47 lines
1.8 KiB
Bash
Executable file
47 lines
1.8 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${root}"
|
|
|
|
host="${EVERY_CHANNEL_FORGE_HOST:-https://git.every.channel}"
|
|
repo="${EVERY_CHANNEL_FORGE_REPO:-every-channel/every.channel}"
|
|
secret_name="${EVERY_CHANNEL_FORGE_AGE_SECRET_NAME:-AGE_FORGE_SSH_KEY}"
|
|
key_path="${1:-$HOME/.config/every.channel/keys/founder_ed25519}"
|
|
confirm="${EVERY_CHANNEL_CONFIRM_DEDICATED_CI_KEY:-}"
|
|
|
|
if [[ "${confirm}" != "I_UNDERSTAND_THIS_IS_A_DEDICATED_CI_KEY" ]]; then
|
|
echo "error: refusing to set ${secret_name} without explicit dedicated-CI-key confirmation" >&2
|
|
echo "set EVERY_CHANNEL_CONFIRM_DEDICATED_CI_KEY=I_UNDERSTAND_THIS_IS_A_DEDICATED_CI_KEY only for a non-personal CI decrypt key" >&2
|
|
echo "preferred path: set CLOUDFLARE_API_TOKEN with scripts/fj-set-cloudflare-token-secret.sh" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if [[ "${key_path}" == "$HOME/.ssh/id_ed25519" || "${key_path}" == "${HOME}/.ssh/id_ed25519" ]]; then
|
|
echo "error: refusing to upload personal key path ${key_path}" >&2
|
|
echo "use a scoped CLOUDFLARE_API_TOKEN or a dedicated CI decrypt key instead" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if [[ ! -f "${key_path}" ]]; then
|
|
echo "error: key file not found: ${key_path}" >&2
|
|
exit 2
|
|
fi
|
|
if ! command -v fj >/dev/null 2>&1; then
|
|
echo "error: fj not found in PATH (run: nix develop)" >&2
|
|
exit 2
|
|
fi
|
|
|
|
"${root}/scripts/fj-auth-forge.sh" >/dev/null
|
|
|
|
key_data="$(base64 < "${key_path}" | tr -d '\n')"
|
|
if [[ -z "${key_data}" ]]; then
|
|
echo "error: key file is empty: ${key_path}" >&2
|
|
exit 2
|
|
fi
|
|
|
|
# Upsert by delete/create because fj currently exposes create/delete.
|
|
fj -H "${host}" actions -r "${repo}" secrets delete "${secret_name}" >/dev/null 2>&1 || true
|
|
fj -H "${host}" actions -r "${repo}" secrets create "${secret_name}" "${key_data}" >/dev/null
|
|
|
|
echo "ok: set ${secret_name} on ${repo} via ${host} (base64-encoded)"
|