feat: deploy rybbit for rubykatzen.com through flightdeck itself

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+ .github/workflows/deploy-shared.yml:
+ # actionlint 1.7.12 predates these GitHub job context properties.
+ ignore:
+ - 'property "workflow_(repository|sha)" is not defined in object type'

.github/actions/build-apps-bundle/action.yml

@@ -0,0 +1,31 @@
+name: Build and upload apps bundle
+description: Build an apps/ catalog bundle and upload it as a GitHub Release asset. Thin defaults wrapper around build-bundle.
+inputs:
+ paths:
+ description: Newline-separated paths to include in the bundle.
+ required: false
+ default: apps
+ bundle-name:
+ description: Bundle archive filename.
+ required: false
+ default: flightdeck-apps.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
+outputs:
+ bundle-path:
+ description: Path to the built bundle archive.
+ value: ${{ steps.build.outputs.bundle-path }}
+runs:
+ using: composite
+ steps:
+ - uses: ./.github/actions/build-bundle
+ id: build
+ with:
+ paths: ${{ inputs.paths }}
+ bundle-name: ${{ inputs.bundle-name }}
+ release-tag: ${{ inputs.release-tag }}
+ token: ${{ inputs.token }}

.github/actions/build-bundle/action.yml

@@ -1,13 +1,31 @@
-name: Build app bundle
-description: Build and validate a zip bundle from specified paths.
+name: Build and upload bundle
+description: Build a zip bundle from specified paths and upload it as a GitHub Release asset. Defaults to Flightdeck's own machinery bundle.
 inputs:
  paths:
  description: Newline-separated paths to include in the bundle.
- required: true
+ required: false
+ default: |
+ ansible.cfg
+ .env.example
+ backup.sh
+ deploy.sh
+ down.sh
+ generate-env.sh
+ lib.sh
+ logs.sh
+ restart.sh
+ up.sh
+ README.md
  bundle-name:
  description: Bundle archive filename.
  required: false
- default: bundle.zip
+ default: flightdeck.zip
+ release-tag:
+ description: Release tag to upload the bundle asset to.
+ required: true
+ token:
+ description: Token with permission to upload release assets.
+ required: true
 outputs:
  bundle-path:
  description: Path to the built bundle archive.
@@ -40,3 +58,10 @@ runs:
  exit 1
  fi
  echo "bundle-path=.bundle/$BUNDLE_NAME" >> "$GITHUB_OUTPUT"
+ - name: Upload bundle
+ shell: bash
+ env:
+ GH_TOKEN: ${{ inputs.token }}
+ RELEASE_TAG: ${{ inputs.release-tag }}
+ BUNDLE_PATH: ${{ steps.build.outputs.bundle-path }}
+ run: gh release upload "$RELEASE_TAG" "$BUNDLE_PATH" --clobber

.github/actions/encrypt-env/README.md

@@ -0,0 +1,43 @@
+# encrypt-env
+
+Composite GitHub Action that renders an encryption config from GitHub Secrets/Variables, encrypts it for named age recipients, and uploads `.sops.env` to an existing GitHub Release.
+
+The release must exist before this action runs.
+
+## Usage
+
+```yaml
+- uses: rubykatzen/flightdeck/.github/actions/encrypt-env@main
+ with:
+ manifest: vaults/mainframe.yml # required
+ keys-directory: keys # default: keys
+ release-tag: ${{ needs.release.outputs.tag }} # required, must already exist
+ release-repo: "" # default: current repository
+ token: ${{ secrets.GITHUB_TOKEN }} # required
+ env:
+ GITHUB_SECRETS_JSON: ${{ toJson(secrets) }}
+ GITHUB_VARS_JSON: ${{ toJson(vars) }}
+```
+
+The calling job requires:
+
+```yaml
+permissions:
+ contents: write
+```
+
+## Manifest
+
+```yaml
+asset: mainframe.sops.env
+keys:
+ - mainframe
+apps:
+ - traefik
+ - rybbit
+env:
+ APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
+ APPS_TIMEZONE: APPS_TIMEZONE
+```
+
+The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.

