From 32ea1133dd3bc2d1d8163251dd62d6337e36839b Mon Sep 17 00:00:00 2001 From: venkata-stepsecurity Date: Thu, 29 Oct 2026 09:49:00 -0700 Subject: [PATCH 1/4] ci: publish int agent builds to GHCR Push to int publishes agent-int:latest, a manual run publishes agent-int:dev-, and a PR to int titled "debug..." publishes agent-int:pr-. Each is also tagged with its commit SHA and holds the amd64 and arm64 tarballs plus checksums.txt as an OCI artifact. --- .github/workflows/int-release.yml | 134 ++++++++++++++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 .github/workflows/int-release.yml diff --git a/.github/workflows/int-release.yml b/.github/workflows/int-release.yml new file mode 100644 index 0000000..fdf5d30 --- /dev/null +++ b/.github/workflows/int-release.yml @@ -0,0 +1,134 @@ +name: INT Release + +# Publishes int builds of the agent to GHCR as an OCI artifact, so they can be +# pulled and tested without a release. +# +# push to int -> ghcr.io/step-security/agent/agent-int:latest and : +# manual run on a branch -> ghcr.io/step-security/agent/agent-int:dev- and : +# PR to int titled "debug..." -> ghcr.io/step-security/agent/agent-int:pr- and : +# +# Each artifact holds agent_linux_amd64.tar.gz, agent_linux_arm64.tar.gz and +# checksums.txt. Pull it with: oras pull ghcr.io/step-security/agent/agent-int:latest + +on: + push: + branches: + - int + workflow_dispatch: + pull_request: + branches: + - int + +permissions: read-all + +env: + GOPRIVATE: github.com/step-security + IMAGE: ghcr.io/step-security/agent/agent-int + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + publish: + if: >- + github.event_name != 'pull_request' || + (startsWith(github.event.pull_request.title, 'debug') && + github.event.pull_request.head.repo.full_name == github.repository) + permissions: + contents: read + packages: write + runs-on: ubuntu-22.04 + steps: + - uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Checkout + uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 + - name: Set up Go + uses: actions/setup-go@424fc82d43fa5a37540bae62709ddcc23d9520d4 + with: + go-version: 1.27.3 + + - name: Configure .netrc + run: | + printf "machine github.com login stepsecurity-infra-bot password ${{ secrets.PAT }}" >>~/.netrc + + - name: Create go vendor dir + run: | + go mod vendor + + - uses: goreleaser/goreleaser-action@5df302e5e9e4c66310a6b6493a8865b12c555af2 + with: + distribution: goreleaser + version: latest + args: release --snapshot --clean --config releasers/int.yml + + - name: Prepare artifact + run: | + mkdir upload + cp dist/agent_*_linux_amd64.tar.gz upload/agent_linux_amd64.tar.gz + cp dist/agent_*_linux_arm64.tar.gz upload/agent_linux_arm64.tar.gz + cd upload + sha256sum agent_linux_amd64.tar.gz agent_linux_arm64.tar.gz > checksums.txt + cat checksums.txt + + - name: Pick tags + id: tags + env: + EVENT: ${{ github.event_name }} + BRANCH: ${{ github.ref_name }} + PR_NUMBER: ${{ github.event.pull_request.number }} + SHA: ${{ github.event.pull_request.head.sha || github.sha }} + run: | + case "$EVENT" in + push) name="latest" ;; + pull_request) name="pr-${PR_NUMBER}" ;; + *) + # Tags allow only [A-Za-z0-9_.-] and up to 128 characters. + name="dev-$(printf '%s' "$BRANCH" | tr -c 'A-Za-z0-9_.