Codex
878 lines
44 KiB
Bash
878 lines
44 KiB
Bash
#!/bin/sh
|
|
set -u
|
|
|
|
tmp="$(mktemp -d)"
|
|
export tmp
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
|
|
json_tail() {
|
|
name="$1"
|
|
limit="${2:-2000}"
|
|
python3 - "$tmp/$name" "$limit" <<'PY'
|
|
import json, sys
|
|
path, limit = sys.argv[1], int(sys.argv[2])
|
|
try:
|
|
data = open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
data = ""
|
|
print(json.dumps(data))
|
|
PY
|
|
}
|
|
|
|
capture_json() {
|
|
name="$1"
|
|
shift
|
|
"$@" -o json >"$tmp/$name.json" 2>"$tmp/$name.err"
|
|
rc=$?
|
|
printf '%s' "$rc" >"$tmp/$name.rc"
|
|
}
|
|
|
|
run_apply() {
|
|
manifest="$tmp/gitea.k8s.yaml"
|
|
printf '%s' "$UNIDESK_GITEA_MANIFEST_B64" | base64 -d >"$manifest"
|
|
if [ "$UNIDESK_GITEA_FRPC_ENABLED" = "1" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then
|
|
printf '%s' "$UNIDESK_GITEA_FRPC_TOML_B64" | base64 -d >"$tmp/frpc.toml"
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" create secret generic "$UNIDESK_GITEA_FRPC_SECRET_NAME" \
|
|
--from-file="$UNIDESK_GITEA_FRPC_SECRET_KEY=$tmp/frpc.toml" \
|
|
--dry-run=client -o yaml | kubectl apply --server-side --force-conflicts --field-manager="$UNIDESK_GITEA_FIELD_MANAGER" -f - >"$tmp/frpc-secret.out" 2>"$tmp/frpc-secret.err"
|
|
frpc_rc=$?
|
|
else
|
|
frpc_rc=0
|
|
: >"$tmp/frpc-secret.out"
|
|
if [ "$UNIDESK_GITEA_FRPC_ENABLED" = "1" ]; then
|
|
printf '%s\n' "dry-run: frpc secret apply skipped" >"$tmp/frpc-secret.err"
|
|
else
|
|
printf '%s\n' "frpc disabled" >"$tmp/frpc-secret.err"
|
|
fi
|
|
fi
|
|
if [ "$UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED" = "1" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" create secret generic "$UNIDESK_GITEA_WEBHOOK_SECRET_NAME" \
|
|
--from-literal=github-token="$UNIDESK_GITEA_GITHUB_TOKEN" \
|
|
--from-literal=gitea-username="$UNIDESK_GITEA_ADMIN_USERNAME" \
|
|
--from-literal=gitea-password="$UNIDESK_GITEA_ADMIN_PASSWORD" \
|
|
--from-literal=github-webhook-secret="$UNIDESK_GITEA_GITHUB_WEBHOOK_SECRET" \
|
|
--dry-run=client -o yaml | kubectl apply --server-side --force-conflicts --field-manager="$UNIDESK_GITEA_FIELD_MANAGER" -f - >"$tmp/webhook-secret.out" 2>"$tmp/webhook-secret.err"
|
|
webhook_secret_rc=$?
|
|
else
|
|
webhook_secret_rc=0
|
|
: >"$tmp/webhook-secret.out"
|
|
if [ "$UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED" = "1" ]; then
|
|
printf '%s\n' "dry-run: webhook sync secret apply skipped" >"$tmp/webhook-secret.err"
|
|
else
|
|
printf '%s\n' "webhook sync disabled" >"$tmp/webhook-secret.err"
|
|
fi
|
|
fi
|
|
dry_arg=""
|
|
if [ "$UNIDESK_GITEA_DRY_RUN" = "1" ]; then
|
|
dry_arg="--dry-run=server"
|
|
fi
|
|
if [ "$frpc_rc" -eq 0 ] && [ "$webhook_secret_rc" -eq 0 ]; then
|
|
timeout "$UNIDESK_GITEA_WAIT_TIMEOUT_SECONDS" kubectl apply --server-side $dry_arg --force-conflicts --field-manager="$UNIDESK_GITEA_FIELD_MANAGER" -f "$manifest" >"$tmp/apply.out" 2>"$tmp/apply.err"
|
|
apply_rc=$?
|
|
else
|
|
apply_rc=1
|
|
: >"$tmp/apply.out"
|
|
printf '%s\n' "frpc or webhook secret apply failed; manifest apply skipped" >"$tmp/apply.err"
|
|
fi
|
|
if [ "$apply_rc" -eq 0 ] && [ "$UNIDESK_GITEA_WAIT" = "1" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then
|
|
timeout "$UNIDESK_GITEA_WAIT_TIMEOUT_SECONDS" kubectl -n "$UNIDESK_GITEA_NAMESPACE" rollout status "statefulset/$UNIDESK_GITEA_STATEFULSET_NAME" --timeout="${UNIDESK_GITEA_WAIT_TIMEOUT_SECONDS}s" >"$tmp/rollout.out" 2>"$tmp/rollout.err"
|
|
rollout_rc=$?
|
|
else
|
|
rollout_rc=0
|
|
: >"$tmp/rollout.out"
|
|
if [ "$UNIDESK_GITEA_DRY_RUN" = "1" ]; then
|
|
printf '%s\n' "dry-run: rollout wait skipped" >"$tmp/rollout.err"
|
|
else
|
|
printf '%s\n' "rollout wait not requested" >"$tmp/rollout.err"
|
|
fi
|
|
fi
|
|
if [ "$apply_rc" -eq 0 ] && [ "$UNIDESK_GITEA_FRPC_ENABLED" = "1" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" rollout restart "deployment/$UNIDESK_GITEA_FRPC_DEPLOYMENT_NAME" >"$tmp/frpc-rollout.out" 2>"$tmp/frpc-rollout.err"
|
|
frpc_rollout_rc=$?
|
|
if [ "$frpc_rollout_rc" -eq 0 ] && [ "$UNIDESK_GITEA_WAIT" = "1" ]; then
|
|
timeout "$UNIDESK_GITEA_WAIT_TIMEOUT_SECONDS" kubectl -n "$UNIDESK_GITEA_NAMESPACE" rollout status "deployment/$UNIDESK_GITEA_FRPC_DEPLOYMENT_NAME" --timeout="${UNIDESK_GITEA_WAIT_TIMEOUT_SECONDS}s" >>"$tmp/frpc-rollout.out" 2>>"$tmp/frpc-rollout.err"
|
|
frpc_rollout_rc=$?
|
|
fi
|
|
else
|
|
frpc_rollout_rc=0
|
|
: >"$tmp/frpc-rollout.out"
|
|
if [ "$UNIDESK_GITEA_DRY_RUN" = "1" ]; then
|
|
printf '%s\n' "dry-run: frpc rollout skipped" >"$tmp/frpc-rollout.err"
|
|
elif [ "$UNIDESK_GITEA_FRPC_ENABLED" = "1" ]; then
|
|
printf '%s\n' "manifest apply failed; frpc rollout skipped" >"$tmp/frpc-rollout.err"
|
|
else
|
|
printf '%s\n' "frpc disabled" >"$tmp/frpc-rollout.err"
|
|
fi
|
|
fi
|
|
if [ "$apply_rc" -eq 0 ] && [ "$UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED" = "1" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" rollout restart "deployment/$UNIDESK_GITEA_WEBHOOK_DEPLOYMENT" >"$tmp/webhook-rollout.out" 2>"$tmp/webhook-rollout.err"
|
|
webhook_rollout_rc=$?
