capistrano-redmine-deployment 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a1d4def15c15b92236d4cad5e63ab56a469b973763bcaeb0be17a59477efc5e
-  data.tar.gz: 91f5982de00664a05f986f714acd782464c60901d6af1ff051dd7691ecf61032
+  metadata.gz: d6bcb935ad7aaa01c101fa9380a958b0dc57a3d6b1b39797fafb3eff6ae03a05
+  data.tar.gz: adaff749719d3b3178b3f6f23e71d9605c8785ff37c773d2422eb2a76f568956
 SHA512:
-  metadata.gz: af10737c30d398ab457265538ea359850403e53ec28771ba020cef4a07d178c712aeaafc0a4cbce4d760d9bf81d21938c8b5aa85ef1a95c6e8116aded924a950
-  data.tar.gz: 9d1282a7b24f607c94603b1604138e5d30a18173bbd468be524e39eb8af6c69bf10c47a36703d1868a047a85f9ebc51c65860b0ded0599c3b46f0655db26b1ac
+  metadata.gz: c552022bdeac49a92283af11c3e99869efb1509be175ee68179759300c6c3fde2e502b1e096736157f20e4382e77bdd1a934ceb93c6a82a2d736bd544a3ba9c1
+  data.tar.gz: b3d6ae5239ac13d3042f5228ba2a6175a3a0d1b115e186196bf26418d50db3518cb3ea4da397d7c5893f4203db3047ffa3b727ead08e30cddf69f5c25227ac2d

data/.rspec

@@ -0,0 +1,2 @@
+--require spec_helper
+--format documentation

data/Gemfile

@@ -6,3 +6,4 @@ source "https://rubygems.org"
 gemspec
 
 gem "rake"
+gem "rspec"

data/README.md

@@ -49,13 +49,43 @@ set(:redmine_repository, "target-redmine-repository-identifier")
 
