chore: use shared gitea credentials

scripts/run_pipeline.sh

@@ -4,33 +4,24 @@ set -eu
 
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
-# ENV_FILE is an explicit override; by default it is the sibling dashboard .env.
-ENV_FILE=${ENV_FILE:-$(CDPATH= cd -- "$PROJECT_ROOT/../direct-report-dashboard" && pwd)/.env}
 PYTHON_BIN=${PYTHON_BIN:-python3}
+CREDENTIALS_FILE=${HOME:?}/.config/gitea/credentials.env
 
-if [ ! -r "$ENV_FILE" ]; then
-    printf '%s\n' "Credential file is not readable: $ENV_FILE" >&2
+if [ ! -r "$CREDENTIALS_FILE" ]; then
+    printf '%s\n' "Credential file is not readable: $CREDENTIALS_FILE" >&2
+    exit 1
+fi
+if [ "$(stat -f '%Lp' "$CREDENTIALS_FILE")" != 600 ]; then
+    printf '%s\n' "Credential file must have mode 600: $CREDENTIALS_FILE" >&2
     exit 1
 fi
 
-# Read only the two Git credential variables; do not source the .env file.
-dotenv_value() {
-    awk -v wanted="$1" '
-        $0 ~ "^[[:space:]]*" wanted "[[:space:]]*=" {
-            sub("^[[:space:]]*" wanted "[[:space:]]*=", "")
-            if ($0 ~ /^".*"[[:space:]]*$/) {
-                sub(/^"/, ""); sub(/"[[:space:]]*$/, "")
-            } else if ($0 ~ /^'"'"'.*'"'"'[[:space:]]*$/) {
-                sub(/^'"'"'/, ""); sub(/'"'"'[[:space:]]*$/, "")
-            }
-            print
-            exit
-        }
-    ' "$ENV_FILE"
+credential_value() {
+    awk -F= -v wanted="$1" '$1 ~ "^[[:space:]]*" wanted "[[:space:]]*$" { sub(/^[[:space:]]*/, "", $2); sub(/[[:space:]]*$/, "", $2); print $2; exit }' "$CREDENTIALS_FILE"
 }
 
-AGENTSTAGE_USER=$(dotenv_value AGENTSTAGE_USER)
-AGENTSTAGE_TOKEN=$(dotenv_value AGENTSTAGE_TOKEN)
+AGENTSTAGE_USER=$(credential_value GITEA_USER)
+AGENTSTAGE_TOKEN=$(credential_value GITEA_TOKEN)
 missing=''
 [ -n "$AGENTSTAGE_USER" ] || missing="$missing AGENTSTAGE_USER"
 [ -n "$AGENTSTAGE_TOKEN" ] || missing="$missing AGENTSTAGE_TOKEN"