every-channel/every.channel
1
0
Fork 0
Code Releases Activity Actions 2

ci: switch deploy secrets to age key workflow

Browse source
This commit is contained in:
every.channel 2026-02-16 00:59:52 -05:00
parent d6a9af8f1e
commit 4dbd831d0b
No known key found for this signature in database
10 changed files with 186 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/fj-auth-codeberg.sh
View file

@ -9,13 +9,19 @@ cd "${root}"
# Auth token source order:
# 1) CODEBERG_TOKEN env var
# 2) `agenix -d secrets/codeberg-token.age` (optional)
# 3) `age -d -i <identity> secrets/codeberg-token.age` (optional)
rules_file="${EVERY_CHANNEL_AGE_RULES_FILE:-./secrets.nix}"
identity_file="${EVERY_CHANNEL_AGE_IDENTITY_FILE:-$HOME/.config/every.channel/keys/founder_ed25519}"
if [[ -z "${CODEBERG_TOKEN:-}" && -f secrets/codeberg-token.age && -x "$(command -v agenix)" ]]; then
export CODEBERG_TOKEN
CODEBERG_TOKEN="$(RULES="${rules_file}" agenix -d secrets/codeberg-token.age -i "${identity_file}")"
if [[ -z "${CODEBERG_TOKEN:-}" && -f secrets/codeberg-token.age ]]; then
if command -v agenix >/dev/null 2>&1; then
export CODEBERG_TOKEN
CODEBERG_TOKEN="$(RULES="${rules_file}" agenix -d secrets/codeberg-token.age -i "${identity_file}")"
elif command -v age >/dev/null 2>&1; then
export CODEBERG_TOKEN
CODEBERG_TOKEN="$(age -d -i "${identity_file}" secrets/codeberg-token.age)"
fi
fi
if [[ -z "${CODEBERG_TOKEN:-}" ]]; then

33
scripts/fj-set-age-key-secret.sh Executable file
View file

@ -0,0 +1,33 @@
#!/usr/bin/env bash
set -euo pipefail
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${root}"
host="${EVERY_CHANNEL_FORGE_HOST:-https://codeberg.org}"
repo="${EVERY_CHANNEL_FORGE_REPO:-every-channel/every.channel}"
secret_name="${EVERY_CHANNEL_FORGE_AGE_SECRET_NAME:-AGE_FORGE_SSH_KEY}"
key_path="${1:-$HOME/.config/every.channel/keys/founder_ed25519}"
if [[ ! -f "${key_path}" ]]; then
echo "error: key file not found: ${key_path}" >&2
exit 2
fi
if ! command -v fj >/dev/null 2>&1; then
echo "error: fj not found in PATH (run: nix develop)" >&2
exit 2
fi
"${root}/scripts/fj-auth-codeberg.sh" >/dev/null
key_data="$(base64 < "${key_path}" | tr -d '\n')"
if [[ -z "${key_data}" ]]; then
echo "error: key file is empty: ${key_path}" >&2
exit 2
fi
# Upsert by delete/create because fj currently exposes create/delete.
fj -H "${host}" actions -r "${repo}" secrets delete "${secret_name}" >/dev/null 2>&1 || true
fj -H "${host}" actions -r "${repo}" secrets create "${secret_name}" "${key_data}" >/dev/null
echo "ok: set ${secret_name} on ${repo} via ${host} (base64-encoded)"