From 6d55dbfbeff949ec008e2ef9fc88f24841216e28 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 6 Aug 2026 12:56:27 -0400 Subject: [PATCH 1/2] fix: Add trap to ensure temp key file removal after GCP SA key creation --- scripts/gcp-setup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/gcp-setup.sh b/scripts/gcp-setup.sh index 0c88c08..7308437 100755 --- a/scripts/gcp-setup.sh +++ b/scripts/gcp-setup.sh @@ -102,6 +102,7 @@ echo "Granted objectViewer to $SA_EMAIL." echo "" echo "--- Step 9: Create and store service account key ---" KEY_FILE=$(mktemp) +trap 'rm -f "$KEY_FILE"' EXIT $GCLOUD iam service-accounts keys create "$KEY_FILE" --iam-account="$SA_EMAIL" echo "Service account key created." @@ -118,7 +119,6 @@ else --region "$AWS_REGION" echo "Created secret forgejo/gcs-sa-key." fi -rm -f "$KEY_FILE" echo "Key stored in AWS Secrets Manager, local copy deleted." # --- Storage Transfer --- From 495c281f169c6d2d37be99ba77635d3032d4c406 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 6 Aug 2026 13:13:21 -0400 Subject: [PATCH 2/2] fix(scripts): delete temp GCP key before success message Restore the immediate rm after Secrets Manager store so the status line is accurate and the key is gone before later steps; EXIT trap still covers failure paths. --- scripts/gcp-setup.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/gcp-setup.sh b/scripts/gcp-setup.sh index 7308437..d55e32b 100755 --- a/scripts/gcp-setup.sh +++ b/scripts/gcp-setup.sh @@ -119,6 +119,7 @@ else --region "$AWS_REGION" echo "Created secret forgejo/gcs-sa-key." fi +rm -f "$KEY_FILE" echo "Key stored in AWS Secrets Manager, local copy deleted." # --- Storage Transfer ---