fix production trial issue

2026-07-29 16:05:01 -04:00
parent dc04ef07b9
commit 7bc1dd338a
4 changed files with 186 additions and 0 deletions
@@ -447,6 +447,95 @@ jobs:
          ENV_DOCKER_PRODUCTION_RAW_B64="$(printf '%s' "$ENV_DOCKER_PRODUCTION" | base64 | tr -d '\n')"
          STRIPE_API_KEY_B64="$(printf '%s' "$STRIPE_API_KEY" | base64 | tr -d '\n')"
          STRIPE_WEBHOOK_SECRET_B64="$(printf '%s' "$STRIPE_WEBHOOK_SECRET" | base64 | tr -d '\n')"
+          validate_stripe_secret_inputs() {
+            local env_file stripe_api_key stripe_webhook_secret
+
+            env_file="$(mktemp)"
+            trap 'rm -f "$env_file"' EXIT
+
+            if [ -n "$ENV_DOCKER_PRODUCTION_B64_CLEAN" ]; then
+              if ! printf '%s' "$ENV_DOCKER_PRODUCTION_B64_CLEAN" | base64 -d > "$env_file"; then
+                echo "::error::ENV_DOCKER_PRODUCTION_B64 is not valid base64"
+                exit 1
+              fi
+            elif [ -n "$ENV_DOCKER_PRODUCTION" ]; then
+              printf '%s' "$ENV_DOCKER_PRODUCTION" > "$env_file"
+            else
+              : > "$env_file"
+            fi
+
+            read_env_key() {
+              local key="$1"
+              awk -F= -v key="$key" '
+                /^[[:space:]]*#/ || index($0, "=") == 0 {
+                  next
+                }
+                {
+                  name = $1
+                  sub(/^[[:space:]]*export[[:space:]]+/, "", name)
+                  gsub(/^[[:space:]]+|[[:space:]]+$/, "", name)
+                  if (name == key) {
+                    value = substr($0, index($0, "=") + 1)
+                  }
+                }
+                END {
+                  print value
+                }
+              ' "$env_file"
+            }
+
+            normalize_secret() {
+              local value="$1"
+              value="${value%$'\r'}"
+              value="${value#"${value%%[![:space:]]*}"}"
+              value="${value%"${value##*[![:space:]]}"}"
+              if [[ "$value" == \"*\" && "$value" == *\" ]]; then
+                value="${value#\"}"
+                value="${value%\"}"
+              elif [[ "$value" == \'*\' && "$value" == *\' ]]; then
+                value="${value#\'}"
+                value="${value%\'}"
+              fi
+              printf '%s' "$value"
+            }
+
+            stripe_api_key="$(normalize_secret "${STRIPE_API_KEY:-$(read_env_key STRIPE_API_KEY)}")"
+            stripe_webhook_secret="$(normalize_secret "${STRIPE_WEBHOOK_SECRET:-$(read_env_key STRIPE_WEBHOOK_SECRET)}")"
+
+            case "$stripe_api_key" in
+              sk_live_*|rk_live_*) ;;
+              "")
+                echo "::error::STRIPE_API_KEY is missing. Add a live sk_live_ or restricted rk_live_ key to the STRIPE_API_KEY secret, ENV_DOCKER_PRODUCTION, or ENV_DOCKER_PRODUCTION_B64."
+                exit 1
+                ;;
+              placeholder|replace-with-*|*changeme*|*change-me*)
+                echo "::error::STRIPE_API_KEY is still a placeholder. Replace it with a live sk_live_ or restricted rk_live_ key in Gitea Actions secrets."
+                exit 1
+                ;;
+              *)
+                echo "::error::STRIPE_API_KEY must start with sk_live_ or rk_live_ for production billing."
+                exit 1
+                ;;
+            esac
+
+            case "$stripe_webhook_secret" in
+              whsec_*) ;;
+              "")
+                echo "::error::STRIPE_WEBHOOK_SECRET is missing. Add the Stripe webhook signing secret to the STRIPE_WEBHOOK_SECRET secret, ENV_DOCKER_PRODUCTION, or ENV_DOCKER_PRODUCTION_B64."
+                exit 1
+                ;;
+              placeholder|replace-with-*|*changeme*|*change-me*)
+                echo "::error::STRIPE_WEBHOOK_SECRET is still a placeholder. Replace it with the Stripe webhook signing secret in Gitea Actions secrets."
+                exit 1
+                ;;
+              *)
+                echo "::error::STRIPE_WEBHOOK_SECRET must start with whsec_."
+                exit 1
+                ;;
+            esac
+          }
+
+          validate_stripe_secret_inputs
          REGISTRY_USERNAME="${REGISTRY_USERNAME:-${REGISTRY_USER:-}}"
          REGISTRY_PASSWORD="${REGISTRY_PASSWORD:-${REGISTRY_TOKEN:-}}"
          REGISTRY_PASSWORD_B64="$(printf '%s' "$REGISTRY_PASSWORD" | base64 | tr -d '\n')"