new command: sudo-gcp-export

bin/sudo-gcp-export

@@ -0,0 +1 @@
+../lib/gcloud/sudo-gcp-export

lib/ci/bin/terragrunt-noninteractive

@@ -31,23 +31,50 @@ export TF_CLI_ARGS_apply="-lock=false -refresh=false"
 export DEBUG="${DEBUG:-}"
 if (( DEBUG >= 1 )); then
   export TF_LOG=debug
-  export TERRAGRUNT_LOG_LEVEL=info
+fi
+if (( DEBUG >= 4 )); then
   set -x
 fi
 if (( DEBUG >= 3 )); then
   export TERRAGRUNT_LOG_LEVEL=debug
-elif (( DEBUG <= 0 )); then
+elif (( DEBUG < 0 )); then
   export TERRAGRUNT_LOG_LEVEL=error
+else  # 0 <= DEBUG < 3
+  # NOTE: "inner" terraform errors are logged as "info"
+  export TERRAGRUNT_LOG_LEVEL=info
 fi
 
 TERRAGRUNT="$(which terragrunt)"
 while [[ "$TERRAGRUNT" -ef "$0" ]]; do
   TERRAGRUNT="$(super "$TERRAGRUNT")"
 done
 
-# sed: shorten the absurdly long "module prefix", but don't combine stdout/err
-"$TERRAGRUNT" "$@" \
+env \
+  sed=>(
+    sed -ur "
+      # shorten terragrunt's absurdly long output, using relative paths
+      s#$PWD/##g
+      s#$PWD\>#.#g
+      s#^\[\.\] ##  # remove any empty 'module prefix'
+
+      # shorten terragrunt's absurdly long output, using symbolic paths
+      s#$TERRAGRUNT_DOWNLOAD\>#\$TERRAGRUNT_DOWNLOAD#
+      s#$REPO_ROOT\>#\$REPO_ROOT#
+      s#$REPO\>#\$REPO#
+      s#$HOME\>#~#
+    " >&2
+  ) \
+  tty-attach bash -euc '
+    # .. but dont separate stdout/err, unless they were already
+    if [[ /dev/fd/1 -ef /dev/fd/2 ]]; then
+      exec 2>"$sed" 1>&2
+    else
+      exec 2>"$sed"
+    fi
+
+    "$@"
+  ' \
   0</dev/null \
-  1> >( sed -ur "s#$PWD/##g; s#$PWD\>#.#; s#^\[\.\] ##" >&1 ) \
-  2> >( sed -ur "s#$PWD/##g; s#$PWD\>#.#; s#^\[\.\] ##" >&2 ) \
+  - \
+  "$TERRAGRUNT" "$@" \
 ;

lib/gcloud/gcloud-auth-export-access-token

@@ -41,14 +41,15 @@ fi
 
 export configuration_properties_core_account
 export credential_access_token
-eval "$(
+eval="$(  # eval in two steps to avoid ignoring error codes
   unset CLOUDSDK_CORE_ACCOUNT
   unset CLOUDSDK_AUTH_ACCESS_TOKEN
   # enable interactive reauth, iff we have a controlling tty
   tty-attach gcloud config config-helper \
     --format 'config[export](configuration.properties.core.account,credential.access_token)' \
   ;
 )"
+eval "$eval"
 origin_identity="${configuration_properties_core_account:-}"
 token="$credential_access_token"
 target_identity="${target_identity:-}"
@@ -92,6 +93,14 @@ set -x CLOUDSDK_CORE_ACCOUNT "$target_identity"
 set -x GOOGLE_OAUTH_ACCESS_TOKEN '$token'
 set -x CLOUDSDK_AUTH_ACCESS_TOKEN "\$GOOGLE_OAUTH_ACCESS_TOKEN"
 EOF
+elif [[ "$SHELL" =~ (^|/)json$ ]]; then
+  cat <<EOF
+{"CLOUDSDK_CORE_ACCOUNT":"$target_identity"
+,"GOOGLE_OAUTH_ACCESS_TOKEN":"$token"
+,"CLOUDSDK_AUTH_ACCESS_TOKEN":"$token"
+}
+EOF
+  exit 0
 else
   cat <<EOF
 export CLOUDSDK_CORE_ACCOUNT="$target_identity"
@@ -100,7 +109,7 @@ export CLOUDSDK_AUTH_ACCESS_TOKEN="\$GOOGLE_OAUTH_ACCESS_TOKEN"
 EOF
 fi
 