|
|
if [ "$webhook_rollout_rc" -eq 0 ] && [ "$UNIDESK_GITEA_WAIT" = "1" ]; then
|
|
timeout "$UNIDESK_GITEA_WAIT_TIMEOUT_SECONDS" kubectl -n "$UNIDESK_GITEA_NAMESPACE" rollout status "deployment/$UNIDESK_GITEA_WEBHOOK_DEPLOYMENT" --timeout="${UNIDESK_GITEA_WAIT_TIMEOUT_SECONDS}s" >>"$tmp/webhook-rollout.out" 2>>"$tmp/webhook-rollout.err"
|
|
webhook_rollout_rc=$?
|
|
fi
|
|
else
|
|
webhook_rollout_rc=0
|
|
: >"$tmp/webhook-rollout.out"
|
|
if [ "$UNIDESK_GITEA_DRY_RUN" = "1" ]; then
|
|
printf '%s\n' "dry-run: webhook sync rollout skipped" >"$tmp/webhook-rollout.err"
|
|
elif [ "$UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED" = "1" ]; then
|
|
printf '%s\n' "manifest apply failed; webhook sync rollout skipped" >"$tmp/webhook-rollout.err"
|
|
else
|
|
printf '%s\n' "webhook sync disabled" >"$tmp/webhook-rollout.err"
|
|
fi
|
|
fi
|
|
python3 - "$frpc_rc" "$webhook_secret_rc" "$apply_rc" "$rollout_rc" "$frpc_rollout_rc" "$webhook_rollout_rc" "$tmp/frpc-secret.out" "$tmp/frpc-secret.err" "$tmp/webhook-secret.out" "$tmp/webhook-secret.err" "$tmp/apply.out" "$tmp/apply.err" "$tmp/rollout.out" "$tmp/rollout.err" "$tmp/frpc-rollout.out" "$tmp/frpc-rollout.err" "$tmp/webhook-rollout.out" "$tmp/webhook-rollout.err" <<'PY'
|
|
import json, os, sys
|
|
frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc = [int(value) for value in sys.argv[1:7]]
|
|
def text(path, limit=3000):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
dry = os.environ.get("UNIDESK_GITEA_DRY_RUN") == "1"
|
|
payload = {
|
|
"ok": all(value == 0 for value in [frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc]),
|
|
"target": os.environ.get("UNIDESK_GITEA_TARGET_ID"),
|
|
"route": os.environ.get("UNIDESK_GITEA_ROUTE"),
|
|
"namespace": os.environ.get("UNIDESK_GITEA_NAMESPACE"),
|
|
"mode": "dry-run" if dry else "confirmed",
|
|
"mutation": not dry,
|
|
"image": os.environ.get("UNIDESK_GITEA_IMAGE"),
|
|
"objects": {
|
|
"statefulSet": os.environ.get("UNIDESK_GITEA_STATEFULSET_NAME"),
|
|
"service": os.environ.get("UNIDESK_GITEA_SERVICE_NAME"),
|
|
"networkPolicy": "allow-all",
|
|
},
|
|
"steps": {
|
|
"frpcSecret": {"exitCode": frpc_rc, "stdoutTail": text(sys.argv[7]), "stderrTail": text(sys.argv[8])},
|
|
"webhookSyncSecret": {"exitCode": webhook_secret_rc, "stdoutTail": text(sys.argv[9]), "stderrTail": text(sys.argv[10])},
|
|
"apply": {"exitCode": apply_rc, "stdoutTail": text(sys.argv[11]), "stderrTail": text(sys.argv[12])},
|
|
"rollout": {"exitCode": rollout_rc, "stdoutTail": text(sys.argv[13]), "stderrTail": text(sys.argv[14])},
|
|
"frpcRollout": {"exitCode": frpc_rollout_rc, "stdoutTail": text(sys.argv[15]), "stderrTail": text(sys.argv[16])},
|
|
"webhookSyncRollout": {"exitCode": webhook_rollout_rc, "stdoutTail": text(sys.argv[17]), "stderrTail": text(sys.argv[18])},
|
|
},
|
|
"valuesPrinted": False,
|
|
}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
}
|
|
|
|
run_status() {
|
|
selector="app.kubernetes.io/name=$UNIDESK_GITEA_APP_NAME,app.kubernetes.io/component=gitea"
|
|
capture_json namespace kubectl get namespace "$UNIDESK_GITEA_NAMESPACE"
|
|
capture_json networkpolicy kubectl -n "$UNIDESK_GITEA_NAMESPACE" get networkpolicy allow-all
|
|
capture_json statefulset kubectl -n "$UNIDESK_GITEA_NAMESPACE" get statefulset "$UNIDESK_GITEA_STATEFULSET_NAME"
|
|
capture_json service kubectl -n "$UNIDESK_GITEA_NAMESPACE" get service "$UNIDESK_GITEA_SERVICE_NAME"
|
|
capture_json endpoints kubectl -n "$UNIDESK_GITEA_NAMESPACE" get endpoints "$UNIDESK_GITEA_SERVICE_NAME"
|
|
capture_json pods kubectl -n "$UNIDESK_GITEA_NAMESPACE" get pods -l "$selector"
|
|
capture_json pvc kubectl -n "$UNIDESK_GITEA_NAMESPACE" get pvc -l "$selector"
|
|
capture_json events kubectl -n "$UNIDESK_GITEA_NAMESPACE" get events --sort-by=.lastTimestamp
|
|
python3 - "$tmp" <<'PY'
|
|
import json, os, sys
|
|
tmp = sys.argv[1]
|
|
def rc(name):
|
|
try:
|
|
return int(open(f"{tmp}/{name}.rc", encoding="utf-8").read() or "1")
|
|
except FileNotFoundError:
|
|
return 1
|
|
def load(name):
|
|
try:
|
|
return json.load(open(f"{tmp}/{name}.json", encoding="utf-8"))
|
|
except Exception:
|
|
return None
|
|
def items(name):
|
|
data = load(name)
|
|
if isinstance(data, dict) and isinstance(data.get("items"), list):
|
|
return data["items"]
|
|
if isinstance(data, dict) and data.get("kind") != "Status":
|
|
return [data]
|
|
return []
|
|
def meta_name(item):
|
|
return ((item or {}).get("metadata") or {}).get("name")
|
|
def pod_ready(item):
|
|
status = (item or {}).get("status") or {}
|
|
return any(c.get("type") == "Ready" and c.get("status") == "True" for c in status.get("conditions", []))
|
|
def pod_summary(item):
|
|
status = (item or {}).get("status") or {}
|
|
containers = status.get("containerStatuses") or []
|
|
return {
|
|
"name": meta_name(item),
|
|
"phase": status.get("phase"),
|
|
"ready": pod_ready(item),
|
|
"restarts": sum(int(c.get("restartCount") or 0) for c in containers if isinstance(c, dict)),
|
|
}
|
|
def service_summary(item):
|
|
spec = (item or {}).get("spec") or {}
|
|
return {
|
|
"name": meta_name(item),
|
|
"type": spec.get("type"),
|
|
"clusterIP": spec.get("clusterIP"),
|
|
"ports": [{"name": p.get("name"), "port": p.get("port"), "targetPort": p.get("targetPort")} for p in spec.get("ports", [])],
|
|
}
|
|
def endpoint_ready(item):
|
|
subsets = ((item or {}).get("subsets") or [])
|
|
return any(s.get("addresses") for s in subsets if isinstance(s, dict))
|
|
def pvc_summary(item):
|
|
spec = (item or {}).get("spec") or {}
|
|
status = (item or {}).get("status") or {}
|
|
return {
|
|
"name": meta_name(item),
|
|
"phase": status.get("phase"),
|
|
"storageClassName": spec.get("storageClassName"),
|
|
"capacity": (status.get("capacity") or {}).get("storage"),
|
|
}
|
|
def event_tail(limit=8):
|
|
result = []
|
|
for item in items("events")[-limit:]:
|
|
result.append({
|
|
"type": item.get("type"),
|
|
