ruby_vault 0.3.0.pre.1 → 0.3.0.pre.2.pr131.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile.lock +93 -82
- data/README.md +4 -4
- data/Rakefile +111 -47
- data/lib/ruby_vault/options/types.rb +2 -2
- data/lib/ruby_vault/version.rb +1 -1
- data/ruby_vault.gemspec +2 -3
- metadata +10 -24
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: c216faca48e7d40bb1e19f4edbe180981ed19cc7afd4b4316c7c3a1ce918556e
|
|
4
|
+
data.tar.gz: 3fd92fa40eec1d9eb9993580b59e6335a7c5b8d2ae08dea629b1d9dcfc84102e
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 6363a56c297fa78b8211a56c4c85034b754436062ccaff6b5778e5e9f065ec369829304bf37d7ea9c6e3646452c43541ba4af98bcf96110d94e6dd925879994b
|
|
7
|
+
data.tar.gz: a76492dbcb00b730558c9508fbd3a26f0492be03440001cfb360a4bca5aad5567db161654dca1f94e27d94cc088367f699c50aa3c0dfbf89b1803efdf1fb4ecc
|
data/Gemfile.lock
CHANGED
|
@@ -1,56 +1,66 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
ruby_vault (0.3.0.pre.1)
|
|
4
|
+
ruby_vault (0.3.0.pre.2.pr131.4.1)
|
|
5
5
|
immutable-struct (~> 2.4)
|
|
6
6
|
lino (>= 4.1)
|
|
7
7
|
|
|
8
8
|
GEM
|
|
9
9
|
remote: https://rubygems.org/
|
|
10
10
|
specs:
|
|
11
|
-
activesupport (
|
|
11
|
+
activesupport (8.1.3)
|
|
12
12
|
base64
|
|
13
13
|
bigdecimal
|
|
14
|
-
concurrent-ruby (~> 1.0, >= 1.
|
|
14
|
+
concurrent-ruby (~> 1.0, >= 1.3.1)
|
|
15
15
|
connection_pool (>= 2.2.5)
|
|
16
16
|
drb
|
|
17
17
|
i18n (>= 1.6, < 2)
|
|
18
|
+
json
|
|
19
|
+
logger (>= 1.4.2)
|
|
18
20
|
minitest (>= 5.1)
|
|
19
|
-
|
|
20
|
-
tzinfo (~> 2.0)
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
21
|
+
securerandom (>= 0.3)
|
|
22
|
+
tzinfo (~> 2.0, >= 2.0.5)
|
|
23
|
+
uri (>= 0.13.1)
|
|
24
|
+
addressable (2.9.0)
|
|
25
|
+
public_suffix (>= 2.0.2, < 8.0)
|
|
26
|
+
ast (2.4.3)
|
|
27
|
+
base64 (0.3.0)
|
|
28
|
+
bigdecimal (4.1.2)
|
|
26
29
|
childprocess (5.0.0)
|
|
27
30
|
coderay (1.1.3)
|
|
28
31
|
colored2 (3.1.2)
|
|
29
|
-
concurrent-ruby (1.3.
|
|
30
|
-
connection_pool (
|
|
31
|
-
diff-lcs (1.
|
|
32
|
+
concurrent-ruby (1.3.8)
|
|
33
|
+
connection_pool (3.0.2)
|
|
34
|
+
diff-lcs (1.6.2)
|
|
32
35
|
docile (1.4.0)
|
|
33
|
-
drb (2.2.
|
|
34
|
-
excon (
|
|
35
|
-
|
|
36
|
+
drb (2.2.3)
|
|
37
|
+
excon (1.6.0)
|
|
38
|
+
logger
|
|
39
|
+
faker (3.5.1)
|
|
36
40
|
i18n (>= 1.8.11, < 2)
|
|
37
|
-
faraday (2.
|
|
38
|
-
faraday-net_http (>= 2.0, < 3.
|
|
41
|
+
faraday (2.14.3)
|
|
42
|
+
faraday-net_http (>= 2.0, < 3.5)
|
|
43
|
+
json
|
|
39
44
|
logger
|
|
40
|
-
faraday-net_http (3.
|
|
41
|
-
net-http
|
|
42
|
-
ffi (1.17.