 # in case of `SSL` issues that are caused by *CRL* (i.e. by LetsEncrypt certificates)
 set(:redmine_host_verification, false)
+
+# alternatively, for instances with a custom CA, point to a CA bundle instead of
+# disabling verification entirely (preferred over :redmine_host_verification)
+set(:redmine_ca_file, "/path/to/ca-bundle.pem")
 ```
 
 ### User-specific credentials
 
+The `api_key` is resolved from the following sources, **later ones win**:
+
+1. capistrano variables: `:redmine_api_key`, or `:redmine_api_key_command` (its stdout is used as the key) as fallback
+2. `.redmine` file in the current directory (`$PWD`) or `$HOME`
+3. the `REDMINE_API_KEY` ENV variable
+
+#### Option A: macOS Keychain (recommended)
+
+Store the key once per developer in the keychain (use a dedicated entry):
+
+    $ security add-generic-password -s ri-redmine-deploy -a "$USER" -w 'YOUR_KEY'
+
+Then point capistrano at a command that reads it, in your `config/deploy.rb`:
+
+```ruby
+set :redmine_api_key_command, 'security find-generic-password -s ri-redmine-deploy -w'
+```
+
+No secret ends up in `deploy.rb` or your SCM — only the command. Once every developer
+has switched over, the `.redmine` file can be removed entirely (it stays supported as a
+fallback).
+
+> Use a **dedicated** keychain entry (e.g. `ri-redmine-deploy`).
+
+#### Option B: `.redmine` file via rake-task
+
 Setup redmine `API-KEY` through rake-task:
 
-    $ rake capistrano:redmine:deploy:setup
+    $ rake capistrano:redmine:deployment:setup
 
 
 ## Redmine requirements

data/docs/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Capistrano::Redmine::Deployment - CHANGELOG
 
+## [1.1.0] - 2026-07-10
+* **[add]** ENV layer for config (`REDMINE_API_KEY`, `REDMINE_HOST`, `REDMINE_PROJECT`, `REDMINE_REPOSITORY`, `REDMINE_CA_FILE`)
+* **[add]** `:redmine_api_key` capistrano variable, with `:redmine_api_key_command` (command stdout, e.g. macOS keychain) as fallback
+* **[add]** `:redmine_ca_file` config (and `REDMINE_CA_FILE` ENV) as a safe alternative to disabling host verification
+* **[add]** rspec test suite for `Config.resolve` layer precedence
+* **[ref]** config resolution order: capistrano is the base, then `.redmine` files, then ENV win over it
+* **[fix]** enable SSL by URI scheme (`https`) instead of only port 443, so HTTPS on non-standard ports works
+
 ## [1.0.1] - 2025-10-24
 * **[add]** config for `host_verification` to skip issues with OpenSSL / CRL issues
 * **[add]** warning message during deployment while host verification is disabled

data/lib/capistrano/redmine/deployment/client.rb

@@ -60,8 +60,13 @@ module Capistrano
           uri = URI("#{config.host}/projects/#{config.project}/deploy/#{config.repository}.json")
 
           http = Net::HTTP.new(uri.host, uri.port)
-          http.use_ssl = true if uri.port == 443
-          http.verify_mode = OpenSSL::SSL::VERIFY_NONE if config.host_verification == false
+          http.use_ssl = true if uri.scheme == 'https'
+
+          if config.ca_file
+            http.ca_file = config.ca_file
+          elsif config.host_verification == false
+            http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+          end
 
           request = Net::HTTP::Post.new(uri.request_uri)
           request["Content-Type"] = "application/json"
@@ -79,7 +84,8 @@ module Capistrano
 
         def log_deploy(deployment)
           puts "Sending deployment information to #{config.host} (project: '#{config.project}' | repo: '#{config.repository}')"
-          puts "\e[33m   WARNING: Host verification disabled!\e[0m" if config.host_verification == false
+          puts "\e[33m   Using custom CA file: #{config.ca_file}\e[0m" if config.ca_file
+          puts "\e[33m   WARNING: Host verification disabled!\e[0m" if config.ca_file.nil? && config.host_verification == false
           puts ""
           puts "   Commits......: #{deployment[:from_revision]} ... #{deployment[:to_revision]}"
           puts "   Environment..: #{deployment[:environment] || '-'}"

data/lib/capistrano/redmine/deployment/config.rb

@@ -14,7 +14,7 @@ module Capistrano
             # build new empty config
             config = new
 
-            # try to resolve from capistrano
+            # capistrano is the base - files and ENV win over it
             config.assign!(config_from_capistrano(capistrano)) if capistrano
 
             # try to resolve from current PWD
@@ -22,23 +22,58 @@ module Capistrano
             config.assign!(config_from_file(File.join(ENV['HOME'], '.redmine')))
             config.assign!(config_from_file(file)) if file
 
+            # ENV wins over files and capistrano
+            config.assign!(config_from_env)
+
             config
           end
 
           def config_from_capistrano(capistrano)
             config = {
+              api_key: capistrano.fetch(:redmine_api_key) || api_key_from_command(capistrano),
               host: capistrano.fetch(:redmine_host),
               project: capistrano.fetch(:redmine_project) || capistrano.fetch(:redmine_project_id),
               repository: capistrano.fetch(:redmine_repository),
-              host_verification: capistrano.fetch(:redmine_host_verification)
+              host_verification: capistrano.fetch(:redmine_host_verification),
+              ca_file: capistrano.fetch(:redmine_ca_file)
             }
 
             new(config)
           end
 
+          # Resolves config from ENV variables. Values are filtered by `assign!`,
+          # so unset (nil/empty) variables never overwrite an existing value.
+          def config_from_env
+            new({
+              api_key:    ENV['REDMINE_API_KEY'],
+              host:       ENV['REDMINE_HOST'],
+              project:    ENV['REDMINE_PROJECT'],
+              repository: ENV['REDMINE_REPOSITORY'],
+              ca_file:    ENV['REDMINE_CA_FILE']
+            })
+          end
+
           def config_from_file(file)
             new(file: file)
           end
+
+          private
+
+          # Resolves the api_key by running the `:redmine_api_key_command` capistrano
+          # variable (if set) and taking its stdout. This keeps the secret out of
+          # `deploy.rb` - only the command (e.g. a keychain lookup) lives there.
+          #
+          # On any failure (non-zero exit or empty stdout) nil is returned so the
+          # file/ENV fallback still applies.
+          def api_key_from_command(capistrano)
+            cmd = capistrano.fetch(:redmine_api_key_command)
+            return nil unless cmd && cmd != ''
+
+            key = `#{cmd}`.strip
+            return nil unless $?.success? && !key.empty?
+
+            key
+          end
         end
 
         def initialize(config = {}, file: nil)

data/lib/capistrano/redmine/deployment/gem_version.rb

@@ -10,8 +10,8 @@ module Capistrano
 
       module VERSION
         MAJOR = 1
-        MINOR = 0
-        TINY  = 1
+        MINOR = 1
+        TINY  = 0
         PRE   = nil
 
         STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/capistrano/redmine/deployment/tasks/setup.rake

@@ -24,6 +24,11 @@ Configure the redmine credentials for deployment.
         puts ""
         puts " > HINT: Keep configs empty to prevent to overwrite existing configs."
         puts ""
+        puts " > ALTERNATIVE (recommended): the api_key can also be provided without this file"
+        puts "   via the ENV variable 'REDMINE_API_KEY' or the capistrano variable"
+        puts "   ':redmine_api_key_command' (e.g. a macOS keychain lookup). Both win over"
+        puts "   the '.redmine' file. See the README for details."
+        puts ""
         puts "******************************************************************************************************"
         puts ""
         puts ""

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-redmine-deployment
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Tobias Gonsior
@@ -19,6 +19,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
+- ".rspec"
 - Gemfile
 - LICENSE.txt
 - README.md