spiff-arena/spiffworkflow-backend/bin/clone_process_models
Bret Mogilefsky a3c5219a94
Enable using read-only HTTPS repositories (#2171)
* Enable using read-only HTTPS repositories

If someone wants to clone read-only from an `https://github.com/...` URL, that should be permitted, and in that case they shouldn't be required to provide an SSH key.

* Add comment on ssh vs https behavior
2024-12-03 03:48:56 -08:00

47 lines
2.0 KiB
Bash
Executable File

#!/usr/bin/env bash
function error_handler() {
echo >&2 "Exited with BAD EXIT CODE '${2}' in ${0} script at line: ${1}."
exit "$2"
}
trap 'error_handler ${LINENO} $?' ERR
set -o errtrace -o errexit -o nounset -o pipefail
if [[ -z "${SPIFFWORKFLOW_BACKEND_GIT_PUBLISH_CLONE_URL:-}" ]]; then
echo >&2 "ERROR: SPIFFWORKFLOW_BACKEND_GIT_PUBLISH_CLONE_URL must be specified to clone the git repo."
exit 1
fi
if [[ -z "${SPIFFWORKFLOW_BACKEND_GIT_SOURCE_BRANCH:-}" ]]; then
echo >&2 "ERROR: SPIFFWORKFLOW_BACKEND_GIT_SOURCE_BRANCH must be specified to clone the git repo."
exit 1
fi
if [[ -z "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-}" ]]; then
echo >&2 "ERROR: SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR must be specified to clone the git repo."
exit 1
fi
if [[ -z "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY_PATH:-}" ]]; then
if [[ -n "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY:-}" ]]; then
SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY_PATH=$(mktemp /tmp/ssh_private_key.XXXXXX)
export SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY_PATH
chmod 600 "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY_PATH}"
echo "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY}" >"${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY_PATH}"
fi
fi
# Only configure SSH if a private key is available; CLONE_URL might be HTTPS, which is still valid
if [[ -n "${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY_PATH}" ]]; then
export GIT_SSH_COMMAND="ssh -F /dev/null -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${SPIFFWORKFLOW_BACKEND_GIT_SSH_PRIVATE_KEY_PATH}"
fi
if [[ ! -d "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR}/.git" ]]; then
# otherwise git clone will not clone since the directory is not empty
if [[ -d "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR}/lost+found" ]]; then
rm -r "${SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR}/lost+found"
fi
git clone -b "$SPIFFWORKFLOW_BACKEND_GIT_SOURCE_BRANCH" "$SPIFFWORKFLOW_BACKEND_GIT_PUBLISH_CLONE_URL" "$SPIFFWORKFLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR"
fi