65 lines
1.9 KiB
Bash
65 lines
1.9 KiB
Bash
REPO_DIR="${REPO_DIR:-/persist/@configuration}"
|
|
STATE_DIR="${STATE_DIR:-/persist/@autodeploy}"
|
|
BRANCH="origin/${DEPLOY_BRANCH:-master}"
|
|
|
|
mkdir -p "$STATE_DIR"
|
|
exec 9>"$STATE_DIR/lock"
|
|
flock -n 9 || { echo "another deploy running"; exit 0; }
|
|
|
|
runas() { runuser -u "$REPO_OWNER" -- "$@"; }
|
|
|
|
report_status() {
|
|
echo "updating status to: $1 - $2"
|
|
[[ -f "$TOKEN_FILE" ]] || return 0
|
|
curl -sf -X POST \
|
|
-H "Authorization: token $(<"$TOKEN_FILE")" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$HOSTNAME" \
|
|
'{state:$s,description:$d,context:$c}')" \
|
|
"$GITEA_URL/api/v1/repos/$GITEA_REPO/statuses/$3" >/dev/null
|
|
}
|
|
|
|
cd "$REPO_DIR"
|
|
|
|
export GIT_CONFIG_COUNT=2
|
|
export GIT_CONFIG_KEY_0=gpg.format
|
|
export GIT_CONFIG_VALUE_0=ssh
|
|
export GIT_CONFIG_KEY_1=gpg.ssh.allowedSignersFile
|
|
export GIT_CONFIG_VALUE_1="$ALLOWED_SIGNERS"
|
|
|
|
runas git fetch origin --tags --prune-tags
|
|
|
|
latest=$(runas git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
|
|
echo "no tags on $BRANCH"
|
|
exit 0
|
|
}
|
|
|
|
current=$(cat "$STATE_DIR/tag" 2>/dev/null) || true
|
|
[[ "$latest" != "$current" ]] || { echo "already at $latest"; exit 0; }
|
|
|
|
echo "new tag: $latest (current: ${current:-none})"
|
|
|
|
runas git tag -v "$latest" || {
|
|
sha=$(runas git rev-list -1 "$latest")
|
|
report_status "failure" "tag signature verification failed" "$sha"
|
|
exit 1
|
|
}
|
|
|
|
sha=$(runas git rev-list -1 "$latest")
|
|
report_status "pending" "deploying $latest" "$sha"
|
|
|
|
label_dir=$(mktemp -d)
|
|
echo "$latest" > "$label_dir/label"
|
|
flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$HOSTNAME"
|
|
|
|
if nixos-rebuild switch --flake "$flake_url" --override-input deploy-label "path:$label_dir"; then
|
|
rm -rf "$label_dir"
|
|
echo "$latest" > "$STATE_DIR/tag"
|
|
report_status "success" "deployed $latest" "$sha"
|
|
echo "deployed $latest"
|
|
else
|
|
rm -rf "$label_dir"
|
|
report_status "failure" "nixos-rebuild failed" "$sha"
|
|
exit 1
|
|
fi
|