-' '-' | cut -c1-100)" + ;; + esac + echo "tags=${name},${SHA}" >> "$GITHUB_OUTPUT" + echo "name=${name}" >> "$GITHUB_OUTPUT" + + - uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2 + + - name: Push to GHCR + working-directory: upload + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ACTOR: ${{ github.actor }} + TAGS: ${{ steps.tags.outputs.tags }} + SOURCE: ${{ github.server_url }}/${{ github.repository }} + REVISION: ${{ github.event.pull_request.head.sha || github.sha }} + run: | + echo "$GITHUB_TOKEN" | oras login ghcr.io -u "$ACTOR" --password-stdin + oras push "${IMAGE}:${TAGS}" \ + --artifact-type application/vnd.stepsecurity.agent.v1 \ + --annotation "org.opencontainers.image.source=${SOURCE}" \ + --annotation "org.opencontainers.image.revision=${REVISION}" \ + --annotation "org.opencontainers.image.description=StepSecurity agent int build" \ + agent_linux_amd64.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip \ + agent_linux_arm64.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip \ + checksums.txt:text/plain + + - name: Summary + env: + NAME: ${{ steps.tags.outputs.name }} + REVISION: ${{ github.event.pull_request.head.sha || github.sha }} + run: | + { + echo "### Published ${IMAGE}:${NAME}" + echo + echo "Commit: \`${REVISION}\` (also tagged \`${IMAGE}:${REVISION}\`)" + echo + echo '```' + echo "oras pull ${IMAGE}:${NAME}" + echo "sha256sum -c checksums.txt" + echo '```' + echo + echo '```' + cat upload/checksums.txt + echo '```' + } >> "$GITHUB_STEP_SUMMARY" From dce3c91af7b4053664c18072f82887870528f18b Mon Sep 17 00:00:00 2001 From: venkata-stepsecurity Date: Thu, 29 Oct 2026 09:51:37 -0700 Subject: [PATCH 2/4] ci: build the PR head commit in int release --- .github/workflows/int-release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/int-release.yml b/.github/workflows/int-release.yml index fdf5d30..d0eb269 100644 --- a/.github/workflows/int-release.yml +++ b/.github/workflows/int-release.yml @@ -45,6 +45,10 @@ jobs: egress-policy: audit - name: Checkout uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 + with: + # On a PR, build the PR's head commit, not the merge commit, so the + # artifact matches the SHA it is tagged with. + ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Set up Go uses: actions/setup-go@424fc82d43fa5a37540bae62709ddcc23d9520d4 with: From e27537d8555f56837fd3b2df1f9acc9a811ec00d Mon Sep 17 00:00:00 2001 From: venkata-stepsecurity Date: Thu, 29 Oct 2026 11:41:05 -0700 Subject: [PATCH 3/4] ci: add a script to install int agent builds from GHCR scripts/install-int-agent.sh start [tag] installs ghcr.io/step-security/agent/agent-int: on a GitHub-hosted Linux runner the way harden-runner does (registers the job with the int API, writes agent.json, starts the agent service) after checking the tarball against its OCI digest. stop signals the end of the job and prints the agent log. --- scripts/install-int-agent.sh | 209 +++++++++++++++++++++++++++++++++++ 1 file changed, 209 insertions(+) create mode 100755 scripts/install-int-agent.sh diff --git a/scripts/install-int-agent.sh b/scripts/install-int-agent.sh new file mode 100755 index 0000000..bf213e8 --- /dev/null +++ b/scripts/install-int-agent.sh @@ -0,0 +1,209 @@ +#!/usr/bin/env bash +# Installs an int build of the agent from GHCR on a GitHub-hosted Linux runner, +# for testing before a release. It does what harden-runner's pre and post steps +# do for the agent, but reports to int. Use it instead of harden-runner, not +# with it: both install into /home/agent. +# +# start [tag] install and start ghcr.io/step-security/agent/agent-int: +# (default latest; also pr-, dev- or a commit SHA) +# stop tell the agent the job is done and print its log +# +# Optional environment: EGRESS_POLICY (audit or block, default audit), +# ALLOWED_ENDPOINTS, DISABLE_FILE_MONITORING (true or false, default