"reason": item.get("reason"),
|
|
"object": f"{((item.get('involvedObject') or {}).get('kind') or '-')}/{((item.get('involvedObject') or {}).get('name') or '-')}",
|
|
"message": (item.get("message") or "")[:300],
|
|
"lastTimestamp": item.get("lastTimestamp") or item.get("eventTime"),
|
|
})
|
|
return result
|
|
sts = load("statefulset") or {}
|
|
sts_spec = sts.get("spec") or {}
|
|
sts_status = sts.get("status") or {}
|
|
desired = int(sts_spec.get("replicas") or 0)
|
|
ready_replicas = int(sts_status.get("readyReplicas") or 0)
|
|
pods = [pod_summary(item) for item in items("pods")]
|
|
service = service_summary(load("service") or {})
|
|
endpoint_ok = endpoint_ready(load("endpoints") or {})
|
|
ready = rc("namespace") == 0 and rc("networkpolicy") == 0 and rc("service") == 0 and desired > 0 and ready_replicas >= desired and endpoint_ok
|
|
payload = {
|
|
"ok": True,
|
|
"ready": ready,
|
|
"target": os.environ.get("UNIDESK_GITEA_TARGET_ID"),
|
|
"route": os.environ.get("UNIDESK_GITEA_ROUTE"),
|
|
"namespace": os.environ.get("UNIDESK_GITEA_NAMESPACE"),
|
|
"image": os.environ.get("UNIDESK_GITEA_IMAGE"),
|
|
"serviceDns": f"{os.environ.get('UNIDESK_GITEA_SERVICE_NAME')}.{os.environ.get('UNIDESK_GITEA_NAMESPACE')}.svc.cluster.local:{os.environ.get('UNIDESK_GITEA_HTTP_PORT')}",
|
|
"networkPolicy": {"allowAllPresent": rc("networkpolicy") == 0},
|
|
"statefulSet": {"name": meta_name(sts), "desired": desired, "readyReplicas": ready_replicas, "updatedReplicas": sts_status.get("updatedReplicas")},
|
|
"service": service,
|
|
"endpointsReady": endpoint_ok,
|
|
"pods": pods,
|
|
"pvcs": [pvc_summary(item) for item in items("pvc")],
|
|
"eventsTail": event_tail(),
|
|
"valuesPrinted": False,
|
|
}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0)
|
|
PY
|
|
}
|
|
|
|
run_validate() {
|
|
proxy_path="/api/v1/namespaces/$UNIDESK_GITEA_NAMESPACE/services/http:$UNIDESK_GITEA_SERVICE_NAME:$UNIDESK_GITEA_HTTP_PORT/proxy$UNIDESK_GITEA_HEALTH_PATH"
|
|
kubectl get --raw "$proxy_path" >"$tmp/health.out" 2>"$tmp/health.err"
|
|
health_rc=$?
|
|
capture_json endpoints kubectl -n "$UNIDESK_GITEA_NAMESPACE" get endpoints "$UNIDESK_GITEA_SERVICE_NAME"
|
|
python3 - "$health_rc" "$tmp/health.out" "$tmp/health.err" "$tmp/endpoints.json" "$tmp/endpoints.rc" <<'PY'
|
|
import json, os, sys
|
|
health_rc = int(sys.argv[1])
|
|
def text(path, limit=2000):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
body = text(sys.argv[2], 4000)
|
|
try:
|
|
parsed = json.loads(body)
|
|
except Exception:
|
|
parsed = None
|
|
try:
|
|
endpoint_rc = int(open(sys.argv[5], encoding="utf-8").read() or "1")
|
|
except Exception:
|
|
endpoint_rc = 1
|
|
try:
|
|
endpoints = json.load(open(sys.argv[4], encoding="utf-8"))
|
|
except Exception:
|
|
endpoints = {}
|
|
subsets = endpoints.get("subsets") if isinstance(endpoints, dict) else []
|
|
endpoints_ready = any(isinstance(s, dict) and s.get("addresses") for s in (subsets or []))
|
|
health_status = parsed.get("status") if isinstance(parsed, dict) else None
|
|
ok = health_rc == 0 and endpoint_rc == 0 and endpoints_ready and health_status == "pass"
|
|
payload = {
|
|
"ok": ok,
|
|
"target": os.environ.get("UNIDESK_GITEA_TARGET_ID"),
|
|
"route": os.environ.get("UNIDESK_GITEA_ROUTE"),
|
|
"namespace": os.environ.get("UNIDESK_GITEA_NAMESPACE"),
|
|
"service": os.environ.get("UNIDESK_GITEA_SERVICE_NAME"),
|
|
"serviceProxyPath": f"/api/v1/namespaces/{os.environ.get('UNIDESK_GITEA_NAMESPACE')}/services/http:{os.environ.get('UNIDESK_GITEA_SERVICE_NAME')}:{os.environ.get('UNIDESK_GITEA_HTTP_PORT')}/proxy{os.environ.get('UNIDESK_GITEA_HEALTH_PATH')}",
|
|
"health": {
|
|
"exitCode": health_rc,
|
|
"status": health_status,
|
|
"description": parsed.get("description") if isinstance(parsed, dict) else None,
|
|
"bodyBytes": len(body.encode("utf-8")),
|
|
"stderrTail": text(sys.argv[3]),
|
|
},
|
|
"endpointsReady": endpoints_ready,
|
|
"valuesPrinted": False,
|
|
}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if ok else 1)
|
|
PY
|
|
}
|
|
|
|
service_base_url() {
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" get svc "$UNIDESK_GITEA_SERVICE_NAME" -o json >"$tmp/gitea-svc.json" 2>"$tmp/gitea-svc.err"
|
|
python3 - "$tmp/gitea-svc.json" "$UNIDESK_GITEA_HTTP_PORT" <<'PY'
|
|
import json, sys
|
|
data = json.load(open(sys.argv[1], encoding="utf-8"))
|
|
print(f"http://{data['spec']['clusterIP']}:{sys.argv[2]}")
|
|
PY
|
|
}
|
|
|
|
mirror_repos_json() {
|
|
printf '%s' "$UNIDESK_GITEA_REPOS_B64" | base64 -d >"$tmp/repos.json"
|
|
}
|
|
|
|
admin_basic_b64() {
|
|
python3 - <<'PY'
|
|
import base64, os
|
|
login = os.environ["UNIDESK_GITEA_ADMIN_USERNAME"]
|
|
username = login.split("@", 1)[0] if "@" in login else login
|
|
raw = f"{username}:{os.environ['UNIDESK_GITEA_ADMIN_PASSWORD']}".encode()
|
|
print(base64.b64encode(raw).decode())
|
|
PY
|
|
}
|
|
|
|
admin_cli_username() {
|
|
python3 - <<'PY'
|
|
import os
|
|
login = os.environ["UNIDESK_GITEA_ADMIN_USERNAME"]
|
|
print(login.split("@", 1)[0] if "@" in login else login)
|
|
PY
|
|
}
|
|
|
|
run_mirror_bootstrap() {
|
|
mirror_repos_json
|
|
pod="$(kubectl -n "$UNIDESK_GITEA_NAMESPACE" get pod -l "app.kubernetes.io/name=$UNIDESK_GITEA_APP_NAME,app.kubernetes.io/component=gitea" -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/pod.err")"
|
|
create_rc=1
|
|
change_rc=1
|
|
unset_rc=1
|
|
if [ -n "$pod" ]; then
|
|
admin_username="$(admin_cli_username)"
|
|
admin_email="$UNIDESK_GITEA_ADMIN_USERNAME"
|
|
case "$admin_email" in
|
|
*@*) ;;
|
|
*) admin_email="$admin_username@local" ;;
|
|
esac
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" exec "$pod" -- gitea --work-path /var/lib/gitea --config /etc/gitea/app.ini admin user create --username "$admin_username" --password "$UNIDESK_GITEA_ADMIN_PASSWORD" --email "$admin_email" --admin --must-change-password=false >"$tmp/admin-create.out" 2>"$tmp/admin-create.err"
|
|
create_rc=$?
