jb/eden
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add durable asset synchronization worker

Browse Source
This commit is contained in:
jb
2026-09-19 22:15:23 -04:00
parent 2675ea8114
commit fe7d218195
36 changed files with 2218 additions and 189 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/secrets.ts
+11 -4
View File
@@ -10,7 +10,7 @@ const HELP = `Infisical-backed development deployment (secret values are never p
bun run secrets:run -- <trusted command> [arguments...]
bun run secrets:run --deployment -- <trusted deployment command> [arguments...]
Optional: --credentials-file PATH (default ~/.config/evebot/infisical.env)
Optional: --credentials-file PATH (default ~/.config/evebot/infisical.env), --worker to inject only worker-safe application secrets, or --deployment --configure for Convex function configuration.
Project metadata: .infisical.json. Public deployment configuration: config/dev.env.
Only allowlisted app secrets are injected. --deployment additionally permits the Convex admin key
and, when absent from the vault, derives it from the local persistent backend without printing it.
@@ -23,22 +23,29 @@ export function parseArguments(args: string[]) {
let command: string[] = [];
let credentialsFile = join(homedir(), '.config/evebot/infisical.env');
let deployment = false;
let worker = false;
let configure = false;
for (let i = 0; i < rest.length; i++) {
if (rest[i] === '--') { command = rest.slice(i + 1); break; }
if (rest[i] === '--credentials-file' && rest[i + 1] && !rest[i + 1].startsWith('--')) credentialsFile = resolve(rest[++i]);
else if (rest[i] === '--deployment') deployment = true;
else if (rest[i] === '--worker') worker = true;
else if (rest[i] === '--configure') configure = true;
// `bun run` consumes its own -- separator before forwarding script arguments.
else if (action === 'run' && !rest[i].startsWith('-')) { command = rest.slice(i); break; }
else throw new Error('Unknown or incomplete secrets helper option');
}
if (action === 'run' && !command.length) throw new Error('Supply a trusted command after --');
if (action === 'status' && command.length) throw new Error('status does not execute a command');
return { action, command, credentialsFile, deployment };
if (worker && deployment) throw new Error('Worker secret mode cannot request deployment admin credentials');
if (worker && configure) throw new Error('Worker and configure secret modes are mutually exclusive');
if (configure && !deployment) throw new Error('--configure requires --deployment so the Convex admin credential is available');
return { action, command, credentialsFile, deployment, worker, configure };
}
async function main(args: string[]): Promise<void> {
if (!args.length || args[0] === '--help') { console.log(HELP); return; }
const { action, command, credentialsFile, deployment } = parseArguments(args);
const { action, command, credentialsFile, deployment, worker, configure } = parseArguments(args);
const project = validateProject(JSON.parse(await readFile(new URL('../.infisical.json', import.meta.url), 'utf8')));
const credentials = await readCredentials(credentialsFile);
const secrets = await fetchSecrets(project, credentials);
@@ -54,7 +61,7 @@ async function main(args: string[]): Promise<void> {
return;
}
const publicConfig = parseEnv(await readFile(new URL('../config/dev.env', import.meta.url), 'utf8'));
const env = applicationEnvironment(process.env, secrets, publicConfig, deployment);
const env = applicationEnvironment(process.env, secrets, publicConfig, deployment, worker ? 'worker' : configure ? 'configure' : 'web');
if (deployment && !env[ADMIN_KEY]) env[ADMIN_KEY] = await localDeploymentAdmin(env);
const child = Bun.spawn(command, { env, stdin: 'inherit', stdout: 'inherit', stderr: 'inherit' });
const interrupt = () => child.kill('SIGINT');