27 lines
1.3 KiB
Bash
27 lines
1.3 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
: "${SSHPASS:?DEPLOY_PASSWORD is required}"
|
|
: "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS is required}"
|
|
[[ "$DEPLOY_HOST" =~ ^[a-zA-Z0-9.-]+$ && "$DEPLOY_USER" =~ ^[a-zA-Z0-9_-]+$ ]] || exit 2
|
|
[[ "$COMMIT_SHA" =~ ^[0-9a-f]{40}$ && "$REMOTE_DIR" =~ ^/[a-zA-Z0-9_/-]+$ && "$REMOTE_DIR" != / && "$REMOTE_DIR" != *..* ]] || exit 2
|
|
known_hosts="$(mktemp)"
|
|
archive="$(mktemp)"
|
|
trap 'rm -f "$known_hosts" "$archive"' EXIT
|
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$known_hosts"
|
|
chmod 600 "$known_hosts"
|
|
options=(-o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts" -o ConnectTimeout=15)
|
|
target="$DEPLOY_USER@$DEPLOY_HOST"
|
|
case "${1:-}" in
|
|
verify)
|
|
build="$REMOTE_DIR/builds/$COMMIT_SHA"
|
|
tar --exclude=.git --exclude=node_modules --exclude=.env --exclude=logs --exclude=bin -czf "$archive" .
|
|
sshpass -e ssh "${options[@]}" "$target" "umask 077; mkdir -p '$build'"
|
|
sshpass -e scp "${options[@]}" "$archive" "$target:$build/source.tar.gz"
|
|
sshpass -e ssh "${options[@]}" "$target" "cd '$build'; tar -xzf source.tar.gz; rm source.tar.gz; bash deploy/remote-build.sh '$REMOTE_DIR' '$COMMIT_SHA'"
|
|
;;
|
|
deploy)
|
|
sshpass -e ssh "${options[@]}" "$target" "bash '$REMOTE_DIR/releases/$COMMIT_SHA/release.sh' '$REMOTE_DIR' '$COMMIT_SHA'"
|
|
;;
|
|
*) exit 2 ;;
|
|
esac
|