|
|
45
|
+
faraday-net_http (3.4.4)
|
|
46
|
+
net-http (~> 0.5)
|
|
47
|
+
ffi (1.17.4)
|
|
48
|
+
ffi (1.17.4-arm64-darwin)
|
|
49
|
+
ffi (1.17.4-x86_64-darwin)
|
|
50
|
+
ffi (1.17.4-x86_64-linux-gnu)
|
|
43
51
|
formatador (1.1.0)
|
|
44
|
-
gem-release (2.2.
|
|
52
|
+
gem-release (2.2.4)
|
|
45
53
|
git (1.19.1)
|
|
46
54
|
addressable (~> 2.8)
|
|
47
55
|
rchardet (~> 1.8)
|
|
48
|
-
guard (2.
|
|
56
|
+
guard (2.19.1)
|
|
49
57
|
formatador (>= 0.2.4)
|
|
50
58
|
listen (>= 2.7, < 4.0)
|
|
59
|
+
logger (~> 1.6)
|
|
51
60
|
lumberjack (>= 1.0.12, < 2.0)
|
|
52
61
|
nenv (~> 0.1)
|
|
53
62
|
notiffany (~> 0.0)
|
|
63
|
+
ostruct (~> 0.6)
|
|
54
64
|
pry (>= 0.13.0)
|
|
55
65
|
shellany (~> 0.0)
|
|
56
66
|
thor (>= 0.18.1)
|
|
@@ -61,50 +71,46 @@ GEM
|
|
|
61
71
|
rspec (>= 2.99.0, < 4.0)
|
|
62
72
|
hamster (3.0.0)
|
|
63
73
|
concurrent-ruby (~> 1.0)
|
|
64
|
-
i18n (1.
|
|
74
|
+
i18n (1.15.2)
|
|
65
75
|
concurrent-ruby (~> 1.0)
|
|
66
|
-
immutable-struct (2.
|
|
67
|
-
json (2.
|
|
68
|
-
language_server-protocol (3.17.0.
|
|
76
|
+
immutable-struct (2.5.0)
|
|
77
|
+
json (2.12.2)
|
|
78
|
+
language_server-protocol (3.17.0.5)
|
|
69
79
|
lino (4.1.0)
|
|
70
80
|
childprocess (~> 5.0.0)
|
|
71
81
|
hamster (~> 3.0)
|
|
72
82
|
open4 (~> 1.3)
|
|
83
|
+
lint_roller (1.1.0)
|
|
73
84
|
listen (3.9.0)
|
|
74
85
|
rb-fsevent (~> 0.10, >= 0.10.3)
|
|
75
86
|
rb-inotify (~> 0.9, >= 0.9.10)
|
|
76
|
-
logger (1.
|
|
87
|
+
logger (1.7.0)
|
|
77
88
|
lumberjack (1.2.10)
|
|
78
89
|
method_source (1.1.0)
|
|
79
|
-
minitest (5.
|
|
80
|
-
mutex_m (0.2.0)
|
|
90
|
+
minitest (5.27.0)
|
|
81
91
|
nenv (0.3.0)
|
|
82
|
-
net-http (0.
|
|
83
|
-
uri
|
|
92
|
+
net-http (0.9.1)
|
|
93
|
+
uri (>= 0.11.1)
|
|
84
94
|
notiffany (0.1.3)
|
|
85
95
|
nenv (~> 0.1)
|
|
86
96
|
shellany (~> 0.0)
|
|
87
|
-
octokit (
|
|
88
|
-
base64
|
|
97
|
+
octokit (10.0.0)
|
|
89
98
|
faraday (>= 1, < 3)
|
|
90
99
|
sawyer (~> 0.9)
|
|
91
100
|
open4 (1.3.4)
|
|
92
|
-
|
|
93
|
-
|
|
101
|
+
ostruct (0.6.1)
|
|
102
|
+
parallel (1.27.0)
|
|
103
|
+
parser (3.3.8.0)
|
|
94
104
|
ast (~> 2.4.1)
|
|
95
105
|
racc
|
|
96
|
-
|
|
106
|
+
prism (1.4.0)
|
|
107
|
+
pry (0.15.2)
|
|
97
108
|
coderay (~> 1.1)
|
|
98
109
|
method_source (~> 1.0)
|
|
99
|
-
public_suffix (
|
|
100
|
-
racc (1.8.