false). +# +# Example: +# - run: curl -fsSL https://raw.githubusercontent.com/step-security/agent/int/scripts/install-int-agent.sh | bash -s -- start pr-506 +# - run: npm test +# - if: always() +# run: curl -fsSL https://raw.githubusercontent.com/step-security/agent/int/scripts/install-int-agent.sh | bash -s -- stop + +set -euo pipefail + +REPOSITORY="step-security/agent/agent-int" +API_URL="https://int.api.stepsecurity.io/v1" +TELEMETRY_URL="https://int.app-api.stepsecurity.io/v1" +WEB_URL="https://int1.stepsecurity.io" +AGENT_DIR="/home/agent" + +fail() { + echo "install-int-agent: $*" >&2 + exit 1 +} + +start() { + local tag="${1:-latest}" + [[ "$(uname -s)" == "Linux" ]] || fail "Linux runners only" + [[ -n "${GITHUB_REPOSITORY:-}" && -n "${GITHUB_RUN_ID:-}" ]] || fail "run this inside a GitHub Actions job" + [[ "$tag" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]] || fail "invalid tag: $tag" + [[ ! -e "$AGENT_DIR/agent" ]] || fail "an agent is already installed in $AGENT_DIR" + + local arch + case "$(uname -m)" in + x86_64) arch=amd64 ;; + aarch64 | arm64) arch=arm64 ;; + *) fail "unsupported architecture: $(uname -m)" ;; + esac + local file="agent_linux_${arch}.tar.gz" + + local work + work="$(mktemp -d)" + + local token + token="$(curl -fsS "https://ghcr.io/token?scope=repository:${REPOSITORY}:pull" | + python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')" + + curl -fsS -H "Authorization: Bearer ${token}" \ + -H "Accept: application/vnd.oci.image.manifest.v1+json" \ + -o "$work/manifest.json" \ + "https://ghcr.io/v2/${REPOSITORY}/manifests/${tag}" || + fail "ghcr.io/${REPOSITORY}:${tag} not found" + + local digest revision + read -r digest revision < <(python3 - "$work/manifest.json" "$file" <<'EOF' +import json, re, sys +manifest = json.load(open(sys.argv[1])) +layers = [l for l in manifest.get("layers", []) + if l.get("annotations", {}).get("org.opencontainers.image.title") == sys.argv[2]] +if len(layers) != 1 or not re.fullmatch(r"sha256:[a-f0-9]{64}", layers[0]["digest"]): + sys.exit(f"{sys.argv[2]} not found in the artifact") +revision = manifest.get("annotations", {}).get("org.opencontainers.image.revision", "unknown") +print(layers[0]["digest"], revision) +EOF + ) + [[ -n "${digest:-}" ]] || fail "$file not found in ghcr.io/${REPOSITORY}:${tag}" + + echo "Installing ghcr.io/${REPOSITORY}:${tag} (commit ${revision}, ${file})" + + # curl does not send the Authorization header to the blob storage host GHCR + # redirects to. + curl -fsSL -H "Authorization: Bearer ${token}" -o "$work/$file" \ + "https://ghcr.io/v2/${REPOSITORY}/blobs/${digest}" + local actual + actual="sha256:$(sha256sum "$work/$file" | cut -d' ' -f1)" + [[ "$actual" == "$digest" ]] || fail "digest mismatch for $file: expected $digest, got $actual" + echo "Digest verified: $digest" + + tar -xzf "$work/$file" -C "$work" agent + + # Register the job with the int API, as harden-runner does, to get the key + # the agent uses to send data. + local correlation_id one_time_key="" + correlation_id="$(cat /proc/sys/kernel/random/uuid)" + local monitor + monitor="$(curl -sS -m 5 -X POST -H "content-type: application/json" \ + -d "{\"correlation_id\":\"${correlation_id}\",\"job\":\"${GITHUB_JOB:-}\"}" \ + "${API_URL}/github/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/monitor" || true)" + one_time_key="$(printf '%s' "$monitor" | + python3 -c 'import json,sys +try: print(json.load(sys.stdin).get("one_time_key", "")) +except Exception: print("")')" + [[ -n "$one_time_key" ]] || echo "warning: int