sync build tree from private myoffice

2026-08-05 11:31:19 +00:00
parent 405abdfe69
commit afa4c42105
60 changed files with 249 additions and 2400 deletions
@@ -5,9 +5,12 @@ Three-tier setup on **your Gitea**:
 | Tier | Repo | Visibility | Contents |
 |------|------|------------|----------|
 | 1. Dev | `myoffice` | Private | Full source + Actions |
-| 2. Public code | `myoffice-public` | Public | Full source (manual build) + Proxmox scripts |
+| 2. Public code | `myoffice-public` | Public | Build tree (`.publishinclude`) + Proxmox scripts + public README |
 | 3. Published app | Releases on `myoffice-public` | Public | `myoffice-publish.tar.gz` |

+Public sync **does not** include Docker, private `.gitignore`, `*.bat`, tests, docs, or private Actions (`.gitea/`). See `.publishinclude`.
+
+
 CT install downloads the **release** tarball (not source). No Docker/nginx/SDK/Node inside the CT — proxy with your existing nginx LXC to Kestrel `:9100`.

 ```text
@@ -53,7 +56,8 @@ $env:GITEA_TOKEN = '<token with write:repository on myoffice-public>'

 - `proxmox/publish.ps1` → `_Published/` + `myoffice-publish.tar.gz`
 - `proxmox/release.ps1` → Gitea Release asset
- `proxmox/sync-public.ps1` → full source + public `README.md` (from `README.public.md`)
+- `proxmox/sync-public.ps1` → allowlisted build tree + public `README.md` (from `README.public.md`)
+

 Or via Gitea Actions on the private repo (`.gitea/workflows/publish.yml`): push `master` → tag `latest`, or push tag `v*` / manual dispatch.

@@ -1,9 +1,9 @@
-# Sync full source from the private repo to the public Gitea repo (manual build + Proxmox scripts).
+# Sync buildable source + Proxmox scripts to the public Gitea repo.
+# Allowlist: .publishinclude  |  Skips: Docker, private .gitignore, *.bat, tests, docs, CI, junk
+#
 # Usage:
 #   $env:GITEA_TOKEN = '<token>'
-#   .\proxmox\sync-public.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Push
-#
-# Copies tracked git files (plus generates public README.md). Skips private CI, secrets, build junk.
+#   .\proxmox\sync-public.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice_public -Push

 [CmdletBinding()]
 param(
@@ -31,20 +31,36 @@ $repoRoot = Resolve-Path (Join-Path $scriptDir '..')
 Set-Location $repoRoot

 $GiteaUrl = $GiteaUrl.TrimEnd('/')
+$includeFile = Join-Path $repoRoot '.publishinclude'
+if (-not (Test-Path $includeFile)) {
+	throw "Missing $includeFile"
+}

 if (-not $WorkDir) {
 	$WorkDir = Join-Path $env:TEMP 'myoffice-public-sync'
 }

-function Test-SkipPath([string]$RelPath) {
+function Test-SkipRel([string]$RelPath) {
 	$n = $RelPath -replace '\\', '/'
+	$base = Split-Path -Leaf $n
+
+	if ($n -eq 'Docker' -or $n.StartsWith('Docker/')) { return $true }
+	if ($base -eq '.gitignore') { return $true }
+	if ($base -like '*.bat') { return $true }
+
+	if ($n -eq 'MyOffice.Tests' -or $n.StartsWith('MyOffice.Tests/')) { return $true }
+	if ($n -eq 'docs' -or $n.StartsWith('docs/')) { return $true }
 	if ($n -eq '.gitea' -or $n.StartsWith('.gitea/')) { return $true }
-	if ($n -eq '_Published' -or $n.StartsWith('_Published/')) { return $true }
-	if ($n -eq 'myoffice-publish.tar.gz') { return $true }
-	if ($n -eq 'Docker/data' -or $n.StartsWith('Docker/data/')) { return $true }
-	if ($n -eq '.env' -or $n.StartsWith('.env.') -or $n -eq 'env.local') { return $true }
+	if ($base -eq '.dockerignore' -or $base -eq 'gulpfile.js' -or $base -eq 'build.ps1' -or $base -eq 'linux_deploy.sh') { return $true }
