77 lines
3.3 KiB
Bash
77 lines
3.3 KiB
Bash
#!/bin/bash
|
||
# ═══════════════════════════════════════════════════════════
|
||
# 光湖语言系统 · 推送守门人部署脚本
|
||
# 目标仓库必须由服务器会话显式传入；禁止把旧广州路径当作默认值。
|
||
#
|
||
# 用法: bash deploy-pre-receive.sh <repo-hooks-dir> [reject|notify]
|
||
# reject = 拦截含敏感信息的推送（推荐）
|
||
# notify = 放行但发邮件通知冰朔
|
||
# ═══════════════════════════════════════════════════════════
|
||
|
||
set -e
|
||
|
||
FORGEJO_HOOK_DIR="${1:-}"
|
||
MODE="${2:-reject}"
|
||
SCRIPT_NAME="pre-receive-guard.py"
|
||
HOOK_NAME="pre-receive"
|
||
|
||
if [ -z "${FORGEJO_HOOK_DIR}" ]; then
|
||
echo "❌ 必须传入当前 Forgejo 裸仓库的 hooks 目录。"
|
||
echo " 例：bash deploy-pre-receive.sh /实际路径/bingshuo/fifth-domain.git/hooks reject"
|
||
exit 2
|
||
fi
|
||
|
||
if [ ! -d "${FORGEJO_HOOK_DIR}" ]; then
|
||
echo "❌ 目标 hooks 目录不存在：${FORGEJO_HOOK_DIR}"
|
||
echo " 停止部署；请先通过 GLSV 会话核对当前仓库物理路径。"
|
||
exit 2
|
||
fi
|
||
|
||
echo "🛡️ 光湖推送守门人 · 部署"
|
||
echo " 模式: ${MODE}"
|
||
echo " 目标 hooks: ${FORGEJO_HOOK_DIR}"
|
||
echo ""
|
||
|
||
# 1. 不悄悄覆盖既有仓库门禁。
|
||
if [ -f "${FORGEJO_HOOK_DIR}/${HOOK_NAME}" ] && ! grep -q "光湖推送守门人 · Forgejo pre-receive 钩子包装器" "${FORGEJO_HOOK_DIR}/${HOOK_NAME}"; then
|
||
echo "❌ 检测到已有 pre-receive Hook，未覆盖。"
|
||
echo " 先读取并整合既有规则，再以带回滚方案的专门部署动作替换。"
|
||
exit 3
|
||
fi
|
||
|
||
# 2. 复制服务器守门人及其导航依赖
|
||
cp pre-receive-guard.py "${FORGEJO_HOOK_DIR}/${SCRIPT_NAME}"
|
||
chmod +x "${FORGEJO_HOOK_DIR}/${SCRIPT_NAME}"
|
||
cp navigation-memory-guard.py "${FORGEJO_HOOK_DIR}/navigation-memory-guard.py"
|
||
chmod +x "${FORGEJO_HOOK_DIR}/navigation-memory-guard.py"
|
||
|
||
# 3. 创建钩子包装器（Forgejo 调用这个脚本 → 内部调 Python）。
|
||
cat > "${FORGEJO_HOOK_DIR}/${HOOK_NAME}" << 'WRAPPER'
|
||
#!/bin/bash
|
||
# 光湖推送守门人 · Forgejo pre-receive 钩子包装器
|
||
export PRE_RECEIVE_MODE="${PRE_RECEIVE_MODE:-reject}"
|
||
export FORGEJO_REPO="${FORGEJO_REPO:-unknown}"
|
||
export FORGEJO_PUSHER="${FORGEJO_PUSHER:-unknown}"
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||
exec python3 "${SCRIPT_DIR}/pre-receive-guard.py"
|
||
WRAPPER
|
||
chmod +x "${FORGEJO_HOOK_DIR}/${HOOK_NAME}"
|
||
|
||
# 4. 验证部署
|
||
echo ""
|
||
echo "✅ 部署完成"
|
||
echo ""
|
||
echo " 钩子位置: ${FORGEJO_HOOK_DIR}/${HOOK_NAME}"
|
||
echo " 审计脚本: ${FORGEJO_HOOK_DIR}/${SCRIPT_NAME}"
|
||
echo ""
|
||
echo "📋 下一步（在当前 GLSV 工作会话中执行）:"
|
||
echo " # 先读取现有 Hook；如存在旧规则，先做合并、备份和回滚计划。"
|
||
echo ""
|
||
echo " # 测试推送（在本地 clone 里试推一个含密码的文件）:"
|
||
echo " echo 'password=test123' > test_sensitive.txt"
|
||
echo " git add test_sensitive.txt && git commit -m 'test' && git push"
|
||
echo " # 应该看到: 🛡️ 光湖推送守门人 · 检测到敏感信息 · 推送被拦截"
|
||
echo ""
|
||
echo "⊢ 钩子路径必须从服务器实时探测得出，旧资料只用于恢复架构，不直接覆盖现实状态。"
|