|
|
|
@@ -0,0 +1,148 @@
|
|
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
set -Eeuo pipefail
|
|
|
|
|
umask 027
|
|
|
|
|
|
|
|
|
|
# Install as /usr/local/bin/forgeflow-deploy, owned by root and not writable by
|
|
|
|
|
# the Gitea runner. Targets are read from the root-owned data file below.
|
|
|
|
|
|
|
|
|
|
readonly CONFIG_FILE="/etc/forgeflow/targets.conf"
|
|
|
|
|
readonly REPOSITORY="${1:-}"
|
|
|
|
|
readonly ENVIRONMENT="${2:-}"
|
|
|
|
|
readonly SHA="${3:-}"
|
|
|
|
|
readonly REQUEST_ID="${4:-manual-$(date +%s)}"
|
|
|
|
|
|
|
|
|
|
fail_usage() {
|
|
|
|
|
echo "Usage: forgeflow-deploy <owner/repository> <environment> <full-sha> [request-id]" >&2
|
|
|
|
|
exit 64
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
[[ "$REPOSITORY" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || fail_usage
|
|
|
|
|
[[ "$ENVIRONMENT" =~ ^[A-Za-z0-9._-]+$ ]] || fail_usage
|
|
|
|
|
[[ "$SHA" =~ ^[0-9a-fA-F]{40,64}$ ]] || fail_usage
|
|
|
|
|
[[ "$REQUEST_ID" =~ ^[A-Za-z0-9._:-]{1,100}$ ]] || fail_usage
|
|
|
|
|
[[ -f "$CONFIG_FILE" ]] || { echo "Missing target configuration: $CONFIG_FILE" >&2; exit 78; }
|
|
|
|
|
|
|
|
|
|
# The target file is security-sensitive because it controls root-executed paths.
|
|
|
|
|
config_owner="$(stat -c '%U' "$CONFIG_FILE")"
|
|
|
|
|
config_mode="$(stat -c '%a' "$CONFIG_FILE")"
|
|
|
|
|
[[ "$config_owner" == "root" ]] || { echo "Target configuration must be owned by root" >&2; exit 78; }
|
|
|
|
|
# Reject group/other write bits. GNU stat returns an octal string such as 640.
|
|
|
|
|
(( (8#$config_mode & 8#022) == 0 )) || { echo "Target configuration may not be group/other writable" >&2; exit 78; }
|
|
|
|
|
|
|
|
|
|
APP_DIR=""
|
|
|
|
|
BRANCH=""
|
|
|
|
|
COMPOSE_FILE=""
|
|
|
|
|
HEALTHCHECK_URL=""
|
|
|
|
|
STATUS_FILE=""
|
|
|
|
|
while IFS='|' read -r config_repository config_environment config_app_dir config_branch config_compose config_health config_status extra; do
|
|
|
|
|
[[ -z "${config_repository// }" || "$config_repository" == \#* ]] && continue
|
|
|
|
|
[[ -z "${extra:-}" ]] || { echo "Invalid extra field in $CONFIG_FILE" >&2; exit 78; }
|
|
|
|
|
if [[ "$config_repository" == "$REPOSITORY" && "$config_environment" == "$ENVIRONMENT" ]]; then
|
|
|
|
|
APP_DIR="$config_app_dir"
|
|
|
|
|
BRANCH="$config_branch"
|
|
|
|
|
COMPOSE_FILE="$config_compose"
|
|
|
|
|
HEALTHCHECK_URL="$config_health"
|
|
|
|
|
STATUS_FILE="$config_status"
|
|
|
|
|
break
|
|
|
|
|
fi
|
|
|
|
|
done < "$CONFIG_FILE"
|
|
|
|
|
|
|
|
|
|
[[ -n "$APP_DIR" ]] || { echo "Repository/environment is not allowlisted" >&2; exit 64; }
|
|
|
|
|
[[ "$APP_DIR" == /* && "$COMPOSE_FILE" == /* && "$STATUS_FILE" == /var/lib/forgeflow-status/* ]] || {
|
|
|
|
|
echo "Target configuration contains an unsafe path" >&2
|
|
|
|
|
exit 78
|
|
|
|
|
}
|
|
|
|
|
[[ "$BRANCH" =~ ^[A-Za-z0-9._/-]+$ && "$BRANCH" != *..* ]] || { echo "Unsafe branch in target configuration" >&2; exit 78; }
|
|
|
|
|
[[ -d "$APP_DIR/.git" ]] || { echo "Application directory is not a Git working tree: $APP_DIR" >&2; exit 72; }
|
|
|
|
|
[[ -f "$COMPOSE_FILE" ]] || { echo "Compose file does not exist: $COMPOSE_FILE" >&2; exit 72; }
|
|
|
|
|
|
|
|
|
|
install -d -o root -g root -m 0755 "$(dirname "$STATUS_FILE")"
