@supacloud/admin 0.7.5 → 0.7.6

package/dist/index.js

@@ -25622,7 +25622,7 @@ SUPACLOUD_GITHUB_REPOSITORY="\${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supaclou
 SUPACLOUD_RELEASES_API="\${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/releases}"
 SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="\${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-\${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"
 SUPACLOUD_GH_VERSION="\${SUPACLOUD_GH_VERSION:-2.96.0}"
-SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.51.0}"
+SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"
 SUPACLOUD_GH_AMD64_SHA256="\${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"
 SUPACLOUD_GH_ARM64_SHA256="\${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"
 
@@ -25992,7 +25992,8 @@ supacloud_verify_attestation() (
         if ! verification_output=$(gh attestation verify "$artifact_file" \\
             --bundle "$bundle_file" \\
             --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\
-            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" 2>&1); then
+            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\
+            --source-ref "refs/heads/main" 2>&1); then
             echo "GitHub artifact attestation verification failed: \${verification_output}" >&2
             return 1
         fi
@@ -26011,12 +26012,15 @@ supacloud_verify_attestation() (
 )
 
 supacloud_attestation_verifier_available() {
-    local version
+    local version help
     command -v gh >/dev/null 2>&1 || return 1
     version=$(supacloud_gh_version)
     [[ -n "$version" ]] || return 1
     supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1
-    gh attestation verify --help 2>&1 | grep -q -- '--signer-workflow'
+    help=$(gh attestation verify --help 2>&1) || return 1
+    grep -Eq -- '(^|[[:space:]])--bundle([=[:space:]]|$)' <<< "$help" || return 1
+    grep -Eq -- '(^|[[:space:]])--signer-workflow([=[:space:]]|$)' <<< "$help" || return 1
+    grep -Eq -- '(^|[[:space:]])--source-ref([=[:space:]]|$)' <<< "$help"
 }
 
 supacloud_download_release_asset() (
@@ -26171,6 +26175,12 @@ function componentPreflightCommands(request) {
     `test "$EDGE_RUNTIME_MODE_VALUE" = external || { echo 'Edge Runtime component upgrade supports persisted external mode only' >&2; exit 1; }`
   ] : [];
 }
+function signalSafeCleanupTraps(cleanupCommand) {
+  return [
+    `trap '${cleanupCommand}' EXIT`,
+    `trap 'trap - EXIT HUP INT TERM; ${cleanupCommand}; exit 1' HUP INT TERM`
+  ];
+}
 function buildRootUpgradeScript(request) {
   const envAssignments = upgradeEnvAssignments(request);
   return [
@@ -26179,12 +26189,12 @@ function buildRootUpgradeScript(request) {
     "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
     "export PATH",
     "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
-    request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY",
+    request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
     'for tool in curl jq file sha256sum tar; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
     ...componentPreflightCommands(request),
     "STAGED_MANAGEMENT=''",
-    `trap 'test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"' EXIT HUP INT TERM`,
+    ...signalSafeCleanupTraps('test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"'),
     `source ${quoteEnvValue(request.helperPath)}`,
     "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
     "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
@@ -26195,7 +26205,11 @@ function buildRootUpgradeScript(request) {
 }
 function buildOfficialUpgradeCommand(request) {
   const rootScript = buildRootUpgradeScript(request);
-  return `set -e; trap 'rm -f ${request.helperPath}' EXIT HUP INT TERM; ` + 'if [ "$(id -u)" -eq 0 ]; then ' + `bash -c ${quoteEnvValue(rootScript)}; ` + "else sudo -n true; " + `sudo -n bash -c ${quoteEnvValue(rootScript)}; fi`;
+  return [
+    "set -e",
+    ...signalSafeCleanupTraps(`rm -f ${request.helperPath}`),
+    'if [ "$(id -u)" -eq 0 ]; then ' + `bash -c ${quoteEnvValue(rootScript)}; ` + "else sudo -n true; " + `sudo -n bash -c ${quoteEnvValue(rootScript)}; fi`
+  ].join("; ");
 }
 async function removeRemoteUpgradeHelper(ssh, helperPath) {
   const cleanup = await ssh.exec(`rm -f ${quoteEnvValue(helperPath)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",