|
|
110
|
+
public_suffix (7.0.5)
|
|
111
|
+
racc (1.8.1)
|
|
101
112
|
rainbow (3.1.1)
|
|
102
|
-
rake (13.2
|
|
103
|
-
rake_circle_ci (0.11.0)
|
|
104
|
-
colored2 (~> 3.1)
|
|
105
|
-
excon (~> 0.72)
|
|
106
|
-
rake_factory (~> 0.23)
|
|
107
|
-
sshkey (~> 2.0)
|
|
113
|
+
rake (13.4.2)
|
|
108
114
|
rake_factory (0.33.0)
|
|
109
115
|
activesupport (>= 4)
|
|
110
116
|
rake (~> 13.0)
|
|
@@ -112,69 +118,74 @@ GEM
|
|
|
112
118
|
colored2 (~> 3.1)
|
|
113
119
|
git (~> 1.13, >= 1.13.2)
|
|
114
120
|
rake_factory (~> 0.33)
|
|
115
|
-
rake_git_crypt (0.
|
|
121
|
+
rake_git_crypt (0.4.0)
|
|
116
122
|
colored2 (~> 3.1)
|
|
123
|
+
lino (~> 4.1)
|
|
117
124
|
rake_factory (~> 0.33)
|
|
118
125
|
ruby_git_crypt (~> 0.1)
|
|
119
126
|
ruby_gpg2 (~> 0.12)
|
|
120
|
-
rake_github (0.
|
|
127
|
+
rake_github (0.17.0)
|
|
121
128
|
colored2 (~> 3.1)
|
|
122
|
-
octokit (>=
|
|
123
|
-
rake_factory (~> 0.
|
|
129
|
+
octokit (>= 7.0, < 11.0)
|
|
130
|
+
rake_factory (~> 0.33)
|
|
131
|
+
rbnacl (~> 7.1)
|
|
124
132
|
sshkey (~> 2.0)
|
|
125
133
|
rake_gpg (0.20.0)
|
|
126
134
|
rake_factory (~> 0.33)
|
|
127
135
|
ruby_gpg2 (~> 0.12)
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
rake_factory (~> 0.
|
|
131
|
-
sshkey (~> 2.0)
|
|
136
|
+
rake_slack (0.3.0)
|
|
137
|
+
excon (>= 0.72, < 2.0)
|
|
138
|
+
rake_factory (~> 0.33)
|
|
132
139
|
rb-fsevent (0.11.2)
|
|
133
140
|
rb-inotify (0.11.1)
|
|
134
141
|
ffi (~> 1.0)
|
|
142
|
+
rbnacl (7.1.2)
|
|
143
|
+
ffi (~> 1)
|
|
135
144
|
rchardet (1.8.0)
|
|
136
|
-
regexp_parser (2.
|
|
137
|
-
|
|
138
|
-
strscan
|
|
139
|
-
rspec (3.13.0)
|
|
145
|
+
regexp_parser (2.10.0)
|
|
146
|
+
rspec (3.13.1)
|
|
140
147
|
rspec-core (~> 3.13.0)
|
|
141
148
|
rspec-expectations (~> 3.13.0)
|
|
142
149
|
rspec-mocks (~> 3.13.0)
|
|
143
|
-
rspec-core (3.13.
|
|
150
|
+
rspec-core (3.13.4)
|
|
144
151
|
rspec-support (~> 3.13.0)
|
|
145
|
-
rspec-expectations (3.13.
|
|
152
|
+
rspec-expectations (3.13.5)
|
|
146
153
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
147
154
|
rspec-support (~> 3.13.0)
|
|
148
|
-
rspec-mocks (3.13.
|
|
155
|
+
rspec-mocks (3.13.5)
|
|
149
156
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
150
157
|
rspec-support (~> 3.13.0)
|
|
151
|
-
rspec-support (3.13.
|
|
152
|
-
rubocop (1.
|
|
158
|
+
rspec-support (3.13.4)
|
|
159
|
+
rubocop (1.75.8)
|
|
153
160
|
json (~> 2.3)
|
|
154
|
-
language_server-protocol (
|
|
161
|
+
language_server-protocol (~> 3.17.0.2)
|
|
162
|
+
lint_roller (~> 1.1.0)
|
|
155
163
|
parallel (~> 1.10)
|
|
156
164
|
parser (>= 3.3.0.2)
|
|
157
165
|
rainbow (>= 2.2.2, < 4.0)
|
|
158
|
-
regexp_parser (>= 2.
|
|
159
|
-
|
|
160
|
-
rubocop-ast (>= 1.31.1, < 2.0)
|
|
166
|
+
regexp_parser (>= 2.9.3, < 3.0)
|
|
167
|
+
rubocop-ast (>= 1.44.0, < 2.0)
|
|
161
168
|
ruby-progressbar (~> 1.7)
|
|
162
|
-
unicode-display_width (>= 2.4.0, <
|
|
163
|
-
rubocop-ast (1.
|
|
164
|
-
parser (>= 3.3.
