AkurAI-Build

public

Latest change ea39afcb9913b520c8c8e53efc1b4df1de83be22 - Deploy through a host agent; CI jobs cannot mutate the hardened service by Ólafur Búi Ólafsson

#!/bin/sh
# Stage the freshly packaged akurai binary for the host deploy agent.
#
# CI jobs run inside the hardened akurai-build service (ProtectHome=read-only,
# NoNewPrivileges), so they cannot swap the service binary or restart the unit
# themselves. Instead this job writes the candidate into the service data dir
# (the only writable home path) and the root-owned akurai-deploy.path unit
# installs it, restarts the service, health-gates, and reports back through
# deploy-staging/result. Host units live in deploy/host/.
set -eu

staging="${AKURAI_DEPLOY_STAGING:-/home/olibuijr/.local/share/akurai-build/deploy-staging}"

test -x target/release/akurai
mkdir -p "$staging"
rm -f "$staging/result"

install -m 755 target/release/akurai "$staging/akurai.next"
sha256sum "$staging/akurai.next" | cut -d' ' -f1 > "$staging/request.tmp"
mv "$staging/request.tmp" "$staging/request"

attempt=0
while [ "$attempt" -lt 60 ]; do
  if [ -f "$staging/result" ]; then
    result=$(cat "$staging/result")
    rm -f "$staging/result"
    if [ "$result" = ok ]; then
      printf '%s\n' "deploy healthy"
      exit 0
    fi
    printf 'deploy failed: %s\n' "$result" >&2
    exit 1
  fi
  attempt=$((attempt + 1))
  sleep 2
done

printf '%s\n' "deploy agent did not respond within 120s" >&2
exit 1