@meistrari/mise-en-place 2.18.3 → 2.19.0

package/mise/tasks/import-secrets-into-file.sh

@@ -26,20 +26,34 @@ if [ -z "$FILE_NAME" ]; then
     exit 1
 fi
 
+# Maybe in the future we can make this script more flexible and allow the user
+# to specify the environment as an argument or environment variable.
+# For now, we will hardcode it to development.
 ENV=development
 
-SECRET_PATH="$APP_NAME/$ENV/$WORKLOAD_PATH"
+# Reads a secret from the kv mount and appends its values to $FILE_NAME.
+# Aborts the script if the secret cannot be read.
+append_secrets() {
+    local secret_path="$1"
+    local secret_json
 
-if ! SECRET_JSON="$(vault kv get -mount=kv -format=json "$SECRET_PATH" 2>&1)"; then
-    echo "Failed to read kv/$SECRET_PATH from $VAULT_ADDR:" >&2
-    echo "$SECRET_JSON" >&2
-    echo "" >&2
-    echo "Inspect it in the browser: $VAULT_ADDR/ui/vault/secrets/kv/kv/list/${APP_NAME}/" >&2
-    exit 1
-fi
+    if ! secret_json="$(vault kv get -mount=kv -format=json "$secret_path" 2>&1)"; then
+        echo "Failed to read kv/$secret_path from $VAULT_ADDR:" >&2
+        echo "$secret_json" >&2
+        echo "" >&2
+        echo "Inspect it in the browser: $VAULT_ADDR/ui/vault/secrets/kv/kv/list/$(dirname "$secret_path")/" >&2
+        exit 1
+    fi
+
+    echo "$secret_json" | jq -r '.data.data | to_entries[] | "\(.key)=\(.value | @sh)"' >> "$FILE_NAME"
+}
 
 echo "# Values from VaultSecrets" > "$FILE_NAME"
 echo "# Edits to this file may be overwritten" >> "$FILE_NAME"
 
-echo "$SECRET_JSON" \
-    | jq -r '.data.data | to_entries[] | "\(.key)=\(.value | @sh)"' >> "$FILE_NAME"
+# Shared values come first so app-specific ones override them on collision.
+if [ "$ENV" == "development" ]; then
+    append_secrets "shared/$ENV"
+fi
+
+append_secrets "$APP_NAME/$ENV/$WORKLOAD_PATH"

package/mise/tasks/registry-login.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+#MISE description="Login to Harbor (internal registry). Opens the UI so you can copy your CLI secret."
+#USAGE flag "-r --registry <registry>" default="harbor.internal.tela.tools" help="Harbor host to authenticate against." env="HARBOR_REGISTRY"
+#USAGE flag "-u --username <username>" default="" help="Harbor OIDC username. Prompted for when omitted." env="HARBOR_USERNAME"
+#USAGE flag "-f --force" default=#false help="Re-authenticate even if the stored credential still works."
+#USAGE flag "--browser" negate="--no-browser" default=#true help="Open the Harbor UI so the CLI secret can be copied."
+#MISE quiet=true
+#MISE interactive=true
+
+set -euo pipefail
+
+REGISTRY="${usage_registry:-registry.internal.tela.tools}"
+USERNAME="${usage_username:-}"
+
+# Harbor runs authMode: oidc_auth, so the Google password is not a valid docker
+# credential. Harbor mints a per-user CLI secret instead, shown in the UI. This
+# is that copy step, wrapped.
+
+die() { echo "error: $*" >&2; exit 1; }
+
+# `externalURL` is the VPN-only internal gateway, so an unreachable host almost
+# always means NetBird is down rather than Harbor being broken. Say so, because
+# the raw curl failure sends people to the wrong place.
+check_reachable() {
+    curl -fsS --max-time 8 -o /dev/null "https://${REGISTRY}/api/v2.0/systeminfo" 2>/dev/null
+}
+
+# Presence of a credential is not the same as a working one: CLI secrets get
+# rotated and OIDC sessions lapse. Ask Harbor rather than reading the keychain.
+#
+# Checked against /v2/ (the registry API) rather than /api/v2.0/users/current,
+# because a robot credential answers 412 on the latter — it has no user profile —
+# which would report a perfectly good pull credential as broken. /v2/ is also
+# the endpoint that actually governs `docker pull`, so it tests what we care about.
+check_credential() {
+    local auth
+    auth=$(docker-credential-"$(docker_cred_store)" get <<<"${REGISTRY}" 2>/dev/null) || return 1
+    local user secret
+    user=$(jq -r '.Username // empty' <<<"$auth")
+    secret=$(jq -r '.Secret // empty' <<<"$auth")
+    [ -n "$user" ] && [ -n "$secret" ] || return 1
+    curl -fsS --max-time 8 -o /dev/null -u "${user}:${secret}" \
+        "https://${REGISTRY}/v2/" 2>/dev/null
+}
+
+docker_cred_store() {
+    jq -r '.credsStore // "osxkeychain"' ~/.docker/config.json 2>/dev/null || echo osxkeychain
+}
+
+open_browser() {
+    local url="https://${REGISTRY}"
+    if command -v open >/dev/null 2>&1; then
+        open "$url"
+    elif command -v xdg-open >/dev/null 2>&1; then
+        xdg-open "$url"
+    else
+        echo "Open this manually: $url"
+    fi
+}
+
+command -v docker >/dev/null 2>&1 || die "docker is not installed"
+command -v jq >/dev/null 2>&1 || die "jq is not installed"
+
+check_reachable || die "cannot reach ${REGISTRY}. It is only routable over the NetBird VPN — connect and retry."
+
+if [ "${usage_force:-false}" != "true" ] && check_credential; then
+    echo "Already logged in to ${REGISTRY}."
+    # A working credential is usually what people want, so staying logged in is
+    # the default. Offer the way out anyway: CLI secrets are per-user, and
+    # switching accounts otherwise means remembering --force.
+    if [ -t 0 ]; then
+        read -r -p "Log out and re-authenticate? [y/N] " answer || true
+    else
+        answer=""
+    fi
+    case "${answer:-}" in
+        [yY]|[yY][eE][sS])
+            # Drop the stored credential first, so a failed re-login does not
+            # leave the old account silently in place.
+            docker logout "$REGISTRY" >/dev/null
+            ;;
+        *)
+            exit 0
+            ;;
+    esac
+fi
+
+if [ -z "$USERNAME" ]; then
+    # Harbor identities come from Google (Dex), so only a work address is a
+    # plausible default. A personal git email would just be a wrong prefill.
+    default_user="$(git config --get user.email 2>/dev/null || true)"
+    case "$default_user" in
+        *@meistrari.com|*@tela.com) ;;
+        *) default_user="" ;;
+    esac
+    read -r -p "Harbor username${default_user:+ [$default_user]}: " USERNAME || true
+    USERNAME="${USERNAME:-$default_user}"
+    [ -n "$USERNAME" ] || die "a username is required"
+fi
+
+if [ "${usage_browser:-true}" = "true" ]; then
+    cat <<EOF
+
+In the Harbor UI:
+  1. Sign in through Google (Dex) if prompted
+  2. Open the avatar menu (top right) -> User Profile
+  3. Copy the CLI secret
+
+EOF
+    # Pause before launching, so the steps above can be read rather than being
+    # buried the instant the browser takes focus.
+    read -r -p "Press ENTER to open ${REGISTRY} in your browser... " _ || true
+    open_browser
+fi
+
+# -s so the secret never reaches the terminal or shell history.
+read -r -s -p "Paste your Harbor CLI secret: " CLI_SECRET || true
+echo
+
+[ -n "$CLI_SECRET" ] || die "no CLI secret entered"
+
+printf '%s' "$CLI_SECRET" | docker login "$REGISTRY" --username "$USERNAME" --password-stdin
+
+echo "Logged in to ${REGISTRY} as ${USERNAME}."

