amadan
deploy: release.sh — one-command release (Bitwarden key fetch + stdin pipe) (#1104)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+34
−0
deploy/release.sh+34 −0
diff --git a/deploy/release.sh b/deploy/release.sh| new file mode 100755 |
| index 0000000..d58c02d |
| --- /dev/null |
| +++ b/deploy/release.sh |
| @@ -0,0 +1,34 @@ |
| +#!/usr/bin/env sh |
| +# One-command release: fetch the signing key from Bitwarden and drive |
| +# release-server.sh — no key file to manage, runnable from anywhere: |
| +# |
| +# ./deploy/release.sh "release notes" # = publish (the common case) |
| +# ./deploy/release.sh promote <ver> <chan> # move a channel pointer |
| +# ./deploy/release.sh ship # box catch-up (no key involved) |
| +# |
| +# This wrapper is deliberately the ONLY place that knows where the signing key |
| +# lives (the Bitwarden item below); release-server.sh itself stays |
| +# secret-manager-agnostic — the fetch happens out here and the key rides |
| +# stdin (LCHAT_RELEASE_KEY_FILE=-), so it never lands on disk or in the |
| +# environment. bw prompts to unlock when the vault is locked. |
| +set -eu |
| +root="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)" |
| +ITEM="Eleven Messenger server release signing key" |
| + |
| +# Bare arguments are publish notes; ship never needs the key. |
| +case "${1:-}" in publish|promote|ship) ;; *) set -- publish "$@" ;; esac |
| +if [ "$1" = ship ]; then exec "$root/deploy/release-server.sh" "$@"; fi |
| + |
| +key="$(bw get item "$ITEM" | jq -r '(.fields[]? | select(.name=="credential").value) // .notes // empty')" |
| +nl=' |
| +' |
| +case "$key" in |
| +"") |
| + echo "release: no signing key in the Bitwarden item \"$ITEM\" (checked the credential field, then notes)" >&2 |
| + exit 1 ;; |
| +*"$nl"*) |
| + echo "release: the Bitwarden item \"$ITEM\" yielded a multi-line value — that isn't the key. Inspect with:" >&2 |
| + echo " bw get item \"$ITEM\" | jq '{fields:[.fields[]?.name]}'" >&2 |
| + exit 1 ;; |
| +esac |
| +printf '%s\n' "$key" | LCHAT_RELEASE_KEY_FILE=- "$root/deploy/release-server.sh" "$@" |