API did not return a one-time key; the agent will run but may not report" + + sudo mkdir -p "$AGENT_DIR" + sudo chown "$(id -un)" "$AGENT_DIR" + cp "$work/agent" "$AGENT_DIR/agent" + chmod +x "$AGENT_DIR/agent" + + CORRELATION_ID="$correlation_id" ONE_TIME_KEY="$one_time_key" \ + API_URL="$API_URL" TELEMETRY_URL="$TELEMETRY_URL" \ + python3 - "$AGENT_DIR/agent.json" <<'EOF' +import json, os, sys +env = os.environ +private = False +try: + private = json.load(open(env["GITHUB_EVENT_PATH"]))["repository"]["private"] +except Exception: + pass +config = { + "repo": env["GITHUB_REPOSITORY"], + "run_id": env["GITHUB_RUN_ID"], + "correlation_id": env["CORRELATION_ID"], + "working_directory": env.get("GITHUB_WORKSPACE", ""), + "api_url": env["API_URL"], + "telemetry_url": env["TELEMETRY_URL"], + "allowed_endpoints": env.get("ALLOWED_ENDPOINTS", ""), + "denied_endpoints": "", + "egress_policy": env.get("EGRESS_POLICY", "audit"), + "disable_telemetry": False, + "disable_sudo": False, + "disable_sudo_and_containers": False, + "disable_file_monitoring": env.get("DISABLE_FILE_MONITORING", "false") == "true", + "private": private, + "is_github_hosted": True, + "is_debug": env.get("RUNNER_DEBUG") == "1", + "one_time_key": env["ONE_TIME_KEY"], + "deploy_on_self_hosted_vm": False, +} +with open(sys.argv[1], "w") as f: + json.dump(config, f) +EOF + + sudo tee /etc/systemd/system/agent.service >/dev/null <<'EOF' +[Unit] +Description=Agent +After=network.target + +[Service] +Type=simple +ExecStart=/home/agent/agent +WorkingDirectory=/home/agent +StandardOutput=syslog +StandardError=syslog +SyslogIdentifier=agentservice +AmbientCapabilities=CAP_NET_BIND_SERVICE, CAP_NET_ADMIN + +[Install] +WantedBy=multi-user.target +EOF + sudo systemctl daemon-reload + sudo service agent start + + for _ in $(seq 1 30); do + [[ -f "$AGENT_DIR/agent.status" ]] && break + sleep 1 + done + if [[ -f "$AGENT_DIR/agent.status" ]]; then + cat "$AGENT_DIR/agent.status" + echo + else + echo "warning: agent did not write agent.status within 30s" + fi + + echo "Step Security Job Correlation ID: ${correlation_id}" + echo "Insights: ${WEB_URL}/github/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" + rm -rf "$work" +} + +stop() { + if [[ ! -d "$AGENT_DIR" ]]; then + echo "no agent installed, nothing to stop" + return 0 + fi + if [[ -e "$AGENT_DIR/post_event.json" ]]; then + echo "stop already ran" + return 0 + fi + + echo '{"event":"post"}' > "$AGENT_DIR/post_event.json" + for _ in $(seq 1 10); do + [[ -f "$AGENT_DIR/done.json" ]] && break + sleep 1 + done + [[ -f "$AGENT_DIR/done.json" ]] || echo "timed out waiting for done.json" + + if [[ -f "$AGENT_DIR/agent.log" ]]; then + echo "log:" + cat "$AGENT_DIR/agent.log" + fi + if [[ -f "$AGENT_DIR/agent.status" ]]; then + echo "status:" + cat "$AGENT_DIR/agent.status" + echo + fi +} + +case "${1:-}" in + start) start "${2:-latest}" ;; + stop) stop ;; + *) fail "usage: install-int-agent.sh start [tag] | stop" ;; +esac From 55aa77f6d108157747bd29bff0273f2a5333e98a Mon Sep 17 00:00:00 2001 From: venkata-stepsecurity Date: Thu, 29 Oct 2026 14:12:35 -0700 Subject: [PATCH 4/4] ci: remove the int agent install script --- scripts/install-int-agent.sh | 209 ----------------------------------- 1 file changed, 209 deletions(-) delete mode 100755 scripts/install-int-agent.sh diff --git a/scripts/install-int-agent.sh b/scripts/install-int-agent.sh deleted file mode 100755 index bf213e8..0000000 --- a/scripts/install-int-agent.sh +++ /dev/null @@ -1,209 +0,0 @@ -#!