68 lines
2.2 KiB
Bash
68 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$#" -ne 1 ]; then
|
|
echo "Usage: $0 OUTPUT_DIRECTORY" >&2
|
|
exit 2
|
|
fi
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
OUTPUT_DIR="$1"
|
|
|
|
if [ -e "$OUTPUT_DIR" ]; then
|
|
echo "Output path already exists: $OUTPUT_DIR" >&2
|
|
exit 1
|
|
fi
|
|
# Ignore checkout-only executable-bit and CRLF differences so the same guard works
|
|
# from Windows Git and WSL. Content changes still fail the export.
|
|
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
|
|
|| ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
|
|
echo "Commit or stash repository changes before creating a public export." >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$OUTPUT_DIR"
|
|
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"
|
|
|
|
# Production deployment dispatch belongs to the private operations repository.
|
|
rm -f "$OUTPUT_DIR/.gitea/workflows/unraid-deploy.yml"
|
|
|
|
for forbidden in \
|
|
'.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
|
|
'secret.key' 'id_rsa' 'id_ed25519'; do
|
|
if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
|
|
echo "Forbidden file found in public export: $forbidden" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
if grep -RIlE --exclude='export-public-source.sh' \
|
|
'192\.168\.10\.150|NuklearRabbit' "$OUTPUT_DIR" >/dev/null; then
|
|
echo "Private deployment marker found in public export." >&2
|
|
exit 1
|
|
fi
|
|
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
|
|
echo "Unexpected file larger than 10 MiB found in public export." >&2
|
|
exit 1
|
|
fi
|
|
|
|
git -C "$OUTPUT_DIR" init -q
|
|
git -C "$OUTPUT_DIR" add .
|
|
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
|
|
-c user.email='release-export@invalid.example' \
|
|
commit -q -m "Publish LumaOps source"
|
|
|
|
(
|
|
cd "$OUTPUT_DIR"
|
|
git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
|
|
)
|
|
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
|
|
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
|
|
-c user.email='release-export@invalid.example' \
|
|
commit -q --amend --no-edit
|
|
git -C "$OUTPUT_DIR" tag public-release-baseline
|
|
|
|
echo "Public source export created at $OUTPUT_DIR"
|
|
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"
|