44 lines
1.6 KiB
Python
44 lines
1.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Gitea release webhook -> spawn deploy script. Socket-activated (systemd
|
|
Accept=yes + StandardInput/Output=socket + KillMode=process — without
|
|
KillMode=process the spawn is killed when this handler exits)."""
|
|
import hmac, hashlib, json, os, subprocess, sys
|
|
|
|
SECRET_FILE = os.path.expanduser("~/.config/kanbante-webhook-secret")
|
|
DEPLOY = "/home/bruno/bin/deploy-on-release.sh"
|
|
LOG = os.path.expanduser("~/.local/state/kanbante-deploy.log")
|
|
|
|
f = sys.stdin.buffer
|
|
f.readline() # POST / HTTP/1.1
|
|
hdrs = {}
|
|
while True:
|
|
line = f.readline()
|
|
if line in (b"\r\n", b"\n", b""):
|
|
break
|
|
k, _, v = line.decode(errors="replace").partition(":")
|
|
hdrs[k.strip().lower()] = v.strip()
|
|
raw = f.read(int(hdrs.get("content-length", 0))) if hdrs.get("content-length") else b""
|
|
|
|
def reply(code, msg):
|
|
sys.stdout.write(f"HTTP/1.1 {code} {msg}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n")
|
|
sys.stdout.flush()
|
|
|
|
if hdrs.get("x-gitea-event") != "release":
|
|
sys.exit(0)
|
|
secret = open(SECRET_FILE, "rb").read().strip()
|
|
sig = hdrs.get("x-gitea-signature", "")
|
|
if not hmac.compare_digest(sig, hmac.new(secret, raw, hashlib.sha256).hexdigest()):
|
|
reply("401", "Unauthorized")
|
|
sys.exit(1)
|
|
try:
|
|
rel = json.loads(raw)["release"]
|
|
if rel.get("action", "published") != "published":
|
|
sys.exit(0)
|
|
tag = rel["tag_name"]
|
|
except Exception:
|
|
sys.exit(0)
|
|
reply("202", "Accepted")
|
|
open(LOG, "a").write(f"{__import__('datetime').datetime.now().astimezone().isoformat()} webhook: release {tag}\n")
|
|
env = dict(os.environ, DEPLOY_TAG=tag)
|
|
subprocess.Popen([DEPLOY], env=env, stdout=open(LOG, "a"), stderr=subprocess.STDOUT)
|