tegwick
6382139890
Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests. Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.
31 lines
824 B
Bash
Executable file
31 lines
824 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Non-secret source-side preflight for SECRETS-WP-0003.
|
|
set -euo pipefail
|
|
|
|
DECISION_ID="e6381a56-6b04-4fd5-b2de-f3ef59cde888"
|
|
CATALOG_ID="whynot-design-npm-publish"
|
|
|
|
if [[ -d .venv ]]; then
|
|
# shellcheck disable=SC1091
|
|
source .venv/bin/activate
|
|
fi
|
|
|
|
if command -v secrets-engine >/dev/null 2>&1; then
|
|
SECRETS_ENGINE=(secrets-engine)
|
|
else
|
|
export PYTHONPATH="src${PYTHONPATH:+:$PYTHONPATH}"
|
|
SECRETS_ENGINE=(python3 -m secrets_engine.cli)
|
|
fi
|
|
|
|
export SECRETS_ENGINE_EVIDENCE="${SECRETS_ENGINE_EVIDENCE:-/tmp/secrets-engine-whynot-preflight-evidence}"
|
|
|
|
echo "### decision"
|
|
"${SECRETS_ENGINE[@]}" decision inspect "$DECISION_ID"
|
|
|
|
echo
|
|
echo "### publication policy"
|
|
"${SECRETS_ENGINE[@]}" policy publication "$CATALOG_ID"
|
|
|
|
echo
|
|
echo "### route pointer"
|
|
"${SECRETS_ENGINE[@]}" route "$CATALOG_ID" --json
|