59 lines
1.7 KiB
Bash
59 lines
1.7 KiB
Bash
REPO_DIR="${REPO_DIR:-/persist/@configuration}"
|
|
STATE_DIR="${STATE_DIR:-/persist/@autodeploy}"
|
|
BRANCH="origin/${DEPLOY_BRANCH:-master}"
|
|
|
|
mkdir -p "$STATE_DIR"
|
|
exec 9>"$STATE_DIR/lock"
|
|
flock -n 9 || { echo "another deploy running"; exit 0; }
|
|
|
|
report_status() {
|
|
[[ -f "$TOKEN_FILE" ]] || return 0
|
|
curl -sf -X POST \
|
|
-H "Authorization: token $(<"$TOKEN_FILE")" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$(hostname)" \
|
|
'{state:$s,description:$d,context:$c}')" \
|
|
"$GITEA_URL/api/v1/repos/$GITEA_REPO/statuses/$3" >/dev/null
|
|
}
|
|
|
|
cd "$REPO_DIR"
|
|
|
|
export GIT_CONFIG_COUNT=2
|
|
export GIT_CONFIG_KEY_0=gpg.format
|
|
export GIT_CONFIG_VALUE_0=ssh
|
|
export GIT_CONFIG_KEY_1=gpg.ssh.allowedSignersFile
|
|
export GIT_CONFIG_VALUE_1="$ALLOWED_SIGNERS"
|
|
|
|
git fetch origin --tags --prune-tags
|
|
|
|
latest=$(git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
|
|
echo "no tags on $BRANCH"
|
|
exit 0
|
|
}
|
|
|
|
current=$(cat "$STATE_DIR/tag" 2>/dev/null) || true
|
|
[[ "$latest" != "$current" ]] || { echo "already at $latest"; exit 0; }
|
|
|
|
echo "new tag: $latest (current: ${current:-none})"
|
|
|
|
git tag -v "$latest" || {
|
|
sha=$(git rev-list -1 "$latest")
|
|
report_status "failure" "tag signature verification failed" "$sha"
|
|
exit 1
|
|
}
|
|
|
|
sha=$(git rev-list -1 "$latest")
|
|
report_status "pending" "deploying $latest" "$sha"
|
|
|
|
# build from remote, pinned to the verified rev - no local checkout needed
|
|
flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$(hostname)"
|
|
|
|
if nixos-rebuild switch --flake "$flake_url"; then
|
|
echo "$latest" > "$STATE_DIR/tag"
|
|
report_status "success" "deployed $latest" "$sha"
|
|
echo "deployed $latest"
|
|
else
|
|
report_status "failure" "nixos-rebuild failed" "$sha"
|
|
exit 1
|
|
fi
|