feat: simplify public preview installation

scripts/test-git-install-fixture.sh

@@ -30,7 +30,11 @@ else
   [ "$KAIDI_DB_USERNAME" = 'kaidi' ]
   [ "$KAIDI_DB_PASSWORD" = 'fixture-password' ]
 fi
-[ "$(cat "$KAIDI_RELEASE_TOKEN_FILE")" = 'fixture-read-token' ]
+if [ "${EXPECT_TOKEN:-false}" = true ]; then
+  [ "$(cat "$KAIDI_RELEASE_TOKEN_FILE")" = 'fixture-read-token' ]
+else
+  [ -z "${KAIDI_RELEASE_TOKEN_FILE:-}" ]
+fi
 printf 'fixture-installer: PASS\n'
 SH
 
@@ -40,7 +44,6 @@ chmod 0600 "$FIXTURE/token"
 installer_sha256=$(sha256sum "$FIXTURE/repo/deploy/install.sh" | awk '{print $1}')
 
 PATH="$FIXTURE/bin:$PATH" \
-KAIDI_RELEASE_TOKEN_FILE="$FIXTURE/token" \
 KAIDI_INSTALLER_SHA256="$installer_sha256" \
 KAIDI_RELEASE_API_URL=https://git.example.test/api/v1/repos/TEAM/REPO/releases/latest \
 KAIDI_RELEASE_PUBLIC_KEY_SHA256=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
@@ -50,6 +53,14 @@ KAIDI_DB_PASSWORD=fixture-password \
   "$FIXTURE/repo/deploy/install-from-git.sh"
 
 PATH="$FIXTURE/bin:$PATH" \
+KAIDI_INSTALLER_SHA256="$installer_sha256" \
+KAIDI_RELEASE_API_URL=https://git.example.test/api/v1/repos/TEAM/REPO/releases/latest \
+KAIDI_RELEASE_PUBLIC_KEY_SHA256=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
+KAIDI_SETUP_WIZARD=true \
+  "$FIXTURE/repo/deploy/install-from-git.sh"
+
+PATH="$FIXTURE/bin:$PATH" \
+EXPECT_TOKEN=true \
 KAIDI_RELEASE_TOKEN_FILE="$FIXTURE/token" \
 KAIDI_INSTALLER_SHA256="$installer_sha256" \
 KAIDI_RELEASE_API_URL=https://git.example.test/api/v1/repos/TEAM/REPO/releases/latest \
@@ -58,7 +69,6 @@ KAIDI_SETUP_WIZARD=true \
   "$FIXTURE/repo/deploy/install-from-git.sh"
 
 if PATH="$FIXTURE/bin:$PATH" \
-  KAIDI_RELEASE_TOKEN_FILE="$FIXTURE/token" \
   KAIDI_INSTALLER_SHA256=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb \
   "$FIXTURE/repo/deploy/install-from-git.sh" > "$FIXTURE/hash-mismatch.log" 2>&1; then
   printf 'Mismatched installer SHA-256 was accepted\n' >&2

scripts/test-install-fixture.sh

@@ -199,7 +199,19 @@ grep -Fq 'java_sha256=$(jq -er' "$ROOT/deploy/install.sh" \
 grep -Fq '[ "$actual_sha256" = "$java_sha256" ]' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer verifies the Java runtime SHA-256'
 grep -Fq 'https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest' "$ROOT/deploy/install.sh" \
-  || fail 'installer default release source is not the private Gitea latest API'
+  || fail 'installer default release source is not the public Gitea latest API'
+# shellcheck disable=SC2016 # Match literal installer source.
+grep -Fq 'TRUSTED_PUBLIC_KEY_SHA256=${KAIDI_RELEASE_PUBLIC_KEY_SHA256:-807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9}' "$ROOT/deploy/install.sh" \
+  || fail 'installer does not pin the default release public-key fingerprint'
+# shellcheck disable=SC2016 # Match literal installer source.
+grep -Fq 'SETUP_WIZARD=${KAIDI_SETUP_WIZARD:-true}' "$ROOT/deploy/install.sh" \
+  || fail 'installer does not enable the first-run setup wizard by default'
+! grep -Fq 'docker run' "$ROOT/deploy/install.sh" \
+  || fail 'installer must not create a MySQL container'
+! grep -Fq 'install_docker' "$ROOT/deploy/install.sh" \
+  || fail 'installer must not install Docker or MySQL automatically'
+grep -Fq 'An external MySQL 8.4 database is required' "$ROOT/deploy/install.sh" \
+  || fail 'installer does not require an operator-managed external MySQL database'
 grep -Fq 'KAIDI_RELEASE_TOKEN_FILE' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer supports a protected initial Gitea token file'
 grep -Fq 'KAIDI_SETUP_WIZARD' "$ROOT/deploy/install.sh" \
@@ -215,7 +227,7 @@ grep -Fq 'EnvironmentFile=-/var/lib/kaidi/setup/application.env' \
 # shellcheck disable=SC2016 # Match the literal installer source.
 grep -Fq 'chown root:kaidi "$UPDATE_STATE_ROOT"' "$ROOT/deploy/install.sh" \
   || fail 'update state parent is not group-accessible to the application user'
-grep -Fq 'KAIDI_SETUP_WIZARD=true' "$ROOT/README.md" \
-  || fail 'README does not document the setup-wizard install path'
+grep -Fq 'install.sh | sudo bash' "$ROOT/README.md" \
+  || fail 'README does not document the public one-line setup-wizard install path'
 
-printf 'Install configuration, private Gitea, i686, setup wizard, and MySQL 8.4 fixtures passed\n'
+printf 'Install configuration, public Gitea, optional private token, i686, setup wizard, and MySQL 8.4 fixtures passed\n'