.github/actions/encrypt-env/action.yml

@@ -0,0 +1,108 @@
+name: Encrypt env
+description: Render a target env, encrypt it with SOPS age recipients, and upload it to a GitHub Release.
+inputs:
+ manifest:
+ description: Path to the YAML env manifest.
+ required: true
+ release-repo:
+ description: GitHub repository containing the release. Defaults to the current repository.
+ required: false
+ default: ""
+ release-tag:
+ description: Existing release tag to publish the asset to.
+ required: true
+ keys-directory:
+ description: Directory containing public age recipients named <key>.pub.
+ required: false
+ default: keys
+ token:
+ description: Token with permission to write releases.
+ required: true
+outputs:
+ release-repo:
+ description: GitHub repository used for publication.
+ value: ${{ steps.publish.outputs.release_repo }}
+ tag:
+ description: Release tag used for publication.
+ value: ${{ steps.publish.outputs.tag }}
+ ref:
+ description: Release asset ref in owner/repo@tag:asset format.
+ value: ${{ steps.publish.outputs.ref }}
+runs:
+ using: composite
+ steps:
+ - name: Install dependencies
+ shell: bash
+ env:
+ SOPS_VERSION: "3.13.1"
+ run: |
+ python3 -m pip install --disable-pip-version-check --requirement "$GITHUB_ACTION_PATH/requirements.txt"
+ mkdir -p "$RUNNER_TEMP/encrypt-env/bin"
+ curl --fail --location --silent --show-error \
+ "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+ --output "$RUNNER_TEMP/encrypt-env/bin/sops"
+ chmod +x "$RUNNER_TEMP/encrypt-env/bin/sops"
+ echo "$RUNNER_TEMP/encrypt-env/bin" >> "$GITHUB_PATH"
+ - name: Render env
+ id: render
+ shell: bash
+ env:
+ MANIFEST: ${{ inputs.manifest }}
+ run: |
+ mkdir -p "$RUNNER_TEMP/encrypt-env"
+ python3 "$GITHUB_ACTION_PATH/scripts/render-env.py" \
+ --manifest "$MANIFEST" \
+ --output "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Resolve release target
+ id: target
+ shell: bash
+ env:
+ INPUT_RELEASE_REPO: ${{ inputs.release-repo }}
+ DEFAULT_RELEASE_REPO: ${{ github.repository }}
+ ASSET_NAME: ${{ steps.render.outputs.asset }}
+ run: |
+ release_repo="${INPUT_RELEASE_REPO:-$DEFAULT_RELEASE_REPO}"
+ echo "release_repo=$release_repo" >> "$GITHUB_OUTPUT"
+ echo "asset_name=$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Encrypt env
+ shell: bash
+ env:
+ KEYS: ${{ steps.render.outputs.keys }}
+ KEYS_DIRECTORY: ${{ inputs.keys-directory }}
+ run: |
+ recipients=""
+ IFS=',' read -ra names <<< "$KEYS"
+ for name in "${names[@]}"; do
+ recipient="$(tr -d '[:space:]' < "$KEYS_DIRECTORY/${name}.pub")"
+ if [[ ! "$recipient" =~ ^age1 ]]; then
+ echo "Invalid age recipient: $KEYS_DIRECTORY/${name}.pub" >&2
+ exit 1
+ fi
+ recipients="${recipients:+$recipients,}$recipient"
+ done
+ SOPS_AGE_RECIPIENTS="$recipients" sops encrypt \
+ --input-type dotenv \
+ --output-type dotenv \
+ "$RUNNER_TEMP/encrypt-env/plain.env" \
+ > "$RUNNER_TEMP/encrypt-env/.sops.env"
+ rm "$RUNNER_TEMP/encrypt-env/plain.env"
+ - name: Upload encrypted env
+ id: publish
+ shell: bash
+ env:
+ RELEASE_REPO: ${{ steps.target.outputs.release_repo }}
+ TAG: ${{ inputs.release-tag }}
+ ASSET_NAME: ${{ steps.target.outputs.asset_name }}
+ GH_TOKEN: ${{ inputs.token }}
+ run: |
+ set -euo pipefail
+ asset_path="$RUNNER_TEMP/encrypt-env/$ASSET_NAME"
+ cp "$RUNNER_TEMP/encrypt-env/.sops.env" "$asset_path"
+ gh release upload "$TAG" "$asset_path" --repo "$RELEASE_REPO" --clobber
+ echo "release_repo=$RELEASE_REPO" >> "$GITHUB_OUTPUT"
+ echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+ echo "ref=$RELEASE_REPO@$TAG:$ASSET_NAME" >> "$GITHUB_OUTPUT"
+ - name: Cleanup
+ if: always()
+ shell: bash
+ run: rm -rf "$RUNNER_TEMP/encrypt-env"

.github/actions/publish-sops-env/scripts/render-env.py → .github/actions/encrypt-env/scripts/render-env.py

@@ -12,9 +12,8 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-RELEASE_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-RELEASE_TAG_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-RELEASE_ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
+APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
 class ManifestError(Exception):
@@ -59,32 +58,31 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- if "package" in manifest:
- raise ManifestError("package has been replaced by release-repo/release-tag GitHub Releases configuration")
- release_repo = manifest.get("release_repo")
- release_tag = manifest.get("release_tag")
- release_asset = manifest.get("release_asset", f"{path.stem}.sops.env")
+ unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ if unknown:
+ raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
+ asset = manifest.get("asset")
  keys = manifest.get("keys")
+ apps = manifest.get("apps")
  env = manifest.get("env")
- if "raw_env" in manifest:
- raise ManifestError("raw_env is no longer supported; store values as data, not shell syntax")
- if release_repo is not None and (
- not isinstance(release_repo, str) or not RELEASE_REPO_RE.fullmatch(release_repo)
- ):
- raise ManifestError("release_repo must be in owner/repo format")
- if release_tag is not None and (
- not isinstance(release_tag, str) or not RELEASE_TAG_RE.fullmatch(release_tag)
- ):
- raise ManifestError("release_tag must contain only letters, numbers, dots, underscores, or hyphens")
- if not isinstance(release_asset, str) or not RELEASE_ASSET_RE.fullmatch(release_asset):
- raise ManifestError("release_asset must be named like server.sops.env")
+ if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
+ raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
+ if not isinstance(apps, list) or not apps:
+ raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
+ for app in apps:
+ if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
+ raise ManifestError(f"invalid app name: {app!r}")
+ if len(apps) != len(set(apps)):
+ raise ManifestError("apps contains duplicate app names")
+ if "APPS" in env:
+ raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -113,7 +111,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = []
+ lines = [f"APPS={','.join(manifest['apps'])}"]
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)
@@ -148,9 +146,7 @@ def main(argv=None):
  args.output.chmod(0o600)
  write_github_outputs(
  {
- "release_repo": manifest.get("release_repo", ""),
- "release_tag": manifest.get("release_tag", ""),
- "release_asset": manifest.get("release_asset", f"{args.manifest.stem}.sops.env"),
+ "asset": manifest["asset"],
  "keys": ",".join(manifest["keys"]),
  }
  )