ruby_vault 0.3.0.pre.2 → 0.3.0.pre.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile.lock +92 -83
- data/README.md +4 -4
- data/Rakefile +111 -47
- data/lib/ruby_vault/options/types.rb +2 -2
- data/lib/ruby_vault/version.rb +1 -1
- data/ruby_vault.gemspec +2 -3
- metadata +10 -24
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: a3b77227fc9e2bdd03c3fe0aab40f11cb328d7e68cfbefef64305e9d32a6b53d
|
|
4
|
+
data.tar.gz: 0bda1482b38e6ebdbe5bae02efe30059122325ced2c74d2f466b44bb94d6b7e9
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: f4212a33fd9acedd4884293687bd03290cf1599fe95321c995753e9e61d5e90d89ed1156a4f6d164615b16936fe927baf3c63a48d76d29b40167fa31bb5284c4
|
|
7
|
+
data.tar.gz: d71c285d6477617c3df0a77fb0361e92c75be6abc22ba3ccc92bf0afbfdf48d228dd1ec314df95be38d3c237ef97cb082e4a47cda372f3775299377bc30f52ad
|
data/Gemfile.lock
CHANGED
|
@@ -1,58 +1,66 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
ruby_vault (0.3.0.pre.
|
|
4
|
+
ruby_vault (0.3.0.pre.3)
|
|
5
5
|
immutable-struct (~> 2.4)
|
|
6
6
|
lino (>= 4.1)
|
|
7
7
|
|
|
8
8
|
GEM
|
|
9
9
|
remote: https://rubygems.org/
|
|
10
10
|
specs:
|
|
11
|
-
activesupport (
|
|
11
|
+
activesupport (8.1.3)
|
|
12
12
|
base64
|
|
13
13
|
bigdecimal
|
|
14
|
-
concurrent-ruby (~> 1.0, >= 1.
|
|
14
|
+
concurrent-ruby (~> 1.0, >= 1.3.1)
|
|
15
15
|
connection_pool (>= 2.2.5)
|
|
16
16
|
drb
|
|
17
17
|
i18n (>= 1.6, < 2)
|
|
18
|
+
json
|
|
19
|
+
logger (>= 1.4.2)
|
|
18
20
|
minitest (>= 5.1)
|
|
19
|
-
|
|
20
|
-
tzinfo (~> 2.0)
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
21
|
+
securerandom (>= 0.3)
|
|
22
|
+
tzinfo (~> 2.0, >= 2.0.5)
|
|
23
|
+
uri (>= 0.13.1)
|
|
24
|
+
addressable (2.9.0)
|
|
25
|
+
public_suffix (>= 2.0.2, < 8.0)
|
|
26
|
+
ast (2.4.3)
|
|
27
|
+
base64 (0.3.0)
|
|
28
|
+
bigdecimal (4.1.2)
|
|
26
29
|
childprocess (5.0.0)
|
|
27
30
|
coderay (1.1.3)
|
|
28
31
|
colored2 (3.1.2)
|
|
29
|
-
concurrent-ruby (1.3.
|
|
30
|
-
connection_pool (
|
|
31
|
-
diff-lcs (1.
|
|
32
|
+
concurrent-ruby (1.3.8)
|
|
33
|
+
connection_pool (3.0.2)
|
|
34
|
+
diff-lcs (1.6.2)
|
|
32
35
|
docile (1.4.0)
|
|
33
|
-
drb (2.2.
|
|
34
|
-
excon (
|
|
35
|
-
|
|
36
|
+
drb (2.2.3)
|
|
37
|
+
excon (1.6.0)
|
|
38
|
+
logger
|
|
39
|
+
faker (3.5.1)
|
|
36
40
|
i18n (>= 1.8.11, < 2)
|
|
37
|
-
faraday (2.
|
|
38
|
-
faraday-net_http (>= 2.0, < 3.
|
|
41
|
+
faraday (2.14.3)
|
|
42
|
+
faraday-net_http (>= 2.0, < 3.5)
|
|
43
|
+
json
|
|
39
44
|
logger
|
|
40
|
-
faraday-net_http (3.
|
|
41
|
-
net-http
|
|
42
|
-
ffi (1.17.
|
|
43
|
-
ffi (1.17.
|
|
44
|
-
ffi (1.17.
