gitlab-ci: make populating secrets into repo more consistent

.gitlab-ci.yml

@@ -6,8 +6,7 @@ nixCache:
   stage: build
   image: "nixos/nix:latest"
   script:
-    - "mkdir -p ops/secrets"
+    - "./hack/populate_secrets.sh"
-    - "cp ${OPS_SECRETS_DEFAULT_NIX} ops/secrets/default.nix"
     - "nix build -v -f ./ci-root.nix --substituters \"https://cache.nixos.org s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1\""
     - "nix copy -v --to 's3://lukegb-nix-cache?endpoint=storage.googleapis.com' ./result"
 

hack/deploy.sh

@@ -2,13 +2,7 @@
 
 set -euo pipefail
 
-echo Dropping files into place as defined by manifest...
+./hack/populate_secrets.sh
-while read -r manifest_line; do
-  IFS='=' read -ra manifest_bits <<< "$manifest_line"
-  if [[ "${#manifest_bits[@]}" -ne 2 ]]; then continue; fi
-  echo -e "\t${manifest_bits[1]}"
-  cp "${!manifest_bits[0]}" "${manifest_bits[1]}"
-done < "$SECRETS_MANIFEST"
 
 ssh_cmd="ssh -o StrictHostKeyChecking=accept-new"
 

hack/populate_secrets.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo Dropping files into place as defined by manifest...
+while read -r manifest_line; do
+  IFS='=' read -ra manifest_bits <<< "$manifest_line"
+  if [[ "${#manifest_bits[@]}" -ne 2 ]]; then continue; fi
+  echo -e "\t${manifest_bits[1]}"
+  cp "${!manifest_bits[0]}" "${manifest_bits[1]}"
+done < "$SECRETS_MANIFEST"