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
rubocop (
|
|
169
|
+
unicode-display_width (>= 2.4.0, < 4.0)
|
|
170
|
+
rubocop-ast (1.44.1)
|
|
171
|
+
parser (>= 3.3.7.2)
|
|
172
|
+
prism (~> 1.4)
|
|
173
|
+
rubocop-rake (0.7.1)
|
|
174
|
+
lint_roller (~> 1.1)
|
|
175
|
+
rubocop (>= 1.72.1)
|
|
176
|
+
rubocop-rspec (3.6.0)
|
|
177
|
+
lint_roller (~> 1.1)
|
|
178
|
+
rubocop (~> 1.72, >= 1.72.1)
|
|
169
179
|
ruby-progressbar (1.13.0)
|
|
170
180
|
ruby_git_crypt (0.1.0)
|
|
171
181
|
immutable-struct (~> 2.4)
|
|
172
182
|
lino (>= 4.1)
|
|
173
183
|
ruby_gpg2 (0.12.0)
|
|
174
184
|
lino (>= 4.1)
|
|
175
|
-
sawyer (0.9.
|
|
185
|
+
sawyer (0.9.3)
|
|
176
186
|
addressable (>= 2.3.5)
|
|
177
187
|
faraday (>= 0.17.3, < 3)
|
|
188
|
+
securerandom (0.4.1)
|
|
178
189
|
shellany (0.0.1)
|
|
179
190
|
simplecov (0.22.0)
|
|
180
191
|
docile (~> 1.1)
|
|
@@ -183,14 +194,15 @@ GEM
|
|
|
183
194
|
simplecov-html (0.12.3)
|
|
184
195
|
simplecov_json_formatter (0.1.4)
|
|
185
196
|
sshkey (2.0.0)
|
|
186
|
-
strscan (3.1.0)
|
|
187
197
|
terminal-notifier-guard (1.7.0)
|
|
188
|
-
thor (1.3.
|
|
198
|
+
thor (1.3.2)
|
|
189
199
|
tzinfo (2.0.6)
|
|
190
200
|
concurrent-ruby (~> 1.0)
|
|
191
|
-
unicode-display_width (
|
|
192
|
-
|
|
193
|
-
|
|
201
|
+
unicode-display_width (3.1.4)
|
|
202
|
+
unicode-emoji (~> 4.0, >= 4.0.4)
|
|
203
|
+
unicode-emoji (4.0.4)
|
|
204
|
+
uri (1.1.1)
|
|
205
|
+
yard (0.9.37)
|
|
194
206
|
|
|
195
207
|
PLATFORMS
|
|
196
208
|
arm64-darwin-21
|
|
@@ -208,12 +220,11 @@ DEPENDENCIES
|
|
|
208
220
|
guard
|
|
209
221
|
guard-rspec
|
|
210
222
|
rake
|
|
211
|
-
rake_circle_ci
|
|
212
223
|
rake_git
|
|
213
224
|
rake_git_crypt
|
|
214
225
|
rake_github
|
|
215
226
|
rake_gpg
|
|
216
|
-
|
|
227
|
+
rake_slack
|
|
217
228
|
rspec
|
|
218
229
|
rubocop
|
|
219
230
|
rubocop-rake
|
|
@@ -224,4 +235,4 @@ DEPENDENCIES
|
|
|
224
235
|
yard
|
|
225
236
|
|
|
226
237
|
BUNDLED WITH
|
|
227
|
-
2.
|
|
238
|
+
2.5.15
|
data/README.md
CHANGED
|
@@ -63,16 +63,16 @@ To check for code linting / formatting issues without fixing:
|
|
|
63
63
|
You can also run `bin/console` for an interactive prompt that will allow you to
|
|
64
64
|
experiment.
|
|
65
65
|
|
|
66
|
-
### Managing
|
|
66
|
+
### Managing CI keys
|
|
67
67
|
|
|
68
|
-
To encrypt a GPG key for use by
|
|
68
|
+
To encrypt a GPG key for use by CI:
|
|
69
69
|
|
|
70
70
|
```shell
|
|
71
71
|
openssl aes-256-cbc \
|
|
72
72
|
-e \
|
|
73
73
|
-md sha1 \
|
|
74
74
|
-in ./config/secrets/ci/gpg.private \
|
|
75
|
-
-out ./.
