capistrano-dockerbuild 1.0.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 411b02ef1e66127fab930b7476e2f4e618276c0f0e60ac8327543e6f0051bd35
-  data.tar.gz: ffed26862d2999bf476f464da9e2a11aa4844088a7cb34a01d01a401331524c5
+  metadata.gz: ed984b515b7f0d43d3985d442dba5bf85c1539f3109d8360bf9864db5a549a2d
+  data.tar.gz: cbcea200c07484a17aec1edb9d6e5e99ec2548811e3bc3de34cec1f2deb993a0
 SHA512:
-  metadata.gz: 636f6d7114ee9ed6a1e156d0bd7c41d46ab91e52e747afa1142599b2e12c90ae5a3b8cf126fd4152b6729eab2e0a6b3ceefea181601b3f980762867173c34315
-  data.tar.gz: 9f585640710fb132e198ddb94493d5a1fc600cee7e542e41cd97667ede164f508fe5393c922a22dbb97c3d307dbd34aa2ce889f6701839cbca0853a11413ba62
+  metadata.gz: eb19d9ee91eb190e367a5dfe3fe75c9a695465afae9eff6d9a6f9d79c1548b4e6ede86a66f004bc4d9d23d5bbc56e70b719ca157903b59f8ca4251b4fc6342e7
+  data.tar.gz: 98752e45ab74d37285903f283efa3c8c2e167d51e8fd366c381099bc33b33b947c9a03ea018d93e90bfa91bcfbfd5a302288db93630a6700e671e7c9490f44e0

data/README.md

@@ -88,6 +88,8 @@ Use common variables
 | keep_docker_image_count       | no       | 10                                                                                                                 |                                                                                          |
 | git_http_username             | no       | nil                                                                                                                | See below                                                                                |
 | git_http_password             | no       | nil                                                                                                                | See below                                                                                |
+| git_auth_token                | no       | nil                                                                                                                | See below                                                                                |
+| update_git_submodule          | no       | false                                                                                                              | Run `git submodule update --init --recursive` after checkout                             |
 
 If you want to use GitHub Apps installation access token or something to authorize repository access using HTTPS protocol. You can set variables in your config/deploy.rb:
 
@@ -105,17 +107,43 @@ end
 
 Update remote URL always if you set proper value to all of `repo_url`, `git_http_username`, and `git_http_password`.
 
+Alternatively, you can authenticate via an HTTP `Authorization` header using `:git_auth_token`. This is useful when the build server has no SSH key access to the repository (e.g. using a GitHub Apps installation access token or a personal access token).
+
+```ruby
+set :git_auth_token, -> { ENV["GIT_AUTH_TOKEN"] }
+set :repo_url, "git@github.com:owner/repo.git"  # SSH or HTTPS both work
+```
+
+When `:git_auth_token` is set, `docker:setup` creates a temporary `.gitconfig` on each remote build host containing:
+
+- `http.extraheader = Authorization: Basic <token>` — injects the token into every HTTPS git request
+- `url."https://<host>/".insteadOf` rules — rewrites SSH-style URLs (`git@host:` and `ssh://git@host/`) to HTTPS so the token is used regardless of how `repo_url` is written
+
+The host is derived automatically from `:repo_url`, so this works with GitHub, GitLab, Bitbucket, or any self-hosted git server.
+
+The temporary directory is removed automatically by `docker:clean` after `docker:build`.
+
 ## Tasks
 
+#### docker:setup
+- Create a temporary `.gitconfig` on each remote build host when `:git_auth_token` is set
+- Automatically invoked before `docker:check`
+
+#### docker:clean
+- Remove the temporary directory created by `docker:setup`
+- Automatically invoked after `docker:build`
+
 #### docker:check
 - Ensure `#{docker_build_base_dir}`
 - Ensure git reachable
 
 #### docker:clone
 - Clone repo to `#{docker_build_base_dir}` as mirror
+- Serialized with `docker:update_mirror` via a `flock` keyed by `#{docker_build_base_dir}`'s basename, since both mutate the shared repo directory (a mirror by default, or a regular checkout under `:docker_build_no_worktree`) at `#{docker_build_base_dir}`. This matters when multiple deploys (e.g. CI jobs for different branches) target the same build host concurrently — without it, concurrent `git clone`/`git remote update` on the shared directory can corrupt its `.git/config` or fail with transport errors. Keying the lock by basename keeps unrelated consumers that share the same parent directory from serializing against each other.
 
