PHP を使用して GIT コードを自動的にデプロイする

最近、Coding のコード ホスティングを使用しており、WebHook の自動デプロイメントを設定しました。これは、主に Linux の権限制御をまだ理解していないためです。しかし、幸いにもそれを理解できたので共有させてください。参考までに、原文は英語ですので、なんとか理解できます

原文リンク: http://jondavidjohn.com/ git-pull-from-a-php-script-not-so-simple/

私は、新しいコミットがプッシュアップされたときに開発サーバー上でプルを開始するリポジトリ (BitBucket でホストされている) をセットアップするつもりでした。

それBitBucket には受信後フックとして POST リクエストを発行するサービスがあるため、ランダム化されたトークンをチェックしてから git pull を開始するように設定しました。 code>. 次のようになります...<code>git pull. Looking something like this...

<code data-lang="php"><span><?php

<span>define<span>(<span>'PRIVATE_KEY'<span>, <span>'XXXXXXXXXXXXXXXXxxx'<span>);

<span>if <span>(<span>$_SERVER<span>[<span>'REQUEST_METHOD'<span>] <span>=== <span>'POST'
        <span>&& <span>$_REQUEST<span>[<span>'thing'<span>] <span>=== <span>PRIVATE_KEY<span>)
<span>{
    <span>echo <span>shell_exec<span>(<span>"git pull"<span>);
<span>}
</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></code>

Didn't end up being as simple as I had anticipated...

There were a few considerations that I did not take into account. Documenting them here will hopefully help you avoid some obstacles in trying to get something like this set up.

(Missed) Considerations

the binary (git in this case)

The user that is attempting to execute git pull is the apache user (www in our case). This user did not happen to have git in their path.

This took a while to track down because the exec() family of functions simply fail silently because they only report STDOUT and not STDERR. To get the function to report STDERR you can route it into STDOUT by adding 2->&1</span> at the end of your command.

After I realized this I logged in and found the full path of the git binary with which git, which is /full/path/to/bin/git.

<code data-lang="php"><span><?php
<span>...
    <span>echo <span>shell_exec<span>(<span>"/full/path/to/bin/git pull 2>&1"<span>);
<span>...
</span></span></span></code>

Now it was reporting the next issue...

permissions

<code data-lang="text">error: cannot open .git/FETCH_HEAD: Permission denied
</code>

The apache user also needs read and write access to the entire repository.

<code data-lang="text">chown -R ssh_user:www repository/
</code>

It's also a good idea to make sure any files/directories inherit this ownership if being created by others by setting the group sticky bit.

<code data-lang="text">chmod -R g+s repository/
</code>

"Host key verification failed"

Next, you need to do an intial git pull with the apache user to make sure the remote is added to the apache user's known_hosts file

<code data-lang="text">sudo -u www git pull
</code>

ssh key

Another consideration created by this command being run by the apache user is the ssh key it uses to communicate with the remote repository.

First, I went down the path of attempting to use the GIT_SSH environment variable to set the ssh -i option to tell it to use a specific ssh key I had generated with the ssh user. I never got this to work, most likely because there are a lot of rules ssh uses to determine the safety of a given key. It requires some specific permissions regarding the user that is attempting to use the key.

An easier way I discovered was to give the apache user a home directory (via /etc/passwd) and a .ssh directory and then run the ssh-keygen command as the apache user (www

<code data-lang="text">sudo -u www ssh-keygen -t rsa
</code>

)

git pull

) です。このユーザーはたまたまパスに

<code data-lang="php"><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span><span> </span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></code>