Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/app/services/controller_artifact_promoter.py

@@ -11,19 +11,22 @@ import httpx
 from ..connectors.portainer import PortainerConnector
 from ..core.config import settings
 from ..core.redaction import redact_message
+from .controller_artifact_helper_spec import (
+    CONTROLLER_VERSION,
+    HELPER_LABEL,
+    HELPER_NAME,
+    SOURCE_REPOSITORY as SOURCE_REPOSITORY,
+    _IMAGE_ID,
+    _REVISION,
+    helper_container_spec,
+)
 from .deployment_broker import DeploymentBrokerClient
 
-SOURCE_REPOSITORY = "jens/unraid-appops-gateway"
 GITEA_OWNER = "Jens"
 GITEA_REPOSITORY = "Unraid-AppOps-Gateway"
 REQUIRED_PUSH_CONTEXT = "Managed validation / full (push)"
-HELPER_NAME = "itworx-controller-artifact-promoter"
 CONTROLLER_CONTAINER = "gitea-deploy-control"
-CONTROLLER_VERSION = "2.1.13"
-HELPER_LABEL = "itworx.controller.promoter"
 _HELPER_TIMEOUT_SECONDS = 240
-_REVISION = re.compile(r"^[0-9a-f]{40}$")
-_IMAGE_ID = re.compile(r"^sha256:[0-9a-f]{64}$")
 _TIMESTAMP = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$")
 
 
@@ -31,78 +34,6 @@ class ControllerArtifactPromotionError(RuntimeError):
     pass
 
 
-def helper_container_spec(*, revision: str, image_id: str) -> dict[str, Any]:
-    if not _REVISION.fullmatch(revision):
-        raise ValueError("controller_promoter_revision_invalid")
-    if not _IMAGE_ID.fullmatch(image_id):
-        raise ValueError("controller_promoter_image_invalid")
-
-    command = f"""set -Eeuo pipefail
-umask 077
-revision='{revision}'
-version='{CONTROLLER_VERSION}'
-repo='/gitea-repositories/jens/unraid-appops-gateway.git'
-work="$(mktemp -d -p /tmp 'itworx-controller-artifact-promoter-{revision[:12]}.XXXXXX')"
-[[ -d "$work" && ! -L "$work" && "$(stat -c '%u:%a' "$work")" == '0:700' ]]
-cleanup() {{ rm -rf -- "$work"; }}
-trap cleanup EXIT
-command -v git >/dev/null
-command -v docker >/dev/null
-docker compose version >/dev/null
-command -v python3 >/dev/null
-command -v tar >/dev/null
-command -v curl >/dev/null
-git --git-dir="$repo" cat-file -e "$revision^{{commit}}"
-tree="$(git --git-dir="$repo" rev-parse "$revision^{{tree}}")"
-git --git-dir="$repo" archive --format=tar "$revision" \
-  ops/gitea-deploy-broker \
-  scripts/prepare_controller_artifact.py \
-  scripts/reconcile_controller_state.py \
-  scripts/run_repopulse_adoption.py \
-  scripts/prepare_controller_hub_release_volume.py \
-  scripts/vendor \
-  scripts/upgrade_deployment_controller.sh > "$work/controller.tar"
-chmod 0600 "$work/controller.tar"
-archive_sha="$(sha256sum "$work/controller.tar" | cut -d ' ' -f 1)"
-git --git-dir="$repo" show "$revision:scripts/upgrade_deployment_controller.sh" > "$work/upgrade.sh"
-chmod 0700 "$work/upgrade.sh"
-bash "$work/upgrade.sh" \
-  --archive "$work/controller.tar" \
-  --archive-sha256 "$archive_sha" \
-  --source-repository '{SOURCE_REPOSITORY}' \
-  --source-revision "$revision" \
-  --source-tree "$tree" \
-  --controller-version "$version" \
-  --image-id '{image_id}' \
-  --confirm UPGRADE_DEPLOYMENT_CONTROLLER_V2
-"""
-
-    return {
-        "Image": image_id,
-        "User": "0:0",
-        "Cmd": ["/bin/bash", "-lc", command],
-        "Labels": {
-            HELPER_LABEL: "true",
-            "itworx.source.repository": SOURCE_REPOSITORY,
-            "itworx.source.revision": revision,
-            "itworx.controller.version": CONTROLLER_VERSION,
-        },
-        "HostConfig": {
-            "Binds": [
-                "/mnt/cache:/mnt/cache",
-                "/mnt/user:/mnt/user",
-                "/srv/example/appdata/gitea/git/repositories:/gitea-repositories:ro",
-                "/var/lib/docker:/var/lib/docker:ro",
-                "/var/run/docker.sock:/var/run/docker.sock",
-            ],
-            "NetworkMode": "host",
-            "Privileged": False,
-            "SecurityOpt": ["no-new-privileges:true"],
-            "RestartPolicy": {"Name": "no"},
-        },
-    }
-
-
 class ControllerArtifactPromoter:
     def __init__(
         self,