44 lines
1.7 KiB
Text
44 lines
1.7 KiB
Text
|
#!/usr/bin/env nu
|
||
|
|
def main [
|
||
|
|
--workspace: string = ""
|
||
|
|
--key-type: string = ""
|
||
|
|
--dry-run
|
||
|
|
]: nothing -> nothing {
|
||
|
|
let ws = if ($workspace | is-not-empty) { $workspace } else { $env.PLAYBOOK_PARAM_WORKSPACE? | default "" }
|
||
|
|
let ktype = if ($key_type | is-not-empty) { $key_type } else { $env.PLAYBOOK_PARAM_KEY_TYPE? | default "" }
|
||
|
|
|
||
|
|
if ($ws | is-empty) { error make { msg: "workspace is required" } }
|
||
|
|
|
||
|
|
let repo = $"state-($ws)"
|
||
|
|
|
||
|
|
if $dry_run {
|
||
|
|
print $"[dry-run] would await quorum signatures on pending delegation patch in ($repo)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
let list_r = do { ^rad patch list --repo $repo --state open --json } | complete
|
||
|
|
if $list_r.exit_code != 0 {
|
||
|
|
error make { msg: $"Cannot list open patches on ($repo): ($list_r.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let patches = $list_r.stdout | from json
|
||
|
|
let delegation_patches = $patches | where { |p|
|
||
|
|
($p.title? | default "" | str contains "Rotate") and ($p.title? | default "" | str contains $ktype)
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($delegation_patches | is-empty) {
|
||
|
|
error make { msg: $"No open delegation patch found for ($ktype) in ($repo). Propose one first." }
|
||
|
|
}
|
||
|
|
|
||
|
|
let patch_id = $delegation_patches | first | get id
|
||
|
|
print $"Found delegation patch ($patch_id) — initiating quorum sign flow"
|
||
|
|
|
||
|
|
let sign_r = do { ^rad patch review $patch_id --repo $repo --accept } | complete
|
||
|
|
if $sign_r.exit_code != 0 {
|
||
|
|
error make { msg: $"Failed to sign delegation patch ($patch_id): ($sign_r.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"Signed delegation patch ($patch_id). Remaining quorum members must also sign via: rad patch review ($patch_id) --repo ($repo) --accept"
|
||
|
|
print $sign_r.stdout
|
||
|
|
}
|