From a4a4dfeb3a3f57cadd38e4757d379d42016e8d53 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Mon, 7 Sep 2026 21:20:34 +0000 Subject: [PATCH] chore: update mise agent config Signed-off-by: GitHub --- mise.agent.toml | 40 ++++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-) diff --git a/mise.agent.toml b/mise.agent.toml index e0d85186c..0806490ae 100644 --- a/mise.agent.toml +++ b/mise.agent.toml @@ -4,40 +4,48 @@ DEVSY_GIT_SIGNING_PRIVATE_KEY = { age = "YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTU [tasks."setup:agent"] run = ''' set -eu -if [ -z "$DEVSY_GIT_SIGNING_PRIVATE_KEY" ]; then - echo "DEVSY_GIT_SIGNING_PRIVATE_KEY is not set" + +if [ -z "${DEVSY_GIT_SIGNING_PRIVATE_KEY:-}" ]; then + echo "ERROR: DEVSY_GIT_SIGNING_PRIVATE_KEY is not set" exit 1 fi -if [ -z "$DEVSY_GIT_AUTHOR_NAME" ]; then - echo "DEVSY_GIT_AUTHOR_NAME is not set" +if [ -z "${DEVSY_GIT_AUTHOR_NAME:-}" ]; then + echo "ERROR: DEVSY_GIT_AUTHOR_NAME is not set" exit 1 fi -if [ -z "$DEVSY_GIT_AUTHOR_EMAIL" ]; then - echo "DEVSY_GIT_AUTHOR_EMAIL is not set" +if [ -z "${DEVSY_GIT_AUTHOR_EMAIL:-}" ]; then + echo "ERROR: DEVSY_GIT_AUTHOR_EMAIL is not set" exit 1 fi + SIGNING_DIR="$HOME/.local/share/devsy/signing" SIGNING_PRIVATE_KEY="$SIGNING_DIR/devsy-agent-signing" SIGNING_PUBLIC_KEY="$SIGNING_DIR/devsy-agent-signing.pub" +ALLOWED_SIGNERS="$SIGNING_DIR/allowed_signers" mkdir -p "$SIGNING_DIR" chmod 700 "$SIGNING_DIR" -echo "$DEVSY_GIT_SIGNING_PRIVATE_KEY" > "$SIGNING_PRIVATE_KEY" +printf '%s\n' "$DEVSY_GIT_SIGNING_PRIVATE_KEY" > "$SIGNING_PRIVATE_KEY" chmod 600 "$SIGNING_PRIVATE_KEY" ssh-keygen -y -f "$SIGNING_PRIVATE_KEY" > "$SIGNING_PUBLIC_KEY" +chmod 644 "$SIGNING_PUBLIC_KEY" + +printf '%s %s\n' \ + "$DEVSY_GIT_AUTHOR_EMAIL" \ + "$(cat "$SIGNING_PUBLIC_KEY")" \ + > "$ALLOWED_SIGNERS" +chmod 600 "$ALLOWED_SIGNERS" + +git config --global user.name "$DEVSY_GIT_AUTHOR_NAME" +git config --global user.email "$DEVSY_GIT_AUTHOR_EMAIL" +git config --global user.useConfigOnly true git config --global gpg.format ssh -git config --global user.signingkey "$SIGNING_PUBLIC_KEY" +git config --global user.signingkey "$SIGNING_PRIVATE_KEY" git config --global commit.gpgsign true git config --global tag.gpgsign true -git config --global user.name "$DEVSY_GIT_AUTHOR_NAME" -git config --global user.email "$DEVSY_GIT_AUTHOR_EMAIL" - -mkdir -p "$HOME/.ssh" -chmod 700 "$HOME/.ssh" -echo "$DEVSY_GIT_AUTHOR_EMAIL $(cat $SIGNING_PUBLIC_KEY)" > "$HOME/.ssh/allowed_signers" -chmod 600 "$HOME/.ssh/allowed_signers" -git config --global gpg.ssh.allowedSignersFile "$HOME/.ssh/allowed_signers" +git config --global gpg.ssh.allowedSignersFile "$ALLOWED_SIGNERS" +git config --global --unset-all core.hooksPath 2>/dev/null || true '''