halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(release): the Forgejo token from Proton Pass as well
All checks were successful
CI / check (push) Successful in 40m37s
Details
CI / deploy (push) Successful in 56s
Details

Browse source 
tool/with_signing_keys.sh reads the token releases publish with from its
login in the vault Infra and hands it over as HALKYON_FORGEJO_TOKEN, but
for a dry run, so a release asks for no secret at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-31 21:53:08 +01:00
commit 90edf2ec84
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 22 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tool/with_signing_keys.sh
View file

@ -5,7 +5,8 @@
# tmpfs only the own user reads), handed to the release tool by the variables it reads
# their paths from, and removed however the run ends. Their passwords, each item's hidden
# field "Password", go to it in its environment (<keystore variable>_PASSWORD), so it
# asks for none; a dry run asks for no secret, and gets none.
# asks for none, nor for the Forgejo token, a login's password in the vault Infra
# (HALKYON_FORGEJO_TOKEN); a dry run asks for no secret, and gets none.
#
# tool/with_signing_keys.sh <app> [release.dart's arguments]
# tool/with_signing_keys.sh train minor --dry-run
@ -36,6 +37,10 @@ case "$app" in
esac
# The F-Droid repository's index key, the same for every app listed there.
readonly fdroid_item='Halkyon Learn – F-Droid index keystore'
# The Forgejo token releases publish with (write:repository), a login's password in
# the vault Infra (its folder API Tokens), made for this laptop.
readonly token_vault='Infra'
readonly token_item='Forgejo Token halkyon_learn release signing script (melchior)'
for tool in pass-cli jq; do
command -v "$tool" >/dev/null || fail "$tool is missing."
@ -73,6 +78,16 @@ password() {
printf '%s' "$value"
}
# The Forgejo token: the password of the login $token_item in $token_vault.
forgejo_token() {
local value
value=$(pass-cli item view --vault-name "$token_vault" --item-title "$token_item" --output json |
jq -r '.item.content.content.Login.password // empty') ||
fail "Can't read the item \"$token_item\" in $token_vault (pass-cli login?)."
[ -n "$value" ] || fail "The item \"$token_item\" in $token_vault has no password."
printf '%s' "$value"
}
echo "▸ Fetching the signing keys from $vault"
fetch "$app_item" android-release.p12 "$keys/android-release.p12"
fetch "$fdroid_item" fdroid-index.p12 "$keys/fdroid-index.p12"
@ -88,7 +103,9 @@ if ! $dry_run; then
fdroid_password=$(password "$fdroid_item")
export "${app_variable}_PASSWORD=$app_password"
export HALKYON_FDROID_KEYSTORE_PASSWORD="$fdroid_password"
unset app_password fdroid_password
token=$(forgejo_token)
export HALKYON_FORGEJO_TOKEN="$token"
unset app_password fdroid_password token
fi
status=0
dart run tool/release.dart "$app" "$@" || status=$?