@hed-hog/cli 0.0.65 → 0.0.67

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hed-hog/cli",
-    "version": "0.0.65",
+    "version": "0.0.67",
     "description": "HedHog CLI tool",
     "author": "HedHog",
     "private": false,

package/dist/src/templates/deployment/workflow.deploy.yml.ejs

@@ -278,6 +278,7 @@ jobs:
         run: |
           set -eu
           REGISTRY_NAME="${REGISTRY##*/}"
+          DIGEST_REGEX='^sha256:[a-f0-9]{64}$'
           
           cleanup_repository() {
             REPOSITORY="$1"
@@ -291,14 +292,31 @@ jobs:
               return 0
             fi
             
-            CURRENT_DIGEST="$(printf '%s\n' "${TAG_ROWS}" | awk -v target="${{ github.sha }}" '$1 == target { print $2; exit }')"
+            CURRENT_DIGEST="$(printf '%s\n' "${TAG_ROWS}" | awk -v target="${{ github.sha }}" -v regex="${DIGEST_REGEX}" '
+              $1 == target {
+                for (i = 1; i <= NF; i++) {
+                  if ($i ~ regex) {
+                    print $i;
+                    exit;
+                  }
+                }
+              }
+            ')"
             
             if [ -z "${CURRENT_DIGEST}" ]; then
               echo "::error::Unable to determine current manifest digest for ${REPOSITORY}:${{ github.sha }}"
               exit 1
             fi
             
-            OLD_DIGESTS="$(printf '%s\n' "${TAG_ROWS}" | awk -v keep="${CURRENT_DIGEST}" 'NF >= 2 && $2 != keep { print $2 }' | sort -u)"
+            OLD_DIGESTS="$(printf '%s\n' "${TAG_ROWS}" | awk -v keep="${CURRENT_DIGEST}" -v regex="${DIGEST_REGEX}" '
+              {
+                for (i = 1; i <= NF; i++) {
+                  if ($i ~ regex && $i != keep) {
+                    print $i;
+                  }
+                }
+              }
+            ' | sort -u)"
             
             if [ -z "${OLD_DIGESTS}" ]; then
               echo "No old manifests to delete for ${REPOSITORY}."
@@ -312,6 +330,11 @@ jobs:
               if [ -z "${DIGEST}" ]; then
                 continue
               fi
+
+              if ! printf '%s\n' "${DIGEST}" | grep -Eq "${DIGEST_REGEX}"; then
+                echo "Skipping invalid digest candidate: ${DIGEST}"
+                continue
+              fi
               
