Sécuriser Gitea et alerter sur les échecs CI

ops/provision-dashboard-alert-token.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+readonly DASHBOARD_APP_DIR="${DASHBOARD_APP_DIR:-/opt/manus-deploy/apps/manus-dashboard}"
+readonly DASHBOARD_ENV_FILE="${DASHBOARD_ENV_FILE:-${DASHBOARD_APP_DIR}/.env}"
+readonly REFERENTIEL_CONTAINER="${REFERENTIEL_CONTAINER:-referentiel-ia}"
+readonly REFERENTIEL_URL="${IA_REFERENTIEL_URL:-https://referentiel-ia.recette.santinova-soft.org}"
+
+backup="$(mktemp /tmp/manus-dashboard-env-backup.XXXXXX)"
+temporary="$(mktemp /tmp/manus-dashboard-env-next.XXXXXX)"
+chmod 0600 "${backup}" "${temporary}"
+cp "${DASHBOARD_ENV_FILE}" "${backup}"
+
+cleanup() {
+  rm -f "${backup}" "${temporary}"
+  unset token result
+}
+trap cleanup EXIT
+
+result="$(docker exec "${REFERENTIEL_CONTAINER}" sh -lc 'cd /app && corepack pnpm exec tsx scripts/dashboard-alert-token.ts prepare')"
+token="${result%%$'\t'*}"
+token_id="${result##*$'\t'}"
+[[ -n "${token}" && "${token_id}" =~ ^[0-9]+$ ]] || { echo "Le Référentiel IA n’a pas retourné un jeton exploitable." >&2; exit 1; }
+
+awk -v value="${token}" '
+  BEGIN { replaced = 0 }
+  /^IA_REFERENTIEL_TOKEN=/ { print "IA_REFERENTIEL_TOKEN=" value; replaced = 1; next }
+  { print }
+  END { if (!replaced) print "IA_REFERENTIEL_TOKEN=" value }
+' "${DASHBOARD_ENV_FILE}" > "${temporary}"
+mv "${temporary}" "${DASHBOARD_ENV_FILE}"
+chmod 0600 "${DASHBOARD_ENV_FILE}"
+
+if ! (cd "${DASHBOARD_APP_DIR}" && docker compose up -d --force-recreate dashboard >/dev/null); then
+  cp "${backup}" "${DASHBOARD_ENV_FILE}"
+  exit 1
+fi
+sleep 8
+health="$(curl -sS -o /dev/null -w '%{http_code}' -H "Authorization: Bearer ${token}" "${REFERENTIEL_URL}/api/integration/v1/alerts/ci/health")"
+if [[ "${health}" != "204" ]]; then
+  cp "${backup}" "${DASHBOARD_ENV_FILE}"
+  (cd "${DASHBOARD_APP_DIR}" && docker compose up -d --force-recreate dashboard >/dev/null) || true
+  echo "Le nouveau jeton d’alerte a échoué au contrôle HTTP (${health}); rollback effectué." >&2
+  exit 1
+fi
+
+docker exec "${REFERENTIEL_CONTAINER}" sh -lc "cd /app && corepack pnpm exec tsx scripts/dashboard-alert-token.ts finalize ${token_id}" >/dev/null
+echo "DASHBOARD_ALERT_TOKEN_PROVISIONED"