71 lines
1.7 KiB
YAML
71 lines
1.7 KiB
YAML
---BEGIN WORKFLOW---
|
|
ame: AzerothAI Validated Patch
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
patch_file:
|
|
description: Patch file under ops/patches/
|
|
required: true
|
|
|
|
jobs:
|
|
patch:
|
|
runs-on: azerothai-host
|
|
timeout-minutes: 10
|
|
|
|
env:
|
|
PATCH_FILE: ${{ inputs.patch_file }}
|
|
AZEROTH_ACTOR: ${{ gitea.actor }}
|
|
AZEROTH_REPOSITORY: ${{ gitea.repository }}
|
|
|
|
steps:
|
|
- name: Verify authorized request
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
[ "$AZEROTH_ACTOR" = "richard" ] || {
|
|
echo "Unauthorized actor: $AZEROTH_ACTOR"
|
|
exit 1
|
|
}
|
|
|
|
[ "$AZEROTH_REPOSITORY" = "richard/AzerothAI" ] || {
|
|
echo "Wrong repository: $AZEROTH_REPOSITORY"
|
|
exit 1
|
|
}
|
|
|
|
base="${PATCH_FILE#ops/patches/}"
|
|
|
|
[ "$base" != "$PATCH_FILE" ] || {
|
|
echo "Patch must be under ops/patches/"
|
|
exit 1
|
|
}
|
|
|
|
[[ "$base" != */* ]] || {
|
|
echo "Nested patch paths are not allowed"
|
|
exit 1
|
|
}
|
|
|
|
[[ "$base" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*\.patch$ ]] || {
|
|
echo "Invalid patch filename"
|
|
exit 1
|
|
}
|
|
|
|
- name: Check out patch source
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Apply validated patch
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
[ -f "$PATCH_FILE" ] || {
|
|
echo "Patch file not found: $PATCH_FILE"
|
|
exit 1
|
|
}
|
|
|
|
sha="$(sha256sum "$PATCH_FILE" | awk '{print $1}')"
|
|
payload="$(base64 -w0 "$PATCH_FILE")"
|
|
|
|
sudo -n /usr/local/bin/azerothai-ops "apply-patch:${sha}:${payload}"
|
|
---END WORKFLOW--- |