 	if ($n -eq 'proxmox/README.public.md') { return $true }
-	if ($n.EndsWith('.user') -or $n.EndsWith('.suo')) { return $true }
+
+	if ($n -match '(^|/)node_modules(/|$)' -or $n -match '(^|/)(bin|obj|\.angular)(/|$)') { return $true }
+	if ($n -eq '_Published' -or $n.StartsWith('_Published/') -or $base -eq 'myoffice-publish.tar.gz') { return $true }
+	if ($base -eq '.env' -or $base -eq 'env.local' -or $base -like '.env.*') { return $true }
+	if ($base -eq 'appsettings.Docker.json' -or $base -eq 'appsettings.shared.Docker.json' -or $base -eq 'environment.docker.ts') { return $true }
+	if ($base -like '*.user' -or $base -like '*.suo') { return $true }
+	if ($base -eq 'karma.conf.js' -or $base -like '*.spec.ts') { return $true }
+
 	return $false
 }

@@ -59,7 +75,7 @@ else {
 }

 Write-Host "-----------------------------------------------"
-Write-Host "Sync full source -> $Owner/$Repo ($Branch)"
+Write-Host "Sync allowlist (.publishinclude) -> $Owner/$Repo ($Branch)"
 Write-Host "WorkDir: $WorkDir"
 Write-Host "-----------------------------------------------"

@@ -70,9 +86,7 @@ New-Item -ItemType Directory -Path $WorkDir | Out-Null

 $cloned = $false
 git clone --depth 1 --branch $Branch $remote $WorkDir 2>$null
-if ($LASTEXITCODE -eq 0) {
-	$cloned = $true
-}
+if ($LASTEXITCODE -eq 0) { $cloned = $true }

 if (-not $cloned) {
 	Write-Host "Clone failed or empty repo — initializing new git repo..."
@@ -89,33 +103,71 @@ Get-ChildItem -Path $WorkDir -Force | Where-Object { $_.Name -ne '.git' } | ForE
 	Remove-Item $_.FullName -Recurse -Force
 }

-$tracked = git -C $repoRoot ls-files
+$tracked = @(git -C $repoRoot ls-files)
+$trackedSet = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+foreach ($t in $tracked) { [void]$trackedSet.Add(($t -replace '\\', '/')) }
+
 $copied = 0
 $skipped = 0
-foreach ($f in $tracked) {
-	if (Test-SkipPath $f) {
-		$skipped++
-		continue
+
+function Copy-Rel([string]$Rel) {
+	$script:n = $Rel -replace '\\', '/'
+	if (Test-SkipRel $n) {
+		$script:skipped++
+		return
 	}
-	$src = Join-Path $repoRoot $f
-	if (-not (Test-Path -LiteralPath $src)) {
-		continue
-	}
-	$dest = Join-Path $WorkDir $f
+	$src = Join-Path $repoRoot $n
+	if (-not (Test-Path -LiteralPath $src)) { return }
+	$dest = Join-Path $WorkDir $n
 	$destDir = Split-Path -Parent $dest
 	if (-not (Test-Path $destDir)) {
 		New-Item -ItemType Directory -Path $destDir -Force | Out-Null
 	}
 	Copy-Item -LiteralPath $src -Destination $dest -Force
-	$copied++
+	$script:copied++
 }
-Write-Host "Copied $copied tracked files (skipped $skipped)."
+
+Get-Content -LiteralPath $includeFile | ForEach-Object {
+	$line = $_
+	if ($line -match '#') { $line = $line.Substring(0, $line.IndexOf('#')) }
+	$line = $line.Trim()
+	if (-not $line) { return }
+
+	$norm = $line -replace '\\', '/'
+	if ($norm.EndsWith('/')) {
+		$prefix = $norm
+		$dir = $norm.TrimEnd('/')
+		if (-not (Test-Path (Join-Path $repoRoot $dir))) {
+			Write-Host "Skip missing dir: $dir"
+			return
+		}
+		foreach ($t in $tracked) {
+			$tn = $t -replace '\\', '/'
+			if ($tn.StartsWith($prefix)) { Copy-Rel $tn }
+		}
+		Write-Host "Synced $dir/"
+	}
+	else {
+		if (Test-SkipRel $norm) {
+			$skipped++
+			Write-Host "Skip excluded: $norm"
+			return
+		}
+		$src = Join-Path $repoRoot $norm
+		if (-not (Test-Path -LiteralPath $src)) {
+			Write-Host "Skip missing file: $norm"
+			return
+		}
+		Copy-Rel $norm
+		Write-Host "Synced $norm"
+	}
+}
+
+Write-Host "Copied $copied files (skipped $skipped)."

