inboxos-v1/scripts/setup_gitea_secrets.sh

#!/usr/bin/env bash
# ── InboxOS — Gitea Actions secrets one-shot (Phase 3.1b) ─────
# Sets the known-value repository secrets on
#   https://git.cloudinit.dev/${GITEA_OWNER:-jc-capital}/inboxos
# using a Gitea API token supplied by the operator.
#
# This is meant to be run ONCE by the board (or anyone with a
# working admin/owner token on the repo). After the board already
# set IMAP_PASSWORD manually, this script fills in every other
# secret the workflows need.
#
# Required env:
#   GITEA_TOKEN   a Gitea user access token with write:repository
#                 scope on ${GITEA_OWNER:-jc-capital}/inboxos (the
#                 token the board used to set IMAP_PASSWORD
#                 already has this)
# Optional:
#   GITEA_URL     default: https://git.cloudinit.dev
#   GITEA_OWNER   default: jc-capital
#   GITEA_REPO    default: inboxos
#
# The script is idempotent: re-running updates the same secrets.
# Secrets whose value is not yet known are SKIPPED and listed in
# the final report so the board knows what to source next.

set -euo pipefail

GITEA_URL="${GITEA_URL:-https://git.cloudinit.dev}"
GITEA_OWNER="${GITEA_OWNER:-jc-capital}"
GITEA_REPO="${GITEA_REPO:-inboxos}"
GITEA_TOKEN="${GITEA_TOKEN:?GITEA_TOKEN is required - the board owner-scoped token}"

API="$GITEA_URL/api/v1"

ok_set=()
ok_skip=()
missing_required=()
err_list=()

put_secret() {
  local name="$1"
  local value="$2"
  local required="${3:-yes}"
  if [ -z "$value" ]; then
    printf "  [skip] %s %s\n" "$name" "(no value provided)"
    if [ "$required" = "yes" ]; then
      missing_required+=("$name")
    else
      ok_skip+=("$name")
    fi
    return 0
  fi
  local body
  body=$(jq -nc --arg v "$value" '{value: $v}')
  local http
  http=$(curl -s -o "/tmp/secret_put.$$" -w "%{http_code}" \
    -X "$API/repos/$GITEA_OWNER/$GITEA_REPO/actions/secrets/$name" \
    -H "Authorization: token $GITEA_TOKEN" \
    -H "Content-Type: application/json" \
    -d "$body")
  if [ "$http" = "201" ] || [ "$http" = "204" ]; then
    printf "  [set]  %s %s\n" "$name" "(HTTP $http)"
    ok_set+=("$name")
  else
    printf "  [FAIL] %s %s %s\n" "$name" "(HTTP $http)" "$(cat /tmp/secret_put.$$ 2>/dev/null || echo 'no body')"
    err_list+=("$name: HTTP $http")
  fi
  rm -f "/tmp/secret_put.$$"
}

# Sanity check
printf "== %s ==\n" "Preflight"
whoami=$(curl -fsS -H "Authorization: token $GITEA_TOKEN" \
  "$API/user" | jq -r '.login // .username // "unknown"')
echo "Authenticated to $GITEA_URL as '$whoami'"
if ! curl -fsS -H "Authorization: token $GITEA_TOKEN" \
     "$API/repos/$GITEA_OWNER/$GITEA_REPO" >/dev/null; then
  echo "Cannot read repo $GITEA_OWNER/$GITEA_REPO -- token lacks access."
  exit 1
fi
echo "Repo $GITEA_OWNER/$GITEA_REPO is reachable."

printf "== %s ==\n" "Setting known-value secrets"

# IMAP
put_secret "IMAP_HOST"       "${IMAP_HOST:-imap.gmail.com}"
put_secret "IMAP_PORT"       "${IMAP_PORT:-993}"
put_secret "IMAP_USER"       "${IMAP_USER:-jonathan@cloudinit.dev}"
# IMAP_PASSWORD is intentionally NOT set here -- the board has
# already configured it via the web UI. Re-setting it from this
# script would require a plaintext value on disk.
put_secret "IMAP_USE_SSL"    "${IMAP_USE_SSL:-true}"
put_secret "IMAP_MAILBOX"    "${IMAP_MAILBOX:-INBOX}"

# SeaweedFS
put_secret "SEAWEEDFS_S3_ENDPOINT"   "${SEAWEEDFS_S3_ENDPOINT:-https://storage.cloudinit.dev}"
put_secret "SEAWEEDFS_S3_BUCKET"     "${SEAWEEDFS_S3_BUCKET:-inboxos}"
put_secret "SEAWEEDFS_S3_ACCESS_KEY" "${SEAWEEDFS_S3_ACCESS_KEY:-}" "no"
put_secret "SEAWEEDFS_S3_SECRET_KEY" "${SEAWEEDFS_S3_SECRET_KEY:-}" "no"

# NocoDB
put_secret "NOCODB_BASE_URL"        "${NOCODB_BASE_URL:-https://noco.cloudinit.dev}"
put_secret "NOCODB_API_TOKEN"       "${NOCODB_API_TOKEN:-}" "no"
put_secret "NOCODB_PROJECT_ID"      "${NOCODB_PROJECT_ID:-}" "no"
put_secret "NOCODB_MODULE_TABLES"   "${NOCODB_MODULE_TABLES:-}" "no"

# Ollama
put_secret "OLLAMA_BASE_URL"        "${OLLAMA_BASE_URL:-https://ollama-frp.cloudinit.dev/v1}"

# Gitea runner auth
put_secret "GITEA_INSTANCE_URL"     "${GITEA_INSTANCE_URL:-http://gitea:3000}"

# OpenCode version pin (INB-20). Workflow default is already
# '1.15.13' in historical-pipeline.yml; setting this repo secret
# (or var) is only needed to override to a different pin in CI.
put_secret "OPENCODE_NPM_VERSION"  "${OPENCODE_NPM_VERSION:-1.15.13}" "no"

printf "== %s ==\n" "Summary"
echo
echo "Set:        ${#ok_set[@]}"
for s in "${ok_set[@]:-}"; do echo "  - $s"; done
echo
echo "Skipped:    ${#ok_skip[@]}"
for s in "${ok_skip[@]:-}"; do echo "  - $s"; done
echo
if [ ${#missing_required[@]} -gt 0 ]; then
  echo "MISSING (required): ${#missing_required[@]}"
  for s in "${missing_required[@]}"; do echo "  - $s"; done
fi
if [ ${#err_list[@]} -gt 0 ]; then
  echo "FAILED: ${#err_list[@]}"
  for s in "${err_list[@]}"; do echo "  - $s"; done
fi
echo
printf "== %s ==\n" "What is still missing for E2E"
cat <<'NOTE'
  - IMAP_PASSWORD         set by board already -- verify with the
                          web UI; this script intentionally does
                          not touch it
  - SEAWEEDFS_S3_ACCESS_KEY / SECRET_KEY   mint on the SeaweedFS
                          host, or have infra owner paste them
  - NOCODB_API_TOKEN      issue from the NocoDB super admin
                          user -- self-signup is closed
  - NOCODB_PROJECT_ID     after INB-12 applies the schema
  - NOCODB_MODULE_TABLES  JSON map; produced by
                          scripts/apply_schemas.py -- see INB-12
  - Gmail forwarding from jonathan@cloudinit.dev to
    <anything>@inbox.cloudinit.dev   operator action in Gmail
                                     settings -- Papra's
                                     INTAKE_EMAILS_* env is
                                     already set in compose
NOTE

if [ ${#err_list[@]} -gt 0 ] || [ ${#missing_required[@]} -gt 0 ]; then
  exit 1
fi