|
|
75
|
+
-out ./.github/gpg.private.enc \
|
|
76
76
|
-k "<passphrase>"
|
|
77
77
|
```
|
|
78
78
|
|
|
@@ -82,7 +82,7 @@ To check decryption is working correctly:
|
|
|
82
82
|
openssl aes-256-cbc \
|
|
83
83
|
-d \
|
|
84
84
|
-md sha1 \
|
|
85
|
-
-in ./.
|
|
85
|
+
-in ./.github/gpg.private.enc \
|
|
86
86
|
-k "<passphrase>"
|
|
87
87
|
```
|
|
88
88
|
|
data/Rakefile
CHANGED
|
@@ -1,15 +1,13 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
-
require 'rake_circle_ci'
|
|
4
3
|
require 'rake_git'
|
|
5
4
|
require 'rake_git_crypt'
|
|
6
5
|
require 'rake_github'
|
|
7
6
|
require 'rake_gpg'
|
|
8
|
-
require '
|
|
7
|
+
require 'rake_slack'
|
|
9
8
|
require 'rspec/core/rake_task'
|
|
10
9
|
require 'rubocop/rake_task'
|
|
11
10
|
require 'securerandom'
|
|
12
|
-
require 'yaml'
|
|
13
11
|
require 'yard'
|
|
14
12
|
|
|
15
13
|
task default: %i[
|
|
@@ -60,13 +58,6 @@ namespace :encryption do
|
|
|
60
58
|
end
|
|
61
59
|
|
|
62
60
|
namespace :keys do
|
|
63
|
-
namespace :deploy do
|
|
64
|
-
RakeSSH.define_key_tasks(
|
|
65
|
-
path: 'config/secrets/ci/',
|
|
66
|
-
comment: 'maintainers@infrablocks.io'
|
|
67
|
-
)
|
|
68
|
-
end
|
|
69
|
-
|
|
70
61
|
namespace :gpg do
|
|
71
62
|
RakeGPG.define_generate_key_task(
|
|
72
63
|
output_directory: 'config/secrets/ci',
|
|
@@ -92,7 +83,6 @@ namespace :secrets do
|
|
|
92
83
|
desc 'Generate all generatable secrets.'
|
|
93
84
|
task generate: %w[
|
|
94
85
|
encryption:passphrase:generate
|
|
95
|
-
keys:deploy:generate
|
|
96
86
|
keys:gpg:generate
|
|
97
87
|
]
|
|
98
88
|
|
|
@@ -121,6 +111,11 @@ namespace :library do
|
|
|
121
111
|
|
|
122
112
|
desc 'Attempt to automatically fix issues with the library'
|
|
123
113
|
task fix: [:'rubocop:autocorrect_all']
|
|
114
|
+
|
|
115
|
+
desc 'Build the library'
|
|
116
|
+
task :build do
|
|
117
|
+
sh 'gem build ruby_vault.gemspec'
|
|
118
|
+
end
|
|
124
119
|
end
|
|
125
120
|
|
|
126
121
|
namespace :documentation do
|
|
@@ -146,54 +141,91 @@ namespace :test do
|
|
|
146
141
|
RSpec::Core::RakeTask.new(:unit)
|
|
147
142
|
end
|
|
148
143
|
|
|
149
|
-
RakeCircleCI.define_project_tasks(
|
|
150
|
-
namespace: :circle_ci,
|
|
151
|
-
project_slug: 'github/infrablocks/ruby_vault'
|
|
152
|
-
) do |t|
|
|
153
|
-
circle_ci_config =
|
|
154
|
-
YAML.load_file('config/secrets/circle_ci/config.yaml')
|
|
155
|
-
|
|
156
|
-
t.api_token = circle_ci_config['circle_ci_api_token']
|
|
157
|
-
t.environment_variables = {
|
|
158
|
-
ENCRYPTION_PASSPHRASE:
|
|
159
|
-
File.read('config/secrets/ci/encryption.passphrase')
|
|
160
|
-
.chomp
|
|
161
|
-
}
|
|
162
|
-
t.checkout_keys = []
|
|
163
|
-
t.ssh_keys = [
|
|
164
|
-
{
|
|
165
|
-
hostname: 'github.com',
|
|
166
|
-
private_key: File.read('config/secrets/ci/ssh.private')
|
|
167
|
-
}
|
|
168
|
-
]
|
|
169
|
-
end
|
|
170
|
-
|
|
171
144
|
RakeGithub.define_repository_tasks(
|
|
172
145
|
namespace: :github,
|
|
173
146
|
repository: 'infrablocks/ruby_vault'
