fix pipeline use of bash

2026-07-11 16:24:07 +09:30
parent 2e318fba00
commit 8325818c1b
2 changed files with 8 additions and 16 deletions
@@ -167,18 +167,13 @@ jobs:
          SB_KEY:   ${{ secrets.SB_KEY }}
          SB_CERT:  ${{ secrets.SB_CERT }}
          FLEET_CA: ${{ secrets.FLEET_CA }}
+        # POSIX sh (the runner defaults to dash) — no bashisms like ${!v}.
        run: |
          miss=0
-          for v in SB_KEY SB_CERT FLEET_CA; do
-            if [ -z "${!v}" ]; then
-              echo "::error::required secret ${v} is empty — production builds are signed with a real fleet CA (no fallback). Set it in the Gitea repo secrets."
-              miss=1
-            fi
-          done
-          if [ "${ENABLE_STIG}" != "true" ]; then
-            echo "::error::ENABLE_STIG must be 'true' — production builds are hardening-mandatory (POA&M P-03)."
-            miss=1
-          fi
+          [ -n "$SB_KEY" ]   || { echo "::error::required secret SB_KEY is empty — production builds must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
+          [ -n "$SB_CERT" ]  || { echo "::error::required secret SB_CERT is empty — production builds must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
+          [ -n "$FLEET_CA" ] || { echo "::error::required secret FLEET_CA is empty — production builds bake a real fleet CA (no placeholder). Set it in the Gitea repo secrets."; miss=1; }
+          [ "$ENABLE_STIG" = "true" ] || { echo "::error::ENABLE_STIG must be 'true' — production builds are hardening-mandatory (POA&M P-03)."; miss=1; }
          [ "$miss" = 0 ] || exit 1
          echo "Production gate passed: SB_KEY, SB_CERT, FLEET_CA present; STIG enabled."