tegwick
4143f7c004
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
48 lines
1.5 KiB
Python
48 lines
1.5 KiB
Python
"""Runtime configuration helpers that keep secret values out of manifests."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import re
|
|
from pathlib import Path
|
|
|
|
POSTGRES_IDENTIFIER = re.compile(r"^[a-z_][a-z0-9_]*$")
|
|
|
|
|
|
def database_target(default: str | Path | None = None) -> str | Path:
|
|
"""Return the configured database target, preferring a mounted secret file."""
|
|
url_file = os.getenv("SBOM_NEXUS_DATABASE_URL_FILE")
|
|
if url_file:
|
|
path = Path(url_file)
|
|
try:
|
|
value = path.read_text(encoding="utf-8").strip()
|
|
except OSError as exc:
|
|
raise RuntimeError(f"Unable to read SBOM_NEXUS_DATABASE_URL_FILE: {path}") from exc
|
|
if not value:
|
|
raise RuntimeError(f"SBOM_NEXUS_DATABASE_URL_FILE is empty: {path}")
|
|
return value
|
|
|
|
url = os.getenv("SBOM_NEXUS_DATABASE_URL")
|
|
if url:
|
|
return url
|
|
|
|
path = os.getenv("SBOM_NEXUS_DATABASE_PATH")
|
|
if path:
|
|
return path
|
|
|
|
if default is None:
|
|
raise RuntimeError(
|
|
"Configure SBOM_NEXUS_DATABASE_URL_FILE, SBOM_NEXUS_DATABASE_URL, "
|
|
"or SBOM_NEXUS_DATABASE_PATH"
|
|
)
|
|
return default
|
|
|
|
|
|
def migration_role() -> str | None:
|
|
"""Return the durable PostgreSQL role that must own migrated objects."""
|
|
role = os.getenv("SBOM_NEXUS_MIGRATION_ROLE")
|
|
if not role:
|
|
return None
|
|
if not POSTGRES_IDENTIFIER.fullmatch(role):
|
|
raise RuntimeError("SBOM_NEXUS_MIGRATION_ROLE must be a PostgreSQL identifier")
|
|
return role
|