Sothis/snglpi
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX: Secret ENV_PRODUCTION colado direto no script bash quebrava com $ dentro do conteudo

Browse Source 
${{ secrets.ENV_PRODUCTION }} usado direto dentro de um run: substitui o texto
antes do bash rodar - qualquer '$algo' dentro do conteudo do .env.production
(por exemplo em senhas) era interpretado como expansao de variavel de shell.
Com set -u ligado isso quebrou o step "Check required secrets" (variavel nao
definida = erro fatal). Sem set -u, o step "Write .env.production from
secret" teria o mesmo problema de forma silenciosa: qualquer '$algo' dentro
das credenciais reais seria substituido por vazio no arquivo escrito na VM,
corrompendo senha sem nenhum aviso.

Corrige passando o secret via env: e referenciando como variavel de ambiente
normal ($ENV_PRODUCTION) nos dois steps - bash trata o valor como dado opaco,
sem tentar expandir nada dentro dele.
This commit is contained in:
Rafael Alves Lopes 2026-07-15 14:01:49 -03:00
parent cefeb3ea25
commit e838081aae
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.gitea/workflows/deploy-production.yml
View File

@ -29,9 +29,11 @@ jobs:
- name: Check required secrets - name: Check required secrets
shell: bash shell: bash
env:
ENV_PRODUCTION: ${{ secrets.ENV_PRODUCTION }}
run: | run: |
set -euo pipefail set -euo pipefail
if [ -z "${{ secrets.ENV_PRODUCTION }}" ]; then if [ -z "${ENV_PRODUCTION:-}" ]; then
echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying." echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
exit 1 exit 1
fi fi
@ -44,11 +46,13 @@ jobs:
- name: Write .env.production from secret - name: Write .env.production from secret
shell: bash shell: bash
env:
ENV_PRODUCTION: ${{ secrets.ENV_PRODUCTION }}
run: | run: |
set -euo pipefail set -euo pipefail
DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}" DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
mkdir -p "$DEPLOY_PATH" mkdir -p "$DEPLOY_PATH"
printf '%s\n' "${{ secrets.ENV_PRODUCTION }}" > "$DEPLOY_PATH/.env.production" printf '%s\n' "$ENV_PRODUCTION" > "$DEPLOY_PATH/.env.production"
chmod 600 "$DEPLOY_PATH/.env.production" chmod 600 "$DEPLOY_PATH/.env.production"
- name: Deploy files and restart PM2 - name: Deploy files and restart PM2