|
|
|
|
|
|
|
|
|
|
json_string() {
|
|
|
|
|
# Inputs accepted by this script are deliberately restricted to characters
|
|
|
|
|
# that do not need JSON escaping. This guard prevents accidental expansion.
|
|
|
|
|
[[ "$1" =~ ^[A-Za-z0-9._:/-]*$ ]] || return 1
|
|
|
|
|
printf '%s' "$1"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
write_status() {
|
|
|
|
|
local health="$1"
|
|
|
|
|
local live_sha="$2"
|
|
|
|
|
local previous_sha="$3"
|
|
|
|
|
local exit_code="${4:-0}"
|
|
|
|
|
local deployed_at temporary
|
|
|
|
|
deployed_at="$(date --utc +%Y-%m-%dT%H:%M:%SZ)"
|
|
|
|
|
temporary="${STATUS_FILE}.${$}.tmp"
|
|
|
|
|
json_string "$health" >/dev/null
|
|
|
|
|
json_string "$REQUEST_ID" >/dev/null
|
|
|
|
|
[[ "$live_sha" =~ ^[0-9a-fA-F]{40,64}$ ]] || { echo "Invalid live SHA for status output" >&2; return 1; }
|
|
|
|
|
[[ "$previous_sha" =~ ^[0-9a-fA-F]{40,64}$ ]] || { echo "Invalid previous SHA for status output" >&2; return 1; }
|
|
|
|
|
cat > "$temporary" <<JSON
|
|
|
|
|
{
|
|
|
|
|
"repository": "$REPOSITORY",
|
|
|
|
|
"environment": "$ENVIRONMENT",
|
|
|
|
|
"request_id": "$REQUEST_ID",
|
|
|
|
|
"commit_sha": "$live_sha",
|
|
|
|
|
"previous_sha": "$previous_sha",
|
|
|
|
|
"requested_sha": "$SHA",
|
|
|
|
|
"deployed_at": "$deployed_at",
|
|
|
|
|
"health": "$health",
|
|
|
|
|
"last_exit_code": $exit_code
|
|
|
|
|
}
|
|
|
|
|
JSON
|
|
|
|
|
chmod 0644 "$temporary"
|
|
|
|
|
mv -f "$temporary" "$STATUS_FILE"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
exec 9>"/run/lock/forgeflow-${REPOSITORY//\//-}-${ENVIRONMENT}.lock"
|
|
|
|
|
flock -n 9 || { echo "Another deployment is already running" >&2; exit 75; }
|
|
|
|
|
|
|
|
|
|
current_sha="$(git -C "$APP_DIR" rev-parse HEAD)"
|
|
|
|
|
previous_sha="$(cat "$APP_DIR/.forgeflow-live-sha" 2>/dev/null || printf '%s' "$current_sha")"
|
|
|
|
|
[[ "$previous_sha" =~ ^[0-9a-fA-F]{40,64}$ ]] || previous_sha="$current_sha"
|
|
|
|
|
|
|
|
|
|
echo "ForgeFlow request: $REQUEST_ID"
|
|
|
|
|
echo "Target: $REPOSITORY / $ENVIRONMENT"
|
|
|
|
|
echo "Current SHA: $current_sha"
|
|
|
|
|
echo "Requested SHA: $SHA"
|
|
|
|
|
|
|
|
|
|
on_error() {
|
|
|
|
|
local exit_code=$?
|
|
|
|
|
local actual_sha
|
|
|
|
|
trap - ERR
|
|
|
|
|
actual_sha="$(git -C "$APP_DIR" rev-parse HEAD 2>/dev/null || printf '%s' "$current_sha")"
|
|
|
|
|
write_status "unhealthy" "$actual_sha" "$previous_sha" "$exit_code" || true
|
|
|
|
|
echo "Deployment failed with exit code $exit_code" >&2
|
|
|
|
|
exit "$exit_code"
|
|
|
|
|
}
|
|
|
|
|
trap on_error ERR
|
|
|
|
|
|
|
|
|
|
git -C "$APP_DIR" fetch --prune origin "$BRANCH"
|
|
|
|
|
git -C "$APP_DIR" cat-file -e "$SHA^{commit}"
|
|
|
|
|
git -C "$APP_DIR" merge-base --is-ancestor "$SHA" "origin/$BRANCH" || {
|
|
|
|
|
echo "Requested SHA is not part of origin/$BRANCH" >&2
|
|
|
|
|
exit 65
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
write_status "deploying" "$current_sha" "$previous_sha" 0
|
|
|
|
|
git -C "$APP_DIR" reset --hard "$SHA"
|
|
|
|
|
docker compose -f "$COMPOSE_FILE" up -d --build --remove-orphans
|
|
|
|
|
|
|
|
|
|
for attempt in $(seq 1 30); do
|
|
|
|
|
if curl --fail --silent --show-error --max-time 5 "$HEALTHCHECK_URL" >/dev/null; then
|
|
|
|
|
printf '%s\n' "$SHA" > "$APP_DIR/.forgeflow-live-sha"
|
|
|
|
|
printf '%s\n' "$previous_sha" > "$APP_DIR/.forgeflow-previous-sha"
|
|
|
|
|
chmod 0640 "$APP_DIR/.forgeflow-live-sha" "$APP_DIR/.forgeflow-previous-sha"
|
|
|
|
|
write_status "healthy" "$SHA" "$previous_sha" 0
|
|
|
|
|
trap - ERR
|
|
|
|
|
echo "Deployment healthy at $SHA"
|
|
|
|
|
exit 0
|
|
|
|
|
fi
|
|
|
|
|
echo "Healthcheck attempt $attempt/30 did not pass yet"
|
|
|
|
|
sleep 2
|
|
|
|
|
done
|
|
|
|
|
|
|
|
|
|
trap - ERR
|
|
|
|
|
write_status "unhealthy" "$SHA" "$previous_sha" 70
|
|
|
|
|
echo "Healthcheck failed after deployment" >&2
|
|
|
|
|
exit 70
|
NuklearRabbit