mirror of
https://github.com/iflytek/skillhub.git
synced 2026-09-24 00:55:35 +00:00
d824a0498c
Some checks are pending
Deploy Docs / build (push) Waiting to run
Deploy Docs / Deploy (push) Blocked by required conditions
Security / Dependency Review (push) Waiting to run
Security / CodeQL (java-kotlin) (push) Waiting to run
Security / CodeQL (javascript-typescript) (push) Waiting to run
Security / CodeQL (python) (push) Waiting to run
* fix(skill): harden SkillHub CLI guide bootstrap Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * test(web): support exact preview browser checks Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * test(skill): enforce guide safety contracts Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(skill): verify CLI package provenance Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * test(web): align CLI provenance assertions Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
32 lines
1.7 KiB
Bash
32 lines
1.7 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${SKILLHUB_WEB_API_BASE_URL:=}"
|
|
: "${SKILLHUB_PUBLIC_BASE_URL:=}"
|
|
: "${SKILLHUB_WEB_AUTH_DIRECT_ENABLED:=false}"
|
|
: "${SKILLHUB_WEB_AUTH_DIRECT_PROVIDER:=}"
|
|
|
|
# Session-bootstrap variables are defaulted here so envsubst writes
|
|
# `authSessionBootstrapEnabled: "false"` into runtime-config.js instead of leaving
|
|
# the literal `${...}` placeholder. They are intentionally NOT exposed in
|
|
# compose.release.yml or .env.release.example: the matching server-side switch
|
|
# does not exist yet, so surfacing the toggle would let the frontend hit
|
|
# /api/v1/auth/session/bootstrap and receive 403. See PR #280 discussion.
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED:=false}"
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER:=}"
|
|
: "${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO:=false}"
|
|
|
|
# Generate runtime-config.js
|
|
envsubst '${SKILLHUB_WEB_API_BASE_URL} ${SKILLHUB_PUBLIC_BASE_URL} ${SKILLHUB_WEB_AUTH_DIRECT_ENABLED} ${SKILLHUB_WEB_AUTH_DIRECT_PROVIDER} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER} ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO}' \
|
|
< /usr/share/nginx/html/runtime-config.js.template \
|
|
> /usr/share/nginx/html/runtime-config.js
|
|
|
|
# The guide derives its registry from the URL used to fetch it. Keep a Host
|
|
# allowlist on the public route, but do not embed a second source of truth in
|
|
# the document body.
|
|
guide_url_config="${SKILLHUB_NGINX_GUIDE_URL_CONFIG:-/etc/nginx/skillhub-guide-public-url.conf}"
|
|
printf '%s\n' \
|
|
'if ($http_host !~ "^(?:[A-Za-z0-9.-]+|\\[[0-9A-Fa-f:.]+\\])(?::[0-9]{1,5})?$") { return 400; }' \
|
|
> "$guide_url_config"
|
|
cp /usr/share/nginx/html/registry/skill.md.template \
|
|
/usr/share/nginx/html/registry/skill.md
|