
+printf '{}\n' > "$merged"
+
+merge_secret() {
+  local path="$1"
+
+  bao kv get -mount=ci -format=json "$path" > "$payload"
+
+  python3 - "$payload" "$merged" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+merged_path = Path(sys.argv[2])
+merged = json.loads(merged_path.read_text(encoding="utf-8"))
+
+data = payload.get("data", {})
+if isinstance(data, dict) and isinstance(data.get("data"), dict):
+    data = data["data"]
+
+if not isinstance(data, dict):
+    raise SystemExit("OpenBao response does not contain an object secret payload")
+
+merged.update({key: value for key, value in data.items() if value is not None})
+merged_path.write_text(json.dumps(merged), encoding="utf-8")
+PY
+}
+
+merge_secret "shared/registry"
+merge_secret "shared/deploy-ssh"
+merge_secret "projects/${OPENBAO_APP}/deploy"
+merge_secret "projects/${OPENBAO_APP}/runtime"
+
+python3 - "$merged" "$output" <<'PY'
+import json
+import re
+import shlex
+import sys
+from pathlib import Path
+
+data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+output_path = Path(sys.argv[2])
+
+if "REGISTRY_USERNAME" in data and "DEPLOY_REGISTRY_USER" not in data:
+    data["DEPLOY_REGISTRY_USER"] = data["REGISTRY_USERNAME"]
+
+if "REGISTRY_PASSWORD" in data and "DEPLOY_REGISTRY_TOKEN" not in data:
+    data["DEPLOY_REGISTRY_TOKEN"] = data["REGISTRY_PASSWORD"]
+
+name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+lines = [
+    "# Generated by scripts/load-openbao-env.sh",
+    "# Do not commit this file.",
+]
+
+for key in sorted(data):
+    if not name_re.match(key):
+        raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
+    value = data[key]
+    if isinstance(value, bool):
+        value = "true" if value else "false"
+    elif not isinstance(value, str):
+        value = str(value)
+    lines.append(f"export {key}={shlex.quote(value)}")
+
+output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+output_path.chmod(0o600)
+print(f"Loaded {len(lines) - 2} OpenBao values into {output_path}", file=sys.stderr)
+PY