 #### docker:update_mirror
 - git remote update `#{docker_build_base_dir}`
+- Serialized with `docker:clone` via the same `flock` (see above)
 
 #### docker:build
 - Create `#{branch}` worktree to `#{docker_tag}-#{timestamp}`
@@ -132,7 +160,9 @@ Update remote URL always if you set proper value to all of `repo_url`, `git_http
 
 ## Task Dependency
 
-docker:push => docker:build => docker:update_mirror => docker:clone => docker:check
+docker:push => docker:build => docker:update_mirror => docker:clone => docker:check => docker:setup
+
+docker:clean is triggered automatically after docker:build
 
 ## Development
 

data/capistrano-dockerbuild.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "capistrano-dockerbuild"
-  spec.version       = "1.0.0"
+  spec.version       = "1.2.0"
   spec.authors       = ["joker1007"]
   spec.email         = ["kakyoin.hierophant@gmail.com"]
 
@@ -22,6 +22,6 @@ Gem::Specification.new do |spec|
 
   spec.add_runtime_dependency "capistrano", ">= 3.2"
 
-  spec.add_development_dependency "bundler", "~> 2.3"
+  spec.add_development_dependency "bundler", ">= 2.3"
   spec.add_development_dependency "rake", "~> 13.0"
 end

data/lib/capistrano/dockerbuild.rb

@@ -1,5 +1,7 @@
 require "cgi"
 require "uri"
+require "securerandom"
+require "shellwords"
 
 class Capistrano::Dockerbuild < Capistrano::Plugin
   def set_defaults
@@ -15,6 +17,7 @@ class Capistrano::Dockerbuild < Capistrano::Plugin
     set_if_empty :keep_docker_image_count, 10
     set_if_empty :git_gc_prune_date, "3.days.ago"
     set_if_empty :docker_build_no_worktree, false
+    set_if_empty :update_git_submodule, false
   end
 
   def define_tasks
@@ -26,6 +29,16 @@ class Capistrano::Dockerbuild < Capistrano::Plugin
     Pathname(fetch(:docker_build_base_dir))
   end
 
+  # Lock serializing access to the shared repo dir at docker_build_base_path
+  # across concurrent deploys on the same build host (see README for the race).
+  #
+  # Keyed by basename, not a fixed name, so unrelated consumers sharing a parent
+  # directory don't serialize against each other.
+  def docker_build_lock_path
+    base = docker_build_base_path
+    base.dirname.join("capistrano_dockerbuild.#{base.basename}.lock").to_s
+  end
+
   def git_repo_url
     if fetch(:git_http_username) && fetch(:git_http_password)
       URI.parse(repo_url).tap do |repo_uri|
@@ -40,4 +53,20 @@ class Capistrano::Dockerbuild < Capistrano::Plugin
       repo_url
     end
   end
+
+  def git_repo_host
+    URI.parse(repo_url.sub(/^git@.*/) {|m| "https://#{m}" }).host
+  end
+
+  def tmp_home(host)
+    @tmp_host ||= {}
+    @tmp_host[host.properties.arch] ||= "/tmp/capistrano-dockerbuild-#{SecureRandom.hex(8)}"
+  end
+
+  def git_env(host)
+    return {} if fetch(:git_auth_token).to_s.empty?
+
+    @git_env ||= {}
+    @git_env[host.properties.arch] ||= { HOME: tmp_home(host), GIT_CONFIG_NOSYSTEM: "1" }
+  end
 end

data/lib/capistrano/tasks/docker.rake

@@ -1,32 +1,57 @@
 dockerbuild_plugin = self
 
 namespace :docker do
+  desc "setup temporary gitconfig for HTTP authentication"
+  task :setup do
+    on roles(:docker_build) do |host|
+      unless fetch(:git_auth_token).to_s.empty?
+        tmp_home = dockerbuild_plugin.tmp_home(host)
+        git_host = dockerbuild_plugin.git_repo_host
+        execute :mkdir, "-p", tmp_home
+        execute :git, :config, "--file", "#{tmp_home}/.gitconfig", "http.extraheader", "'Authorization: Basic #{fetch(:git_auth_token)}'"
+        execute :git, :config, "--file", "#{tmp_home}/.gitconfig", %Q(url."https://#{git_host}/".insteadOf), "git@#{git_host}:"
+        execute :git, :config, "--file", "#{tmp_home}/.gitconfig", "--add", %Q(url."https://#{git_host}/".insteadOf), "ssh://git@#{git_host}/"
+      end
+    end
+  end
+
+  desc "clean up temporary gitconfig"
+  task :clean do
+    on roles(:docker_build) do |host|
+      unless fetch(:git_auth_token).to_s.empty?
+        tmp_home = dockerbuild_plugin.tmp_home(host)
+        execute :rm, "-rf", tmp_home
+      end
+    end
+  end
+
   desc "check directory exist"
-  task :check do
+  task check: [:"docker:setup"] do
     on roles(:docker_build) do |host|
-      execute :mkdir, "-p", dockerbuild_plugin.docker_build_base_path.dirname.to_s
-      execute :git, :'ls-remote', dockerbuild_plugin.git_repo_url, "HEAD"
+      with dockerbuild_plugin.git_env(host) do
+        execute :mkdir, "-p", dockerbuild_plugin.docker_build_base_path.dirname.to_s
+        execute :git, :'ls-remote', dockerbuild_plugin.git_repo_url, "HEAD"
+      end
     end
   end
 