 $repoRawBase = "$GiteaUrl/$Owner/$Repo/raw/branch/$Branch"
 $template = Join-Path $scriptDir 'README.public.md'
-if (-not (Test-Path $template)) {
-	throw "Missing $template"
-}
+if (-not (Test-Path $template)) { throw "Missing $template" }
 $readme = Get-Content -LiteralPath $template -Raw -Encoding utf8
 $readme = $readme.
 	Replace('__GITEA_URL__', $GiteaUrl).
@@ -126,6 +178,21 @@ $readme = $readme.
 Set-Content -LiteralPath (Join-Path $WorkDir 'README.md') -Value $readme -Encoding utf8 -NoNewline
 Write-Host "Wrote public README.md"

+@(
+	'**/bin/',
+	'**/obj/',
+	'**/node_modules/',
+	'**/.angular/',
+	'_Published/',
+	'myoffice-publish.tar.gz',
+	'*.user',
+	'.env',
+	'env.local',
+	'MyOffice.SPA/src/environments/environment.ts',
+	'MyOffice.Shared/appsettings.shared.Development.json',
+	'MyOffice.Shared/appsettings.shared.Production.json'
+) | Set-Content -LiteralPath (Join-Path $WorkDir '.gitignore') -Encoding utf8
+
 git -C $WorkDir add -A
 $status = git -C $WorkDir status --porcelain
 if (-not $status) {
@@ -133,16 +200,14 @@ if (-not $status) {
 }
 else {
 	git -C $WorkDir -c user.email='myoffice-sync@local' -c user.name='myoffice-sync' `
-		commit -m "sync full source from private myoffice"
+		commit -m "sync build tree from private myoffice"
 	Write-Host "Committed public snapshot."
 }

 if ($Push) {
 	Write-Host "Pushing to origin $Branch..."
 	git -C $WorkDir push -u origin "HEAD:$Branch"
-	if ($LASTEXITCODE -ne 0) {
-		throw "git push failed with exit code $LASTEXITCODE"
-	}
+	if ($LASTEXITCODE -ne 0) { throw "git push failed with exit code $LASTEXITCODE" }
 	Write-Host "Pushed."
 }
 else {
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Sync full source from the private repo to the public Gitea repo (manual build + Proxmox scripts).
+# Sync buildable source + Proxmox scripts to the public Gitea repo.
+# Allowlist: .publishinclude  |  Skips: Docker, .gitignore, *.bat, tests, docs, CI, junk
+#
 # Usage:
 #   export GITEA_TOKEN='<token>'
-#   ./proxmox/sync-public.sh --gitea-url https://gitea.example.com --owner org --repo myoffice-public --push
-#
-# Copies tracked git files (plus generates public README.md). Skips private CI, secrets, build junk.
+#   ./proxmox/sync-public.sh --gitea-url https://gitea.example.com --owner org --repo myoffice_public --push

 set -euo pipefail

@@ -19,6 +19,7 @@ branch="${BRANCH:-master}"
 token="${GITEA_TOKEN:-}"
 work_dir="${WORK_DIR:-}"
 do_push=false
+include_file="$repo_root/.publishinclude"

 usage() {
 	echo "Usage: $0 --gitea-url URL --owner OWNER [--repo REPO] [--branch BRANCH] [--push]" >&2
@@ -27,73 +28,69 @@ usage() {

 while [[ $# -gt 0 ]]; do
 	case "$1" in
-		--gitea-url)
-			gitea_url="$2"
-			shift 2
-			;;
-		--owner)
-			owner="$2"
-			shift 2
-			;;
-		--repo)
-			repo="$2"
-			shift 2
-			;;
-		--branch)
-			branch="$2"
-			shift 2
-			;;
-		--work-dir)
-			work_dir="$2"
-			shift 2
-			;;
-		--push)
-			do_push=true
-			shift
-			;;
-		-h | --help)
-			usage
-			;;
-		*)
-			echo "Unknown argument: $1" >&2
-			usage
-			;;
+		--gitea-url) gitea_url="$2"; shift 2 ;;
+		--owner) owner="$2"; shift 2 ;;
+		--repo) repo="$2"; shift 2 ;;
+		--branch) branch="$2"; shift 2 ;;
+		--work-dir) work_dir="$2"; shift 2 ;;
+		--push) do_push=true; shift ;;
+		-h|--help) usage ;;
+		*) echo "Unknown argument: $1" >&2; usage ;;
 	esac
 done

-if [[ -z "$gitea_url" || -z "$owner" ]]; then
-	usage
-fi
+[[ -n "$gitea_url" && -n "$owner" ]] || usage
+[[ -f "$include_file" ]] || { echo "Missing $include_file" >&2; exit 1; }

 gitea_url="${gitea_url%/}"
+[[ -n "$work_dir" ]] || work_dir="${TMPDIR:-/tmp}/myoffice-public-sync"

-if [[ -z "$work_dir" ]]; then
-	work_dir="${TMPDIR:-/tmp}/myoffice-public-sync"
-fi
-
-# Paths never published (private CI, secrets, local junk).