               doctl registry repository delete-manifest "${REPOSITORY}" "${DIGEST}" --registry "${REGISTRY_NAME}" --force
             done
@@ -359,11 +382,54 @@ jobs:
           docker pull hello-world
           docker tag hello-world ${{ env.REGISTRY }}/ci-auth-probe-admin:${{ github.run_id }}
           docker push ${{ env.REGISTRY }}/ci-auth-probe-admin:${{ github.run_id }}
+      - name: Validate admin API URLs
+        run: |
+          set -eu
+
+          if [ -z "${{ env.ADMIN_API_URL }}" ]; then
+            echo "::error::ADMIN_API_URL is empty. Set it in workflow env before building admin image."
+            exit 1
+          fi
+
+          if [ -z "${{ env.ADMIN_API_BASE_URL }}" ]; then
+            echo "::error::ADMIN_API_BASE_URL is empty. Set it in workflow env before building admin image."
+            exit 1
+          fi
+
+          if [ -z "${{ env.ADMIN_INTERNAL_API_URL }}" ]; then
+            echo "::error::ADMIN_INTERNAL_API_URL is empty. Set it in workflow env before building admin image."
+            exit 1
+          fi
+
+          case "${{ env.ADMIN_API_URL }}" in
+            http://*|https://*) ;;
+            *)
+              echo "::error::ADMIN_API_URL must be an absolute URL (http/https). Current value: ${{ env.ADMIN_API_URL }}"
+              exit 1
+              ;;
+          esac
+
+          case "${{ env.ADMIN_API_BASE_URL }}" in
+            http://*|https://*) ;;
+            *)
+              echo "::error::ADMIN_API_BASE_URL must be an absolute URL (http/https). Current value: ${{ env.ADMIN_API_BASE_URL }}"
+              exit 1
+              ;;
+          esac
+
+          case "${{ env.ADMIN_INTERNAL_API_URL }}" in
+            http://*|https://*) ;;
+            *)
+              echo "::error::ADMIN_INTERNAL_API_URL must be an absolute URL (http/https). Current value: ${{ env.ADMIN_INTERNAL_API_URL }}"
+              exit 1
+              ;;
+          esac
       - name: Build Docker image
         run: |
-          docker build -t ${{ env.REGISTRY }}/<%= config.appName %:${{ github.sha }} \
+          docker build -t ${{ env.REGISTRY }}/hub-admin:${{ github.sha }} \
             --build-arg NEXT_PUBLIC_API_BASE_URL=${{ env.ADMIN_API_BASE_URL }} \
             --build-arg NEXT_PUBLIC_API_URL=${{ env.ADMIN_API_URL }} \
+            --build-arg INTERNAL_API_URL=${{ env.ADMIN_INTERNAL_API_URL }} \
             -f apps/admin/Dockerfile .
       - name: Push Docker image (sha)
         run: |
@@ -411,6 +477,7 @@ jobs:
           set -eu
           REGISTRY_NAME="${REGISTRY##*/}"
           REPOSITORY="<%= config.appName %>-admin"
+          DIGEST_REGEX='^sha256:[a-f0-9]{64}$'
           
           echo "Inspecting repository ${REPOSITORY} in registry ${REGISTRY_NAME}"
           
@@ -421,14 +488,31 @@ jobs:
             exit 0
           fi
           
-          CURRENT_DIGEST="$(printf '%s\n' "${TAG_ROWS}" | awk -v target="${{ github.sha }}" '$1 == target { print $2; exit }')"
+          CURRENT_DIGEST="$(printf '%s\n' "${TAG_ROWS}" | awk -v target="${{ github.sha }}" -v regex="${DIGEST_REGEX}" '
+            $1 == target {
+              for (i = 1; i <= NF; i++) {
+                if ($i ~ regex) {
+                  print $i;
+                  exit;
+                }
+              }
+            }
+          ')"
           
           if [ -z "${CURRENT_DIGEST}" ]; then
             echo "::error::Unable to determine current manifest digest for ${REPOSITORY}:${{ github.sha }}"
             exit 1
           fi
           
-          OLD_DIGESTS="$(printf '%s\n' "${TAG_ROWS}" | awk -v keep="${CURRENT_DIGEST}" 'NF >= 2 && $2 != keep { print $2 }' | sort -u)"
+          OLD_DIGESTS="$(printf '%s\n' "${TAG_ROWS}" | awk -v keep="${CURRENT_DIGEST}" -v regex="${DIGEST_REGEX}" '
+            {
+              for (i = 1; i <= NF; i++) {
+                if ($i ~ regex && $i != keep) {
+                  print $i;
+                }
+              }
+            }
+          ' | sort -u)"
           
           if [ -z "${OLD_DIGESTS}" ]; then
             echo "No old manifests to delete for ${REPOSITORY}."
@@ -442,6 +526,11 @@ jobs:
             if [ -z "${DIGEST}" ]; then
               continue
             fi
+
+            if ! printf '%s\n' "${DIGEST}" | grep -Eq "${DIGEST_REGEX}"; then
+              echo "Skipping invalid digest candidate: ${DIGEST}"
+              continue
+            fi
             
             doctl registry repository delete-manifest "${REPOSITORY}" "${DIGEST}" --registry "${REGISTRY_NAME}" --force
           done