Sécurisation du script de déploiement

.github/workflows/deploy.yml

@@ -1,4 +1,4 @@
-name: Deploy to server
+name: Deploy via SSH
 
 on:
   push:
@@ -20,75 +20,79 @@ jobs:
 
           script: |
 
-            REPO="https://github.com/Johnnybegood90/GridTV.git"
+            set -e
 
-            PROD="${{ secrets.DEPLOY_PATH }}"
+            echo "===== DEPLOY START ====="
-            DEMO="${{ secrets.DEMO_DEPLOY_PATH }}"
+            echo "Branch: ${{ github.ref }}"
-            BETA="${{ secrets.BETA_DEPLOY_PATH }}"
 
-            # Hash SHA256 des chemins autorisés
+            DEPLOY_PATH="${{ secrets.DEPLOY_PATH }}"
-            H1="d6b79f6d0d7c0e7f3d44f79e4a71e1f19df24d3b1f3e2a4b4a9b0a6e7d5b8a12"
+            DEMO_DEPLOY_PATH="${{ secrets.DEMO_DEPLOY_PATH }}"
-            H2="4a5f6c8d1a4d5e0b4c2e6d3f7a9c1b2d5f6a8c4d3e1f7b2a6d8c9e0f1b2c3d4"
+            BETA_DEPLOY_PATH="${{ secrets.BETA_DEPLOY_PATH }}"
-            H3="0f2c4e6a8b1d3f5c7e9a2b4d6f8c0e1a3d5f7c9b1e2d4f6a8c0b2d4e6f8a0c2"
 
-            is_allowed () {
+            # normalisation des chemins (supprime espaces et slash final)
-
+            normalize() {
-              HASH=$(printf "%s" "$1" | sha256sum | awk '{print $1}')
+              p=$(echo "$1" | xargs)
-
+              p=${p%/}
-              if [ "$HASH" = "$H1" ] || \
+              echo "$p"
-                 [ "$HASH" = "$H2" ] || \
-                 [ "$HASH" = "$H3" ]; then
-                return 0
-              else
-                return 1
-              fi
             }
 
-            safe_deploy () {
+            DEPLOY_PATH=$(normalize "$DEPLOY_PATH")
+            DEMO_DEPLOY_PATH=$(normalize "$DEMO_DEPLOY_PATH")
+            BETA_DEPLOY_PATH=$(normalize "$BETA_DEPLOY_PATH")
 
-              TARGET="$1"
+            SAFE_PATHS=(
-              BRANCH="$2"
+              "/var/www/guide.tv.plex.johnnybegood.fr"
+              "/var/www/guide.demo.johnnybegood.fr"
+              "/var/www/beta.guide.tv.plex.johnnybegood.fr"
+            )
 
-              echo "Deploy $BRANCH"
+            is_safe() {
+              for allowed in "${SAFE_PATHS[@]}"; do
+                if [ "$1" = "$allowed" ]; then
+                  return 0
+                fi
+              done
+              return 1
+            }
 
-              if [ -z "$TARGET" ]; then
+            deploy_repo() {
-                echo "ERROR: empty path"
-                exit 1
-              fi
 
-              if ! is_allowed "$TARGET"; then
+              TARGET=$1
+              BRANCH=$2
+
+              echo "Deploying $BRANCH -> $TARGET"
+
+              if ! is_safe "$TARGET"; then
                 echo "ERROR: unauthorized path"
                 exit 1
               fi
 
               mkdir -p "$TARGET"
-              cd "$TARGET" || exit 1
+              cd "$TARGET"
 
               if [ ! -d ".git" ]; then
-                echo "Repo missing → reclone"
+                echo "Repo absent -> clone"
-
+                git clone --branch "$BRANCH" https://github.com/Johnnybegood90/GridTV.git .
-                rm -rf ./* ./.??* 2>/dev/null || true
+              else
-
+                echo "Repo présent -> reset"
-                git clone "$REPO" .
+                git fetch origin
+                git reset --hard origin/$BRANCH
               fi
-
-              git fetch origin
-              git checkout -B "$BRANCH" "origin/$BRANCH"
-              git reset --hard "origin/$BRANCH"
-              git clean -fd
-
-              echo "Deploy finished"
             }
 
             if [ "${{ github.ref }}" = "refs/heads/main" ]; then
 
-              safe_deploy "$PROD" main
+              echo "=== DEPLOY MAIN ==="
-              safe_deploy "$DEMO" main
+
+              deploy_repo "$DEPLOY_PATH" "main"
+              deploy_repo "$DEMO_DEPLOY_PATH" "main"
+
+            elif [ "${{ github.ref }}" = "refs/heads/beta" ]; then
+
+              echo "=== DEPLOY BETA ==="
+
+              deploy_repo "$BETA_DEPLOY_PATH" "beta"
 
             fi
 
-            if [ "${{ github.ref }}" = "refs/heads/beta" ]; then
+            echo "===== DEPLOY DONE ====="
-
-              safe_deploy "$BETA" beta
-
-            fi