|
|
45
|
+
faraday-net_http (3.4.4)
|
|
46
|
+
net-http (~> 0.5)
|
|
47
|
+
ffi (1.17.4)
|
|
48
|
+
ffi (1.17.4-arm64-darwin)
|
|
49
|
+
ffi (1.17.4-x86_64-darwin)
|
|
50
|
+
ffi (1.17.4-x86_64-linux-gnu)
|
|
45
51
|
formatador (1.1.0)
|
|
46
|
-
gem-release (2.2.
|
|
52
|
+
gem-release (2.2.4)
|
|
47
53
|
git (1.19.1)
|
|
48
54
|
addressable (~> 2.8)
|
|
49
55
|
rchardet (~> 1.8)
|
|
50
|
-
guard (2.
|
|
56
|
+
guard (2.19.1)
|
|
51
57
|
formatador (>= 0.2.4)
|
|
52
58
|
listen (>= 2.7, < 4.0)
|
|
59
|
+
logger (~> 1.6)
|
|
53
60
|
lumberjack (>= 1.0.12, < 2.0)
|
|
54
61
|
nenv (~> 0.1)
|
|
55
62
|
notiffany (~> 0.0)
|
|
63
|
+
ostruct (~> 0.6)
|
|
56
64
|
pry (>= 0.13.0)
|
|
57
65
|
shellany (~> 0.0)
|
|
58
66
|
thor (>= 0.18.1)
|
|
@@ -63,50 +71,46 @@ GEM
|
|
|
63
71
|
rspec (>= 2.99.0, < 4.0)
|
|
64
72
|
hamster (3.0.0)
|
|
65
73
|
concurrent-ruby (~> 1.0)
|
|
66
|
-
i18n (1.
|
|
74
|
+
i18n (1.15.2)
|
|
67
75
|
concurrent-ruby (~> 1.0)
|
|
68
|
-
immutable-struct (2.
|
|
69
|
-
json (2.
|
|
70
|
-
language_server-protocol (3.17.0.
|
|
76
|
+
immutable-struct (2.5.0)
|
|
77
|
+
json (2.12.2)
|
|
78
|
+
language_server-protocol (3.17.0.5)
|
|
71
79
|
lino (4.1.0)
|
|
72
80
|
childprocess (~> 5.0.0)
|
|
73
81
|
hamster (~> 3.0)
|
|
74
82
|
open4 (~> 1.3)
|
|
83
|
+
lint_roller (1.1.0)
|
|
75
84
|
listen (3.9.0)
|
|
76
85
|
rb-fsevent (~> 0.10, >= 0.10.3)
|
|
77
86
|
rb-inotify (~> 0.9, >= 0.9.10)
|
|
78
|
-
logger (1.
|
|
87
|
+
logger (1.7.0)
|
|
79
88
|
lumberjack (1.2.10)
|
|
80
89
|
method_source (1.1.0)
|
|
81
|
-
minitest (5.
|
|
82
|
-
mutex_m (0.2.0)
|
|
90
|
+
minitest (5.27.0)
|
|
83
91
|
nenv (0.3.0)
|
|
84
|
-
net-http (0.
|
|
85
|
-
uri
|
|
92
|
+
net-http (0.9.1)
|
|
93
|
+
uri (>= 0.11.1)
|
|
86
94
|
notiffany (0.1.3)
|
|
87
95
|
nenv (~> 0.1)
|
|
88
96
|
shellany (~> 0.0)
|
|
89
|
-
octokit (
|
|
90
|
-
base64
|
|
97
|
+
octokit (10.0.0)
|
|
91
98
|
faraday (>= 1, < 3)
|
|
92
99
|
sawyer (~> 0.9)
|
|
93
100
|
open4 (1.3.4)
|
|
94
|
-
|
|
95
|
-
|
|
101
|
+
ostruct (0.6.1)
|
|
102
|
+
parallel (1.27.0)
|
|
103
|
+
parser (3.3.8.0)
|
|
96
104
|
ast (~> 2.4.1)
|
|
97
105
|
racc
|
|
98
|
-
|
|
106
|
+
prism (1.4.0)
|
|
107
|
+
pry (0.15.2)
|
|
99
108
|
coderay (~> 1.1)
|
|
100
109
|
method_source (~> 1.0)
|
|
101
|
-
public_suffix (
|
|
102
|
-
racc (1.8.
