Marc Mintel
6466bc4090
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 41s
Build & Deploy / 🧪 QA (push) Failing after 1m0s
Build & Deploy / 🏗️ Build (push) Has been skipped
Build & Deploy / 🚀 Deploy (push) Has been skipped
Build & Deploy / 🧪 Post-Deploy Verification (push) Has been skipped
Build & Deploy / 🔔 Notify (push) Successful in 1s
54 lines
1.7 KiB
Bash
Executable File
54 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Robust Registry Authentication Script
|
|
# Following Mintel CI/CD Hardening Standards
|
|
|
|
# 1. Discovery
|
|
TOKENS="${NPM_TOKEN} ${GITEA_PAT} ${MINTEL_PRIVATE_TOKEN}"
|
|
|
|
VALID_TOKEN=""
|
|
|
|
echo "🔍 Starting functional registry discovery..."
|
|
|
|
for T in $TOKENS; do
|
|
[ -z "$T" ] && continue
|
|
|
|
T_START="${T:0:4}"
|
|
T_END="${T: -4}"
|
|
echo "Testing token starting with '$T_START...' and ending with '...$T_END'"
|
|
|
|
# Use Gitea API to verify token
|
|
# We use -k (insecure) if needed, but infra.mintel.me should have valid certs
|
|
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $T" "https://git.infra.mintel.me/api/v1/user" || echo "500")
|
|
|
|
if [ "$STATUS" == "200" ]; then
|
|
VALID_TOKEN="$T"
|
|
echo "✅ Token verified via API"
|
|
break
|
|
else
|
|
echo "❌ Token rejected by API (Status: $STATUS)"
|
|
fi
|
|
done
|
|
|
|
# Fallback: If API verification failed, try to use NPM_TOKEN if provided
|
|
if [ -z "$VALID_TOKEN" ] && [ -n "$NPM_TOKEN" ]; then
|
|
echo "⚠️ API verification failed, falling back to provided NPM_TOKEN"
|
|
VALID_TOKEN="$NPM_TOKEN"
|
|
fi
|
|
|
|
if [ -z "$VALID_TOKEN" ]; then
|
|
echo "❌ CRITICAL: No valid registry token found in environment."
|
|
exit 1
|
|
fi
|
|
|
|
# 2. Hardened .npmrc Generation
|
|
# Trailing slashes are CRITICAL for pnpm registry matching
|
|
cat << EOF > .npmrc
|
|
@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm/
|
|
//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
|
|
//git.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
|
|
//registry.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
|
|
//registry.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
|
|
EOF
|
|
|
|
echo "✅ .npmrc hardened and generated."
|