-info "You are authenticated for the next hour as: $target_identity"
+info "This process is authenticated for the next hour as: $target_identity"
 
 cat <<EOF
 

lib/gcloud/sudo-gcp

@@ -15,7 +15,7 @@ if [[ "${1:-}" = "-u" ]]; then
   service_account=("$1")
   shift 1
 elif ! [[ "${1:-}" || "${1:-}" =~ ^- ]]; then
-  echo >&2 'usage: sudo-gcp -u $GCP_SERVICE_ACCOUNT $COMAND'
+  echo >&2 'usage: sudo-gcp [-u $GCP_SERVICE_ACCOUNT] $COMMAND'
   exit 1
 else
   service_account=(

lib/gcloud/sudo-gcp-export

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+HERE="$(dirname "$(readlink -f "$0")")"
+
+export DEBUG="${DEBUG:-}"
+if (( DEBUG >= 1 )); then
+  set -x
+fi
+
+# FIXME: support `-u $USER` and/or `-u $EMAIL` to request an end-user access token
+if [[ "${1:-}" = "-u" ]]; then
+  shift 1
+  service_account=("$1")
+  shift 1
+elif [[ "${1:-}" =~ ^- ]]; then
+  echo >&2 'usage: sudo-gcp-export [-u $GCP_SERVICE_ACCOUNT] [SHELL]'
+  exit 1
+else
+  service_account=(
+    "${SUDO_GCP_SERVICE_ACCOUNT:-"$(
+      "$HERE/"sudo-gcp-service-account
+    )"}"
+  )
+fi
+
+shell="${1:-${SHELL:-bash}}"
+
+env SHELL="$shell" \
+  "$HERE/"gcloud-auth-export-access-token "${service_account[@]}"

lib/gcloud/sudo-gcp-service-account

@@ -21,9 +21,13 @@ interpolate_line() {
   /bin/sh -ec 'echo "'"$val"'"'
 }
 
-export DEBUG="${DEBUG:-}"
+# honor any direnv config
+export DIRENV_LOG_FORMAT=  # don't spam "direnv loading..." lines
+eval="$(direnv export bash)"
+eval "$eval"
 
-if (( DEBUG >= 1 )); then
+export DEBUG="${DEBUG:-}"
+if (( DEBUG >= 5 )); then
   set -x
 fi
 

lib/unix/super

@@ -17,7 +17,7 @@ fi
 script="${1:-}"  # what are we looking for?
 if [[ -x "$script" ]]; then
   found=false
-elif command -v "$script"; then
+elif command -v "$script" >/dev/null; then
   found=true
 else
   usage

lib/unix/tty-attach

@@ -3,15 +3,20 @@ set -euo pipefail
 # attach subcommand to an interactive terminal, if possible
 
 export DEBUG="${DEBUG:-}"
-if (( DEBUG >= 2 )); then
+if (( DEBUG >= 4 )); then
   set -x
 fi
 
 # NOTE: a simple readabilty check (i.e. [ -r) gives false positives
 if ( : < /dev/tty ) 2>/dev/null; then
-  exec 0</dev/tty 2>/dev/tty
+  if [[ /dev/fd/1 -ef /dev/fd/2 ]]; then
+    : tty-attach: keep stdout/stderr combined
+    exec 0</dev/tty 2>/dev/tty 1>&2
+  else
+    : tty-attach: keep stdout separate
+    exec 0</dev/tty 2>/dev/tty
+  fi
   flock /dev/tty "$@"
 else
   "$@"
 fi
-