Marc Mintel
c113c27743
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 42s
Build & Deploy / 🧪 QA (push) Successful in 1m32s
Build & Deploy / 🚀 Deploy (push) Has been cancelled
Build & Deploy / 🧪 Post-Deploy Verification (push) Has been cancelled
Build & Deploy / 🔔 Notify (push) Has been cancelled
Build & Deploy / 🏗️ Build (push) Has been cancelled
111 lines
3.9 KiB
Bash
Executable File
111 lines
3.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
# --- CONFIGURATION ---
|
|
# The registry domain and base path for @mintel packages
|
|
DOMAINS=("git.infra.mintel.me" "registry.infra.mintel.me")
|
|
REGISTRY_PATH="/api/packages/mmintel/npm"
|
|
# Package used for functional connectivity test (URL encoded)
|
|
TEST_PACKAGE_ENCODED="%40mintel%2Fmail"
|
|
|
|
echo "🚀 Starting Hardened Registry Authentication Discovery..."
|
|
|
|
# --- TOKEN DISCOVERY ---
|
|
# We try various candidate secrets. Gitea environment might have different names.
|
|
CANDIDATES=(
|
|
"NPM_TOKEN"
|
|
"GITEA_PAT"
|
|
"MINTEL_PRIVATE_TOKEN"
|
|
"MINTEL_REGISTRY_TOKEN"
|
|
"GITHUB_TOKEN"
|
|
"GITEA_TOKEN"
|
|
)
|
|
|
|
WORKING_TOKEN=""
|
|
WORKING_DOMAIN=""
|
|
|
|
for DOMAIN in "${DOMAINS[@]}"; do
|
|
echo "🔍 Testing connectivity to ${DOMAIN}..."
|
|
|
|
for VAR_NAME in "${CANDIDATES[@]}"; do
|
|
TOKEN_VAL="${!VAR_NAME}"
|
|
[ -z "${TOKEN_VAL}" ] && continue
|
|
|
|
echo " Testing ${VAR_NAME} (len: ${#TOKEN_VAL})..."
|
|
|
|
# Method 1: Bearer
|
|
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${TOKEN_VAL}" "https://${DOMAIN}${REGISTRY_PATH}/${TEST_PACKAGE_ENCODED}" || echo "000")
|
|
if [ "$STATUS" == "200" ]; then
|
|
echo " ✅ ${VAR_NAME} verified via Bearer on ${DOMAIN}"
|
|
WORKING_TOKEN="${TOKEN_VAL}"
|
|
WORKING_DOMAIN="${DOMAIN}"
|
|
break 2
|
|
fi
|
|
|
|
# Method 2: Basic (Token as user, empty password)
|
|
AUTH_BASIC=$(echo -n "${TOKEN_VAL}:" | base64)
|
|
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Basic ${AUTH_BASIC}" "https://${DOMAIN}${REGISTRY_PATH}/${TEST_PACKAGE_ENCODED}" || echo "000")
|
|
if [ "$STATUS" == "200" ]; then
|
|
echo " ✅ ${VAR_NAME} verified via Basic on ${DOMAIN}"
|
|
WORKING_TOKEN="${TOKEN_VAL}"
|
|
WORKING_DOMAIN="${DOMAIN}"
|
|
break 2
|
|
fi
|
|
|
|
# Method 3: Basic (User 'token', Token as password - Gitea standard)
|
|
AUTH_GITEA=$(echo -n "token:${TOKEN_VAL}" | base64)
|
|
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Basic ${AUTH_GITEA}" "https://${DOMAIN}${REGISTRY_PATH}/${TEST_PACKAGE_ENCODED}" || echo "000")
|
|
if [ "$STATUS" == "200" ]; then
|
|
echo " ✅ ${VAR_NAME} verified via Gitea-Token-Basic on ${DOMAIN}"
|
|
WORKING_TOKEN="${TOKEN_VAL}"
|
|
WORKING_DOMAIN="${DOMAIN}"
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
if [ -z "${WORKING_TOKEN}" ]; then
|
|
echo "⚠️ ALL functional tests failed for all domains."
|
|
if [ -n "${NPM_TOKEN}" ]; then
|
|
echo "Falling back to NPM_TOKEN (unverified) and git.infra.mintel.me"
|
|
WORKING_TOKEN="${NPM_TOKEN}"
|
|
WORKING_DOMAIN="git.infra.mintel.me"
|
|
else
|
|
echo "❌ CRITICAL: No usable token found and NPM_TOKEN is empty."
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# --- .npmrc GENERATION ---
|
|
# We generate a .npmrc that matches the local pattern exactly to avoid resolution drift.
|
|
# Local pattern:
|
|
# @mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm
|
|
# //git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${TOKEN}
|
|
|
|
cat > .npmrc << EOF
|
|
@mintel:registry=https://${WORKING_DOMAIN}${REGISTRY_PATH}
|
|
//${WORKING_DOMAIN}${REGISTRY_PATH}/:_authToken=${WORKING_TOKEN}
|
|
//${WORKING_DOMAIN}${REGISTRY_PATH}/:always-auth=true
|
|
EOF
|
|
|
|
# Add secondary domain if we found one working
|
|
for DOMAIN in "${DOMAINS[@]}"; do
|
|
if [ "${DOMAIN}" != "${WORKING_DOMAIN}" ]; then
|
|
cat >> .npmrc << EOF
|
|
//${DOMAIN}${REGISTRY_PATH}/:_authToken=${WORKING_TOKEN}
|
|
//${DOMAIN}${REGISTRY_PATH}/:always-auth=true
|
|
EOF
|
|
fi
|
|
done
|
|
|
|
echo "✅ .npmrc hardened with verified token on ${WORKING_DOMAIN}."
|
|
echo "--- Generated .npmrc (masked) ---"
|
|
sed 's/_authToken=.*/_authToken=********/' .npmrc
|
|
echo "--------------------------------"
|
|
|
|
# --- OUTPUT FOR CI ---
|
|
if [ -n "$GITHUB_OUTPUT" ]; then
|
|
echo "working_token=${WORKING_TOKEN}" >> "$GITHUB_OUTPUT"
|
|
echo "working_domain=${WORKING_DOMAIN}" >> "$GITHUB_OUTPUT"
|
|
fi
|