From fb096f7897330770e94c8d49f3a94300c88fd753 Mon Sep 17 00:00:00 2001 From: stephan Date: Thu, 15 Jan 2026 13:13:38 +0100 Subject: [PATCH] fix: ignore unreadable env files in upload script --- CHANGELOG.md | 3 + scripts/upload_release.sh | 126 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 129 insertions(+) create mode 100755 scripts/upload_release.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e9aec8..f9c0562 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -73,6 +73,9 @@ By: Codex (GPT-5) | 15.01.2026 | ⚙️ Code | ID: Update-Service Status zeigt Dev/Prod und nutzt konsistente Panel-Styles. By: Codex (GPT-5) | | 15.01.2026 | 🏗️ Planning | ID: US_000047/TASK_000056 Update-ENV getrennt. By: Codex (GPT-5) | | 15.01.2026 | ⚙️ Code | ID: Update-Config in env.update.example ausgelagert. By: Codex (GPT-5) | +| 15.01.2026 | 🏗️ Planning | ID: US_000048/TASK_000057 Release-Upload automatisieren. By: Codex (GPT-5) | +| 15.01.2026 | ⚙️ Code | ID: Release-Upload Script hinzugefuegt (tar.gz + curl). By: Codex (GPT-5) | +| 15.01.2026 | ⚙️ Code | ID: Upload-Script toleriert fehlende Leserechte fuer /etc/skd/*. By: Codex (GPT-5) | | 15.01.2026 | ⚙️ Code | ID: Makefile restart-Target hinzugefuegt. By: Codex (GPT-5) | --- diff --git a/scripts/upload_release.sh b/scripts/upload_release.sh new file mode 100755 index 0000000..33ddce0 --- /dev/null +++ b/scripts/upload_release.sh @@ -0,0 +1,126 @@ +#!/usr/bin/env bash +set -euo pipefail + +PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +ENV_FILE="${ENV_FILE:-/etc/skd/env}" +UPDATE_ENV_FILE="${UPDATE_ENV_FILE:-/etc/skd/update.env}" + +SERVICE_URL="${SKD_UPDATE_SERVICE_URL:-}" +PROJECT_ID="${SKD_UPDATE_PROJECT_ID:-}" +UPLOAD_TOKEN="${SKD_UPDATE_UPLOAD_TOKEN:-}" +UPLOAD_TOKEN_FILE="${SKD_UPDATE_UPLOAD_TOKEN_FILE:-${PROJECT_ROOT}/upload.token}" +VERSION="" +ARTIFACT_PATH="" + +usage() { + cat <<'EOF' +Usage: upload_release.sh [options] + +Options: + --service-url URL Update-Service URL (default: SKD_UPDATE_SERVICE_URL) + --project-id ID Project ID (default: SKD_UPDATE_PROJECT_ID) + --token TOKEN Upload token (default: SKD_UPDATE_UPLOAD_TOKEN) + --token-file PATH Upload token file (default: ./upload.token or SKD_UPDATE_UPLOAD_TOKEN_FILE) + --artifact PATH Use existing tar.gz artifact instead of building + --version VERSION Override VERSION file + --env-file PATH Read core env file (default: /etc/skd/env) + --update-env PATH Read update env file (default: /etc/skd/update.env) + -h, --help Show this help +EOF +} + +read_env_value() { + local key="$1" + python3 - <<'PY' "${ENV_FILE}" "${UPDATE_ENV_FILE}" "${key}" +from pathlib import Path +import sys + +env_paths = [Path(sys.argv[1]), Path(sys.argv[2])] +key = sys.argv[3] +for path in env_paths: + if not path.exists(): + continue + try: + lines = path.read_text(encoding="utf-8").splitlines() + except OSError: + continue + for raw in lines: + line = raw.strip() + if not line or line.startswith("#"): + continue + if not line.startswith(f"{key}="): + continue + value = line.split("=", 1)[1].strip() + if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")): + value = value[1:-1] + print(value) + sys.exit(0) +PY +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --service-url) SERVICE_URL="$2"; shift 2 ;; + --project-id) PROJECT_ID="$2"; shift 2 ;; + --token) UPLOAD_TOKEN="$2"; shift 2 ;; + --token-file) UPLOAD_TOKEN_FILE="$2"; shift 2 ;; + --artifact) ARTIFACT_PATH="$2"; shift 2 ;; + --version) VERSION="$2"; shift 2 ;; + --env-file) ENV_FILE="$2"; shift 2 ;; + --update-env) UPDATE_ENV_FILE="$2"; shift 2 ;; + -h|--help) usage; exit 0 ;; + *) echo "Unknown option: $1" >&2; usage; exit 1 ;; + esac +done + +SERVICE_URL="${SERVICE_URL:-$(read_env_value SKD_UPDATE_SERVICE_URL)}" +PROJECT_ID="${PROJECT_ID:-$(read_env_value SKD_UPDATE_PROJECT_ID)}" +UPLOAD_TOKEN="${UPLOAD_TOKEN:-$(read_env_value SKD_UPDATE_UPLOAD_TOKEN)}" +UPLOAD_TOKEN_FILE="${UPLOAD_TOKEN_FILE:-$(read_env_value SKD_UPDATE_UPLOAD_TOKEN_FILE)}" +VERSION="${VERSION:-$(cat "${PROJECT_ROOT}/VERSION" 2>/dev/null || true)}" + +if [[ -z "${SERVICE_URL}" || -z "${PROJECT_ID}" ]]; then + echo "Missing service URL or project ID." >&2 + echo "Set SKD_UPDATE_SERVICE_URL and SKD_UPDATE_PROJECT_ID or pass --service-url/--project-id." >&2 + exit 1 +fi + +if [[ -z "${VERSION}" ]]; then + echo "Missing VERSION." >&2 + exit 1 +fi + +if [[ -z "${UPLOAD_TOKEN}" && -n "${UPLOAD_TOKEN_FILE}" && -f "${UPLOAD_TOKEN_FILE}" ]]; then + UPLOAD_TOKEN="$(cat "${UPLOAD_TOKEN_FILE}" | tr -d '\n')" +fi + +if [[ -z "${UPLOAD_TOKEN}" ]]; then + echo "Missing upload token. Provide --token or SKD_UPDATE_UPLOAD_TOKEN[_FILE]." >&2 + exit 1 +fi + +if [[ -z "${ARTIFACT_PATH}" ]]; then + ARTIFACT_PATH="$(mktemp "/tmp/sk_release_${VERSION}.XXXXXX.tar.gz")" + tar czf "${ARTIFACT_PATH}" \ + --exclude '.git' \ + --exclude '.venv' \ + --exclude 'upload.token' \ + -C "${PROJECT_ROOT}" . +fi + +if [[ ! -f "${ARTIFACT_PATH}" ]]; then + echo "Artifact not found: ${ARTIFACT_PATH}" >&2 + exit 1 +fi + +SHA256="$(sha256sum "${ARTIFACT_PATH}" | awk '{print $1}')" + +UPLOAD_URL="${SERVICE_URL%/}/v1/projects/${PROJECT_ID}/releases" + +curl -fsS -X POST "${UPLOAD_URL}" \ + -H "Authorization: Bearer ${UPLOAD_TOKEN}" \ + -F "version=${VERSION}" \ + -F "sha256=${SHA256}" \ + -F "artifact=@${ARTIFACT_PATH}" + +echo "Upload finished: version=${VERSION} sha256=${SHA256}"