|
|
174
147
|
) do |t|
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
148
|
+
# Operator's ambient auth. Resolve once and fail fast: a missing,
|
|
149
|
+
# unauthenticated, or absent gh yields an empty string, which would
|
|
150
|
+
# otherwise surface later as an opaque Octokit 401. An empty or
|
|
151
|
+
# whitespace-only GITHUB_TOKEN is treated as absent so an authenticated
|
|
152
|
+
# operator falls through to `gh auth token` rather than hitting the raise.
|
|
153
|
+
github_token = ENV['GITHUB_TOKEN'].to_s.strip
|
|
154
|
+
if github_token.empty?
|
|
155
|
+
github_token = begin
|
|
156
|
+
`gh auth token`
|
|
157
|
+
rescue Errno::ENOENT
|
|
158
|
+
''
|
|
159
|
+
end.strip
|
|
160
|
+
end
|
|
161
|
+
if github_token.empty?
|
|
162
|
+
raise 'No GitHub token available: set GITHUB_TOKEN or run `gh auth login`'
|
|
163
|
+
end
|
|
164
|
+
|
|
165
|
+
t.access_token = github_token
|
|
166
|
+
|
|
167
|
+
# Actions store only: dependabot runs never reach the passphrase — the
|
|
168
|
+
# only pr.yaml job that unlocks git-crypt (prerelease) is guarded to
|
|
169
|
+
# same-repo human PRs. Guard against a locked clone: without
|
|
170
|
+
# it, File.read returns git-crypt ciphertext and github:secrets:ensure
|
|
171
|
+
# silently uploads garbage that only surfaces much later as an opaque
|
|
172
|
+
# GPG unlock failure in the release job.
|
|
173
|
+
passphrase_path = 'config/secrets/ci/encryption.passphrase'
|
|
174
|
+
unless File.exist?(passphrase_path)
|
|
175
|
+
raise "Passphrase file not found: #{passphrase_path} — expected a " \
|
|
176
|
+
'git-crypt-unlocked clone with the CI secrets present'
|
|
177
|
+
end
|
|
178
|
+
passphrase = File.binread(passphrase_path)
|
|
179
|
+
if passphrase.start_with?("\x00GITCRYPT")
|
|
180
|
+
raise 'encryption.passphrase is git-crypt ciphertext — unlock the ' \
|
|
181
|
+
'clone before provisioning'
|
|
182
|
+
end
|
|
183
|
+
|
|
184
|
+
t.secrets = [
|
|
185
|
+
{ name: 'ENCRYPTION_PASSPHRASE', value: passphrase.chomp }
|
|
186
|
+
]
|
|
187
|
+
t.environments = [
|
|
188
|
+
{ name: 'release',
|
|
189
|
+
reviewers: [{ team: 'maintainers' }] }
|
|
184
190
|
]
|
|
185
191
|
end
|
|
186
192
|
|
|
187
193
|
namespace :pipeline do
|
|
188
|
-
desc 'Prepare
|
|
194
|
+
desc 'Prepare GitHub Actions pipeline'
|
|
189
195
|
task prepare: %i[
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
circle_ci:ssh_keys:ensure
|
|
193
|
-
github:deploy_keys:ensure
|
|
196
|
+
github:secrets:ensure
|
|
197
|
+
github:environments:ensure
|
|
194
198
|
]
|
|
195
199
|
end
|
|
196
200
|
|
|
201
|
+
namespace :slack do
|
|
202
|
+
RakeSlack.define_notification_tasks do |t|
|
|
203
|
+
t.bot_token = ENV.fetch('SLACK_BOT_TOKEN', nil)
