replace web iex launcher with a save-and-run script
The iex (irm ...) one-liner could never work against a private repo: raw.githubusercontent.com returns 404 without a token, and a git operation's Credential Manager auth does not apply to a plain irm. The prior token-passing workaround (get.ps1, 717387f) asked pilots to paste a PAT, which they will not do and may not have.
Start-ShopDBDev.ps1 is a downloaded FILE, not a web pipe, so only its git clone/fetch need auth - and those go through Git Credential Manager using the login pilots already have from cloning this repo or signing in via Visual Studio / VS Code. No token, no paste. It takes -Channel stable|edge and hands off to dev-bootstrap.ps1. DEV-BUILD-TEST.md is rewritten for the save-and-run flow with a GCM-seeding fallback.
This commit is contained in:
benjamin.baker
86
scripts/Start-ShopDBDev.ps1
Normal file
86
scripts/Start-ShopDBDev.ps1
Normal file
@@ -0,0 +1,86 @@
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Save-and-run launcher for a ShopDB dev workstation (stable or edge).
|
||||
|
||||
.DESCRIPTION
|
||||
Download this one file and run it. It clones (or updates) the repo at the
|
||||
channel branch into a local path, then hands off to scripts/dev-bootstrap.ps1
|
||||
for the real dependency-check / build / up work.
|
||||
|
||||
ge-aero/shopdb-flask is a PRIVATE repo, but this needs no token pasting: the
|
||||
clone uses a plain https URL and Git Credential Manager supplies your stored
|
||||
GitHub credential automatically - the same way `git clone` works in the wiki
|
||||
DEVELOPMENT-SETUP procedure. If you have ever cloned this repo or signed in to
|
||||
GitHub in Visual Studio / VS Code on this box, GCM already has what it needs.
|
||||
|
||||
This is a downloaded FILE, not a web `iex` one-liner, precisely because a
|
||||
private repo cannot be fetched anonymously from raw.githubusercontent.com. A
|
||||
saved script sidesteps that entirely - only the git operations need auth, and
|
||||
GCM handles those.
|
||||
|
||||
.PARAMETER Channel
|
||||
'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
|
||||
|
||||
.PARAMETER TargetDir
|
||||
Where to clone. Defaults to %USERPROFILE%\shopdb-dev, a separate working copy
|
||||
from any repo you already have open.
|
||||
|
||||
.EXAMPLE
|
||||
# Bleeding edge:
|
||||
powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel edge
|
||||
|
||||
.EXAMPLE
|
||||
# Stable:
|
||||
powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel stable
|
||||
|
||||
.NOTES
|
||||
ASCII only, no emoji or smart punctuation, per repo style. PowerShell 5.1+.
|
||||
Needs Git (with Credential Manager, the Git-for-Windows default);
|
||||
dev-bootstrap.ps1 offers to winget-install anything else that is missing.
|
||||
#>
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
[ValidateSet('stable', 'edge')]
|
||||
[string]$Channel = 'stable',
|
||||
|
||||
[string]$TargetDir
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# Plain https URL. No token in the URL: Git Credential Manager injects the
|
||||
# stored GitHub credential for github.com, so clone/fetch authenticate against
|
||||
# the private repo without anything sensitive touching this script or disk.
|
||||
$repoUrl = 'https://github.com/ge-aero/shopdb-flask.git'
|
||||
$branch = if ($Channel -eq 'edge') { 'dev-be' } else { 'main' }
|
||||
$target = if ($TargetDir) { $TargetDir } else { Join-Path $env:USERPROFILE 'shopdb-dev' }
|
||||
|
||||
Write-Host "ShopDB dev launcher" -ForegroundColor White
|
||||
Write-Host " Channel : $Channel ($branch)" -ForegroundColor White
|
||||
Write-Host " Target : $target" -ForegroundColor White
|
||||
|
||||
if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
|
||||
throw 'git is required. Install Git for Windows (winget install Git.Git) and re-run.'