-should_skip() {
+# Relative path should not be copied into public tree.
+should_skip_rel() {
 	local f="$1"
-	case "$f" in
-		.gitea | .gitea/*) return 0 ;;
-		_Published | _Published/*) return 0 ;;
-		myoffice-publish.tar.gz) return 0 ;;
-		Docker/data | Docker/data/*) return 0 ;;
-		.env | .env.* | env.local) return 0 ;;
-		*.user | *.suo) return 0 ;;
-		proxmox/README.public.md) return 0 ;; # baked into public README.md
-		*) return 1 ;;
-	esac
+	local base
+	base="$(basename "$f")"
+
+	# User / policy excludes
+	[[ "$f" == Docker || "$f" == Docker/* ]] && return 0
+	[[ "$base" == .gitignore ]] && return 0
+	[[ "$base" == *.bat ]] && return 0
+
+	# Not required to build or install CT
+	[[ "$f" == MyOffice.Tests || "$f" == MyOffice.Tests/* ]] && return 0
+	[[ "$f" == docs || "$f" == docs/* ]] && return 0
+	[[ "$f" == .gitea || "$f" == .gitea/* ]] && return 0
+	[[ "$base" == .dockerignore ]] && return 0
+	[[ "$base" == gulpfile.js ]] && return 0
+	[[ "$base" == build.ps1 ]] && return 0
+	[[ "$base" == linux_deploy.sh ]] && return 0
+	[[ "$f" == proxmox/README.public.md ]] && return 0
+
+	# Build junk / secrets / Docker-only appsettings
+	[[ "$base" == node_modules || "$f" == */node_modules/* ]] && return 0
+	[[ "$base" == bin || "$f" == */bin/* ]] && return 0
+	[[ "$base" == obj || "$f" == */obj/* ]] && return 0
+	[[ "$base" == .angular || "$f" == */.angular/* ]] && return 0
+	[[ "$base" == _Published || "$f" == _Published/* ]] && return 0
+	[[ "$base" == myoffice-publish.tar.gz ]] && return 0
+	[[ "$base" == .env || "$base" == env.local || "$base" == .env.* ]] && return 0
+	[[ "$base" == appsettings.Docker.json ]] && return 0
+	[[ "$base" == appsettings.shared.Docker.json ]] && return 0
+	[[ "$base" == environment.docker.ts ]] && return 0
+	[[ "$base" == *.user || "$base" == *.suo ]] && return 0
+
+	# SPA unit-test harness (not used by ng build --configuration proxmox)
+	[[ "$base" == karma.conf.js ]] && return 0
+	[[ "$base" == *.spec.ts ]] && return 0
+
+	return 1
 }

 if [[ -n "$token" ]]; then
 	host_part="${gitea_url#https://}"
 	host_part="${host_part#http://}"
-	if [[ "$gitea_url" == http://* ]]; then
-		scheme=http
-	else
-		scheme=https
-	fi
+	scheme=https
+	[[ "$gitea_url" == http://* ]] && scheme=http
 	remote="${scheme}://oauth2:${token}@${host_part}/${owner}/${repo}.git"
 else
 	remote="${gitea_url}/${owner}/${repo}.git"
@@ -101,16 +98,14 @@ else
 fi

 echo "-----------------------------------------------"
-echo "Sync full source -> $owner/$repo ($branch)"
+echo "Sync allowlist (.publishinclude) -> $owner/$repo ($branch)"
 echo "WorkDir: $work_dir"
 echo "-----------------------------------------------"

 rm -rf "$work_dir"
 mkdir -p "$work_dir"

-if git clone --depth 1 --branch "$branch" "$remote" "$work_dir" 2>/dev/null; then
-	:
-else
+if ! git clone --depth 1 --branch "$branch" "$remote" "$work_dir" 2>/dev/null; then
 	echo "Clone failed or empty repo — initializing new git repo..."
