Add Docker test deployment on Gitea Actions

src/adcloud_server/container_entrypoint.py

@@ -0,0 +1,69 @@
+"""Persist per-deployment secrets in a Docker volume before starting uvicorn."""
+
+import fcntl
+import os
+import re
+import secrets
+import sys
+import tempfile
+from pathlib import Path
+
+from dotenv import dotenv_values
+
+SECRET_NAMES = ("IDENTITY_SECRET", "SERVICE_TOKEN")
+
+
+def bootstrap(path: Path):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    lock = path.with_suffix(".lock")
+    descriptor = os.open(lock, os.O_WRONLY | os.O_CREAT, 0o600)
+    with os.fdopen(descriptor, "w") as handle:
+        fcntl.flock(handle, fcntl.LOCK_EX)
+        existing = dotenv_values(path) if path.exists() else {}
+        selected = {
+            name: os.environ.get(name)
+            or existing.get(name)
+            or secrets.token_urlsafe(48)
+            for name in SECRET_NAMES
+        }
+        if any(
+            not re.fullmatch(r"[A-Za-z0-9_-]{32,}", value)
+            for value in selected.values()
+        ):
+            raise ValueError("Container secrets must have 32+ URL-safe characters")
+        if any(existing.get(name) != value for name, value in selected.items()):
+            temporary = None
+            try:
+                with tempfile.NamedTemporaryFile(
+                    mode="w", dir=path.parent, prefix=".identity-", delete=False
+                ) as output:
+                    temporary = Path(output.name)
+                    os.chmod(temporary, 0o600)
+                    for name, value in selected.items():
+                        output.write(name + "=" + value + "\n")
+                    output.flush()
+                    os.fsync(output.fileno())
+                os.replace(temporary, path)
+            finally:
+                if temporary is not None:
+                    temporary.unlink(missing_ok=True)
+        os.chmod(path, 0o600)
+        return selected
+
+
+def main():
+    path = Path(os.getenv("IDENTITY_BOOTSTRAP_FILE", "/config/identity.env"))
+    os.environ.update(bootstrap(path))
+    command = sys.argv[1:] or [
+        "uvicorn",
+        "adcloud_server.main:app",
+        "--host",
+        "0.0.0.0",
+        "--port",
+        "8000",
+    ]
+    os.execvp(command[0], command)
+
+
+if __name__ == "__main__":
+    main()