/usr/bin/env bash -# Installs an int build of the agent from GHCR on a GitHub-hosted Linux runner, -# for testing before a release. It does what harden-runner's pre and post steps -# do for the agent, but reports to int. Use it instead of harden-runner, not -# with it: both install into /home/agent. -# -# start [tag] install and start ghcr.io/step-security/agent/agent-int: -# (default latest; also pr-, dev- or a commit SHA) -# stop tell the agent the job is done and print its log -# -# Optional environment: EGRESS_POLICY (audit or block, default audit), -# ALLOWED_ENDPOINTS, DISABLE_FILE_MONITORING (true or false, default false). -# -# Example: -# - run: curl -fsSL https://raw.githubusercontent.com/step-security/agent/int/scripts/install-int-agent.sh | bash -s -- start pr-506 -# - run: npm test -# - if: always() -# run: curl -fsSL https://raw.githubusercontent.com/step-security/agent/int/scripts/install-int-agent.sh | bash -s -- stop - -set -euo pipefail - -REPOSITORY="step-security/agent/agent-int" -API_URL="https://int.api.stepsecurity.io/v1" -TELEMETRY_URL="https://int.app-api.stepsecurity.io/v1" -WEB_URL="https://int1.stepsecurity.io" -AGENT_DIR="/home/agent" - -fail() { - echo "install-int-agent: $*" >&2 - exit 1 -} - -start() { - local tag="${1:-latest}" - [[ "$(uname -s)" == "Linux" ]] || fail "Linux runners only" - [[ -n "${GITHUB_REPOSITORY:-}" && -n "${GITHUB_RUN_ID:-}" ]] || fail "run this inside a GitHub Actions job" - [[ "$tag" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]] || fail "invalid tag: $tag" - [[ ! -e "$AGENT_DIR/agent" ]] || fail "an agent is already installed in $AGENT_DIR" - - local arch - case "$(uname -m)" in - x86_64) arch=amd64 ;; - aarch64 | arm64) arch=arm64 ;; - *) fail "unsupported architecture: $(uname -m)" ;; - esac - local file="agent_linux_${arch}.tar.gz" - - local work - work="$(mktemp -d)" - - local token - token="$(curl -fsS "https://ghcr.io/token?scope=repository:${REPOSITORY}:pull" | - python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')" - - curl -fsS -H "Authorization: Bearer ${token}" \ - -H "Accept: application/vnd.oci.image.manifest.v1+json" \ - -o "$work/manifest.json" \ - "https://ghcr.io/v2/${REPOSITORY}/manifests/${tag}" || - fail "ghcr.io/${REPOSITORY}:${tag} not found" - - local digest revision - read -r digest revision < <(python3 - "$work/manifest.json" "$file" <<'EOF' -import json, re, sys -manifest = json.load(open(sys.argv[1])) -layers = [l for l in manifest.get("layers", []) - if l.get("annotations", {}).get("org.opencontainers.image.title") == sys.argv[2]] -if len(layers) != 1 or not re.fullmatch(r"sha256:[a-f0-9]{64}", layers[0]["digest"]): - sys.exit(f"{sys.argv[2]} not found in the artifact") -revision = manifest.get("annotations", {}).get("org.opencontainers.image.revision", "unknown") -print(layers[0]["digest"], revision) -EOF - ) - [[ -n "${digest:-}" ]] || fail "$file not found in ghcr.io/${REPOSITORY}:${tag}" - - echo "Installing ghcr.io/${REPOSITORY}:${tag} (commit ${revision}, ${file})" - - # curl does not send the Authorization header to the blob storage host GHCR - # redirects to. - curl -fsSL -H "Authorization: Bearer ${token}" -o "$work/$file" \ - "https://ghcr.io/v2/${REPOSITORY}/blobs/${digest}" - local actual - actual="sha256:$(sha256sum "$work/$file" | cut -d' ' -f1)" - [[ "$actual" == "$digest" ]] || fail "digest mismatch for $file: expected $digest, got $actual" - echo "Digest verified: $digest" - - tar -xzf "$work/$file" -C "$work" agent - - # Register the job with the int API, as harden-runner does, to get the key - # the agent uses