|
|
if [ "$create_rc" -ne 0 ] && grep -qi 'user already exists' "$tmp/admin-create.err"; then
|
|
create_rc=0
|
|
fi
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" exec "$pod" -- gitea --work-path /var/lib/gitea --config /etc/gitea/app.ini admin user change-password --username "$admin_username" --password "$UNIDESK_GITEA_ADMIN_PASSWORD" --must-change-password=false >"$tmp/admin-pass.out" 2>"$tmp/admin-pass.err"
|
|
change_rc=$?
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" exec "$pod" -- gitea --work-path /var/lib/gitea --config /etc/gitea/app.ini admin user must-change-password --unset "$admin_username" >"$tmp/admin-unset.out" 2>"$tmp/admin-unset.err"
|
|
unset_rc=$?
|
|
else
|
|
printf '%s\n' "gitea pod not found" >"$tmp/admin-create.err"
|
|
: >"$tmp/admin-create.out"
|
|
: >"$tmp/admin-pass.out"
|
|
: >"$tmp/admin-pass.err"
|
|
: >"$tmp/admin-unset.out"
|
|
: >"$tmp/admin-unset.err"
|
|
fi
|
|
|
|
base_url="$(service_base_url)"
|
|
basic="$(admin_basic_b64)"
|
|
python3 - "$base_url" "$basic" "$tmp/repos.json" "$tmp/api.json" <<'PY'
|
|
import json, sys, traceback, urllib.error, urllib.request
|
|
base_url, basic, repos_path, out_path = sys.argv[1:5]
|
|
def request(method, path, payload=None, expected=(200, 201, 204), tolerate=()):
|
|
data = None if payload is None else json.dumps(payload).encode()
|
|
req = urllib.request.Request(base_url + path, data=data, method=method)
|
|
req.add_header("Authorization", "Basic " + basic)
|
|
if payload is not None:
|
|
req.add_header("Content-Type", "application/json")
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=20) as resp:
|
|
body = resp.read().decode("utf-8", errors="replace")
|
|
return {"ok": resp.status in expected, "status": resp.status, "body": body[:1000]}
|
|
except urllib.error.HTTPError as exc:
|
|
body = exc.read().decode("utf-8", errors="replace")
|
|
return {"ok": exc.code in tolerate, "status": exc.code, "body": body[:1000]}
|
|
try:
|
|
repos = json.load(open(repos_path, encoding="utf-8"))
|
|
orgs = {}
|
|
repositories = []
|
|
auth = request("GET", "/api/v1/user")
|
|
for repo in repos:
|
|
owner = repo["gitea"]["owner"]
|
|
if owner not in orgs:
|
|
orgs[owner] = {
|
|
"create": request("POST", "/api/v1/orgs", {"username": owner, "full_name": "UniDesk internal mirrors", "visibility": "public"}, expected=(201,), tolerate=(409, 422)),
|
|
"patch": request("PATCH", f"/api/v1/orgs/{owner}", {"full_name": "UniDesk internal mirrors", "visibility": "public"}, expected=(200,), tolerate=()),
|
|
}
|
|
repositories.append({
|
|
"key": repo["key"],
|
|
"owner": owner,
|
|
"name": repo["gitea"]["name"],
|
|
"create": request("POST", f"/api/v1/orgs/{owner}/repos", {"name": repo["gitea"]["name"], "private": not bool(repo["gitea"].get("publicRead")), "auto_init": False, "description": f"UniDesk controlled mirror for {repo['upstream']['repository']}"}, expected=(201,), tolerate=(409, 422)),
|
|
"patch": request("PATCH", f"/api/v1/repos/{owner}/{repo['gitea']['name']}", {"private": not bool(repo["gitea"].get("publicRead")), "description": f"UniDesk controlled mirror for {repo['upstream']['repository']}"}, expected=(200,), tolerate=()),
|
|
})
|
|
payload = {"auth": auth, "orgs": orgs, "repositories": repositories}
|
|
ok = auth.get("ok") and all(v["create"].get("ok") and v["patch"].get("ok") for v in orgs.values()) and all(item["create"].get("ok") and item["patch"].get("ok") for item in repositories)
|
|
except Exception as exc:
|
|
payload = {
|
|
"auth": {"ok": False},
|
|
"orgs": {},
|
|
"repositories": [],
|
|
"error": str(exc),
|
|
"traceTail": traceback.format_exc()[-1600:],
|
|
}
|
|
ok = False
|
|
json.dump(payload, open(out_path, "w", encoding="utf-8"), ensure_ascii=False, indent=2)
|
|
sys.exit(0 if ok else 1)
|
|
PY
|
|
api_rc=$?
