feedc0de
706d40ca97
Validate, publish and deploy Gramps Web / validate (push) Successful in 23s
Validate, publish and deploy Gramps Web / ensure-postgresql-image (push) Successful in 37s
Validate, publish and deploy Gramps Web / publish (push) Successful in 18s
Validate, publish and deploy Gramps Web / deploy (push) Failing after 21s
63 lines
2.5 KiB
Bash
Executable File
63 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
workdir=$(mktemp --directory)
|
|
trap 'rm -rf "${workdir}"' EXIT HUP INT TERM
|
|
|
|
bash -n \
|
|
"${project_dir}/bootstrap-secrets.sh" \
|
|
"${project_dir}/create-ci-kubeconfig.sh" \
|
|
"${project_dir}/deploy.sh" \
|
|
"${project_dir}/install.sh" \
|
|
"${project_dir}/preflight.sh" \
|
|
"${project_dir}/render.sh" \
|
|
"${project_dir}/test.sh"
|
|
|
|
dependencies=("${project_dir}"/charts/*.tgz)
|
|
if (( ${#dependencies[@]} < 2 )); then
|
|
helm dependency build --skip-refresh "${project_dir}"
|
|
fi
|
|
helm lint "${project_dir}"
|
|
helm lint "${project_dir}" --values "${project_dir}/values-arschrock.yaml"
|
|
helm template gramps-web "${project_dir}" --namespace gramps-web \
|
|
> "${workdir}/default.yaml"
|
|
helm template gramps "${project_dir}" --namespace gramps \
|
|
--values "${project_dir}/values-arschrock.yaml" \
|
|
> "${workdir}/arschrock.yaml"
|
|
helm template external "${project_dir}" --namespace gramps \
|
|
--set postgresql.enabled=false \
|
|
--set database.host=postgres.example.internal \
|
|
--set database.auth.existingSecret=external-postgresql \
|
|
--set valkey.enabled=false \
|
|
--set cache.host=valkey.example.internal \
|
|
--set cache.auth.existingSecret=external-valkey \
|
|
> "${workdir}/external.yaml"
|
|
|
|
grep -Fq 'ghcr.io/gramps-project/grampsweb:latest' "${workdir}/default.yaml"
|
|
grep -Fq 'name: GRAMPSWEB_OIDC_ENABLED' "${workdir}/default.yaml"
|
|
grep -Fq 'name: postgresql' "${workdir}/arschrock.yaml"
|
|
grep -Fq 'name: valkey-primary' "${workdir}/arschrock.yaml"
|
|
grep -Fq 'name: grampsweb-celery' "${workdir}/arschrock.yaml"
|
|
grep -Fq 'name: gramps-runtime' "${workdir}/arschrock.yaml"
|
|
grep -Fq 'path: /ready' "${workdir}/default.yaml"
|
|
grep -Fq 'psycopg2.connect' "${workdir}/default.yaml"
|
|
grep -Fq 'celery -A gramps_webapi.celery inspect ping' "${workdir}/default.yaml"
|
|
if grep -Eq '^kind: StatefulSet$' "${workdir}/external.yaml"; then
|
|
echo "External-service render unexpectedly creates a StatefulSet" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Block the credential patterns that existed in the legacy raw manifests.
|
|
if grep --recursive --extended-regexp --line-number \
|
|
--exclude-dir=.git --exclude-dir=charts --exclude-dir=postgresql \
|
|
--exclude-dir=valkey --exclude=test.sh \
|
|
'(GRAMPSWEB_POSTGRES_PASSWORD:[[:space:]]+[^{$]|OIDC_CLIENT_SECRET:[[:space:]]+[^{$]|AWS_SECRET_ACCESS_KEY:[[:space:]]+[^{$]|password:[[:space:]]+[A-Za-z0-9]{24,})' \
|
|
"${project_dir}"; then
|
|
echo "A likely plaintext credential is present in committable chart sources" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Chart renders successfully with bundled and external data services."
|