|
|
110
|
+
public_suffix (7.0.5)
|
|
111
|
+
racc (1.8.1)
|
|
103
112
|
rainbow (3.1.1)
|
|
104
|
-
rake (13.2
|
|
105
|
-
rake_circle_ci (0.11.0)
|
|
106
|
-
colored2 (~> 3.1)
|
|
107
|
-
excon (~> 0.72)
|
|
108
|
-
rake_factory (~> 0.23)
|
|
109
|
-
sshkey (~> 2.0)
|
|
113
|
+
rake (13.4.2)
|
|
110
114
|
rake_factory (0.33.0)
|
|
111
115
|
activesupport (>= 4)
|
|
112
116
|
rake (~> 13.0)
|
|
@@ -114,69 +118,74 @@ GEM
|
|
|
114
118
|
colored2 (~> 3.1)
|
|
115
119
|
git (~> 1.13, >= 1.13.2)
|
|
116
120
|
rake_factory (~> 0.33)
|
|
117
|
-
rake_git_crypt (0.
|
|
121
|
+
rake_git_crypt (0.4.0)
|
|
118
122
|
colored2 (~> 3.1)
|
|
123
|
+
lino (~> 4.1)
|
|
119
124
|
rake_factory (~> 0.33)
|
|
120
125
|
ruby_git_crypt (~> 0.1)
|
|
121
126
|
ruby_gpg2 (~> 0.12)
|
|
122
|
-
rake_github (0.
|
|
127
|
+
rake_github (0.17.0)
|
|
123
128
|
colored2 (~> 3.1)
|
|
124
|
-
octokit (>=
|
|
125
|
-
rake_factory (~> 0.
|
|
129
|
+
octokit (>= 7.0, < 11.0)
|
|
130
|
+
rake_factory (~> 0.33)
|
|
131
|
+
rbnacl (~> 7.1)
|
|
126
132
|
sshkey (~> 2.0)
|
|
127
133
|
rake_gpg (0.20.0)
|
|
128
134
|
rake_factory (~> 0.33)
|
|
129
135
|
ruby_gpg2 (~> 0.12)
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
rake_factory (~> 0.
|
|
133
|
-
sshkey (~> 2.0)
|
|
136
|
+
rake_slack (0.3.0)
|
|
137
|
+
excon (>= 0.72, < 2.0)
|
|
138
|
+
rake_factory (~> 0.33)
|
|
134
139
|
rb-fsevent (0.11.2)
|
|
135
140
|
rb-inotify (0.11.1)
|
|
136
141
|
ffi (~> 1.0)
|
|
142
|
+
rbnacl (7.1.2)
|
|
143
|
+
ffi (~> 1)
|
|
137
144
|
rchardet (1.8.0)
|
|
138
|
-
regexp_parser (2.
|
|
139
|
-
|
|
140
|
-
strscan
|
|
141
|
-
rspec (3.13.0)
|
|
145
|
+
regexp_parser (2.10.0)
|
|
146
|
+
rspec (3.13.1)
|
|
142
147
|
rspec-core (~> 3.13.0)
|
|
143
148
|
rspec-expectations (~> 3.13.0)
|
|
144
149
|
rspec-mocks (~> 3.13.0)
|
|
145
|
-
rspec-core (3.13.
|
|
150
|
+
rspec-core (3.13.4)
|
|
146
151
|
rspec-support (~> 3.13.0)
|
|
147
|
-
rspec-expectations (3.13.
|
|
152
|
+
rspec-expectations (3.13.5)
|
|
148
153
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
149
154
|
rspec-support (~> 3.13.0)
|
|
150
|
-
rspec-mocks (3.13.
|
|
155
|
+
rspec-mocks (3.13.5)
|
|
151
156
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
152
157
|
rspec-support (~> 3.13.0)
|
|
153
|
-
rspec-support (3.13.
|
|
154
|
-
rubocop (1.
|
|
158
|
+
rspec-support (3.13.4)
|
|
159
|
+
rubocop (1.75.8)
|
|
155
160
|
json (~> 2.3)
|
|
156
|
-
language_server-protocol (
|
|
161
|
+
language_server-protocol (~> 3.17.0.2)
|
|
162
|
+
lint_roller (~> 1.1.0)
|
|
157
163
|
parallel (~> 1.10)
|
|
158
164
|
parser (>= 3.3.0.2)
|
|
159
165
|
rainbow (>= 2.2.2, < 4.0)
|
|
160
|
-
regexp_parser (>= 2.
|
|
161
|
-
|
|
162
|
-
rubocop-ast (>= 1.31.1, < 2.0)
|
|
166
|
+
regexp_parser (>= 2.9.3, < 3.0)
|
|
167
|
+
rubocop-ast (>= 1.44.0, < 2.0)
|
|
163
168
|
ruby-progressbar (~> 1.7)
|
|
164
|
-
unicode-display_width (>= 2.4.0, <
|
|
165
|
-
rubocop-ast (1.
|
|
166
|
-
parser (>= 3.3.
