From 8325818c1b7e158b4ab2c15622e9adf359500270 Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Sat, 11 Jul 2026 16:24:07 +0930
Subject: [PATCH] fix pipeline use of bash

---
 .gitea/workflows/gitea-main-ci.yaml | 15 +++++----------
 .gitea/workflows/ipxe-image.yaml    |  9 +++------
 2 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml
index 7349621..2a8ac36 100644
--- a/.gitea/workflows/gitea-main-ci.yaml
+++ b/.gitea/workflows/gitea-main-ci.yaml
@@ -167,18 +167,13 @@ jobs:
           SB_KEY:   ${{ secrets.SB_KEY }}
           SB_CERT:  ${{ secrets.SB_CERT }}
           FLEET_CA: ${{ secrets.FLEET_CA }}
+        # POSIX sh (the runner defaults to dash) — no bashisms like ${!v}.
         run: |
           miss=0
-          for v in SB_KEY SB_CERT FLEET_CA; do
-            if [ -z "${!v}" ]; then
-              echo "::error::required secret ${v} is empty — production builds are signed with a real fleet CA (no fallback). Set it in the Gitea repo secrets."
-              miss=1
-            fi
-          done
-          if [ "${ENABLE_STIG}" != "true" ]; then
-            echo "::error::ENABLE_STIG must be 'true' — production builds are hardening-mandatory (POA&M P-03)."
-            miss=1
-          fi
+          [ -n "$SB_KEY" ]   || { echo "::error::required secret SB_KEY is empty — production builds must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
+          [ -n "$SB_CERT" ]  || { echo "::error::required secret SB_CERT is empty — production builds must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
+          [ -n "$FLEET_CA" ] || { echo "::error::required secret FLEET_CA is empty — production builds bake a real fleet CA (no placeholder). Set it in the Gitea repo secrets."; miss=1; }
+          [ "$ENABLE_STIG" = "true" ] || { echo "::error::ENABLE_STIG must be 'true' — production builds are hardening-mandatory (POA&M P-03)."; miss=1; }
           [ "$miss" = 0 ] || exit 1
           echo "Production gate passed: SB_KEY, SB_CERT, FLEET_CA present; STIG enabled."
 
diff --git a/.gitea/workflows/ipxe-image.yaml b/.gitea/workflows/ipxe-image.yaml
index 43c4a20..994d6d4 100644
--- a/.gitea/workflows/ipxe-image.yaml
+++ b/.gitea/workflows/ipxe-image.yaml
@@ -114,14 +114,11 @@ jobs:
         env:
           SB_KEY:  ${{ secrets.SB_KEY }}
           SB_CERT: ${{ secrets.SB_CERT }}
+        # POSIX sh (the runner defaults to dash) — no bashisms like ${!v}.
         run: |
           miss=0
-          for v in SB_KEY SB_CERT; do
-            if [ -z "${!v}" ]; then
-              echo "::error::required secret ${v} is empty — the fleet-ipxe bootloader must be signed (no unsigned fallback). Set it in the Gitea repo secrets."
-              miss=1
-            fi
-          done
+          [ -n "$SB_KEY" ]  || { echo "::error::required secret SB_KEY is empty — the fleet-ipxe bootloader must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
+          [ -n "$SB_CERT" ] || { echo "::error::required secret SB_CERT is empty — the fleet-ipxe bootloader must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
           [ "$miss" = 0 ] || exit 1
           echo "Production gate passed: SB_KEY, SB_CERT present."