|
|
204
|
+
t.routing_rules = [
|
|
205
|
+
{ when: { type: 'on_hold' },
|
|
206
|
+
channel: 'C038EDCRSQJ', format: :on_hold }, # release
|
|
207
|
+
{ when: { actor: 'dependabot[bot]', outcome: 'success' },
|
|
208
|
+
channel: 'C03N711HVDG', format: :success }, # builds-dependabot
|
|
209
|
+
{ when: { actor: 'dependabot[bot]' },
|
|
210
|
+
channel: 'C03N711HVDG', format: :failure }, # builds-dependabot
|
|
211
|
+
{ when: { outcome: 'success' },
|
|
212
|
+
channel: 'C023XUE76GH', format: :success }, # builds
|
|
213
|
+
# Failures go to builds, not team-dev (org default), to keep noise
|
|
214
|
+
# out of a popular channel while this pipeline beds in.
|
|
215
|
+
{ when: {},
|
|
216
|
+
channel: 'C023XUE76GH', format: :failure } # builds
|
|
217
|
+
]
|
|
218
|
+
end
|
|
219
|
+
end
|
|
220
|
+
|
|
221
|
+
namespace :repository do
|
|
222
|
+
desc 'Set the git author for CI'
|
|
223
|
+
task :set_ci_author do
|
|
224
|
+
sh 'git config --global user.name "InfraBlocks CI"'
|
|
225
|
+
sh 'git config --global user.email "ci@infrablocks.io"'
|
|
226
|
+
end
|
|
227
|
+
end
|
|
228
|
+
|
|
197
229
|
namespace :version do
|
|
198
230
|
desc 'Bump version for specified type (pre, major, minor, patch)'
|
|
199
231
|
task :bump, [:type] do |_, args|
|
|
@@ -201,6 +233,38 @@ namespace :version do
|
|
|
201
233
|
end
|
|
202
234
|
end
|
|
203
235
|
|
|
236
|
+
namespace :prerelease do
|
|
237
|
+
desc 'Build and push a namespaced pre-release to RubyGems ' \
|
|
238
|
+
'(PR CI only; no bump, no tag, no commit, no push)'
|
|
239
|
+
task :publish, %i[pr_number run_number run_attempt] do |_, args|
|
|
240
|
+
%i[pr_number run_number run_attempt].each do |name|
|
|
241
|
+
raise "Missing task argument: #{name}" if args[name].to_s.empty?
|
|
242
|
+
end
|
|
243
|
+
|
|
244
|
+
version_file = 'lib/ruby_vault/version.rb'
|
|
245
|
+
version_pattern = /(VERSION\s*=\s*')([^']+)(')/
|
|
246
|
+
source = File.read(version_file)
|
|
247
|
+
base = source[version_pattern, 2]
|
|
248
|
+
raise "Could not read VERSION from #{version_file}" unless base
|
|
249
|
+
|
|
250
|
+
version = "#{base}.pr#{args.pr_number}" \
|
|
251
|
+
".#{args.run_number}.#{args.run_attempt}"
|
|
252
|
+
gem_file = "ruby_vault-#{version}.gem"
|
|
253
|
+
begin
|
|
254
|
+
File.write(version_file,
|
|
255
|
+
source.sub(version_pattern, "\\1#{version}\\3"))
|
|
256
|
+
# Build + push directly: `gem release` aborts on the (deliberately)
|
|
257
|
+
# uncommitted version rewrite. PR CI must not tag, commit, or push
|
|
258
|
+
# (contrast the `release` task).
|
|
259
|
+
sh 'gem build ruby_vault.gemspec'
|
|
260
|
+
sh "gem push #{gem_file}"
|
|
261
|
+
ensure
|
|
262
|
+
File.write(version_file, source)
|
|
263
|
+
rm_f gem_file
|
|
264
|
+
end
|
|
265
|
+
end
|
|
266
|
+
end
|
|
267
|
+
|
|
204
268
|
desc 'Release gem'
|
|
205
269
|
task :release do
|
|
206
270
|
sh 'gem release --tag --push'
|
|
@@ -6,8 +6,8 @@ require_relative 'types/flag'
|
|
|
6
6
|
module RubyVault
|
|
7
7
|
module Options
|
|
8
8
|
module Types
|
|
9
|
-
def self.standard(name, value, **
|
|
10
|
-
Standard.new(name, value, **
|
|
9
|
+
def self.standard(name, value, **)
|
|
10
|
+
Standard.new(name, value, **)
|
|
11
11
|
end
|
|
12
12
|
|
|
13
13
|
def self.flag(name, value)
|
data/lib/ruby_vault/version.rb
CHANGED
data/ruby_vault.gemspec
CHANGED
|
@@ -36,7 +36,7 @@ Gem::Specification.new do |spec|
|
|
|
36
36
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
|
37
37
|
spec.require_paths = ['lib']
|
|
38
38
|
|
|
39
|
-
spec.required_ruby_version = '>= 3.