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
rubocop (
|
|
169
|
+
unicode-display_width (>= 2.4.0, < 4.0)
|
|
170
|
+
rubocop-ast (1.44.1)
|
|
171
|
+
parser (>= 3.3.7.2)
|
|
172
|
+
prism (~> 1.4)
|
|
173
|
+
rubocop-rake (0.7.1)
|
|
174
|
+
lint_roller (~> 1.1)
|
|
175
|
+
rubocop (>= 1.72.1)
|
|
176
|
+
rubocop-rspec (3.6.0)
|
|
177
|
+
lint_roller (~> 1.1)
|
|
178
|
+
rubocop (~> 1.72, >= 1.72.1)
|
|
171
179
|
ruby-progressbar (1.13.0)
|
|
172
180
|
ruby_git_crypt (0.1.0)
|
|
173
181
|
immutable-struct (~> 2.4)
|
|
174
182
|
lino (>= 4.1)
|
|
175
183
|
ruby_gpg2 (0.12.0)
|
|
176
184
|
lino (>= 4.1)
|
|
177
|
-
sawyer (0.9.
|
|
185
|
+
sawyer (0.9.3)
|
|
178
186
|
addressable (>= 2.3.5)
|
|
179
187
|
faraday (>= 0.17.3, < 3)
|
|
188
|
+
securerandom (0.4.1)
|
|
180
189
|
shellany (0.0.1)
|
|
181
190
|
simplecov (0.22.0)
|
|
182
191
|
docile (~> 1.1)
|
|
@@ -185,14 +194,15 @@ GEM
|
|
|
185
194
|
simplecov-html (0.12.3)
|
|
186
195
|
simplecov_json_formatter (0.1.4)
|
|
187
196
|
sshkey (2.0.0)
|
|
188
|
-
strscan (3.1.0)
|
|
189
197
|
terminal-notifier-guard (1.7.0)
|
|
190
|
-
thor (1.3.
|
|
198
|
+
thor (1.3.2)
|
|
191
199
|
tzinfo (2.0.6)
|
|
192
200
|
concurrent-ruby (~> 1.0)
|
|
193
|
-
unicode-display_width (
|
|
194
|
-
|
|
195
|
-
|
|
201
|
+
unicode-display_width (3.1.4)
|
|
202
|
+
unicode-emoji (~> 4.0, >= 4.0.4)
|
|
203
|
+
unicode-emoji (4.0.4)
|
|
204
|
+
uri (1.1.1)
|
|
205
|
+
yard (0.9.37)
|
|
196
206
|
|
|
197
207
|
PLATFORMS
|
|
198
208
|
arm64-darwin-21
|
|
@@ -210,12 +220,11 @@ DEPENDENCIES
|
|
|
210
220
|
guard
|
|
211
221
|
guard-rspec
|
|
212
222
|
rake
|
|
213
|
-
rake_circle_ci
|
|
214
223
|
rake_git
|
|
215
224
|
rake_git_crypt
|
|
216
225
|
rake_github
|
|
217
226
|
rake_gpg
|
|
218
|
-
|
|
227
|
+
rake_slack
|
|
219
228
|
rspec
|
|
220
229
|
rubocop
|
|
221
230
|
rubocop-rake
|
data/README.md
CHANGED
|
@@ -63,16 +63,16 @@ To check for code linting / formatting issues without fixing:
|
|
|
63
63
|
You can also run `bin/console` for an interactive prompt that will allow you to
|
|
64
64
|
experiment.
|
|
65
65
|
|
|
66
|
-
### Managing
|
|
66
|
+
### Managing CI keys
|
|
67
67
|
|
|
68
|
-
To encrypt a GPG key for use by
|
|
68
|
+
To encrypt a GPG key for use by CI:
|
|
69
69
|
|
|
70
70
|
```shell
|
|
71
71
|
openssl aes-256-cbc \
|
|
72
72
|
-e \
|
|
73
73
|
-md sha1 \
|
|
74
74
|
-in ./config/secrets/ci/gpg.private \
|
|
75
|
-
-out ./.
