002bd382e9
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Build Rust / Cargo Test (push) Successful in 4m14s
Build Site / Next.js Build (push) Failing after 6s
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Lint Governance / BEP Metadata (push) Successful in 0s
Build: Android / Android Rust Core Stub (push) Failing after 23s
121 lines
2.9 KiB
Bash
Executable file
121 lines
2.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
preferred_home() {
|
|
if [[ -n "${RUNNER_HOME:-}" ]]; then
|
|
printf '%s\n' "$RUNNER_HOME"
|
|
elif [[ -n "${FORGEJO_RUNNER_HOME:-}" ]]; then
|
|
printf '%s\n' "$FORGEJO_RUNNER_HOME"
|
|
elif [[ -n "${HOME:-}" ]]; then
|
|
printf '%s\n' "$HOME"
|
|
elif [[ -n "${FORGEJO_RUNNER_WORKDIR:-}" ]]; then
|
|
printf '%s\n' "${FORGEJO_RUNNER_WORKDIR}/home"
|
|
else
|
|
printf '%s\n' "/tmp/forgejo-runner/home"
|
|
fi
|
|
}
|
|
|
|
is_ssh_private_key() {
|
|
local candidate="$1"
|
|
[[ -n "$candidate" && -f "$candidate" && -s "$candidate" ]] || return 1
|
|
chmod 600 "$candidate" 2>/dev/null || true
|
|
ssh-keygen -y -f "$candidate" >/dev/null 2>&1
|
|
}
|
|
|
|
candidate_path() {
|
|
local path="$1"
|
|
if is_ssh_private_key "$path"; then
|
|
printf '%s\n' "$path"
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
decode_base64() {
|
|
local value="$1"
|
|
local path="$2"
|
|
if command -v base64 >/dev/null 2>&1; then
|
|
if printf '%s' "$value" | base64 -d > "$path" 2>/dev/null; then
|
|
return 0
|
|
fi
|
|
if printf '%s' "$value" | base64 -D > "$path" 2>/dev/null; then
|
|
return 0
|
|
fi
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
materialize_secret() {
|
|
local raw="$1"
|
|
local home="$2"
|
|
local path="${home}/.ssh/burrow_forge_ed25519"
|
|
install -d -m 700 "${home}/.ssh"
|
|
|
|
printf '%s\n' "$raw" > "$path"
|
|
if candidate_path "$path"; then
|
|
return 0
|
|
fi
|
|
|
|
if [[ "$raw" == *"\\n"* ]]; then
|
|
printf '%b' "$raw" > "$path"
|
|
if candidate_path "$path"; then
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
if decode_base64 "$raw" "$path" && candidate_path "$path"; then
|
|
return 0
|
|
fi
|
|
|
|
rm -f "$path"
|
|
echo "::warning ::Injected Forge SSH key was present but not parseable; trying file candidates" >&2
|
|
return 1
|
|
}
|
|
|
|
resolve_key() {
|
|
local home
|
|
home="$(preferred_home)"
|
|
|
|
if [[ -n "${BURROW_FORGE_SSH_KEY:-}" ]]; then
|
|
if candidate_path "$BURROW_FORGE_SSH_KEY"; then
|
|
return 0
|
|
fi
|
|
echo "::error ::BURROW_FORGE_SSH_KEY is set but is not an SSH private key: ${BURROW_FORGE_SSH_KEY}" >&2
|
|
return 1
|
|
fi
|
|
|
|
if [[ -n "${AGE_FORGE_SSH_KEY:-}" ]]; then
|
|
materialize_secret "$AGE_FORGE_SSH_KEY" "$home" && return 0
|
|
fi
|
|
|
|
local candidate
|
|
while IFS= read -r candidate; do
|
|
candidate_path "$candidate" && return 0
|
|
done <<EOF
|
|
${AGE_IDENTITY_PATH:-}
|
|
${BURROW_RUNNER_AGE_IDENTITY_PATH:-}
|
|
${RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
|
|
${FORGEJO_RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
|
|
${HOME:-}/.ssh/burrow_forge_ed25519
|
|
${HOME:-}/.ssh/agent_at_burrow_net_ed25519
|
|
${HOME:-}/.ssh/burrow_forgejo_ed25519
|
|
/var/lib/forgejo-runner-agent/age_keystore
|
|
${RUNNER_HOME:-}/.ssh/age_keystore
|
|
${FORGEJO_RUNNER_HOME:-}/.ssh/age_keystore
|
|
${HOME:-}/.ssh/age_keystore
|
|
${FORGEJO_RUNNER_WORKDIR:-}/home/.ssh/age_keystore
|
|
${FORGEJO_RUNNER_WORKDIR:-}/age_keystore
|
|
/tmp/forgejo-runner/home/.ssh/age_keystore
|
|
/tmp/forgejo-runner/age_keystore
|
|
EOF
|
|
|
|
return 1
|
|
}
|
|
|
|
if resolved="$(resolve_key)"; then
|
|
printf 'BURROW_FORGE_SSH_KEY=%s\n' "$resolved"
|
|
exit 0
|
|
fi
|
|
|
|
echo "::error ::Forge SSH key not found. Set BURROW_FORGE_SSH_KEY or AGE_FORGE_SSH_KEY." >&2
|
|
exit 1
|