bchanot/claude
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

job2: F16 remove runtime-dead gitflow-migrate.sh

Browse Source
This commit is contained in:
Bastien Chanot
2026-07-06 12:25:13 +02:00
parent 96deea100f
commit 898b61c005
1 changed files with 0 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/gitflow-migrate.sh
-95
View File
@@ -1,95 +0,0 @@
#!/usr/bin/env bash
# gitflow-migrate.sh — migrate an existing repo to the gitflow model.
# LOCAL (no token): gitflow init existing → master→main, develop, socle, hook.
# PROBE (token, READ-ONLY): identity + scope/rights, before any write.
# REMOTE (token, DESTRUCTIVE): push, default→main, protection, delete master.
# Writes ordered reversible→irreversible; DELETE master is LAST and only
# runs if every prior step succeeded. Halts on first failure.
# No `... | grep -q` under pipefail (SIGPIPE false-negative gotcha). Never echo the token.
set -uo pipefail
GITEA="${GITEA_URL:-https://git.bchanot.fr}"
OWNER="${GITEA_OWNER:-bchanot}"
# ── LOCAL half (token-free) ──────────────────────────────────────────────────
migrate_local() { # <repo-path>
local repo="$1" renamed="no"
cd "$repo" || { echo " ✗ cannot cd $repo" >&2; return 1; }
[ -z "$(git status --porcelain)" ] || { echo " ✗ working tree not clean — stash/commit first" >&2; return 2; }
{ [ -n "$(git config user.name)" ] && [ -n "$(git config user.email)" ]; } \
|| { echo " ✗ git identity unset (user.name/user.email) — set it before migrating $repo" >&2; return 3; }
git show-ref --verify -q refs/heads/master && renamed="yes"
bash "$HOME/.claude/lib/gitflow.sh" init || return 1
git show-ref --verify -q refs/heads/main || { echo " ✗ no main" >&2; return 1; }
git show-ref --verify -q refs/heads/develop || { echo " ✗ no develop" >&2; return 1; }
[ "$(git config core.hooksPath)" = ".githooks" ] || { echo " ✗ hook not active" >&2; return 1; }
[ -z "$(git status --porcelain)" ] || { echo " ✗ tree dirty after init" >&2; return 1; }
echo " ✓ local: main+develop, hook active, tree clean (master→main: $renamed)"
}
# ── Gitea API helper (token in header only; never printed) ────────────────────
_gitea() { # <METHOD> <api-path> [json-body]
local m="$1" p="$2" body="${3:-}"
curl -fsS -X "$m" -H "Authorization: token $GITEA_TOKEN" \
-H "Content-Type: application/json" ${body:+-d "$body"} "$GITEA/api/v1$p"
}
_json() { python3 -c "import sys,json;$1" 2>/dev/null; } # tiny JSON field reader
# ── PROBE (READ-ONLY: identity informational, rights = the real gate) ─────────
# /user needs read:user (cosmetic — the migration never calls it) → informational.
# The gates are the repo-scoped rights the writes actually require: admin+push on
# the repo, and admin scope confirmed by a readable branch_protections list.
gitea_probe() { # <repo-name to test rights against>
local name="$1" me pj perm
[ -n "${GITEA_TOKEN:-}" ] || { echo " ✗ GITEA_TOKEN unset" >&2; return 1; }
# [a] identity — INFORMATIONAL (needs read:user scope the migration never uses)
if me=$(_gitea GET "/user" 2>/dev/null | _json "print(json.load(sys.stdin).get('login','?'))") && [ -n "$me" ]; then
echo " ✓ token identity: $me"
else
echo " ⚠ token identity unavailable (no read:user scope) — cosmetic, migration is repo-scoped"
fi
# [b] repo rights — GATE: admin AND push must be true (default_branch, protections, push)
pj=$(_gitea GET "/repos/$OWNER/$name") \
|| { echo " ✗ GET /repos/$OWNER/$name failed — token lacks repo read scope" >&2; return 1; }
perm=$(printf '%s' "$pj" | _json "p=json.load(sys.stdin).get('permissions',{});print('admin=%s push=%s pull=%s'%(p.get('admin'),p.get('push'),p.get('pull')))")
printf '%s' "$pj" | _json "p=json.load(sys.stdin).get('permissions',{});sys.exit(0 if (p.get('admin') and p.get('push')) else 1)" \
|| { echo " ✗ insufficient rights on $name ($perm) — need admin+push" >&2; return 1; }
echo " ✓ rights on $name: $perm (admin+push confirmed)"
# [c] admin-scope canary — GATE: branch_protections readable (POST/PATCH/DELETE need repo-admin)
_gitea GET "/repos/$OWNER/$name/branch_protections" >/dev/null \
|| { echo " ✗ cannot read branch_protections — token lacks repo-admin scope; protection step would fail" >&2; return 1; }
echo " ✓ repo-admin scope confirmed (branch_protections readable → POST/PATCH/DELETE OK)"
}
# ── REMOTE half (DESTRUCTIVE; reversible→irreversible; delete master LAST) ────
_protect() { # <repo-name> <branch> (Option 1: owner-pushable)
_gitea POST "/repos/$OWNER/$1/branch_protections" \
"{\"branch_name\":\"$2\",\"enable_push\":true,\"enable_push_whitelist\":true,\"push_whitelist_usernames\":[\"$OWNER\"]}"
}
migrate_remote() { # <repo-name> (cwd = the local repo)
local name="$1"
[ -n "${GITEA_TOKEN:-}" ] || { echo " ✗ GITEA_TOKEN unset" >&2; return 1; }
echo " [1/4] push main + develop (ADDITIVE/reversible)…"
git push -u origin main || { echo " ✗ push main failed (push scope?) — STOP, nothing irreversible done" >&2; return 1; }
git push -u origin develop || { echo " ✗ push develop failed — STOP" >&2; return 1; }
echo " [2/4] default_branch → main (REVERSIBLE — scope canary)…"
_gitea PATCH "/repos/$OWNER/$name" '{"default_branch":"main"}' >/dev/null \
|| { echo " ✗ PATCH default_branch failed (admin/write scope?) — STOP before protection & delete" >&2; return 1; }
echo " [3/4] branch protection main + develop (REVERSIBLE)…"
_protect "$name" main >/dev/null || { echo " ✗ protect main failed — STOP before delete" >&2; return 1; }
_protect "$name" develop >/dev/null || { echo " ✗ protect develop failed — STOP before delete" >&2; return 1; }
echo " [4/4] DELETE remote master (IRREVERSIBLE — last; default already repointed)…"
git push origin --delete master || { echo " ✗ delete master failed (left in place — safe)" >&2; return 1; }
echo " ✓ remote: default=main, main/develop protected (owner-pushable), remote master deleted"
}
if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
case "${1:-}" in
local) migrate_local "$2" ;;
probe) gitea_probe "$2" ;;
remote) migrate_remote "$2" ;;
*) echo "usage: gitflow-migrate.sh {local <repo>|probe <name>|remote <name>}" >&2; exit 2 ;;
esac
fi