Gabriel Brown
26a4fd0705
Each job logs in as the read-only spoon-ci machine identity and exports the Infisical prod environment, so production values no longer live in Gitea. After pushing the images, CI asks the VPS to redeploy podman-spoon.service over the forced-command deploy key, with the key passed through env so the printed script never contains it. Installs survive a half-written runner cache, and one production deploy runs at a time. Infisical prod carries a valid JWKS; the copy in DOTENV_PROD had escaped quotes, so the Convex env sync had been serving invalid JSON at /.well-known/jwks.json. The first sync from Infisical replaces it.
15 lines
714 B
Bash
Executable File
15 lines
714 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install on a runner, and survive a half-written cache entry.
|
|
#
|
|
# Runners have failed twice with "Fail extracting tarball" on a different
|
|
# package each time, on different machines, and passed on a re-run. The cache
|
|
# is shared between jobs on a host, so a job that dies mid-write leaves an
|
|
# entry the next job cannot read. Clearing it and installing again costs a
|
|
# couple of minutes; a human re-running the job costs however long it takes
|
|
# someone to notice.
|
|
set -euo pipefail
|
|
if bun install --frozen-lockfile; then exit 0; fi
|
|
echo "Install failed. Clearing the bun cache and trying once more." >&2
|
|
rm -rf "${BUN_INSTALL_CACHE_DIR:-$HOME/.bun/install/cache}"
|
|
bun install --frozen-lockfile
|