fix(deploy): validate and repair shared environment

2026-09-02 00:58:20 +02:00
parent de85492373
commit 7d641edc7b
2 changed files with 15 additions and 2 deletions
@@ -331,6 +331,12 @@ jobs:
              echo "MAINTENANCE_GITEA_TOKEN is not configured as a repository Actions secret."
              exit 1
            fi
+            case "$MAINTENANCE_GITEA_TOKEN" in
+              *[!A-Za-z0-9_-]*)
+                echo "MAINTENANCE_GITEA_TOKEN must be a single token value, not a pasted dotenv block."
+                exit 1
+                ;;
+            esac
            shared_env=/opt/job-tracker/shared/.env
            if [ ! -f "$shared_env" ]; then
              echo "Expected deployment environment at $shared_env."
@@ -338,9 +344,13 @@ jobs:
            fi
            env_tmp="$(mktemp)"
            trap 'rm -f "$env_tmp"' EXIT
-            grep -v '^MAINTENANCE_GITEA_TOKEN=' "$shared_env" > "$env_tmp"
+            grep -Ev '^MAINTENANCE_GITEA_TOKEN=|^```(dotenv)?[[:space:]]*$' "$shared_env" > "$env_tmp"
            printf 'MAINTENANCE_GITEA_TOKEN=%s\n' "$MAINTENANCE_GITEA_TOKEN" >> "$env_tmp"
            chmod --reference="$shared_env" "$env_tmp"
+            if ! docker compose --env-file "$env_tmp" -f docker-compose.yml config --quiet; then
+              echo "Refusing to replace the shared deployment environment because it is invalid."
+              exit 1
+            fi
            cat "$env_tmp" > "$shared_env"
            rm -f "$env_tmp"
            trap - EXIT