Drone: upgrade docker version, sign, add nix shell for signing (#5482)

Reviewed-on: #5482
Co-authored-by: hl <hl@fsfe.org>
Co-committed-by: hl <hl@fsfe.org>

.drone.yml

@@ -8,7 +8,7 @@ clone:
 
 steps:
   - name: pre-commit
-    image: docker:27.4.1
+    image: docker:28
     environment:
       # Environment variables necessary for rootless Docker
       XDG_RUNTIME_DIR: "/run/user/1001"
@@ -25,7 +25,7 @@ steps:
 
   # Test building the deploy docker image
   - name: test-build-docker-image
-    image: docker:27.4.1
+    image: docker:28
     environment:
       # Environment variables necessary for rootless Docker
       XDG_RUNTIME_DIR: "/run/user/1001"
@@ -56,7 +56,7 @@ steps:
         - deployment
 
   - name: deploy-master
-    image: docker:27.4.1
+    image: docker:28
     environment:
       # Environment variables necessary for rootless Docker
       XDG_RUNTIME_DIR: "/run/user/1001"
@@ -90,7 +90,7 @@ steps:
           - pull_request
 
   - name: deploy-test
-    image: docker:27.4.1
+    image: docker:28
     environment:
       # Environment variables necessary for rootless Docker
       XDG_RUNTIME_DIR: "/run/user/1001"
@@ -142,6 +142,6 @@ volumes:
       path: /run/user/1001/docker.sock
 ---
 kind: signature
-hmac: 997582ae47807c3367efcda28920c2d0f84bfd05d6fddf224bf7440a636d91e1
+hmac: 3db8e2103b4160f172248b54c7e21aabd22956f2b3fbf6492e38f9bd5d338e8f
 
 ...

.gitignore

@@ -16,3 +16,4 @@ __pycache__
 .env
 # drone
 secrets.txt
+drone_token.txt

drone-shell.nix

@@ -0,0 +1,41 @@
+# SPDX-FileCopyrightText: 2025 Free Software Foundation Europe <https://fsfe.org>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+{ pkgs ? import <nixpkgs> {} }:
+
+pkgs.mkShell {
+  # we assume the repo is cloned so git is available
+  # we assume awk is present
+  buildInputs = with pkgs; [
+    drone-cli # signing
+  ];
+  shellHook = ''
+  # GIT
+  if ! git remote get-url upstream > /dev/null 2>&1 ; then
+     # REVIEW(fkobi): this could get annoying if for some reason people do not want the upstream
+     git remote add upstream git@git.fsfe.org:fsfe-system-hackers/hugo-container.git
+
+     git config branch.main.pushRemote origin
+  fi
+
+  # DRONE
+  export DRONE_SERVER=https://drone.fsfe.org
+  export DRONE_TOKEN
+
+  DRONE_FILE=drone_token.txt
+  if [[ -r $DRONE_FILE ]]; then
+     DRONE_TOKEN=$(cat $DRONE_FILE)
+  else
+     echo "Insert your drone token (found at $DRONE_SERVER/account)"
+     read -r -p "Token: " DRONE_TOKEN
+     echo -n $DRONE_TOKEN > $DRONE_FILE
+  fi
+  unset DRONE_FILE
+
+  REPO_NAME="$(git remote get-url origin | awk -F "[:.]" '{printf $4}')"
+  alias save="drone sign --save $REPO_NAME && printf 'Hash saved!' && git add .drone.yml"
+
+  echo "You are working on $REPO_NAME repository."
+  echo "Use the \"save\" alias to drone sign and git commit your drone.yml changes."
+  '';
+}