This repository has no description
932 B
21 lines
1#!/usr/bin/env bash
2# Pushes the closures of PATH... to niks3.lassul.us, served as
3# cache.lassul.us, with the job's GitHub OIDC token (needs id-token: write;
4# niks3 on neoprism trusts tokens of lassulus/superconfig, see
5# configs/nix-cache.nix). cache.nixos.org keeps serving what it signed,
6# those paths are left out. Needs niks3 in PATH.
7# Usage: niks3-push.sh PATH...
8# niks3-push.sh --stdin the paths from stdin
9# niks3-push.sh --token the token, as niks3's --auth-token-script
10set -euo pipefail
11url=https://niks3.lassul.us
12
13if [ "${1:-}" = --token ]; then
14 curl -fsS --retry 4 --retry-all-errors \
15 -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:?needs id-token: write}" \
16 "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=$url" | jq -ce '{ token: .value }'
17 exit
18fi
19
20niks3 push --server-url "$url" --auth-token-script "$(realpath "$0") --token" \
21 --ignore-upstream-key cache.nixos.org-1 "$@"