fix: escape secrets (#10 )

- must use $$ for escaped secrets Reviewed-on: #10
fix/release-pipeline-python (#9 )
2026-03-26 14:55:30 +11:00 · 2026-03-26 14:48:30 +11:00 · 2026-03-26 13:46:37 +11:00 · 2026-03-26 13:40:15 +11:00 · 2026-03-26 13:17:25 +11:00 · 2026-03-26 12:48:54 +11:00
1 changed files with 6 additions and 11 deletions
@@ -17,25 +17,20 @@ steps:
  - name: release
    image: git.unkin.net/unkin/almalinux9-base:20260325
    environment:
-      DRONECI_PASSWORD:
+      RELEASER_TOKEN:
-        from_secret: DRONECI_PASSWORD
+        from_secret: RELEASER_TOKEN
    commands:
      - |
        curl --output /usr/local/bin/tea https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/0.12.0/tea-0.12.0-linux-amd64 && chmod +x /usr/local/bin/tea
        tea logins add --name gitea --url https://git.unkin.net --token "$${RELEASER_TOKEN}" --no-version-check
        PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
        if [ -n "$PREV_TAG" ]; then
          NOTES=$(git log "${PREV_TAG}..${CI_COMMIT_TAG}" --merges --pretty=format:"- %s")
        else
          NOTES=$(git log --merges --pretty=format:"- %s")
        fi
-        BODY=$(printf '%s' "$NOTES" | sed 's/"/\\"/g; s/$/\\n/' | tr -d '\n')
+        tea releases edit "${CI_COMMIT_TAG}" --note "${NOTES}" --login gitea --repo "${CI_REPO}"
-        RELEASE_ID=$(curl -sf -X POST "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases" \
+        tea releases assets create "${CI_COMMIT_TAG}" node-lookup --login gitea --repo "${CI_REPO}"
          -u "droneci:$DRONECI_PASSWORD" \
          -H "Content-Type: application/json" \
          -d "{\"tag_name\":\"${CI_COMMIT_TAG}\",\"name\":\"${CI_COMMIT_TAG}\",\"body\":\"${BODY}\"}" \
          | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
        curl -sf -X POST "https://git.unkin.net/api/v1/repos/${CI_REPO}/releases/${RELEASE_ID}/assets" \
          -u "droneci:$DRONECI_PASSWORD" \
          -F "attachment=@node-lookup"
    backend_options:
      kubernetes:
        serviceAccountName: default
Author	SHA1	Message	Date
unkinben	e9ec29d60e	fix: escape secrets (#10 ) ci/woodpecker/release/release Pipeline failed Details - must use $$ for escaped secrets Reviewed-on: #10	2026-03-26 14:55:30 +11:00
unkinben	1daa48ade1	fix/release-pipeline-python (#9 ) ci/woodpecker/release/release Pipeline failed Details Reviewed-on: #9	2026-03-26 14:48:30 +11:00
unkinben	b5978a18a1	fix/release-pipeline-python (#8 ) ci/woodpecker/release/release Pipeline failed Details Reviewed-on: #8	2026-03-26 13:46:37 +11:00
unkinben	6d7703c3f2	fix: use RELEASER_TOKEN for Gitea API auth instead of droneci password (#7 ) ci/woodpecker/release/release Pipeline failed Details droneci user lacks write access; switch to token-based auth header. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #7	2026-03-26 13:40:15 +11:00
unkinben	3291f8f73d	fix: look up existing release by tag instead of creating a new one (#6 ) ci/woodpecker/release/release Pipeline failed Details tea creates the release before the pipeline runs; POST was failing with conflict, leaving RELEASE_ID empty and skipping the asset upload. Now GETs the release by tag, PATCHes its body, then uploads the binary. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #6	2026-03-26 13:17:25 +11:00
unkinben	3a4c9ea1c1	fix: surface release API errors in woodpecker pipeline (#5 ) ci/woodpecker/release/release Pipeline failed Details Capture and print the full Gitea API response before parsing the release ID, and fail explicitly if the ID is empty so the root cause is visible in CI logs instead of silently producing a malformed asset upload URL. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land> Reviewed-on: #5	2026-03-26 12:48:54 +11:00