|
|
39
|
+
spec.required_ruby_version = '>= 3.3'
|
|
40
40
|
|
|
41
41
|
spec.add_dependency 'immutable-struct', '~> 2.4'
|
|
42
42
|
spec.add_dependency 'lino', '>= 4.1'
|
|
@@ -47,12 +47,11 @@ Gem::Specification.new do |spec|
|
|
|
47
47
|
spec.add_development_dependency 'guard'
|
|
48
48
|
spec.add_development_dependency 'guard-rspec'
|
|
49
49
|
spec.add_development_dependency 'rake'
|
|
50
|
-
spec.add_development_dependency 'rake_circle_ci'
|
|
51
50
|
spec.add_development_dependency 'rake_git'
|
|
52
51
|
spec.add_development_dependency 'rake_git_crypt'
|
|
53
52
|
spec.add_development_dependency 'rake_github'
|
|
54
53
|
spec.add_development_dependency 'rake_gpg'
|
|
55
|
-
spec.add_development_dependency '
|
|
54
|
+
spec.add_development_dependency 'rake_slack'
|
|
56
55
|
spec.add_development_dependency 'rspec'
|
|
57
56
|
spec.add_development_dependency 'rubocop'
|
|
58
57
|
spec.add_development_dependency 'rubocop-rake'
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: ruby_vault
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.3.0.pre.1
|
|
4
|
+
version: 0.3.0.pre.2.pr131.4.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- InfraBlocks Maintainers
|
|
8
|
-
autorequire:
|
|
8
|
+
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2026-07-23 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: immutable-struct
|
|
@@ -122,20 +122,6 @@ dependencies:
|
|
|
122
122
|
- - ">="
|
|
123
123
|
- !ruby/object:Gem::Version
|
|
124
124
|
version: '0'
|
|
125
|
-
- !ruby/object:Gem::Dependency
|
|
126
|
-
name: rake_circle_ci
|
|
127
|
-
requirement: !ruby/object:Gem::Requirement
|
|
128
|
-
requirements:
|
|
129
|
-
- - ">="
|
|
130
|
-
- !ruby/object:Gem::Version
|
|
131
|
-
version: '0'
|
|
132
|
-
type: :development
|
|
133
|
-
prerelease: false
|
|
134
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
135
|
-
requirements:
|
|
136
|
-
- - ">="
|
|
137
|
-
- !ruby/object:Gem::Version
|
|
138
|
-
version: '0'
|
|
139
125
|
- !ruby/object:Gem::Dependency
|
|
140
126
|
name: rake_git
|
|
141
127
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -193,7 +179,7 @@ dependencies:
|
|
|
193
179
|
- !ruby/object:Gem::Version
|
|
194
180
|
version: '0'
|
|
195
181
|
- !ruby/object:Gem::Dependency
|
|
196
|
-
name:
|
|
182
|
+
name: rake_slack
|
|
197
183
|
requirement: !ruby/object:Gem::Requirement
|
|
198
184
|
requirements:
|
|
199
185
|
- - ">="
|
|
@@ -350,7 +336,7 @@ licenses:
|
|
|
350
336
|
- MIT
|
|
351
337
|
metadata:
|
|
352
338
|
rubygems_mfa_required: 'false'
|
|
353
|
-
post_install_message:
|
|
339
|
+
post_install_message:
|
|
354
340
|
rdoc_options: []
|
|
355
341
|
require_paths:
|
|
356
342
|
- lib
|
|
@@ -358,15 +344,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
358
344
|
requirements:
|
|
359
345
|
- - ">="
|
|
360
346
|
- !ruby/object:Gem::Version
|
|
361
|
-
version: '3.
|
|
347
|
+
version: '3.3'
|
|
362
348
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
363
349
|
requirements:
|
|
364
|
-
- - "
|
|
350
|
+
- - ">="
|
|
365
351
|
- !ruby/object:Gem::Version
|
|
366
|
-
version:
|
|
352
|
+
version: '0'
|
|
367
353
|
requirements: []
|
|
368
|
-
rubygems_version: 3.
|
|
369
|
-
signing_key:
|
|
354
|
+
rubygems_version: 3.5.22
|
|
355
|
+
signing_key:
|
|
370
356
|
specification_version: 4
|
|
371
357
|
summary: A simple Ruby wrapper for invoking Vault commands.
|
|
372
358
|
test_files: []
|