Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 9 Projects Releases Packages Wiki Activity Actions

render-secrets.sh: fix SC2015 in the mirror-write guard
All checks were successful
PR build (required check) / changes (pull_request) Successful in 21s
Details
secrets-guard / encrypted (pull_request) Successful in 26s
Details
shell-lint / shellcheck (pull_request) Successful in 23s
Details
PR build (required check) / validate-observability (pull_request) Successful in 48s
Details
PR build (required check) / build-frontend (pull_request) Successful in 2m14s
Details
PR build (required check) / build-backend (pull_request) Successful in 2m46s
Details
PR build (required check) / gate (pull_request) Successful in 2s
Details

Browse source 
A && B || C isn't if-then-else -- C can run when A is true but B
fails too. Use an explicit if/else so an mkdir success + install
failure is still caught.
This commit is contained in:
Emi Griffith 2026-07-25 00:12:07 -07:00
parent 73cd6b7aae
commit 40d3b5f5dc
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
infra/deploy/render-secrets.sh
View file

@ -137,9 +137,11 @@ render_thermograph_secrets() {
# prod/beta (apt-installed Docker, no snap confinement) leave it unset and # prod/beta (apt-installed Docker, no snap confinement) leave it unset and
# this is a no-op for them. # this is a no-op for them.
if [ "$rc" = 0 ] && [ -n "${THERMOGRAPH_SECRETS_ENV_FILE_MIRROR:-}" ]; then if [ "$rc" = 0 ] && [ -n "${THERMOGRAPH_SECRETS_ENV_FILE_MIRROR:-}" ]; then
mkdir -p "$(dirname "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR")" \ if ! mkdir -p "$(dirname "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR")" \
&& install -m 0600 "$tmp" "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" \ || ! install -m 0600 "$tmp" "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR"; then
|| { echo "!! cannot write mirror at $THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" >&2; rc=1; } echo "!! cannot write mirror at $THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" >&2
rc=1
fi
fi fi
rm -f "$tmp" rm -f "$tmp"