Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

feat: verify server pull access before deployment

Browse Source
This commit is contained in:
NuklearRabbit
2026-07-29 16:17:54 +02:00
parent 430d40354b
commit ae6c41ff90
8 changed files with 196 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/audit-installed-deployments.cjs
+14 -6
View File
@@ -16,7 +16,6 @@ app.setPath("userData", userDataPath);
app.whenReady().then(async () => {
try {
const reconcile = process.argv.includes("--reconcile");
const configureAccess = process.argv.includes("--configure-access");
const repositoryFilter = new Set(String(process.argv.find((value) => value.startsWith("--repository=")) || "")
.slice("--repository=".length).toLowerCase().split(",").map((value) => value.trim()).filter(Boolean));
@@ -29,20 +28,29 @@ app.whenReady().then(async () => {
const deployments = new UnraidDeploymentService({ store, ssh, git, gitea, sourcePath: path.resolve(__dirname, "..") });
const reports = [];
for (const server of store.data.servers || []) {
const report = await deployments.scanServerInventory(server.id, repositories, { autoLink: reconcile });
const report = await deployments.scanServerInventory(server.id, repositories);
const access = [];
const seenProfiles = new Set();
for (const repository of repositories) {
for (const profile of repository.deploymentProfiles || store.getDeploymentProfiles(repository.fullName) || []) {
if (profile.serverId !== server.id || profile.deploymentMode !== "server-git" || seenProfiles.has(profile.id)) continue;
seenProfiles.add(profile.id);
try {
access.push(await deployments.verifyServerGitProfile({ repository, profileId: profile.id }));
} catch (error) {
access.push({ repository: repository.fullName, profileId: profile.id, readiness: "Verification incomplete", ready: false, error: error.message });
}
}
}
if (configureAccess) {
const refreshedRepositories = await new RepositoryService(store, git, gitea).refresh();
const seenProfiles = new Set();
for (const workload of report.workloads.filter((item) => item.runtime?.running && item.link?.profileId && item.link?.repositoryFullName)) {
if (seenProfiles.has(workload.link.profileId)) continue;
seenProfiles.add(workload.link.profileId);
const repository = refreshedRepositories.find((item) => String(item.fullName).toLowerCase() === String(workload.link.repositoryFullName).toLowerCase());
if (!repository) continue;
if (repositoryFilter.size && !repositoryFilter.has(String(repository.fullName).toLowerCase())) continue;
try {
const configured = await deployments.configureServerGitAccess({ repository, profileId: workload.link.profileId });
access.push({ repository: repository.fullName, ready: true, created: configured.created, remoteSha: configured.remoteSha });
access.push({ repository: repository.fullName, profileId: workload.link.profileId, action: "configured", ready: true, created: configured.created, remoteSha: configured.remoteSha });
await new Promise((resolve) => setTimeout(resolve, 1500));
} catch (error) {
access.push({ repository: repository.fullName, ready: false, error: error.message });