jbourdon/social-media
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: quote deploy environment secrets
All checks were successful
deploy-socialize / image (push) Successful in 27s
Details
deploy-socialize / deploy (push) Successful in 13s
Details

Browse Source
This commit is contained in:
Jonathan Bourdon
2026-05-06 15:08:53 -04:00
parent 0a6d730ca0
commit fb7811c469
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
.gitea/workflows/deploy-socialize.yml
View File

@@ -47,19 +47,29 @@ jobs:
DEPLOY_USER: ${{ secrets.DEPLOY_USER }} DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
DEPLOY_SSH_PRIVATE_KEY_B64: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY_B64 }} DEPLOY_SSH_PRIVATE_KEY_B64: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY_B64 }}
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }} POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
SOCIALIZE_IMAGE_TAG: ${{ gitea.sha }}
run: | run: |
: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD secret is required}" : "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD secret is required}"
: "${SOCIALIZE_IMAGE_TAG:?SOCIALIZE_IMAGE_TAG is required}"
mkdir -p ~/.ssh mkdir -p ~/.ssh
printf '%s' "$DEPLOY_SSH_PRIVATE_KEY_B64" | base64 -d > ~/.ssh/deploy_key printf '%s' "$DEPLOY_SSH_PRIVATE_KEY_B64" | base64 -d > ~/.ssh/deploy_key
chmod 600 ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key
write_env_value() {
key="$1"
value="$2"
escaped_value="$(printf '%s' "$value" | sed "s/'/'\\\\''/g")"
printf "%s='%s'\n" "$key" "$escaped_value"
}
deploy_env="$(mktemp)" deploy_env="$(mktemp)"
{ {
printf 'POSTGRES_USER=sa\n' write_env_value POSTGRES_USER sa
printf 'POSTGRES_PASSWORD=%s\n' "$POSTGRES_PASSWORD" write_env_value POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
printf 'POSTGRES_DB=socialize\n' write_env_value POSTGRES_DB socialize
printf 'ASPNETCORE_ENVIRONMENT=Production\n' write_env_value ASPNETCORE_ENVIRONMENT Production
write_env_value SOCIALIZE_IMAGE_TAG "$SOCIALIZE_IMAGE_TAG"
} > "$deploy_env" } > "$deploy_env"
scp -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new "$deploy_env" "$DEPLOY_USER@$DEPLOY_HOST:/srv/prod/socialize/.env" scp -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new "$deploy_env" "$DEPLOY_USER@$DEPLOY_HOST:/srv/prod/socialize/.env"