|
|
75
|
+
-out ./.github/gpg.private.enc \
|
|
76
76
|
-k "<passphrase>"
|
|
77
77
|
```
|
|
78
78
|
|
|
@@ -82,7 +82,7 @@ To check decryption is working correctly:
|
|
|
82
82
|
openssl aes-256-cbc \
|
|
83
83
|
-d \
|
|
84
84
|
-md sha1 \
|
|
85
|
-
-in ./.
|
|
85
|
+
-in ./.github/gpg.private.enc \
|
|
86
86
|
-k "<passphrase>"
|
|
87
87
|
```
|
|
88
88
|
|
data/Rakefile
CHANGED
|
@@ -1,15 +1,13 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
-
require 'rake_circle_ci'
|
|
4
3
|
require 'rake_git'
|
|
5
4
|
require 'rake_git_crypt'
|
|
6
5
|
require 'rake_github'
|
|
7
6
|
require 'rake_gpg'
|
|
8
|
-
require '
|
|
7
|
+
require 'rake_slack'
|
|
9
8
|
require 'rspec/core/rake_task'
|
|
10
9
|
require 'rubocop/rake_task'
|
|
11
10
|
require 'securerandom'
|
|
12
|
-
require 'yaml'
|
|
13
11
|
require 'yard'
|
|
14
12
|
|
|
15
13
|
task default: %i[
|
|
@@ -60,13 +58,6 @@ namespace :encryption do
|
|
|
60
58
|
end
|
|
61
59
|
|
|
62
60
|
namespace :keys do
|
|
63
|
-
namespace :deploy do
|
|
64
|
-
RakeSSH.define_key_tasks(
|
|
65
|
-
path: 'config/secrets/ci/',
|
|
66
|
-
comment: 'maintainers@infrablocks.io'
|
|
67
|
-
)
|
|
68
|
-
end
|
|
69
|
-
|
|
70
61
|
namespace :gpg do
|
|
71
62
|
RakeGPG.define_generate_key_task(
|
|
72
63
|
output_directory: 'config/secrets/ci',
|
|
@@ -92,7 +83,6 @@ namespace :secrets do
|
|
|
92
83
|
desc 'Generate all generatable secrets.'
|
|
93
84
|
task generate: %w[
|
|
94
85
|
encryption:passphrase:generate
|
|
95
|
-
keys:deploy:generate
|
|
96
86
|
keys:gpg:generate
|
|
97
87
|
]
|
|
98
88
|
|
|
@@ -121,6 +111,11 @@ namespace :library do
|
|
|
121
111
|
|
|
122
112
|
desc 'Attempt to automatically fix issues with the library'
|
|
123
113
|
task fix: [:'rubocop:autocorrect_all']
|
|
114
|
+
|
|
115
|
+
desc 'Build the library'
|
|
116
|
+
task :build do
|
|
117
|
+
sh 'gem build ruby_vault.gemspec'
|
|
118
|
+
end
|
|
124
119
|
end
|
|
125
120
|
|
|
126
121
|
namespace :documentation do
|
|
@@ -146,54 +141,91 @@ namespace :test do
|
|
|
146
141
|
RSpec::Core::RakeTask.new(:unit)
|
|
147
142
|
end
|
|
148
143
|
|
|
149
|
-
RakeCircleCI.define_project_tasks(
|
|
150
|
-
namespace: :circle_ci,
|
|
151
|
-
project_slug: 'github/infrablocks/ruby_vault'
|
|
152
|
-
) do |t|
|
|
153
|
-
circle_ci_config =
|
|
154
|
-
YAML.load_file('config/secrets/circle_ci/config.yaml')
|
|
155
|
-
|
|
156
|
-
t.api_token = circle_ci_config['circle_ci_api_token']
|
|
157
|
-
t.environment_variables = {
|
|
158
|
-
ENCRYPTION_PASSPHRASE:
|
|
159
|
-
File.read('config/secrets/ci/encryption.passphrase')
|
|
160
|
-
.chomp
|
|
161
|
-
}
|
|
162
|
-
t.checkout_keys = []
|
|
163
|
-
t.ssh_keys = [
|
|
164
|
-
{
|
|
165
|
-
hostname: 'github.com',
|
|
166
|
-
private_key: File.read('config/secrets/ci/ssh.private')
|
|
167
|
-
}
|
|
168
|
-
]
|
|
169
|
-
end
|
|
170
|
-
|
|
171
144
|
RakeGithub.define_repository_tasks(
|
|
172
145
|
namespace: :github,
|
|
173
146
|
repository: 'infrablocks/ruby_vault'