|
|
python3 - "$create_rc" "$change_rc" "$unset_rc" "$api_rc" "$tmp/admin-create.out" "$tmp/admin-create.err" "$tmp/admin-pass.out" "$tmp/admin-pass.err" "$tmp/admin-unset.out" "$tmp/admin-unset.err" "$tmp/api.json" <<'PY'
|
|
import json, sys
|
|
def text(path, limit=1600):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
create_rc, change_rc, unset_rc, api_rc = map(int, sys.argv[1:5])
|
|
try:
|
|
api = json.load(open(sys.argv[11], encoding="utf-8"))
|
|
except Exception:
|
|
api = {}
|
|
payload = {
|
|
"ok": create_rc == 0 and change_rc == 0 and unset_rc == 0 and api_rc == 0,
|
|
"target": __import__("os").environ.get("UNIDESK_GITEA_TARGET_ID"),
|
|
"namespace": __import__("os").environ.get("UNIDESK_GITEA_NAMESPACE"),
|
|
"steps": {
|
|
"adminCreate": {"exitCode": create_rc, "stdoutTail": text(sys.argv[5]), "stderrTail": text(sys.argv[6])},
|
|
"adminPassword": {"exitCode": change_rc, "stdoutTail": text(sys.argv[7]), "stderrTail": text(sys.argv[8])},
|
|
"adminMustChangePasswordUnset": {"exitCode": unset_rc, "stdoutTail": text(sys.argv[9]), "stderrTail": text(sys.argv[10])},
|
|
"apiBootstrap": {"exitCode": api_rc},
|
|
},
|
|
"api": api,
|
|
"repositories": api.get("repositories", []),
|
|
"valuesPrinted": False,
|
|
}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
}
|
|
|
|
run_mirror_sync() {
|
|
mirror_repos_json
|
|
base_url="$(service_base_url)"
|
|
basic="$(admin_basic_b64)"
|
|
python3 - "$tmp/repos.json" "$tmp/sync-plan.sh" "$tmp/repo-meta.json" "$base_url" <<'PY'
|
|
import json, shlex, sys, urllib.parse
|
|
repos = json.load(open(sys.argv[1], encoding="utf-8"))
|
|
base_url = sys.argv[4].rstrip("/")
|
|
script = []
|
|
meta = []
|
|
for i, repo in enumerate(repos):
|
|
key = repo["key"]
|
|
source_branch = repo["upstream"]["branch"]
|
|
gitops_branch = repo["gitops"]["branch"]
|
|
branches = [source_branch] + ([] if gitops_branch == source_branch or gitops_branch == "not-a-gitops-branch" else [gitops_branch])
|
|
work = f"$tmp/repo-{i}.git"
|
|
gitea_write_url = base_url + urllib.parse.urlparse(repo["gitea"]["readUrl"]).path
|
|
script += [
|
|
f"mkdir -p {shlex.quote(work)}",
|
|
f"git init --bare {shlex.quote(work)} >$tmp/{key}.init.out 2>$tmp/{key}.init.err; printf '%s' \"$?\" >$tmp/{key}.init.rc",
|
|
f"git -C {shlex.quote(work)} -c http.extraHeader=\"$GITHUB_AUTH_HEADER\" fetch --prune {shlex.quote(repo['upstream']['cloneUrl'])} " + " ".join(shlex.quote(f"+refs/heads/{b}:refs/remotes/github/{b}") for b in branches) + f" >$tmp/{key}.fetch.out 2>$tmp/{key}.fetch.err; fetch_rc=$?; printf '%s' \"$fetch_rc\" >$tmp/{key}.fetch.rc",
|
|
f"if [ \"$fetch_rc\" -eq 0 ]; then sha=$(git -C {shlex.quote(work)} rev-parse refs/remotes/github/{shlex.quote(source_branch)} 2>$tmp/{key}.revparse.err); revparse_rc=$?; printf '%s\\n' \"$sha\" >$tmp/{key}.revparse.out; else sha=''; revparse_rc=1; : >$tmp/{key}.revparse.out; printf '%s\\n' 'fetch failed; revparse skipped' >$tmp/{key}.revparse.err; fi; printf '%s' \"$revparse_rc\" >$tmp/{key}.revparse.rc",
|
|
f"if [ \"$revparse_rc\" -eq 0 ]; then snapshot_ref={shlex.quote(repo['snapshot']['prefix'])}/$sha; git -C {shlex.quote(work)} -c http.extraHeader=\"$GITEA_AUTH_HEADER\" push --force {shlex.quote(gitea_write_url)} $sha:refs/heads/{shlex.quote(source_branch)} $sha:$snapshot_ref >$tmp/{key}.push.out 2>$tmp/{key}.push.err; push_rc=$?; else snapshot_ref=''; push_rc=1; : >$tmp/{key}.push.out; printf '%s\\n' 'revparse failed; push skipped' >$tmp/{key}.push.err; fi; printf '%s' \"$push_rc\" >$tmp/{key}.push.rc",
|
|
]
|
|
if gitops_branch != source_branch and gitops_branch != "not-a-gitops-branch":
|
|
script.append(f"if [ \"$fetch_rc\" -eq 0 ]; then gitops_sha=$(git -C {shlex.quote(work)} rev-parse refs/remotes/github/{shlex.quote(gitops_branch)} 2>/dev/null || true); else gitops_sha=''; fi")
|
|
script.append(f"if [ -n \"$gitops_sha\" ] && [ \"$push_rc\" -eq 0 ]; then git -C {shlex.quote(work)} -c http.extraHeader=\"$GITEA_AUTH_HEADER\" push --force {shlex.quote(gitea_write_url)} $gitops_sha:refs/heads/{shlex.quote(gitops_branch)} >>$tmp/{key}.push.out 2>>$tmp/{key}.push.err; gitops_push_rc=$?; else gitops_push_rc=0; fi; printf '%s' \"$gitops_push_rc\" >$tmp/{key}.gitops-push.rc")
|
|
else:
|
|
script.append(f"printf '%s' '0' >$tmp/{key}.gitops-push.rc")
|
|
script.append(f"if [ \"$push_rc\" -eq 0 ]; then printf '%s %s\\n' \"$sha\" \"$snapshot_ref\" >$tmp/{key}.bundle; fi")
|
|
meta.append({"key": key, "sourceBranch": source_branch, "gitopsBranch": gitops_branch, "readUrl": repo["gitea"]["readUrl"], "writeUrlHost": urllib.parse.urlparse(gitea_write_url).netloc, "snapshotPrefix": repo["snapshot"]["prefix"], "legacyReadUrl": repo["legacyGitMirror"]["readUrl"]})
|
|
open(sys.argv[2], "w", encoding="utf-8").write("\n".join(script) + "\n")
|
|
json.dump(meta, open(sys.argv[3], "w", encoding="utf-8"), ensure_ascii=False, indent=2)
|
|
PY
|
|
github_basic="$(python3 - <<'PY'
|
|
import base64, os
|
|
raw = f"x-access-token:{os.environ['UNIDESK_GITEA_GITHUB_TOKEN']}".encode()
|
|
print(base64.b64encode(raw).decode())
|
|
PY
|
|
)"
|
|
GITHUB_AUTH_HEADER="Authorization: Basic $github_basic"
|
|
GITEA_AUTH_HEADER="Authorization: Basic $basic"
|
|
export GITHUB_AUTH_HEADER GITEA_AUTH_HEADER
|
|
unset GIT_SSH GIT_SSH_COMMAND SSH_AUTH_SOCK
|
|
export GIT_TERMINAL_PROMPT=0
|
|
export GIT_CONFIG_NOSYSTEM=1
|
|
export GIT_CONFIG_GLOBAL=/dev/null
|
|
if [ "$UNIDESK_GITEA_GITHUB_PROXY_ENABLED" = "1" ]; then
|
|
export https_proxy="$UNIDESK_GITEA_GITHUB_PROXY_URL"
|
|
export http_proxy="$UNIDESK_GITEA_GITHUB_PROXY_URL"
|
|
export no_proxy="$UNIDESK_GITEA_NO_PROXY"
|
|
fi
|
|
sh "$tmp/sync-plan.sh" >"$tmp/sync.out" 2>"$tmp/sync.err"
|
|
sync_rc=$?
