Nicolas Cantu
02f822c790
**Motivations :** - keep deploy-by-script-to strict when source-of-truth site slugs are unavailable - align ia_dev deploy wrappers with lecoffreio-only deployment model - avoid hidden default behavior in secrets layout validation **Root causes :** - deploy-by-script-to still had a fallback that reintroduced implicit site assumptions - helper comments and branch-align wording still referenced removed multisite lines **Correctifs :** - remove fallback site injection in deploy-by-script-to and fail explicitly on empty site list - update change-to-all-branches orchestration comment to source-of-truth semantics - align deploy-conf-handling nested secrets guidance with lecoffreio-only tree **Evolutions :** - strengthen strict mode behavior for deployment prerequisites **Page affectées :** - deploy/deploy-by-script-to.sh - deploy/change-to-all-branches.sh - deploy/lib/deploy-conf-handling.sh
70 lines
2.8 KiB
Bash
70 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# ia_dev — conf.json handling identical for every managed project (jq, secrets_path → SECRETS_BASE).
|
|
# Add here any new deploy.* field that must be read the same way for all projects.
|
|
# Do not put project-specific paths, hostnames, or phase ordering here beyond generic keys.
|
|
|
|
_DEPLOY_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=../../lib/conf_path_resolve.sh
|
|
source "${_DEPLOY_LIB_DIR}/../../lib/conf_path_resolve.sh"
|
|
|
|
# ia_dev_deploy_require_jq <log_tag> — exit 1 if jq missing (e.g. log_tag="[orchestrator]")
|
|
ia_dev_deploy_require_jq() {
|
|
local tag="${1:-[ia_dev][deploy]}"
|
|
if ! command -v jq >/dev/null 2>&1; then
|
|
echo "${tag}[ERROR] jq is required to read deploy.* from conf.json" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# ia_dev_deploy_secrets_export_from_conf <conf_path> — export SECRETS_BASE + LECOFFRE_SECRETS_BASE when deploy.secrets_path is a directory
|
|
ia_dev_deploy_secrets_export_from_conf() {
|
|
local conf="${1:?}"
|
|
local secrets_path
|
|
secrets_path="$(jq -r '.deploy.secrets_path // empty' "$conf")"
|
|
secrets_path="$(ia_dev_resolve_path_from_conf "$conf" "$secrets_path")"
|
|
if [[ -n "$secrets_path" && "$secrets_path" != "null" && -d "$secrets_path" ]]; then
|
|
export SECRETS_BASE="$secrets_path"
|
|
export LECOFFRE_SECRETS_BASE="$secrets_path"
|
|
fi
|
|
}
|
|
|
|
# ia_dev_deploy_ensure_nested_secrets_symlinks <secrets_parent> <env>
|
|
# Intentionally a no-op: nested `.secrets/<site>/<env>/` must be **real directories** (no symlinks —
|
|
# low maintainability, breaks tooling expectations). Maintain `lecoffreio/<env>/`
|
|
# as normal folders; use `deploy/scripts_v2/materialize-nested-secrets-mandatory.mjs` on the LeCoffre
|
|
# clone or copy from a canonical tree.
|
|
ia_dev_deploy_ensure_nested_secrets_symlinks() {
|
|
return 0
|
|
}
|
|
|
|
# ia_dev_deploy_export_runtime_context <repository_root> <env> — required handoff to project orchestrator (blocking checks below)
|
|
ia_dev_deploy_export_runtime_context() {
|
|
local repo="${1:?}"
|
|
local env="${2:?}"
|
|
export IA_DEV_DEPLOY_REPO_ROOT="$repo"
|
|
export IA_DEV_DEPLOY_ENV="$env"
|
|
}
|
|
|
|
# ia_dev_deploy_assert_handoff_context <repository_root> <env> <log_tag> — exit 1 if exports missing or inconsistent (no fallback)
|
|
ia_dev_deploy_assert_handoff_context() {
|
|
local repo="${1:?}"
|
|
local env="${2:?}"
|
|
local tag="${3:-[orchestrator]}"
|
|
if [[ -z "$repo" || ! -d "$repo" ]]; then
|
|
echo "${tag}[ERROR] Handoff: repository root invalid or not a directory: ${repo}" >&2
|
|
exit 1
|
|
fi
|
|
if [[ -z "$env" ]]; then
|
|
echo "${tag}[ERROR] Handoff: env is empty" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "${IA_DEV_DEPLOY_REPO_ROOT:-}" != "$repo" ]]; then
|
|
echo "${tag}[ERROR] Handoff: IA_DEV_DEPLOY_REPO_ROOT mismatch or unset (expected ${repo})" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "${IA_DEV_DEPLOY_ENV:-}" != "$env" ]]; then
|
|
echo "${tag}[ERROR] Handoff: IA_DEV_DEPLOY_ENV mismatch or unset (expected ${env}, got ${IA_DEV_DEPLOY_ENV:-})" >&2
|
|
exit 1
|
|
fi
|
|
}
|