|
|
174
147
|
) do |t|
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
148
|
+
# Operator's ambient auth. Resolve once and fail fast: a missing,
|
|
149
|
+
# unauthenticated, or absent gh yields an empty string, which would
|
|
150
|
+
# otherwise surface later as an opaque Octokit 401. An empty or
|
|
151
|
+
# whitespace-only GITHUB_TOKEN is treated as absent so an authenticated
|
|
152
|
+
# operator falls through to `gh auth token` rather than hitting the raise.
|
|
153
|
+
github_token = ENV['GITHUB_TOKEN'].to_s.strip
|
|
154
|
+
if github_token.empty?
|
|
155
|
+
github_token = begin
|
|
156
|
+
`gh auth token`
|
|
157
|
+
rescue Errno::ENOENT
|
|
158
|
+
''
|
|
159
|
+
end.strip
|
|
160
|
+
end
|
|
161
|
+
if github_token.empty?
|
|
162
|
+
raise 'No GitHub token available: set GITHUB_TOKEN or run `gh auth login`'
|
|
163
|
+
end
|
|
164
|
+
|
|
165
|
+
t.access_token = github_token
|
|
166
|
+
|
|
167
|
+
# Actions store only: dependabot runs never reach the passphrase — the
|
|
168
|
+
# only pr.yaml job that unlocks git-crypt (prerelease) is guarded to
|
|
169
|
+
# same-repo human PRs. Guard against a locked clone: without
|
|
170
|
+
# it, File.read returns git-crypt ciphertext and github:secrets:ensure
|
|
171
|
+
# silently uploads garbage that only surfaces much later as an opaque
|
|
172
|
+
# GPG unlock failure in the release job.
|
|
173
|
+
passphrase_path = 'config/secrets/ci/encryption.passphrase'
|
|
174
|
+
unless File.exist?(passphrase_path)
|
|
175
|
+
raise "Passphrase file not found: #{passphrase_path} — expected a " \
|
|
176
|
+
'git-crypt-unlocked clone with the CI secrets present'
|
|
177
|
+
end
|
|
178
|
+
passphrase = File.binread(passphrase_path)
|
|
179
|
+
if passphrase.start_with?("\x00GITCRYPT")
|
|
180
|
+
raise 'encryption.passphrase is git-crypt ciphertext — unlock the ' \
|
|
181
|
+
'clone before provisioning'
|
|
182
|
+
end
|
|
183
|
+
|
|
184
|
+
t.secrets = [
|
|
185
|
+
{ name: 'ENCRYPTION_PASSPHRASE', value: passphrase.chomp }
|
|
186
|
+
]
|
|
187
|
+
t.environments = [
|
|
188
|
+
{ name: 'release',
|
|
189
|
+
reviewers: [{ team: 'maintainers' }] }
|
|
184
190
|
]
|
|
185
191
|
end
|
|
186
192
|
|
|
187
193
|
namespace :pipeline do
|
|
188
|
-
desc 'Prepare
|
|
194
|
+
desc 'Prepare GitHub Actions pipeline'
|
|
189
195
|
task prepare: %i[
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
circle_ci:ssh_keys:ensure
|
|
193
|
-
github:deploy_keys:ensure
|
|
196
|
+
github:secrets:ensure
|
|
197
|
+
github:environments:ensure
|
|
194
198
|
]
|
|
195
199
|
end
|
|
196
200
|
|
|
201
|
+
namespace :slack do
|
|
202
|
+
RakeSlack.define_notification_tasks do |t|
|
|
203
|
+
t.bot_token = ENV.fetch('SLACK_BOT_TOKEN', nil)
