unkin-agent
61bb464e32
Interactive agents are classifier-blocked from plumbing credentials through a shell, so seeding an Authentik outpost token into Vault KV needs to happen inside one binary invocation that never exposes the secret. - Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login (role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged). - Add `agentvault seed-outpost`: read the Authentik API token from kv/service/authentik/agent-api-token (field `token`, falling back to `api_token`), exact-match the outpost by name via the instances search, fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it to --dest-path under --dest-key. - Print only the outpost name, token identifier, dest path and new KV version; keep secret material out of results, errors and logs. - Distinguish the failure stages (login, KV read denied, outpost missing, view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/ ErrOutpostNotFound sentinels and actionable messages. - Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and authentik.go (outpost search + view_key) for reuse by future flows. - Cover the happy path, idempotent re-run, field fallback and every failure mode with httptest servers, including a leak check on error strings. - Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release cross-builds/assets, README and AGENTS.md.
50 lines
1.7 KiB
Bash
Executable File
50 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Package the (already built) agentpr, watchpr, agentws and agentvault binaries into an RPM
|
|
# with nfpm, bundling generated bash/zsh/fish shell completions.
|
|
# Usage: scripts/build-rpm.sh [version] (version defaults to $CI_COMMIT_TAG)
|
|
#
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${ROOT_DIR}"
|
|
|
|
VERSION="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
|
|
VERSION="${VERSION#v}" # strip a leading v
|
|
PACKAGE="agent-tools"
|
|
BINARIES=(agentpr watchpr agentws agentvault)
|
|
DIST="dist"
|
|
|
|
for b in "${BINARIES[@]}"; do
|
|
if [ ! -f "${DIST}/${b}" ]; then
|
|
echo "ERROR: ${DIST}/${b} not found; run 'make build' first" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
# Generate shell completions from the freshly built binaries so they always
|
|
# match the shipped flags/subcommands.
|
|
COMP_DIR="${DIST}/completions"
|
|
mkdir -p "${COMP_DIR}"
|
|
for b in "${BINARIES[@]}"; do
|
|
"./${DIST}/${b}" completion bash >"${COMP_DIR}/${b}.bash"
|
|
"./${DIST}/${b}" completion zsh >"${COMP_DIR}/_${b}"
|
|
"./${DIST}/${b}" completion fish >"${COMP_DIR}/${b}.fish"
|
|
done
|
|
|
|
export PACKAGE_NAME="${PACKAGE}"
|
|
export PACKAGE_VERSION="${VERSION}"
|
|
export PACKAGE_RELEASE="1"
|
|
export PACKAGE_ARCH="amd64"
|
|
export PACKAGE_PLATFORM="linux"
|
|
export PACKAGE_DESCRIPTION="CLI tools for automation as the unkin-agent user: agentpr (create PRs/comments), watchpr (poll PRs and alert on meaningful change), agentws (manage per-branch git worktrees) and agentvault (deterministic Vault flows)"
|
|
export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
|
|
export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/agent-tools"
|
|
export PACKAGE_LICENSE="MIT"
|
|
|
|
envsubst <packaging/nfpm.yaml >"${DIST}/nfpm.yaml"
|
|
nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
|
|
|
|
echo "Built:"
|
|
ls -1 "${DIST}"/*.rpm
|