|
|
python3 - "$sync_rc" "$tmp/repo-meta.json" "$tmp" <<'PY'
|
|
import json, os, sys
|
|
sync_rc = int(sys.argv[1])
|
|
meta = json.load(open(sys.argv[2], encoding="utf-8"))
|
|
tmp = sys.argv[3]
|
|
def text(path, limit=1200):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
def rc(path):
|
|
try:
|
|
return int(open(path, encoding="utf-8").read() or "1")
|
|
except Exception:
|
|
return 1
|
|
repos = []
|
|
bundles = []
|
|
for repo in meta:
|
|
bundle_path = os.path.join(tmp, f"{repo['key']}.bundle")
|
|
source_commit = None
|
|
snapshot_ref = None
|
|
try:
|
|
parts = open(bundle_path, encoding="utf-8").read().strip().split()
|
|
source_commit, snapshot_ref = parts[0], parts[1]
|
|
except Exception:
|
|
pass
|
|
repos.append({
|
|
**repo,
|
|
"sourceCommit": source_commit,
|
|
"snapshotRef": snapshot_ref,
|
|
"syncOk": source_commit is not None and snapshot_ref is not None and rc(os.path.join(tmp, f"{repo['key']}.gitops-push.rc")) == 0,
|
|
"initRc": rc(os.path.join(tmp, f"{repo['key']}.init.rc")),
|
|
"fetchRc": rc(os.path.join(tmp, f"{repo['key']}.fetch.rc")),
|
|
"revparseRc": rc(os.path.join(tmp, f"{repo['key']}.revparse.rc")),
|
|
"pushRc": rc(os.path.join(tmp, f"{repo['key']}.push.rc")),
|
|
"gitopsPushRc": rc(os.path.join(tmp, f"{repo['key']}.gitops-push.rc")),
|
|
"fetchStdoutTail": text(os.path.join(tmp, f"{repo['key']}.fetch.out")),
|
|
"fetchTail": text(os.path.join(tmp, f"{repo['key']}.fetch.err")),
|
|
"pushStdoutTail": text(os.path.join(tmp, f"{repo['key']}.push.out")),
|
|
"pushTail": text(os.path.join(tmp, f"{repo['key']}.push.err")),
|
|
"revparseTail": text(os.path.join(tmp, f"{repo['key']}.revparse.err")),
|
|
})
|
|
if source_commit and snapshot_ref:
|
|
bundles.append({"key": repo["key"], "sourceCommit": source_commit, "snapshotRef": snapshot_ref, "readUrl": repo["readUrl"], "sourceAuthority": "gitea"})
|
|
payload = {"ok": sync_rc == 0 and all(r["syncOk"] for r in repos), "repositories": repos, "sourceBundles": bundles, "valuesPrinted": False}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
}
|
|
|
|
run_mirror_status() {
|
|
mirror_repos_json
|
|
base_url="$(service_base_url)"
|
|
basic="$(admin_basic_b64)"
|
|
python3 - "$tmp/repos.json" "$tmp/status-plan.sh" "$tmp/repo-meta.json" "$base_url" <<'PY'
|
|
import json, shlex, sys, urllib.parse
|
|
repos = json.load(open(sys.argv[1], encoding="utf-8"))
|
|
base_url = sys.argv[4].rstrip("/")
|
|
script = []
|
|
meta = []
|
|
for repo in repos:
|
|
key = repo["key"]
|
|
branch = repo["upstream"]["branch"]
|
|
gitops = repo["gitops"]["branch"]
|
|
gitea_probe_url = base_url + urllib.parse.urlparse(repo["gitea"]["readUrl"]).path
|
|
script.append(f"git -c http.extraHeader=\"$GITEA_AUTH_HEADER\" ls-remote {shlex.quote(gitea_probe_url)} refs/heads/{shlex.quote(branch)} '{shlex.quote(repo['snapshot']['prefix'])}/*' refs/heads/{shlex.quote(gitops)} >$tmp/{key}.ls.out 2>$tmp/{key}.ls.err")
|
|
meta.append({"key": key, "branch": branch, "gitopsBranch": gitops, "readUrl": repo["gitea"]["readUrl"], "probeUrlHost": urllib.parse.urlparse(gitea_probe_url).netloc, "snapshotPrefix": repo["snapshot"]["prefix"], "legacyReadUrl": repo["legacyGitMirror"]["readUrl"], "legacyDisposition": repo["legacyGitMirror"]["disposition"]})
|
|
open(sys.argv[2], "w", encoding="utf-8").write("\n".join(script) + "\n")
|
|
json.dump(meta, open(sys.argv[3], "w", encoding="utf-8"), ensure_ascii=False)
|
|
PY
|
|
GITEA_AUTH_HEADER="Authorization: Basic $basic"
|
|
export GITEA_AUTH_HEADER
|
|
sh "$tmp/status-plan.sh" >"$tmp/status.out" 2>"$tmp/status.err"
|
|
status_rc=$?
|
|
python3 - "$status_rc" "$tmp/repo-meta.json" "$tmp" <<'PY'
|
|
import json, os, sys
|
|
status_rc = int(sys.argv[1])
|
|
meta = json.load(open(sys.argv[2], encoding="utf-8"))
|
|
tmp = sys.argv[3]
|
|
def text(path, limit=1200):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
repos = []
|
|
for repo in meta:
|
|
out = text(os.path.join(tmp, f"{repo['key']}.ls.out"), 20000)
|
|
refs = {}
|
|
for line in out.splitlines():
|
|
parts = line.split()
|
|
if len(parts) == 2:
|
|
refs[parts[1]] = parts[0]
|
|
branch_ref = f"refs/heads/{repo['branch']}"
|
|
branch_commit = refs.get(branch_ref)
|
|
snapshots = sorted((ref, sha) for ref, sha in refs.items() if ref.startswith(repo["snapshotPrefix"] + "/"))
|
|
matching_snapshots = [item for item in snapshots if branch_commit and item[1] == branch_commit]
|
|
latest_snapshot = matching_snapshots[-1] if matching_snapshots else (snapshots[-1] if snapshots else None)
|
|
current_snapshot_ready = bool(branch_commit and latest_snapshot and latest_snapshot[1] == branch_commit)
|
|
repos.append({
|
|
**repo,
|
|
"branchCommit": branch_commit,
|
|
"snapshotRef": latest_snapshot[0] if latest_snapshot else None,
|
|
"snapshotCommit": latest_snapshot[1] if latest_snapshot else None,
|
|
"sourceBundleReady": current_snapshot_ready,
|
|
"mirrorState": "ready" if current_snapshot_ready else "missing-ref",
|
|
"errorTail": text(os.path.join(tmp, f"{repo['key']}.ls.err")),
|
|
})
|
|
payload = {"ok": status_rc == 0 and all(r["sourceBundleReady"] for r in repos), "repositories": repos, "valuesPrinted": False}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
}
|
|
|
|
github_api_env() {
|
|
if [ "$UNIDESK_GITEA_GITHUB_PROXY_ENABLED" = "1" ]; then
|
|
export https_proxy="$UNIDESK_GITEA_GITHUB_PROXY_URL"
|
|
export http_proxy="$UNIDESK_GITEA_GITHUB_PROXY_URL"
|
|
export no_proxy="$UNIDESK_GITEA_NO_PROXY"
|
|
fi
|
|
}
|
|
|
|
run_mirror_webhook_apply() {
|
|
mirror_repos_json
|
|
github_api_env
|
|
python3 - "$tmp/repos.json" <<'PY'
|
|
import json, os, sys, urllib.error, urllib.request
|
|
repos = json.load(open(sys.argv[1], encoding="utf-8"))
|
|
token = os.environ["UNIDESK_GITEA_GITHUB_TOKEN"]
|
|
url = os.environ["UNIDESK_GITEA_WEBHOOK_PUBLIC_URL"]
|
|
secret = os.environ["UNIDESK_GITEA_GITHUB_WEBHOOK_SECRET"]
|
|
events = [item for item in os.environ.get("UNIDESK_GITEA_WEBHOOK_EVENTS", "push").split(",") if item]
|
|
def request(method, api_path, payload=None, expected=(200, 201, 204), tolerate=()):
|
|
data = None if payload is None else json.dumps(payload).encode()
|
|
req = urllib.request.Request("https://api.github.com" + api_path, data=data, method=method)
|
|
req.add_header("Authorization", "Bearer " + token)
|
|
req.add_header("Accept", "application/vnd.github+json")
|
|
req.add_header("X-GitHub-Api-Version", "2022-11-28")
|
|
if payload is not None:
|
|
req.add_header("Content-Type", "application/json")
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=30) as resp:
|
|
body = resp.read().decode("utf-8", errors="replace")
|
|
return {"ok": resp.status in expected, "status": resp.status, "body": body}
|
|
except urllib.error.HTTPError as exc:
|
|
body = exc.read().decode("utf-8", errors="replace")
|
|
return {"ok": exc.code in tolerate, "status": exc.code, "body": body[:1000]}
|
|
rows = []
|
|
for repo in repos:
|
|
repository = repo["upstream"]["repository"]
|
|