   desc "Clone the repo to docker build base directory"
   task :clone => [:'docker:check'] do
     on roles(:docker_build) do |host|
-      if fetch(:docker_build_no_worktree)
-        if test " [ -f #{dockerbuild_plugin.docker_build_base_path}/.git/HEAD ] "
-          info "The repository is at #{dockerbuild_plugin.docker_build_base_path}"
-        else
-          within dockerbuild_plugin.docker_build_base_path.dirname do
-            execute :git, :clone, dockerbuild_plugin.git_repo_url, dockerbuild_plugin.docker_build_base_path.to_s
-          end
-        end
-      else
-        if test " [ -f #{dockerbuild_plugin.docker_build_base_path}/HEAD ] "
-          info t(:mirror_exists, at: dockerbuild_plugin.docker_build_base_path.to_s)
-        else
-          within dockerbuild_plugin.docker_build_base_path.dirname do
-            execute :git, :clone, "--mirror", dockerbuild_plugin.git_repo_url, dockerbuild_plugin.docker_build_base_path.to_s
-          end
+      within dockerbuild_plugin.docker_build_base_path.dirname do
+        with dockerbuild_plugin.git_env(host) do
+          path = dockerbuild_plugin.docker_build_base_path.to_s.shellescape
+          url = dockerbuild_plugin.git_repo_url.shellescape
+          # Existence check runs inside the same flock as the clone itself, not before
+          # acquiring it — otherwise two concurrent deploys can both observe the repo
+          # missing and the second `git clone` fails once the first has created it.
+          commands =
+            if fetch(:docker_build_no_worktree)
+              "[ -f #{path}/.git/HEAD ] || git clone #{url} #{path}"
+            else
+              "[ -f #{path}/HEAD ] || git clone --mirror #{url} #{path}"
+            end
+          execute :flock, dockerbuild_plugin.docker_build_lock_path.shellescape, "-c", commands.shellescape
         end
       end
     end
@@ -36,8 +61,10 @@ namespace :docker do
   task update_mirror: :'docker:clone' do
     on roles(:docker_build) do |host|
       within dockerbuild_plugin.docker_build_base_path do
-        execute :git, :remote, "set-url", :origin, dockerbuild_plugin.git_repo_url
-        execute :git, :remote, :update, "--prune"
+        with dockerbuild_plugin.git_env(host) do
+          commands = "git remote set-url origin #{dockerbuild_plugin.git_repo_url.shellescape} && git remote update --prune"
+          execute :flock, dockerbuild_plugin.docker_build_lock_path.shellescape, "-c", commands.shellescape
+        end
       end
     end
   end
@@ -55,8 +82,11 @@ namespace :docker do
       end
       within dockerbuild_plugin.docker_build_base_path do
         if fetch(:docker_build_no_worktree)
-          commands = "sha1=$(git rev-parse #{fetch(:branch)}); git reset --hard ${sha1}; #{build_cmd.map {|c| c.to_s.shellescape }.join(" ")}"
-          execute(:flock, "capistrano_dockerbuild.lock", "-c", "'#{commands}'")
+          submodule_cmd = fetch(:update_git_submodule) ? "; git submodule update --init --recursive" : ""
+          commands = "sha1=$(git rev-parse #{fetch(:branch)}); git reset --hard ${sha1}#{submodule_cmd}; #{build_cmd.map {|c| c.to_s.shellescape }.join(" ")}"
+          with dockerbuild_plugin.git_env(host) do
+            execute(:flock, dockerbuild_plugin.docker_build_lock_path.shellescape, "-c", "'#{commands}'")
+          end
         else
           timestamp = Time.now.to_i
           git_sha1 = `git rev-parse #{fetch(:branch)}`.chomp
@@ -66,6 +96,11 @@ namespace :docker do
 
           begin
             within worktree_dir_name do
+              if fetch(:update_git_submodule)
+                with dockerbuild_plugin.git_env(host) do
+                  execute :git, :submodule, :update, "--init", "--recursive"
+                end
+              end
               execute(*build_cmd)
             end
           ensure
@@ -136,3 +171,5 @@ namespace :docker do
     end
   end
 end
+
+after "docker:build", "docker:clean"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-dockerbuild
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.2.0
 platform: ruby
 authors:
 - joker1007
 bindir: exe
 cert_chain: []
-date: 2025-02-10 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: capistrano
@@ -27,14 +27,14 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.3'
 - !ruby/object:Gem::Dependency
@@ -86,7 +86,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Capistrano task definition for `docker build`
 test_files: []