syntaxbullet/minabot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: preserve runtime-readable deployment sources

Browse Source
This commit is contained in:
syntaxbullet
2026-09-07 13:03:52 +02:00
parent 2598a5b350
commit 6dad98d230
2 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
deploy/deploy.sh
View File

@@ -6,6 +6,8 @@ root=${MINABOT_DEPLOY_ROOT:-/opt/minabot}
cd "$root"
exec 9>deploy.lock
flock -n 9 || exit 0
# Preserve journal stderr even when a failing build function redirects its logs.
exec 4>&2
export GIT_TERMINAL_PROMPT=0
repo="$root/git-sync.git"
target=''
@@ -27,8 +29,8 @@ failed() {
local result=$?
trap - ERR
set +e
printf 'Deployment failed: %s (exit %s)\n' "${target:-fetch}" "$result" >&2
printf 'Build and test logs: %s\n' "${release:-$root}" >&2
printf 'Deployment failed: %s (exit %s)\n' "${target:-fetch}" "$result" >&4
printf 'Build and test logs: %s\n' "${release:-$root}" >&4
if [[ -n "$target" ]]; then printf '%s\n' "$target" > failed-sha; fi
if $switching; then
compose stop caddy app monitor
@@ -66,7 +68,9 @@ available_kb=$(df -Pk "$root" | awk 'NR==2 {print $4}')
if (( available_kb < 2097152 )); then echo 'Less than 2 GiB free; refusing to build.' >&2; false; fi
release="$root/releases/$target"
mkdir -p "$release"
git --git-dir="$repo" archive "$target" | tar -x -C "$release"
# Source files must remain readable by the non-root runtime after Docker COPY.
# Keep secrets/state private via the outer umask; apply 022 only to Git sources.
git --git-dir="$repo" archive "$target" | (umask 022; tar -x -C "$release")
image="minabot:git-${target:0:12}"
checks="$image-checks"
docker_cmd build --target build -t "$checks" "$release" > "$release/build-checks.log" 2>&1

3
deploy/deploy.test.ts
View File

@@ -6,7 +6,7 @@ import { join, dirname } from 'node:path';
const revision = 'b'.repeat(40);
const stub = `#!${process.execPath}
import {basename} from 'node:path';
import {appendFileSync,mkdirSync,existsSync,writeFileSync} from 'node:fs';
import {appendFileSync,mkdirSync,existsSync,writeFileSync,statSync} from 'node:fs';
const tool=basename(process.argv[1]), args=process.argv.slice(2), root=process.env.STUB_ROOT, mode=process.env.STUB_MODE;
appendFileSync(root+'/calls.jsonl',JSON.stringify({tool,args})+'\\n');
if(tool==='flock') process.exit(0);
@@ -19,6 +19,7 @@ if(tool==='git') {
}
if(tool==='curl') { console.log('{"status":"ok"}');process.exit(0); }
if(tool==='sudo') {
if(args.includes('build') && !(statSync(args.at(-1)+'/Caddyfile').mode & 4)) {console.error('Source unreadable to runtime user');process.exit(2);}
if(args.includes('build') && mode==='build-failure') process.exit(1);
if(args.some(a=>a.includes('SELECT type,name,sql'))) { console.log(mode==='migration-failure' && existsSync(root+'/switched')?'schema-new':'schema-old');process.exit(0); }
if(args.includes('compose') && args.includes('up') && args.includes('app')) {