sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix pipeline use of bash

Browse Source
This commit is contained in:
Audiobuzz
2026-07-11 16:24:07 +09:30
parent 2e318fba00
commit 8325818c1b
2 changed files with 8 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/gitea-main-ci.yaml
+5 -10
View File
@@ -167,18 +167,13 @@ jobs:
SB_KEY: ${{ secrets.SB_KEY }} SB_KEY: ${{ secrets.SB_KEY }}
SB_CERT: ${{ secrets.SB_CERT }} SB_CERT: ${{ secrets.SB_CERT }}
FLEET_CA: ${{ secrets.FLEET_CA }} FLEET_CA: ${{ secrets.FLEET_CA }}
# POSIX sh (the runner defaults to dash) — no bashisms like ${!v}.
run: | run: |
miss=0 miss=0
for v in SB_KEY SB_CERT FLEET_CA; do [ -n "$SB_KEY" ] || { echo "::error::required secret SB_KEY is empty — production builds must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
if [ -z "${!v}" ]; then [ -n "$SB_CERT" ] || { echo "::error::required secret SB_CERT is empty — production builds must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
echo "::error::required secret ${v} is empty — production builds are signed with a real fleet CA (no fallback). Set it in the Gitea repo secrets." [ -n "$FLEET_CA" ] || { echo "::error::required secret FLEET_CA is empty — production builds bake a real fleet CA (no placeholder). Set it in the Gitea repo secrets."; miss=1; }
miss=1 [ "$ENABLE_STIG" = "true" ] || { echo "::error::ENABLE_STIG must be 'true' — production builds are hardening-mandatory (POA&M P-03)."; miss=1; }
fi
done
if [ "${ENABLE_STIG}" != "true" ]; then
echo "::error::ENABLE_STIG must be 'true' — production builds are hardening-mandatory (POA&M P-03)."
miss=1
fi
[ "$miss" = 0 ] || exit 1 [ "$miss" = 0 ] || exit 1
echo "Production gate passed: SB_KEY, SB_CERT, FLEET_CA present; STIG enabled." echo "Production gate passed: SB_KEY, SB_CERT, FLEET_CA present; STIG enabled."
.gitea/workflows/ipxe-image.yaml
+3 -6
View File
@@ -114,14 +114,11 @@ jobs:
env: env:
SB_KEY: ${{ secrets.SB_KEY }} SB_KEY: ${{ secrets.SB_KEY }}
SB_CERT: ${{ secrets.SB_CERT }} SB_CERT: ${{ secrets.SB_CERT }}
# POSIX sh (the runner defaults to dash) — no bashisms like ${!v}.
run: | run: |
miss=0 miss=0
for v in SB_KEY SB_CERT; do [ -n "$SB_KEY" ] || { echo "::error::required secret SB_KEY is empty — the fleet-ipxe bootloader must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
if [ -z "${!v}" ]; then [ -n "$SB_CERT" ] || { echo "::error::required secret SB_CERT is empty — the fleet-ipxe bootloader must be signed (no unsigned fallback). Set it in the Gitea repo secrets."; miss=1; }
echo "::error::required secret ${v} is empty — the fleet-ipxe bootloader must be signed (no unsigned fallback). Set it in the Gitea repo secrets."
miss=1
fi
done
[ "$miss" = 0 ] || exit 1 [ "$miss" = 0 ] || exit 1
echo "Production gate passed: SB_KEY, SB_CERT present." echo "Production gate passed: SB_KEY, SB_CERT present."