|
||||
}
|
||||
|
||||
if (Test-Path (Join-Path $target '.git')) {
|
||||
Write-Host "==> Updating existing clone" -ForegroundColor Cyan
|
||||
git -C $target fetch origin $branch
|
||||
if ($LASTEXITCODE -ne 0) { throw "git fetch failed ($LASTEXITCODE). If this is an auth error, clone the repo once in Visual Studio / VS Code so Credential Manager stores your GitHub login." }
|
||||
git -C $target checkout $branch
|
||||
if ($LASTEXITCODE -ne 0) { throw "git checkout failed ($LASTEXITCODE)." }
|
||||
git -C $target pull --ff-only origin $branch
|
||||
if ($LASTEXITCODE -ne 0) { throw "git pull failed ($LASTEXITCODE)." }
|
||||
} else {
|
||||
Write-Host "==> Cloning $branch" -ForegroundColor Cyan
|
||||
git clone --branch $branch $repoUrl $target
|
||||
if ($LASTEXITCODE -ne 0) { throw "git clone failed ($LASTEXITCODE). If this is an auth error, sign in to GitHub once in Visual Studio / VS Code (or run 'git clone $repoUrl' manually) so Credential Manager stores your login, then re-run." }
|
||||
}
|
||||
|
||||
$bootstrap = Join-Path $target 'scripts\dev-bootstrap.ps1'
|
||||
if (-not (Test-Path $bootstrap)) {
|
||||
throw "dev-bootstrap.ps1 not found at $bootstrap. Is the '$branch' branch correct?"
|
||||
}
|
||||
|
||||
Write-Host "==> Handing off to dev-bootstrap.ps1" -ForegroundColor Cyan
|
||||
& $bootstrap -Channel $Channel
|
||||
@@ -1,95 +0,0 @@
|
||||
<#
|
||||
.SYNOPSIS
|
||||
One-line web launcher for a ShopDB dev workstation.
|
||||
|
||||
.DESCRIPTION
|
||||
The piece that makes `iex (irm .../get.ps1)` work. dev-bootstrap.ps1 operates
|
||||
on a local clone, so it cannot be run straight from the web. This launcher
|
||||
fills that gap: it clones (or updates) the repo at the channel branch into a
|
||||
stable local path, then hands off to scripts/dev-bootstrap.ps1 for the real
|
||||
dependency-check / build / up work.
|
||||
|
||||
Channel is chosen by an environment variable so a pure `iex` pipe (which
|
||||
cannot pass parameters) still selects stable vs edge:
|
||||
|
||||
# Bleeding edge (dev-be):
|
||||
$env:SHOPDB_CHANNEL='edge'
|
||||
$env:SHOPDB_TOKEN='ghp_yourtoken'
|
||||
$h=@{ Authorization="token $env:SHOPDB_TOKEN" }
|
||||
iex (irm -Headers $h https://raw.githubusercontent.com/ge-aero/shopdb-flask/wilm/scripts/get.ps1)
|
||||
|
||||
ge-aero/shopdb-flask is a PRIVATE repo, so both the raw fetch of this
|
||||
launcher AND the git clone it performs need a GitHub token. The raw fetch is
|
||||
authenticated by the -Headers on irm above; the clone is authenticated here
|
||||
by reading the same token from the environment (SHOPDB_TOKEN, or GITHUB_TOKEN
|
||||
as a fallback) and using it in the clone URL. Anonymous access returns 404.
|
||||
|
||||
SHOPDB_DIR overrides the clone location (default %USERPROFILE%\shopdb-dev).
|
||||
|
||||
.NOTES
|
||||
ASCII only, no emoji or smart punctuation, per repo style. PowerShell 5.1+.
|
||||
Runs git-checkout of the channel branch, so it needs Git; dev-bootstrap.ps1
|
||||
offers to winget-install anything else that is missing.
|
||||
#>
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# Private-repo access token, used for the git clone/fetch below. The same token
|
||||
# authenticated the raw fetch of this script (via irm -Headers). Prefer the
|
||||
# ShopDB-specific var so a pilot can keep an unrelated GITHUB_TOKEN in place.
|
||||
$token = if ($env:SHOPDB_TOKEN) { $env:SHOPDB_TOKEN } elseif ($env:GITHUB_TOKEN) { $env:GITHUB_TOKEN } else { '' }
|
||||
if (-not $token) {
|
||||
throw 'No token found. Set $env:SHOPDB_TOKEN (a GitHub PAT with repo read) before running; the repo is private.'
