9c0e2d1d95
- Secrets are never exposed in plaintext in the Cue tree. `dagger query` won't dump secrets anymore, Cue errors won't contain them either. - BuildKit-native secrets support through a new `mount` type. This ensures secrets will never be part of containerd layers, buildkit cache and generally speaking will never be saved to disk in plaintext. - Updated netlify as an example - Added tests - Changed the Cue definition of a secret to: ``` @dagger(secret) id: string } ``` This is to ensure both that setting the wrong input type on a secret (e.g. `dagger input text`) will fail, and attempting to misuse the secret (e.g. interpolating, passing as an env variable, etc) will also fail properly. Signed-off-by: Andrea Luzzardi <aluzzardi@gmail.com>
53 lines
1.5 KiB
CUE
53 lines
1.5 KiB
CUE
package netlify
|
|
|
|
#Site: ctr: command: #"""
|
|
export NETLIFY_AUTH_TOKEN="$(cat /token)"
|
|
|
|
create_site() {
|
|
url="https://api.netlify.com/api/v1/${NETLIFY_ACCOUNT:-}/sites"
|
|
|
|
response=$(curl -s -S -f -H "Authorization: Bearer $NETLIFY_AUTH_TOKEN" \
|
|
-X POST -H "Content-Type: application/json" \
|
|
$url \
|
|
-d "{\"name\": \"${NETLIFY_SITE_NAME}\", \"custom_domain\": \"${NETLIFY_DOMAIN}\"}"
|
|
)
|
|
if [ $? -ne 0 ]; then
|
|
exit 1
|
|
fi
|
|
|
|
echo $response | jq -r '.site_id'
|
|
}
|
|
|
|
site_id=$(curl -s -S -f -H "Authorization: Bearer $NETLIFY_AUTH_TOKEN" \
|
|
https://api.netlify.com/api/v1/sites\?filter\=all | \
|
|
jq -r ".[] | select(.name==\"$NETLIFY_SITE_NAME\") | .id" \
|
|
)
|
|
if [ -z "$site_id" ] ; then
|
|
if [ "${NETLIFY_SITE_CREATE:-}" != 1 ]; then
|
|
echo "Site $NETLIFY_SITE_NAME does not exist"
|
|
exit 1
|
|
fi
|
|
site_id=$(create_site)
|
|
if [ -z "$site_id" ]; then
|
|
echo "create site failed"
|
|
exit 1
|
|
fi
|
|
fi
|
|
netlify deploy \
|
|
--dir="$(pwd)" \
|
|
--site="$site_id" \
|
|
--prod \
|
|
| tee /tmp/stdout
|
|
|
|
url=$(</tmp/stdout sed -n -e 's/^Website URL:.*\(https:\/\/.*\)$/\1/p' | tr -d '\n')
|
|
deployUrl=$(</tmp/stdout sed -n -e 's/^Unique Deploy URL:.*\(https:\/\/.*\)$/\1/p' | tr -d '\n')
|
|
logsUrl=$(</tmp/stdout sed -n -e 's/^Logs:.*\(https:\/\/.*\)$/\1/p' | tr -d '\n')
|
|
|
|
# Write output files
|
|
mkdir -p /netlify
|
|
echo "$url" > /netlify/url
|
|
echo "$deployUrl" > /netlify/deployUrl
|
|
echo "$logsUrl" > /netlify/logsUrl
|
|
|
|
"""#
|