ci: require owner-managed deployment secrets

.gitea/workflows/docker-deploy.yml

@@ -8,7 +8,7 @@ on:
 
 concurrency:
   group: pk-lab-server-production
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
   verify-deploy:
@@ -62,24 +62,8 @@ jobs:
         if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
         run: |
           set -eu
-          secret_volume=pk-lab-production-secrets
-          docker volume create "$secret_volume" >/dev/null
-          docker run --rm \
-            -e INITIAL_POSTGRES_PASSWORD="$POSTGRES_PASSWORD" \
-            -e INITIAL_TOKEN_SECRET="$TOKEN_SECRET" \
-            -v "$secret_volume:/secrets" \
-            alpine:3.20 sh -eu -c '
-              umask 077
-              if [ ! -s /secrets/postgres-password ]; then
-                if [ -n "$INITIAL_POSTGRES_PASSWORD" ]; then printf %s "$INITIAL_POSTGRES_PASSWORD" > /secrets/postgres-password; else head -c 48 /dev/urandom | base64 > /secrets/postgres-password; fi
-              fi
-              if [ ! -s /secrets/token-secret ]; then
-                if [ -n "$INITIAL_TOKEN_SECRET" ]; then printf %s "$INITIAL_TOKEN_SECRET" > /secrets/token-secret; else head -c 64 /dev/urandom | base64 > /secrets/token-secret; fi
-              fi
-            '
-          POSTGRES_PASSWORD="$(docker run --rm -v "$secret_volume:/secrets:ro" alpine:3.20 cat /secrets/postgres-password)"
-          TOKEN_SECRET="$(docker run --rm -v "$secret_volume:/secrets:ro" alpine:3.20 cat /secrets/token-secret)"
-          export POSTGRES_PASSWORD TOKEN_SECRET
+          test -n "$POSTGRES_PASSWORD"
+          test -n "$TOKEN_SECRET"
           export DEPLOY_IMAGE="pk-lab-server:$SOURCE_REVISION"
           sh scripts/deploy.sh
           curl --fail --silent --show-error "http://127.0.0.1:$DEPLOY_PORT/health"