|
||||
}
|
||||
|
||||
# x-access-token is GitHub's documented username for token-in-URL auth; it works
|
||||
# for classic PATs and fine-grained tokens alike. Kept out of any Write-Host so
|
||||
# the secret never lands in the transcript.
|
||||
$repoUrl = "https://x-access-token:$token@github.com/ge-aero/shopdb-flask.git"
|
||||
$channel = if ($env:SHOPDB_CHANNEL) { $env:SHOPDB_CHANNEL } else { 'stable' }
|
||||
if ($channel -notin @('stable', 'edge')) {
|
||||
throw "SHOPDB_CHANNEL must be 'stable' or 'edge' (got '$channel')."
|
||||
}
|
||||
$branch = if ($channel -eq 'edge') { 'dev-be' } else { 'main' }
|
||||
$target = if ($env:SHOPDB_DIR) { $env:SHOPDB_DIR } else { Join-Path $env:USERPROFILE 'shopdb-dev' }
|
||||
|
||||
Write-Host "ShopDB web launcher" -ForegroundColor White
|
||||
Write-Host " Channel : $channel ($branch)" -ForegroundColor White
|
||||
Write-Host " Target : $target" -ForegroundColor White
|
||||
|
||||
if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
|
||||
throw 'git is required to clone the repo. Install Git (winget install Git.Git) and re-run.'
|
||||
}
|
||||
|
||||
if (Test-Path (Join-Path $target '.git')) {
|
||||
Write-Host "==> Updating existing clone" -ForegroundColor Cyan
|
||||
# Fetch by explicit tokenized URL, not `origin`: origin is deliberately the
|
||||
# clean tokenless URL (see the clone path below), so a bare `fetch origin`
|
||||
# would 404 against the private repo. Passing the URL keeps the token off
|
||||
# disk while still authenticating this pull.
|
||||
git -C $target fetch $repoUrl $branch
|
||||
if ($LASTEXITCODE -ne 0) { throw "git fetch failed ($LASTEXITCODE)." }
|
||||
git -C $target checkout $branch
|
||||
if ($LASTEXITCODE -ne 0) { throw "git checkout failed ($LASTEXITCODE)." }
|
||||
git -C $target merge --ff-only FETCH_HEAD
|
||||
if ($LASTEXITCODE -ne 0) { throw "git merge --ff-only failed ($LASTEXITCODE)." }
|
||||
} else {
|
||||
Write-Host "==> Cloning $branch" -ForegroundColor Cyan
|
||||
git clone --branch $branch $repoUrl $target
|
||||
if ($LASTEXITCODE -ne 0) { throw "git clone failed ($LASTEXITCODE)." }
|
||||
# Scrub the token out of the persisted remote: `git clone` writes the full
|
||||
# URL (token included) into .git/config. Reset origin to the clean URL so the
|
||||
# secret does not sit on disk. Fetch/pull above still work because this only
|
||||
# runs on the fresh-clone path; a returning pilot re-fetches with a clean
|
||||
# origin and their own credential helper / token as usual.
|
||||
git -C $target remote set-url origin 'https://github.com/ge-aero/shopdb-flask.git'
|
||||
if ($LASTEXITCODE -ne 0) { throw "git remote set-url failed ($LASTEXITCODE)." }
|
||||
}
|
||||
|
||||
$bootstrap = Join-Path $target 'scripts\dev-bootstrap.ps1'
|
||||
if (-not (Test-Path $bootstrap)) {
|
||||
throw "dev-bootstrap.ps1 not found at $bootstrap. Is the branch correct?"
|
||||
}
|
||||
|
||||
Write-Host "==> Handing off to dev-bootstrap.ps1" -ForegroundColor Cyan
|
||||
& $bootstrap -Channel $channel
|
||||
Reference in New Issue
Block a user