Wire Forge-native release infrastructure

Scripts/resolve-forge-ssh-key.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+preferred_home() {
+  if [[ -n "${RUNNER_HOME:-}" ]]; then
+    printf '%s\n' "$RUNNER_HOME"
+  elif [[ -n "${FORGEJO_RUNNER_HOME:-}" ]]; then
+    printf '%s\n' "$FORGEJO_RUNNER_HOME"
+  elif [[ -n "${HOME:-}" ]]; then
+    printf '%s\n' "$HOME"
+  elif [[ -n "${FORGEJO_RUNNER_WORKDIR:-}" ]]; then
+    printf '%s\n' "${FORGEJO_RUNNER_WORKDIR}/home"
+  else
+    printf '%s\n' "/tmp/forgejo-runner/home"
+  fi
+}
+
+is_ssh_private_key() {
+  local candidate="$1"
+  [[ -n "$candidate" && -f "$candidate" && -s "$candidate" ]] || return 1
+  chmod 600 "$candidate" 2>/dev/null || true
+  ssh-keygen -y -f "$candidate" >/dev/null 2>&1
+}
+
+candidate_path() {
+  local path="$1"
+  if is_ssh_private_key "$path"; then
+    printf '%s\n' "$path"
+    return 0
+  fi
+  return 1
+}
+
+decode_base64() {
+  local value="$1"
+  local path="$2"
+  if command -v base64 >/dev/null 2>&1; then
+    if printf '%s' "$value" | base64 -d > "$path" 2>/dev/null; then
+      return 0
+    fi
+    if printf '%s' "$value" | base64 -D > "$path" 2>/dev/null; then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+materialize_secret() {
+  local raw="$1"
+  local home="$2"
+  local path="${home}/.ssh/burrow_forge_ed25519"
+  install -d -m 700 "${home}/.ssh"
+
+  printf '%s\n' "$raw" > "$path"
+  if candidate_path "$path"; then
+    return 0
+  fi
+
+  if [[ "$raw" == *"\\n"* ]]; then
+    printf '%b' "$raw" > "$path"
+    if candidate_path "$path"; then
+      return 0
+    fi
+  fi
+
+  if decode_base64 "$raw" "$path" && candidate_path "$path"; then
+    return 0
+  fi
+
+  rm -f "$path"
+  echo "::warning ::Injected Forge SSH key was present but not parseable; trying file candidates" >&2
+  return 1
+}
+
+resolve_key() {
+  local home
+  home="$(preferred_home)"
+
+  if [[ -n "${BURROW_FORGE_SSH_KEY:-}" ]]; then
+    if candidate_path "$BURROW_FORGE_SSH_KEY"; then
+      return 0
+    fi
+    echo "::error ::BURROW_FORGE_SSH_KEY is set but is not an SSH private key: ${BURROW_FORGE_SSH_KEY}" >&2
+    return 1
+  fi
+
+  if [[ -n "${AGE_FORGE_SSH_KEY:-}" ]]; then
+    materialize_secret "$AGE_FORGE_SSH_KEY" "$home" && return 0
+  fi
+
+  local candidate
+  while IFS= read -r candidate; do
+    candidate_path "$candidate" && return 0
+  done <<EOF
+${AGE_IDENTITY_PATH:-}
+${BURROW_RUNNER_AGE_IDENTITY_PATH:-}
+${RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
+${FORGEJO_RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
+${HOME:-}/.ssh/burrow_forge_ed25519
+${HOME:-}/.ssh/agent_at_burrow_net_ed25519
+${HOME:-}/.ssh/burrow_forgejo_ed25519
+/var/lib/forgejo-runner-agent/age_keystore
+${RUNNER_HOME:-}/.ssh/age_keystore
+${FORGEJO_RUNNER_HOME:-}/.ssh/age_keystore
+${HOME:-}/.ssh/age_keystore
+${FORGEJO_RUNNER_WORKDIR:-}/home/.ssh/age_keystore
+${FORGEJO_RUNNER_WORKDIR:-}/age_keystore
+/tmp/forgejo-runner/home/.ssh/age_keystore
+/tmp/forgejo-runner/age_keystore
+EOF
+
+  return 1
+}
+
+if resolved="$(resolve_key)"; then
+  printf 'BURROW_FORGE_SSH_KEY=%s\n' "$resolved"
+  exit 0
+fi
+
+echo "::error ::Forge SSH key not found. Set BURROW_FORGE_SSH_KEY or AGE_FORGE_SSH_KEY." >&2
+exit 1