package/package.json

@@ -1,52 +1,52 @@
 {
-  "name": "@meistrari/mise-en-place",
-  "version": "2.18.3",
-  "description": "",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/meistrari/mise-en-place.git"
-  },
-  "scripts": {
-    "build": "unbuild"
-  },
-  "bin": {
-    "mise-en-place": "dist/cli/cli.mjs"
-  },
-  "exports": {
-    "./eslint": {
-      "types": "./dist/eslint.d.ts",
-      "import": "./dist/eslint.mjs"
+    "name": "@meistrari/mise-en-place",
+    "version": "2.19.0",
+    "description": "",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/meistrari/mise-en-place.git"
+    },
+    "scripts": {
+        "build": "unbuild"
+    },
+    "bin": {
+        "mise-en-place": "dist/cli/cli.mjs"
+    },
+    "exports": {
+        "./eslint": {
+            "types": "./dist/eslint.d.ts",
+            "import": "./dist/eslint.mjs"
+        }
+    },
+    "files": [
+        ".editorconfig",
+        "Makefile",
+        "dist",
+        "scripts",
+        "tsconfig.base.json",
+        "mise"
+    ],
+    "keywords": [],
+    "author": "",
+    "license": "ISC",
+    "type": "module",
+    "bugs": {
+        "url": "https://github.com/meistrari/mise-en-place/issues"
+    },
+    "homepage": "https://github.com/meistrari/mise-en-place#readme",
+    "dependencies": {
+        "@antfu/eslint-config": "6.7.3",
+        "dedent": "1.7.1",
+        "eslint": "9.39.4",
+        "eslint-plugin-diff": "2.1.7",
+        "eslint-plugin-drizzle": "0.2.3",
+        "glob": "13.0.6",
+        "jsonc-parser": "3.3.1",
+        "smol-toml": "^1.6.1",
+        "yaml": "2.8.2"
+    },
+    "devDependencies": {
+        "@types/node": "24.12.0",
+        "unbuild": "3.6.1"
     }
-  },
-  "files": [
-    ".editorconfig",
-    "Makefile",
-    "dist",
-    "scripts",
-    "tsconfig.base.json",
-    "mise"
-  ],
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "type": "module",
-  "bugs": {
-    "url": "https://github.com/meistrari/mise-en-place/issues"
-  },
-  "homepage": "https://github.com/meistrari/mise-en-place#readme",
-  "dependencies": {
-    "@antfu/eslint-config": "6.7.3",
-    "dedent": "1.7.1",
-    "eslint": "9.39.4",
-    "eslint-plugin-diff": "2.1.7",
-    "eslint-plugin-drizzle": "0.2.3",
-    "glob": "13.0.6",
-    "jsonc-parser": "3.3.1",
-    "smol-toml": "^1.6.1",
-    "yaml": "2.8.2"
-  },
-  "devDependencies": {
-    "@types/node": "24.12.0",
-    "unbuild": "3.6.1"
-  }
 }