 	git -C "$work_dir" init -b "$branch" 2>/dev/null || {
 		git -C "$work_dir" init
@@ -124,29 +119,66 @@ find "$work_dir" -mindepth 1 -maxdepth 1 ! -name '.git' -exec rm -rf {} +

 copied=0
 skipped=0
-while IFS= read -r -d '' f; do
-	if should_skip "$f"; then
-		skipped=$((skipped + 1))
-		continue
-	fi
-	src="$repo_root/$f"
-	if [[ ! -e "$src" ]]; then
-		continue
-	fi
-	dest="$work_dir/$f"
-	mkdir -p "$(dirname "$dest")"
-	cp -a "$src" "$dest"
-	copied=$((copied + 1))
-done < <(git -C "$repo_root" ls-files -z)

-echo "Copied $copied tracked files (skipped $skipped)."
+copy_tracked_under() {
+	local prefix="$1" # '' for file, or 'Dir/' 
+	while IFS= read -r -d '' f; do
+		if [[ -n "$prefix" ]]; then
+			[[ "$f" == "$prefix"* ]] || continue
+		else
+			[[ "$f" == "$2" ]] || continue
+		fi
+		if should_skip_rel "$f"; then
+			skipped=$((skipped + 1))
+			continue
+		fi
+		src="$repo_root/$f"
+		[[ -e "$src" ]] || continue
+		dest="$work_dir/$f"
+		mkdir -p "$(dirname "$dest")"
+		cp -a "$src" "$dest"
+		copied=$((copied + 1))
+	done < <(git -C "$repo_root" ls-files -z)
+}
+
+while IFS= read -r line || [[ -n "$line" ]]; do
+	line="${line%%#*}"
+	line="$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+	[[ -z "$line" ]] && continue
+
+	src="$repo_root/$line"
+	if [[ "$line" == */ ]]; then
+		dir="${line%/}"
+		if [[ ! -d "$repo_root/$dir" ]]; then
+			echo "Skip missing dir: $dir"
+			continue
+		fi
+		copy_tracked_under "${dir}/"
+		echo "Synced $dir/"
+	else
+		if [[ ! -e "$src" ]]; then
+			echo "Skip missing file: $line"
+			continue
+		fi
+		if should_skip_rel "$line"; then
+			skipped=$((skipped + 1))
+			echo "Skip excluded: $line"
+			continue
+		fi
+		# Only copy if tracked (or exists — LICENSE etc.)
+		dest="$work_dir/$line"
+		mkdir -p "$(dirname "$dest")"
+		cp -a "$src" "$dest"
+		copied=$((copied + 1))
+		echo "Synced $line"
+	fi
+done < "$include_file"
+
+echo "Copied $copied files (skipped $skipped)."

 repo_raw_base="${gitea_url}/${owner}/${repo}/raw/branch/${branch}"
 readme_template="$script_dir/README.public.md"
-if [[ ! -f "$readme_template" ]]; then
-	echo "Missing $readme_template" >&2
-	exit 1
-fi
+[[ -f "$readme_template" ]] || { echo "Missing $readme_template" >&2; exit 1; }
 sed \
 	-e "s|__GITEA_URL__|${gitea_url}|g" \
 	-e "s|__GITEA_OWNER__|${owner}|g" \
@@ -156,15 +188,28 @@ sed \
 	"$readme_template" >"$work_dir/README.md"
 echo "Wrote public README.md"

-# Drop private-only docs that confuse public consumers (optional keep docs/)
-# Keep docs/ — useful for auth notes.
+# Public consumers need a minimal .gitignore so git status stays clean after npm/dotnet restore
+cat >"$work_dir/.gitignore" <<'EOF'
+**/bin/
+**/obj/
+**/node_modules/
+**/.angular/
+_Published/
+myoffice-publish.tar.gz
+*.user
+.env
+env.local
+MyOffice.SPA/src/environments/environment.ts
+MyOffice.Shared/appsettings.shared.Development.json
+MyOffice.Shared/appsettings.shared.Production.json
+EOF

 git -C "$work_dir" add -A
 if [[ -z "$(git -C "$work_dir" status --porcelain)" ]]; then
 	echo "No changes to commit."
 else
 	git -C "$work_dir" -c user.email='myoffice-sync@local' -c user.name='myoffice-sync' \
-		commit -m "sync full source from private myoffice"
+		commit -m "sync build tree from private myoffice"
 	echo "Committed public snapshot."
 fi