|
|
204
|
+
t.routing_rules = [
|
|
205
|
+
{ when: { type: 'on_hold' },
|
|
206
|
+
channel: 'C038EDCRSQJ', format: :on_hold }, # release
|
|
207
|
+
{ when: { actor: 'dependabot[bot]', outcome: 'success' },
|
|
208
|
+
channel: 'C03N711HVDG', format: :success }, # builds-dependabot
|
|
209
|
+
{ when: { actor: 'dependabot[bot]' },
|
|
210
|
+
channel: 'C03N711HVDG', format: :failure }, # builds-dependabot
|
|
211
|
+
{ when: { outcome: 'success' },
|
|
212
|
+
channel: 'C023XUE76GH', format: :success }, # builds
|
|
213
|
+
# Failures go to builds, not team-dev (org default), to keep noise
|
|
214
|
+
# out of a popular channel while this pipeline beds in.
|
|
215
|
+
{ when: {},
|
|
216
|
+
channel: 'C023XUE76GH', format: :failure } # builds
|
|
217
|
+
]
|
|
218
|
+
end
|
|
219
|
+
end
|
|
220
|
+
|
|
221
|
+
namespace :repository do
|
|
222
|
+
desc 'Set the git author for CI'
|
|
223
|
+
task :set_ci_author do
|
|
224
|
+
sh 'git config --global user.name "InfraBlocks CI"'
|
|
225
|
+
sh 'git config --global user.email "ci@infrablocks.io"'
|
|
226
|
+
end
|
|
227
|
+
end
|
|
228
|
+
|
|
197
229
|
namespace :version do
|
|
198
230
|
desc 'Bump version for specified type (pre, major, minor, patch)'
|
|
199
231
|
task :bump, [:type] do |_, args|
|
|
@@ -201,6 +233,38 @@ namespace :version do
|
|
|
201
233
|
end
|
|
202
234
|
end
|
|
203
235
|
|
|
236
|
+
namespace :prerelease do
|
|
237
|
+
desc 'Build and push a namespaced pre-release to RubyGems ' \
|
|
238
|
+
'(PR CI only; no bump, no tag, no commit, no push)'
|
|
239
|
+
task :publish, %i[pr_number run_number run_attempt] do |_, args|
|
|
240
|
+
%i[pr_number run_number run_attempt].each do |name|
|
|
241
|
+
raise "Missing task argument: #{name}" if args[name].to_s.empty?
|
|
242
|
+
end
|
|
243
|
+
|
|
244
|
+
version_file = 'lib/ruby_vault/version.rb'
|
|
245
|
+
version_pattern = /(VERSION\s*=\s*')([^']+)(')/
|
|
246
|
+
source = File.read(version_file)
|
|
247
|
+
base = source[version_pattern, 2]
|
|
248
|
+
raise "Could not read VERSION from #{version_file}" unless base
|
|
249
|
+
|
|
250
|
+
version = "#{base}.pr#{args.pr_number}" \
|
|
251
|
+
".#{args.run_number}.#{args.run_attempt}"
|
|
252
|
+
gem_file = "ruby_vault-#{version}.gem"
|
|
253
|
+
begin
|
|
254
|
+
File.write(version_file,
|
|
255
|
+
source.sub(version_pattern, "\\1#{version}\\3"))
|
|
256
|
+
# Build + push directly: `gem release` aborts on the (deliberately)
|
|
257
|
+
# uncommitted version rewrite. PR CI must not tag, commit, or push
|
|
258
|
+
# (contrast the `release` task).
|
|
259
|
+
sh 'gem build ruby_vault.gemspec'
|
|
260
|
+
sh "gem push #{gem_file}"
|
|
261
|
+
ensure
|
|
262
|
+
File.write(version_file, source)
|
|
263
|
+
rm_f gem_file
|
|
264
|
+
end
|
|
265
|
+
end
|
|
266
|
+
end
|
|
267
|
+
|
|
204
268
|
desc 'Release gem'
|
|
205
269
|
task :release do
|
|
206
270
|
sh 'gem release --tag --push'
|
|
@@ -6,8 +6,8 @@ require_relative 'types/flag'
|
|
|
6
6
|
module RubyVault
|
|
7
7
|
module Options
|
|
8
8
|
module Types
|
|
9
|
-
def self.standard(name, value, **
|
|
10
|
-
Standard.new(name, value, **
|
|
9
|
+
def self.standard(name, value, **)
|
|
10
|
+
Standard.new(name, value, **)
|
|
11
11
|
end
|
|
12
12
|
|
|
13
13
|
def self.flag(name, value)
|
data/lib/ruby_vault/version.rb
CHANGED
data/ruby_vault.gemspec
CHANGED
|
@@ -36,7 +36,7 @@ Gem::Specification.new do |spec|
|
|
|
36
36
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
|
37
37
|
spec.require_paths = ['lib']
|
|
38
38
|
|
|
39
|
-
spec.required_ruby_version = '>= 3.
