87 lines
3.0 KiB
YAML
87 lines
3.0 KiB
YAML
name: ForgeFlow approved deploy
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
environment:
|
|
description: Allowlisted ForgeFlow environment
|
|
required: true
|
|
type: string
|
|
commit_sha:
|
|
description: Exact approved commit SHA
|
|
required: true
|
|
type: string
|
|
request_id:
|
|
description: Immutable AppOps request identifier
|
|
required: true
|
|
type: string
|
|
approval_id:
|
|
description: AppOps approval identifier
|
|
required: true
|
|
type: string
|
|
approval_fingerprint:
|
|
description: Immutable AppOps approval fingerprint
|
|
required: true
|
|
type: string
|
|
evidence_issued_at:
|
|
description: Signed evidence UNIX timestamp
|
|
required: true
|
|
type: string
|
|
evidence_signature:
|
|
description: Base64 Ed25519 signature over the exact deployment evidence
|
|
required: true
|
|
type: string
|
|
|
|
concurrency:
|
|
group: forgeflow-approved-${{ gitea.repository }}-${{ inputs.environment }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: forgeflow
|
|
steps:
|
|
- name: Validate signed deployment inputs
|
|
shell: bash
|
|
env:
|
|
FF_REPOSITORY: ${{ gitea.repository }}
|
|
FF_ENVIRONMENT: ${{ inputs.environment }}
|
|
FF_COMMIT_SHA: ${{ inputs.commit_sha }}
|
|
FF_REQUEST_ID: ${{ inputs.request_id }}
|
|
FF_APPROVAL_ID: ${{ inputs.approval_id }}
|
|
FF_APPROVAL_FINGERPRINT: ${{ inputs.approval_fingerprint }}
|
|
FF_EVIDENCE_ISSUED_AT: ${{ inputs.evidence_issued_at }}
|
|
FF_EVIDENCE_SIGNATURE: ${{ inputs.evidence_signature }}
|
|
run: |
|
|
set -Eeuo pipefail
|
|
[[ "$FF_REPOSITORY" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]]
|
|
[[ "$FF_ENVIRONMENT" =~ ^[a-z0-9][a-z0-9._-]{0,63}$ ]]
|
|
[[ "$FF_COMMIT_SHA" =~ ^[0-9a-fA-F]{40,64}$ ]]
|
|
[[ "$FF_REQUEST_ID" =~ ^appr-[A-Za-z0-9._-]{1,75}$ ]]
|
|
[[ "$FF_APPROVAL_ID" == "$FF_REQUEST_ID" ]]
|
|
[[ "$FF_APPROVAL_FINGERPRINT" =~ ^[0-9a-f]{64}$ ]]
|
|
[[ "$FF_EVIDENCE_ISSUED_AT" =~ ^[0-9]{10,11}$ ]]
|
|
[[ "$FF_EVIDENCE_SIGNATURE" =~ ^[A-Za-z0-9+/]{86}==$ ]]
|
|
|
|
- name: Execute root-owned verified deployment
|
|
shell: bash
|
|
env:
|
|
FF_REPOSITORY: ${{ gitea.repository }}
|
|
FF_ENVIRONMENT: ${{ inputs.environment }}
|
|
FF_COMMIT_SHA: ${{ inputs.commit_sha }}
|
|
FF_REQUEST_ID: ${{ inputs.request_id }}
|
|
FF_APPROVAL_ID: ${{ inputs.approval_id }}
|
|
FF_APPROVAL_FINGERPRINT: ${{ inputs.approval_fingerprint }}
|
|
FF_EVIDENCE_ISSUED_AT: ${{ inputs.evidence_issued_at }}
|
|
FF_EVIDENCE_SIGNATURE: ${{ inputs.evidence_signature }}
|
|
run: |
|
|
set -Eeuo pipefail
|
|
sudo /usr/local/bin/forgeflow-deploy \
|
|
"$FF_REPOSITORY" \
|
|
"$FF_ENVIRONMENT" \
|
|
"$FF_COMMIT_SHA" \
|
|
"$FF_REQUEST_ID" \
|
|
"$FF_APPROVAL_ID" \
|
|
"$FF_APPROVAL_FINGERPRINT" \
|
|
"$FF_EVIDENCE_ISSUED_AT" \
|
|
"$FF_EVIDENCE_SIGNATURE"
|