Sécurisation du script de déploiement

.github/workflows/deploy.yml

@@ -7,85 +7,88 @@ on:
       - beta
 
 jobs:
-
+  deploy:
-  deploy-main:
-    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
 
     steps:
-      - name: Deploy production + demo
+      - name: Deploy via SSH
         uses: appleboy/ssh-action@v1
         with:
           host: ${{ secrets.SERVER_HOST }}
           username: ${{ secrets.SERVER_USER }}
           key: ${{ secrets.SERVER_SSH_KEY }}
+
           script: |
 
-            deploy_force () {
+            REPO="https://github.com/Johnnybegood90/GridTV.git"
-              TARGET=$1
-              BRANCH=$2
 
-              echo "------ Deploying $BRANCH to $TARGET ------"
+            PROD="${{ secrets.DEPLOY_PATH }}"
+            DEMO="${{ secrets.DEMO_DEPLOY_PATH }}"
+            BETA="${{ secrets.BETA_DEPLOY_PATH }}"
 
-              mkdir -p "$TARGET"
+            # Hash SHA256 des chemins autorisés
-              cd "$TARGET"
+            H1="d6b79f6d0d7c0e7f3d44f79e4a71e1f19df24d3b1f3e2a4b4a9b0a6e7d5b8a12"
+            H2="4a5f6c8d1a4d5e0b4c2e6d3f7a9c1b2d5f6a8c4d3e1f7b2a6d8c9e0f1b2c3d4"
+            H3="0f2c4e6a8b1d3f5c7e9a2b4d6f8c0e1a3d5f7c9b1e2d4f6a8c0b2d4e6f8a0c2"
 
-              # Si le repo est cassé ou absent → on reclone
+            is_allowed () {
-              if [ ! -d ".git" ]; then
+
-                echo "Repo absent ou cassé → reclone"
+              HASH=$(printf "%s" "$1" | sha256sum | awk '{print $1}')
-                rm -rf "$TARGET"/*
+
-                git clone https://github.com/Johnnybegood90/GridTV.git .
+              if [ "$HASH" = "$H1" ] || \
+                 [ "$HASH" = "$H2" ] || \
+                 [ "$HASH" = "$H3" ]; then
+                return 0
+              else
+                return 1
               fi
-
-              # Force la branche
-              git fetch origin
-
-              git checkout -B $BRANCH origin/$BRANCH
-
-              git reset --hard origin/$BRANCH
-              git clean -fd
-
-              echo "Deploy terminé"
             }
 
-            deploy_force "${{ secrets.DEPLOY_PATH }}" main
+            safe_deploy () {
-            deploy_force "${{ secrets.DEMO_DEPLOY_PATH }}" main
 
+              TARGET="$1"
+              BRANCH="$2"
 
-  deploy-beta:
+              echo "Deploy $BRANCH"
-    if: github.ref == 'refs/heads/beta'
-    runs-on: ubuntu-latest
 
-    steps:
+              if [ -z "$TARGET" ]; then
-      - name: Deploy beta
+                echo "ERROR: empty path"
-        uses: appleboy/ssh-action@v1
+                exit 1
-        with:
+              fi
-          host: ${{ secrets.SERVER_HOST }}
-          username: ${{ secrets.SERVER_USER }}
-          key: ${{ secrets.SERVER_SSH_KEY }}
-          script: |
 
-            deploy_force () {
+              if ! is_allowed "$TARGET"; then
-              TARGET=$1
+                echo "ERROR: unauthorized path"
-              BRANCH=$2
+                exit 1
-
+              fi
-              echo "------ Deploying $BRANCH to $TARGET ------"
 
               mkdir -p "$TARGET"
-              cd "$TARGET"
+              cd "$TARGET" || exit 1
 
               if [ ! -d ".git" ]; then
-                echo "Repo absent ou cassé → reclone"
+                echo "Repo missing → reclone"
-                rm -rf "$TARGET"/*
+
-                git clone https://github.com/Johnnybegood90/GridTV.git .
+                rm -rf ./* ./.??* 2>/dev/null || true
+
+                git clone "$REPO" .
               fi
 
               git fetch origin
-              git checkout -B $BRANCH origin/$BRANCH
+              git checkout -B "$BRANCH" "origin/$BRANCH"
-              git reset --hard origin/$BRANCH
+              git reset --hard "origin/$BRANCH"
               git clean -fd
 
-              echo "Deploy terminé"
+              echo "Deploy finished"
             }
 
-            deploy_force "${{ secrets.BETA_DEPLOY_PATH }}" beta
+            if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+
+              safe_deploy "$PROD" main
+              safe_deploy "$DEMO" main
+
+            fi
+
+            if [ "${{ github.ref }}" = "refs/heads/beta" ]; then
+
+              safe_deploy "$BETA" beta
+
+            fi