list_result = request("GET", f"/repos/{repository}/hooks")
|
|
hooks = []
|
|
try:
|
|
hooks = json.loads(list_result.get("body") or "[]")
|
|
except Exception:
|
|
hooks = []
|
|
matches = [item for item in hooks if (item.get("config") or {}).get("url") == url]
|
|
body = {"name": "web", "active": True, "events": events, "config": {"url": url, "content_type": "json", "secret": secret, "insecure_ssl": "0"}}
|
|
if matches:
|
|
hook_id = matches[0].get("id")
|
|
result = request("PATCH", f"/repos/{repository}/hooks/{hook_id}", body)
|
|
for duplicate in matches[1:]:
|
|
duplicate_id = duplicate.get("id")
|
|
if duplicate_id:
|
|
request("DELETE", f"/repos/{repository}/hooks/{duplicate_id}", expected=(204,), tolerate=(404,))
|
|
else:
|
|
result = request("POST", f"/repos/{repository}/hooks", body, expected=(201,))
|
|
try:
|
|
hook_id = json.loads(result.get("body") or "{}").get("id")
|
|
except Exception:
|
|
hook_id = None
|
|
rows.append({"key": repo["key"], "repository": repository, "hookId": hook_id, "hookReady": result.get("ok") is True, "status": result.get("status"), "error": None if result.get("ok") else result.get("body", "")[:500], "valuesPrinted": False})
|
|
payload = {"ok": all(row["hookReady"] for row in rows), "repositories": rows, "url": url, "valuesPrinted": False}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
}
|
|
|
|
run_mirror_webhook_status() {
|
|
mirror_repos_json
|
|
github_api_env
|
|
bridge_ready=$(kubectl -n "$UNIDESK_GITEA_NAMESPACE" get deploy "$UNIDESK_GITEA_WEBHOOK_DEPLOYMENT" -o jsonpath='{.status.readyReplicas}/{.spec.replicas}' 2>/dev/null || echo "0/0")
|
|
service_exists=$(kubectl -n "$UNIDESK_GITEA_NAMESPACE" get service "$UNIDESK_GITEA_WEBHOOK_SERVICE" -o name 2>/dev/null || true)
|
|
python3 - "$tmp/repos.json" "$bridge_ready" "$service_exists" <<'PY'
|
|
import json, os, sys, urllib.error, urllib.request
|
|
repos = json.load(open(sys.argv[1], encoding="utf-8"))
|
|
bridge_ready = sys.argv[2]
|
|
service_exists = bool(sys.argv[3])
|
|
token = os.environ["UNIDESK_GITEA_GITHUB_TOKEN"]
|
|
url = os.environ["UNIDESK_GITEA_WEBHOOK_PUBLIC_URL"]
|
|
def request(api_path):
|
|
req = urllib.request.Request("https://api.github.com" + api_path, method="GET")
|
|
req.add_header("Authorization", "Bearer " + token)
|
|
req.add_header("Accept", "application/vnd.github+json")
|
|
req.add_header("X-GitHub-Api-Version", "2022-11-28")
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=30) as resp:
|
|
return {"ok": True, "status": resp.status, "body": resp.read().decode("utf-8", errors="replace")}
|
|
except urllib.error.HTTPError as exc:
|
|
return {"ok": False, "status": exc.code, "body": exc.read().decode("utf-8", errors="replace")[:1000]}
|
|
rows = []
|
|
for repo in repos:
|
|
repository = repo["upstream"]["repository"]
|
|
result = request(f"/repos/{repository}/hooks")
|
|
hooks = []
|
|
try:
|
|
hooks = json.loads(result.get("body") or "[]")
|
|
except Exception:
|
|
hooks = []
|
|
match = next((item for item in hooks if (item.get("config") or {}).get("url") == url), None)
|
|
rows.append({"key": repo["key"], "repository": repository, "hookId": match.get("id") if match else None, "hookReady": bool(match and match.get("active") is True), "active": match.get("active") if match else None, "status": result.get("status"), "error": None if result.get("ok") else result.get("body", "")[:500], "valuesPrinted": False})
|
|
bridge = {"deployment": os.environ["UNIDESK_GITEA_WEBHOOK_DEPLOYMENT"], "ready": bridge_ready not in ("0/0", "/") and bridge_ready.split("/")[0] == bridge_ready.split("/")[-1], "readyReplicas": bridge_ready, "serviceExists": service_exists}
|
|
payload = {"ok": bridge["ready"] and service_exists and all(row["hookReady"] for row in rows), "bridge": bridge, "repositories": rows, "url": url, "valuesPrinted": False}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
}
|
|
|
|
run_mirror_webhook_test() {
|
|
mirror_repos_json
|
|
repo_count=$(python3 - "$tmp/repos.json" <<'PY'
|
|
import json, sys
|
|
print(len(json.load(open(sys.argv[1], encoding="utf-8"))))
|
|
PY
|
|
)
|
|
if [ "$repo_count" != "1" ]; then
|
|
printf '{"ok":false,"error":"webhook test requires exactly one repo","valuesPrinted":false}\n'
|
|
exit 2
|
|
fi
|
|
repo_key=$(python3 - "$tmp/repos.json" <<'PY'
|
|
import json, sys
|
|
print(json.load(open(sys.argv[1], encoding="utf-8"))[0]["key"])
|
|
PY
|
|
)
|
|
github_api_env
|
|
python3 - "$tmp/repos.json" >"$tmp/webhook-ping.json" 2>"$tmp/webhook-ping.err" <<'PY'
|
|
import json, os, sys, time, urllib.error, urllib.request
|
|
repo = json.load(open(sys.argv[1], encoding="utf-8"))[0]
|
|
repository = repo["upstream"]["repository"]
|
|
token = os.environ["UNIDESK_GITEA_GITHUB_TOKEN"]
|
|
url = os.environ["UNIDESK_GITEA_WEBHOOK_PUBLIC_URL"]
|
|
def request(method, path, payload=None, expected=(200, 201, 204)):
|
|
data = None if payload is None else json.dumps(payload).encode()
|
|
req = urllib.request.Request("https://api.github.com" + path, data=data, method=method)
|
|
req.add_header("Authorization", "Bearer " + token)
|
|
req.add_header("Accept", "application/vnd.github+json")
|
|
req.add_header("X-GitHub-Api-Version", "2022-11-28")
|
|
if payload is not None:
|
|
req.add_header("Content-Type", "application/json")
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=30) as resp:
|
|
return {"ok": resp.status in expected, "status": resp.status, "body": resp.read().decode("utf-8", errors="replace")}
|
|
except urllib.error.HTTPError as exc:
|
|
return {"ok": False, "status": exc.code, "body": exc.read().decode("utf-8", errors="replace")[:1000]}
|
|
hooks_result = request("GET", f"/repos/{repository}/hooks")
|
|
hooks = json.loads(hooks_result.get("body") or "[]") if hooks_result.get("ok") else []
|
|
hook = next((item for item in hooks if (item.get("config") or {}).get("url") == url), None)
|
|
hook_id = hook.get("id") if hook else None
|
|
ping = request("POST", f"/repos/{repository}/hooks/{hook_id}/pings", expected=(204,)) if hook_id else {"ok": False, "status": None, "body": "hook not found"}
|
|
delivery = None
|
|
if hook_id and ping.get("ok"):
|
|
time.sleep(3)
|
|
deliveries = request("GET", f"/repos/{repository}/hooks/{hook_id}/deliveries")
|
|
try:
|
|
rows = json.loads(deliveries.get("body") or "[]")
|
|
except Exception:
|
|
rows = []
|
|
delivery = next((item for item in rows if item.get("event") == "ping"), rows[0] if rows else None)
|
|
payload = {"ok": bool(ping.get("ok") and (delivery is None or delivery.get("status_code") in (200, 202))), "repository": repository, "hookId": hook_id, "pingStatus": ping.get("status"), "delivery": {"id": delivery.get("id"), "event": delivery.get("event"), "statusCode": delivery.get("status_code"), "status": delivery.get("status"), "deliveredAt": delivery.get("delivered_at")} if isinstance(delivery, dict) else None, "error": None if ping.get("ok") else ping.get("body"), "valuesPrinted": False}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
ping_rc=$?