to send data. - local correlation_id one_time_key="" - correlation_id="$(cat /proc/sys/kernel/random/uuid)" - local monitor - monitor="$(curl -sS -m 5 -X POST -H "content-type: application/json" \ - -d "{\"correlation_id\":\"${correlation_id}\",\"job\":\"${GITHUB_JOB:-}\"}" \ - "${API_URL}/github/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/monitor" || true)" - one_time_key="$(printf '%s' "$monitor" | - python3 -c 'import json,sys -try: print(json.load(sys.stdin).get("one_time_key", "")) -except Exception: print("")')" - [[ -n "$one_time_key" ]] || echo "warning: int API did not return a one-time key; the agent will run but may not report" - - sudo mkdir -p "$AGENT_DIR" - sudo chown "$(id -un)" "$AGENT_DIR" - cp "$work/agent" "$AGENT_DIR/agent" - chmod +x "$AGENT_DIR/agent" - - CORRELATION_ID="$correlation_id" ONE_TIME_KEY="$one_time_key" \ - API_URL="$API_URL" TELEMETRY_URL="$TELEMETRY_URL" \ - python3 - "$AGENT_DIR/agent.json" <<'EOF' -import json, os, sys -env = os.environ -private = False -try: - private = json.load(open(env["GITHUB_EVENT_PATH"]))["repository"]["private"] -except Exception: - pass -config = { - "repo": env["GITHUB_REPOSITORY"], - "run_id": env["GITHUB_RUN_ID"], - "correlation_id": env["CORRELATION_ID"], - "working_directory": env.get("GITHUB_WORKSPACE", ""), - "api_url": env["API_URL"], - "telemetry_url": env["TELEMETRY_URL"], - "allowed_endpoints": env.get("ALLOWED_ENDPOINTS", ""), - "denied_endpoints": "", - "egress_policy": env.get("EGRESS_POLICY", "audit"), - "disable_telemetry": False, - "disable_sudo": False, - "disable_sudo_and_containers": False, - "disable_file_monitoring": env.get("DISABLE_FILE_MONITORING", "false") == "true", - "private": private, - "is_github_hosted": True, - "is_debug": env.get("RUNNER_DEBUG") == "1", - "one_time_key": env["ONE_TIME_KEY"], - "deploy_on_self_hosted_vm": False, -} -with open(sys.argv[1], "w") as f: - json.dump(config, f) -EOF - - sudo tee /etc/systemd/system/agent.service >/dev/null <<'EOF' -[Unit] -Description=Agent -After=network.target - -[Service] -Type=simple -ExecStart=/home/agent/agent -WorkingDirectory=/home/agent -StandardOutput=syslog -StandardError=syslog -SyslogIdentifier=agentservice -AmbientCapabilities=CAP_NET_BIND_SERVICE, CAP_NET_ADMIN - -[Install] -WantedBy=multi-user.target -EOF - sudo systemctl daemon-reload - sudo service agent start - - for _ in $(seq 1 30); do - [[ -f "$AGENT_DIR/agent.status" ]] && break - sleep 1 - done - if [[ -f "$AGENT_DIR/agent.status" ]]; then - cat "$AGENT_DIR/agent.status" - echo - else - echo "warning: agent did not write agent.status within 30s" - fi - - echo "Step Security Job Correlation ID: ${correlation_id}" - echo "Insights: ${WEB_URL}/github/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" - rm -rf "$work" -} - -stop() { - if [[ ! -d "$AGENT_DIR" ]]; then - echo "no agent installed, nothing to stop" - return 0 - fi - if [[ -e "$AGENT_DIR/post_event.json" ]]; then - echo "stop already ran" - return 0 - fi - - echo '{"event":"post"}' > "$AGENT_DIR/post_event.json" - for _ in $(seq 1 10); do - [[ -f "$AGENT_DIR/done.json" ]] && break - sleep 1 - done - [[ -f "$AGENT_DIR/done.json" ]] || echo "timed out waiting for done.json" - - if [[ -f "$AGENT_DIR/agent.log" ]]; then - echo "log:" - cat "$AGENT_DIR/agent.log" - fi - if [[ -f "$AGENT_DIR/agent.status" ]]; then - echo "status:" - cat "$AGENT_DIR/agent.status" - echo - fi -} - -case "${1:-}" in - start) start "${2:-latest}" ;; - stop) stop ;; - *) fail "usage: install-int-agent.sh start [tag] | stop" ;; -esac