stoke/scripts/publish-deb.sh
codex-bot-andresmgsl dcb169e8ab
All checks were successful
labels / labels (pull_request) Successful in 15s
ci / test (pull_request) Successful in 25s
fix: protect Debian publish credentials
2026-09-04 02:55:49 +00:00

71 lines
2.4 KiB
Bash
Executable file

#!/usr/bin/env bash
#
# Publish a .deb to the Forgejo Debian package registry.
#
# Usage: scripts/publish-deb.sh <path-to-deb> [owner] [distribution] [component]
#
# owner registry owner (user or org), default: heavy-duty
# distribution APT distribution, default: stable
# component APT component, default: main
#
# Authentication (first match wins):
# 1. STOKE_TOKEN environment variable (set from secrets.RELEASE_TOKEN in CI)
# 2. The token stored by `stoke auth login`
#
# The Forgejo URL defaults to the instance in the stoke config, falling back
# to https://forgejo.heavyduty.builders. Override with FORGE_URL.
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
DEB="${1:?usage: publish-deb.sh <path-to-deb> [owner] [distribution] [component]}"
OWNER="${2:-heavy-duty}"
DISTRIBUTION="${3:-stable}"
COMPONENT="${4:-main}"
[ -f "$DEB" ] || { echo "error: no such file: $DEB" >&2; exit 1; }
CONFIG_JSON="$(node -e "const c = require('$ROOT/src/config').loadConfig(); if (c) process.stdout.write(JSON.stringify(c));" 2>/dev/null || true)"
TOKEN="${STOKE_TOKEN:-$(node -pe "(JSON.parse(process.argv[1] || '{}').token) || ''" "$CONFIG_JSON")}"
FORGE_URL="${FORGE_URL:-$(node -pe "(JSON.parse(process.argv[1] || '{}').url) || 'https://forgejo.heavyduty.builders'" "$CONFIG_JSON")}"
if [ -z "$TOKEN" ]; then
cat >&2 <<'EOF'
error: no token.
In CI, this step reads STOKE_TOKEN from secrets.RELEASE_TOKEN; an empty value
means the secret is unset or unreadable by this workflow, not that the tool is missing.
Locally: export STOKE_TOKEN, or run `stoke auth login`.
EOF
exit 1
fi
if [ -n "${RUNNER_TEMP:-}" ]; then
TMP="$(mktemp -d "$RUNNER_TEMP/stoke-publish.XXXXXX")"
else
TMP="$(mktemp -d)"
fi
trap 'rm -rf "$TMP"' EXIT
HEADER_FILE="$TMP/authorization-header"
RESPONSE_FILE="$TMP/response"
umask 077
printf 'Authorization: token %s\n' "$TOKEN" >"$HEADER_FILE"
chmod 0600 "$HEADER_FILE"
URL="$FORGE_URL/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
echo "Uploading $(basename "$DEB") to $URL"
STATUS="$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
-X PUT -H @"$HEADER_FILE" \
--upload-file "$DEB" "$URL")"
case "$STATUS" in
201) echo "Published." ;;
409) echo "Already published (409): this exact version already exists in the registry." ;;
*)
echo "error: upload failed with HTTP $STATUS" >&2
cat "$RESPONSE_FILE" >&2 || true
exit 1
;;
esac