release-me-sh 0.10.11 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-me-sh",
-  "version": "0.10.11",
+  "version": "0.11.0",
   "description": "Blazing fast minimal release workflow script written in Bash with plugins and presets support",
   "keywords": [
     "bash",

package/plugins/docker.sh

@@ -28,9 +28,7 @@ release() {
 
       prepare
 
-      docker build -t "${GIT_REPO_NAME-}:${NEXT_BUILD_VERSION-}" . --push
-      docker tag "${GIT_REPO_NAME}:${NEXT_BUILD_VERSION}" "${GIT_REPO_NAME}:latest"
-      docker push "${GIT_REPO_NAME}"
+      docker build -t "${GIT_REPO_NAME-}:latest" -t "${GIT_REPO_NAME}:${NEXT_BUILD_VERSION-}" . --push
 
       log "Docker image published [${NEXT_RELEASE_TAG}]!"
 

package/plugins/git.sh

@@ -28,12 +28,41 @@ prepare() {
       printf "%s" "${GPG_PASSPHRASE}" | gpg --quiet --batch --yes --pinentry-mode loopback --sign --local-user "${GPG_KEY_ID-}" --passphrase-fd 0 >/dev/null
       log_verbose "Git GPG passphrase set"
     fi
-  elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${SSH_PUB_KEY-}" ]; then
+  elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${SSH_PRIVATE_KEY-}" ] && [ -n "${SSH_PUBLIC_KEY-}" ]; then
+    eval "$(ssh-agent -s)"
+
+    SSH_PUBLIC_KEY_FILE=$(mktemp)
+    printf "%s" "${SSH_PUBLIC_KEY}" >>"${SSH_PUBLIC_KEY_FILE}"
+
     git config --local commit.gpgsign true
-    git config --local user.signingkey "${SSH_PUB_KEY}"
+    git config --local user.signingkey "${SSH_PUBLIC_KEY_FILE}"
     git config --local tag.forceSignAnnotated true
     git config --local gpg.format ssh
-    log_verbose "Git SSH sign is set"
+    log_verbose "Git SSH sign key is set"
+
+    if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
+      SSH_ASKPASS_FILE=$(mktemp)
+      chmod 0755 "${SSH_ASKPASS_FILE}"
+      printf "%s" "echo -n \"${SSH_KEY_PASSPHRASE}\"" >>"${SSH_ASKPASS_FILE}"
+
+      export SSH_ASKPASS="${SSH_ASKPASS_FILE}"
+      export SSH_ASKPASS_REQUIRE="force"
+      log_verbose "Git SSH passphrase set"
+    fi
+
+    if ! ssh-add -L | grep -q "${SSH_PUBLIC_KEY-}"; then
+      printf "%s" "${SSH_PRIVATE_KEY}" | base64 --decode | ssh-add -
+      log_verbose "Git SSH key import loaded"
+    else
+      log_verbose "Git SSH key import skipped"
+    fi
+
+    if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
+      rm -rf "${SSH_ASKPASS}"
+      unset SSH_ASKPASS
+      unset SSH_ASKPASS_REQUIRE
+      log_verbose "Git SSH key security cleanup"
+    fi
   fi
 }
 
@@ -66,6 +95,8 @@ cleanup() {
     git config --local --unset user.signingkey "${SSH_PUB_KEY}"
     git config --local --unset tag.forceSignAnnotated true
     git config --local --unset gpg.format ssh
+
+    ssh-add -L | grep -F "${SSH_PUBLIC_KEY-}" | ssh-add -d -
     log_verbose "Git SSH sign is unset"
   fi
 

package/plugins/npm-post.sh

@@ -28,12 +28,41 @@ prepare() {
       printf "%s" "${GPG_PASSPHRASE}" | gpg --quiet --batch --yes --pinentry-mode loopback --sign --local-user "${GPG_KEY_ID-}" --passphrase-fd 0 >/dev/null
       log_verbose "Git GPG passphrase set"
     fi
-  elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${SSH_PUB_KEY-}" ]; then
+  elif [ -z "${SSH_NO_SIGN-}" ] && [ -n "${SSH_PRIVATE_KEY-}" ] && [ -n "${SSH_PUBLIC_KEY-}" ]; then
+    eval "$(ssh-agent -s)"
+
+    SSH_PUBLIC_KEY_FILE=$(mtemp)
+    printf "%s" "${SSH_PUBLIC_KEY}" >>"${SSH_PUBLIC_KEY_FILE}"
+
     git config --local commit.gpgsign true
-    git config --local user.signingkey "${SSH_PUB_KEY}"
+    git config --local user.signingkey "${SSH_PUBLIC_KEY_FILE}"
     git config --local tag.forceSignAnnotated true
     git config --local gpg.format ssh
-    log_verbose "Git SSH sign is set"
+    log_verbose "Git SSH sign key is set"
+
+    if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
+      SSH_ASKPASS_FILE=$(mktemp)
+      chmod 0755 "${SSH_ASKPASS_FILE}"
+      printf "%s" "echo -n \"${SSH_KEY_PASSPHRASE}\"" >>"${SSH_ASKPASS_FILE}"
+
+      export SSH_ASKPASS="${SSH_ASKPASS_FILE}"
+      export SSH_ASKPASS_REQUIRE="force"
+      log_verbose "Git SSH passphrase set"
+    fi
+
+    if ! ssh-add -L | grep -q "${SSH_PUBLIC_KEY-}"; then
+      printf "%s" "${SSH_PRIVATE_KEY}" | base64 --decode | ssh-add -
+      log_verbose "Git SSH key import loaded"
+    else
+      log_verbose "Git SSH key import skipped"
+    fi
+
+    if [ -n "${SSH_KEY_PASSPHRASE-}" ]; then
+      rm -rf "${SSH_ASKPASS}"
+      unset SSH_ASKPASS
+      unset SSH_ASKPASS_REQUIRE
+      log_verbose "Git SSH key security cleanup"
+    fi
   fi
 }
 
@@ -66,6 +95,8 @@ cleanup() {
     git config --local --unset user.signingkey "${SSH_PUB_KEY}"
     git config --local --unset tag.forceSignAnnotated true
     git config --local --unset gpg.format ssh
+
+    ssh-add -L | grep -F "${SSH_PUBLIC_KEY-}" | ssh-add -d -
     log_verbose "Git SSH sign is unset"
   fi