Publish curated Unraid-AppOps-Gateway source from ad0a390e431166c3198a2ac3bec010c2b44f2dea

backend/app/services/controller_artifact_promoter.py

@@ -39,12 +39,12 @@ def helper_container_spec(*, revision: str, image_id: str) -> dict[str, Any]:
         raise ValueError("controller_promoter_image_invalid")
 
     command = f"""set -Eeuo pipefail
+umask 077
 revision='{revision}'
 version='{CONTROLLER_VERSION}'
 repo='/gitea-repositories/jens/unraid-appops-gateway.git'
-work='/mnt/cache/appdata/gitea-deploy-runners/.controller-promoter-{revision[:12]}'
-rm -rf -- "$work"
-install -d -m 0700 "$work"
+work="$(mktemp -d -p /tmp 'itworx-controller-artifact-promoter-{revision[:12]}.XXXXXX')"
+[[ -d "$work" && ! -L "$work" && "$(stat -c '%u:%a' "$work")" == '0:700' ]]
 cleanup() {{ rm -rf -- "$work"; }}
 trap cleanup EXIT
 command -v git >/dev/null
@@ -59,7 +59,10 @@ git --git-dir="$repo" archive --format=tar "$revision" \
   ops/gitea-deploy-broker \
   scripts/prepare_controller_artifact.py \
   scripts/reconcile_controller_state.py \
-  scripts/run_repopulse_adoption.py > "$work/controller.tar"
+  scripts/run_repopulse_adoption.py \
+  scripts/prepare_controller_hub_release_volume.py \
+  scripts/upgrade_deployment_controller.sh > "$work/controller.tar"
+chmod 0600 "$work/controller.tar"
 archive_sha="$(sha256sum "$work/controller.tar" | cut -d ' ' -f 1)"
 git --git-dir="$repo" show "$revision:scripts/upgrade_deployment_controller.sh" > "$work/upgrade.sh"
 chmod 0700 "$work/upgrade.sh"
@@ -70,6 +73,7 @@ bash "$work/upgrade.sh" \
   --source-revision "$revision" \
   --source-tree "$tree" \
   --controller-version "$version" \
+  --image-id '{image_id}' \
   --confirm UPGRADE_DEPLOYMENT_CONTROLLER_V2
 """
 
@@ -88,6 +92,7 @@ bash "$work/upgrade.sh" \
                 "/mnt/cache:/mnt/cache",
                 "/mnt/user:/mnt/user",
                 "/srv/example/appdata/gitea/git/repositories:/gitea-repositories:ro",
+                "/var/lib/docker:/var/lib/docker:ro",
                 "/var/run/docker.sock:/var/run/docker.sock",
             ],
             "NetworkMode": "host",