fix: ignore unreadable env files in upload script

CHANGELOG.md

@@ -73,6 +73,9 @@ By: Codex (GPT-5)
 | 15.01.2026 | ⚙️ Code | ID: Update-Service Status zeigt Dev/Prod und nutzt konsistente Panel-Styles. By: Codex (GPT-5) |
 | 15.01.2026 | 🏗️ Planning | ID: US_000047/TASK_000056 Update-ENV getrennt. By: Codex (GPT-5) |
 | 15.01.2026 | ⚙️ Code | ID: Update-Config in env.update.example ausgelagert. By: Codex (GPT-5) |
+| 15.01.2026 | 🏗️ Planning | ID: US_000048/TASK_000057 Release-Upload automatisieren. By: Codex (GPT-5) |
+| 15.01.2026 | ⚙️ Code | ID: Release-Upload Script hinzugefuegt (tar.gz + curl). By: Codex (GPT-5) |
+| 15.01.2026 | ⚙️ Code | ID: Upload-Script toleriert fehlende Leserechte fuer /etc/skd/*. By: Codex (GPT-5) |
 | 15.01.2026 | ⚙️ Code | ID: Makefile restart-Target hinzugefuegt. By: Codex (GPT-5) |
 
 ---

scripts/upload_release.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-/etc/skd/env}"
+UPDATE_ENV_FILE="${UPDATE_ENV_FILE:-/etc/skd/update.env}"
+
+SERVICE_URL="${SKD_UPDATE_SERVICE_URL:-}"
+PROJECT_ID="${SKD_UPDATE_PROJECT_ID:-}"
+UPLOAD_TOKEN="${SKD_UPDATE_UPLOAD_TOKEN:-}"
+UPLOAD_TOKEN_FILE="${SKD_UPDATE_UPLOAD_TOKEN_FILE:-${PROJECT_ROOT}/upload.token}"
+VERSION=""
+ARTIFACT_PATH=""
+
+usage() {
+  cat <<'EOF'
+Usage: upload_release.sh [options]
+
+Options:
+  --service-url URL     Update-Service URL (default: SKD_UPDATE_SERVICE_URL)
+  --project-id ID       Project ID (default: SKD_UPDATE_PROJECT_ID)
+  --token TOKEN         Upload token (default: SKD_UPDATE_UPLOAD_TOKEN)
+  --token-file PATH     Upload token file (default: ./upload.token or SKD_UPDATE_UPLOAD_TOKEN_FILE)
+  --artifact PATH       Use existing tar.gz artifact instead of building
+  --version VERSION     Override VERSION file
+  --env-file PATH       Read core env file (default: /etc/skd/env)
+  --update-env PATH     Read update env file (default: /etc/skd/update.env)
+  -h, --help            Show this help
+EOF
+}
+
+read_env_value() {
+  local key="$1"
+  python3 - <<'PY' "${ENV_FILE}" "${UPDATE_ENV_FILE}" "${key}"
+from pathlib import Path
+import sys
+
+env_paths = [Path(sys.argv[1]), Path(sys.argv[2])]
+key = sys.argv[3]
+for path in env_paths:
+    if not path.exists():
+        continue
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+    except OSError:
+        continue
+    for raw in lines:
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        if not line.startswith(f"{key}="):
+            continue
+        value = line.split("=", 1)[1].strip()
+        if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")):
+            value = value[1:-1]
+        print(value)
+        sys.exit(0)
+PY
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --service-url) SERVICE_URL="$2"; shift 2 ;;
+    --project-id) PROJECT_ID="$2"; shift 2 ;;
+    --token) UPLOAD_TOKEN="$2"; shift 2 ;;
+    --token-file) UPLOAD_TOKEN_FILE="$2"; shift 2 ;;
+    --artifact) ARTIFACT_PATH="$2"; shift 2 ;;
+    --version) VERSION="$2"; shift 2 ;;
+    --env-file) ENV_FILE="$2"; shift 2 ;;
+    --update-env) UPDATE_ENV_FILE="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Unknown option: $1" >&2; usage; exit 1 ;;
+  esac
+done
+
+SERVICE_URL="${SERVICE_URL:-$(read_env_value SKD_UPDATE_SERVICE_URL)}"
+PROJECT_ID="${PROJECT_ID:-$(read_env_value SKD_UPDATE_PROJECT_ID)}"
+UPLOAD_TOKEN="${UPLOAD_TOKEN:-$(read_env_value SKD_UPDATE_UPLOAD_TOKEN)}"
+UPLOAD_TOKEN_FILE="${UPLOAD_TOKEN_FILE:-$(read_env_value SKD_UPDATE_UPLOAD_TOKEN_FILE)}"
+VERSION="${VERSION:-$(cat "${PROJECT_ROOT}/VERSION" 2>/dev/null || true)}"
+
+if [[ -z "${SERVICE_URL}" || -z "${PROJECT_ID}" ]]; then
+  echo "Missing service URL or project ID." >&2
+  echo "Set SKD_UPDATE_SERVICE_URL and SKD_UPDATE_PROJECT_ID or pass --service-url/--project-id." >&2
+  exit 1
+fi
+
+if [[ -z "${VERSION}" ]]; then
+  echo "Missing VERSION." >&2
+  exit 1
+fi
+
+if [[ -z "${UPLOAD_TOKEN}" && -n "${UPLOAD_TOKEN_FILE}" && -f "${UPLOAD_TOKEN_FILE}" ]]; then
+  UPLOAD_TOKEN="$(cat "${UPLOAD_TOKEN_FILE}" | tr -d '\n')"
+fi
+
+if [[ -z "${UPLOAD_TOKEN}" ]]; then
+  echo "Missing upload token. Provide --token or SKD_UPDATE_UPLOAD_TOKEN[_FILE]." >&2
+  exit 1
+fi
+
+if [[ -z "${ARTIFACT_PATH}" ]]; then
+  ARTIFACT_PATH="$(mktemp "/tmp/sk_release_${VERSION}.XXXXXX.tar.gz")"
+  tar czf "${ARTIFACT_PATH}" \
+    --exclude '.git' \
+    --exclude '.venv' \
+    --exclude 'upload.token' \
+    -C "${PROJECT_ROOT}" .
+fi
+
+if [[ ! -f "${ARTIFACT_PATH}" ]]; then
+  echo "Artifact not found: ${ARTIFACT_PATH}" >&2
+  exit 1
+fi
+
+SHA256="$(sha256sum "${ARTIFACT_PATH}" | awk '{print $1}')"
+
+UPLOAD_URL="${SERVICE_URL%/}/v1/projects/${PROJECT_ID}/releases"
+
+curl -fsS -X POST "${UPLOAD_URL}" \
+  -H "Authorization: Bearer ${UPLOAD_TOKEN}" \
+  -F "version=${VERSION}" \
+  -F "sha256=${SHA256}" \
+  -F "artifact=@${ARTIFACT_PATH}"
+
+echo "Upload finished: version=${VERSION} sha256=${SHA256}"