|
|
39
|
+
spec.required_ruby_version = '>= 3.3'
|
|
40
40
|
|
|
41
41
|
spec.add_dependency 'immutable-struct', '~> 2.4'
|
|
42
42
|
spec.add_dependency 'lino', '>= 4.1'
|
|
@@ -47,12 +47,11 @@ Gem::Specification.new do |spec|
|
|
|
47
47
|
spec.add_development_dependency 'guard'
|
|
48
48
|
spec.add_development_dependency 'guard-rspec'
|
|
49
49
|
spec.add_development_dependency 'rake'
|
|
50
|
-
spec.add_development_dependency 'rake_circle_ci'
|
|
51
50
|
spec.add_development_dependency 'rake_git'
|
|
52
51
|
spec.add_development_dependency 'rake_git_crypt'
|
|
53
52
|
spec.add_development_dependency 'rake_github'
|
|
54
53
|
spec.add_development_dependency 'rake_gpg'
|
|
55
|
-
spec.add_development_dependency '
|
|
54
|
+
spec.add_development_dependency 'rake_slack'
|
|
56
55
|
spec.add_development_dependency 'rspec'
|
|
57
56
|
spec.add_development_dependency 'rubocop'
|
|
58
57
|
spec.add_development_dependency 'rubocop-rake'
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: ruby_vault
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.3.0.pre.
|
|
4
|
+
version: 0.3.0.pre.3
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- InfraBlocks Maintainers
|
|
8
|
-
autorequire:
|
|
8
|
+
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2026-07-23 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: immutable-struct
|
|
@@ -122,20 +122,6 @@ dependencies:
|
|
|
122
122
|
- - ">="
|
|
123
123
|
- !ruby/object:Gem::Version
|
|
124
124
|
version: '0'
|
|
125
|
-
- !ruby/object:Gem::Dependency
|
|
126
|
-
name: rake_circle_ci
|
|
127
|
-
requirement: !ruby/object:Gem::Requirement
|
|
128
|
-
requirements:
|
|
129
|
-
- - ">="
|
|
130
|
-
- !ruby/object:Gem::Version
|
|
131
|
-
version: '0'
|
|
132
|
-
type: :development
|
|
133
|
-
prerelease: false
|
|
134
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
135
|
-
requirements:
|
|
136
|
-
- - ">="
|
|
137
|
-
- !ruby/object:Gem::Version
|
|
138
|
-
version: '0'
|
|
139
125
|
- !ruby/object:Gem::Dependency
|
|
140
126
|
name: rake_git
|
|
141
127
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -193,7 +179,7 @@ dependencies:
|
|
|
193
179
|
- !ruby/object:Gem::Version
|
|
194
180
|
version: '0'
|
|
195
181
|
- !ruby/object:Gem::Dependency
|
|
196
|
-
name:
|
|
182
|
+
name: rake_slack
|
|
197
183
|
requirement: !ruby/object:Gem::Requirement
|
|
198
184
|
requirements:
|
|
199
185
|
- - ">="
|
|
@@ -350,7 +336,7 @@ licenses:
|
|
|
350
336
|
- MIT
|
|
351
337
|
metadata:
|
|
352
338
|
rubygems_mfa_required: 'false'
|
|
353
|
-
post_install_message:
|
|
339
|
+
post_install_message:
|
|
354
340
|
rdoc_options: []
|
|
355
341
|
require_paths:
|
|
356
342
|
- lib
|
|
@@ -358,15 +344,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
358
344
|
requirements:
|
|
359
345
|
- - ">="
|
|
360
346
|
- !ruby/object:Gem::Version
|
|
361
|
-
version: '3.
|
|
347
|
+
version: '3.3'
|
|
362
348
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
363
349
|
requirements:
|
|
364
|
-
- - "
|
|
350
|
+
- - ">="
|
|
365
351
|
- !ruby/object:Gem::Version
|
|
366
|
-
version:
|
|
352
|
+
version: '0'
|
|
367
353
|
requirements: []
|
|
368
|
-
rubygems_version: 3.
|
|
369
|
-
signing_key:
|
|
354
|
+
rubygems_version: 3.5.22
|
|
355
|
+
signing_key:
|
|
370
356
|
specification_version: 4
|
|
371
357
|
summary: A simple Ruby wrapper for invoking Vault commands.
|
|
372
358
|
test_files: []
|