|
|
repos_inline=$(cat "$tmp/repos.json")
|
|
kubectl -n "$UNIDESK_GITEA_NAMESPACE" exec -i deploy/"$UNIDESK_GITEA_WEBHOOK_DEPLOYMENT" -- node - "$UNIDESK_GITEA_WEBHOOK_PATH" "$repos_inline" >"$tmp/webhook-test.out" 2>"$tmp/webhook-test.err" <<'NODE'
|
|
const http = require('node:http');
|
|
const crypto = require('node:crypto');
|
|
const path = process.argv[2];
|
|
const repos = JSON.parse(process.argv[3]);
|
|
const repo = repos[0];
|
|
const payload = Buffer.from(JSON.stringify({ ref: `refs/heads/${repo.upstream.branch}`, repository: { full_name: repo.upstream.repository } }));
|
|
const signature = `sha256=${crypto.createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET).update(payload).digest('hex')}`;
|
|
const req = http.request({ hostname: '127.0.0.1', port: Number(process.env.UNIDESK_GITEA_WEBHOOK_PORT || '8080'), path, method: 'POST', headers: { 'content-type': 'application/json', 'content-length': payload.length, 'x-github-event': 'push', 'x-hub-signature-256': signature } }, (res) => {
|
|
const chunks = [];
|
|
res.on('data', (chunk) => chunks.push(chunk));
|
|
res.on('end', () => {
|
|
const body = Buffer.concat(chunks).toString('utf8');
|
|
process.stdout.write(JSON.stringify({ statusCode: res.statusCode, body }) + '\n');
|
|
process.exit(res.statusCode >= 200 && res.statusCode < 300 ? 0 : 1);
|
|
});
|
|
});
|
|
req.on('error', (error) => { console.error(error.stack || error.message); process.exit(1); });
|
|
req.write(payload);
|
|
req.end();
|
|
NODE
|
|
test_rc=$?
|
|
run_mirror_status >"$tmp/status-after-test.json" 2>"$tmp/status-after-test.err"
|
|
status_rc=$?
|
|
python3 - "$ping_rc" "$test_rc" "$status_rc" "$repo_key" "$tmp/repos.json" "$tmp/webhook-ping.json" "$tmp/webhook-ping.err" "$tmp/webhook-test.out" "$tmp/webhook-test.err" "$tmp/status-after-test.json" "$tmp/status-after-test.err" <<'PY'
|
|
import json, sys
|
|
ping_rc, test_rc, status_rc = int(sys.argv[1]), int(sys.argv[2]), int(sys.argv[3])
|
|
repo_key = sys.argv[4]
|
|
repos_path = sys.argv[5]
|
|
def text(path, limit=2000):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
def github_head(repo):
|
|
import os, urllib.error, urllib.request
|
|
repository = repo["upstream"]["repository"]
|
|
branch = repo["upstream"]["branch"].replace("/", "%2F")
|
|
token = os.environ["UNIDESK_GITEA_GITHUB_TOKEN"]
|
|
req = urllib.request.Request(f"https://api.github.com/repos/{repository}/git/ref/heads/{branch}", method="GET")
|
|
req.add_header("Authorization", "Bearer " + token)
|
|
req.add_header("Accept", "application/vnd.github+json")
|
|
req.add_header("X-GitHub-Api-Version", "2022-11-28")
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=30) as resp:
|
|
payload = json.loads(resp.read().decode("utf-8", errors="replace") or "{}")
|
|
return payload.get("object", {}).get("sha")
|
|
except Exception:
|
|
return None
|
|
try:
|
|
ping = json.loads(text(sys.argv[6], 100000))
|
|
except Exception:
|
|
ping = {"ok": False, "error": text(sys.argv[7])}
|
|
try:
|
|
status = json.loads(text(sys.argv[10], 100000))
|
|
except Exception:
|
|
status = {}
|
|
try:
|
|
repo_specs = json.load(open(repos_path, encoding="utf-8"))
|
|
except Exception:
|
|
repo_specs = []
|
|
expected_heads = {repo.get("key"): github_head(repo) for repo in repo_specs}
|
|
rows = []
|
|
for repo in status.get("repositories", []):
|
|
if repo.get("key") == repo_key:
|
|
expected_head = expected_heads.get(repo_key)
|
|
branch_matches_github = bool(expected_head and repo.get("branchCommit") == expected_head)
|
|
rows.append({**repo, "expectedGitHubHead": expected_head, "branchMatchesGitHub": branch_matches_github, "pingOk": ping_rc == 0 and ping.get("ok") is True, "testOk": test_rc == 0, "error": None if ping_rc == 0 and test_rc == 0 and repo.get("sourceBundleReady") and branch_matches_github else (ping.get("error") or text(sys.argv[9]) or text(sys.argv[11]) or "gitea mirror branch does not match GitHub head")[:500]})
|
|
payload = {"ok": ping_rc == 0 and test_rc == 0 and status_rc == 0 and all(row.get("sourceBundleReady") and row.get("branchMatchesGitHub") for row in rows), "repositories": rows, "githubPing": ping, "test": {"exitCode": test_rc, "stdoutTail": text(sys.argv[8]), "stderrTail": text(sys.argv[9])}, "valuesPrinted": False}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
}
|
|
|
|
case "$UNIDESK_GITEA_ACTION" in
|
|
apply) run_apply ;;
|
|
status) run_status ;;
|
|
validate) run_validate ;;
|
|
mirror-bootstrap) run_mirror_bootstrap ;;
|
|
mirror-sync) run_mirror_sync ;;
|
|
mirror-status) run_mirror_status ;;
|
|
mirror-webhook-apply) run_mirror_webhook_apply ;;
|
|
mirror-webhook-status) run_mirror_webhook_status ;;
|
|
mirror-webhook-test) run_mirror_webhook_test ;;
|
|
*) printf '{"ok":false,"error":"unsupported-gitea-remote-action"}\n'; exit 2 ;;
|
|
esac
|