|
48522
|
27238
|
116
|
5
|
1b299e8dfc1590fce7375145c273e7fe4614a3a7
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39259
|
2
|
1794231794
|
1794231795
|
1794231780
|
1794231795
|
|
1
|
|
0
|
Edit
Delete
|
|
48534
|
27243
|
116
|
5
|
84b2ca03115b828b77ca42f813939b99d9906eed
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39271
|
2
|
1794233612
|
1794233612
|
1794233596
|
1794233612
|
|
1
|
|
0
|
Edit
Delete
|
|
48550
|
27245
|
116
|
5
|
c468c86000bf3adde6ef295a31d63acdaf599978
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39287
|
2
|
1794233955
|
1794233955
|
1794233940
|
1794233955
|
|
1
|
|
0
|
Edit
Delete
|
|
48558
|
27246
|
116
|
5
|
7f603d3ee205f8cd2b45a24f4acb597bfd45a403
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39295
|
2
|
1794234081
|
1794234081
|
1794234067
|
1794234081
|
|
1
|
|
0
|
Edit
Delete
|
|
48575
|
27249
|
116
|
5
|
877e0a80f3ff2d4fef69259f1d2d6c5ec5512b53
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39312
|
2
|
1794235568
|
1794235568
|
1794235554
|
1794235568
|
|
1
|
|
0
|
Edit
Delete
|
|
48587
|
27254
|
116
|
5
|
afd591986e5dc8c1c30830f1fd3b9b9b901ac389
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39324
|
2
|
1794237185
|
1794237185
|
1794237168
|
1794237185
|
|
1
|
|
0
|
Edit
Delete
|
|
48609
|
27269
|
116
|
5
|
8afa0c23c437669251a542340dc15be2de659563
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39346
|
2
|
1794242887
|
1794242887
|
1794242872
|
1794242887
|
|
1
|
|
0
|
Edit
Delete
|
|
48618
|
27271
|
116
|
5
|
a1f66e76fc2abc78b3c3739bb9f0053c795e2569
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39355
|
2
|
1794243683
|
1794243683
|
1794243667
|
1794243683
|
|
1
|
|
0
|
Edit
Delete
|
|
48630
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39367
|
2
|
1794246421
|
1794246421
|
1794246405
|
1794246421
|
|
1
|
|
0
|
Edit
Delete
|
|
48641
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39378
|
2
|
1794247819
|
1794247819
|
1794247805
|
1794247819
|
|
1
|
|
0
|
Edit
Delete
|
|
48650
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39387
|
2
|
1794248428
|
1794248428
|
1794248413
|
1794248429
|
|
1
|
|
0
|
Edit
Delete
|
|
48663
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39400
|
2
|
1794252162
|
1794252162
|
1794252148
|
1794252162
|
|
1
|
|
0
|
Edit
Delete
|
|
48676
|
27293
|
116
|
5
|
38a4ca00530190a3ace9286e74382b39db9a6b71
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794255967
|
1794255751
|
1794255967
|
|
0
|
|
0
|
Edit
Delete
|
|
48684
|
27294
|
116
|
5
|
56a721c2db249abfc02eb1b4ec9c7882478058f6
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39413
|
2
|
1794256006
|
1794256006
|
1794255968
|
1794256007
|
|
1
|
|
0
|
Edit
Delete
|
|
48693
|
27296
|
116
|
5
|
818b762c87b12b050d7e86e6b95cc3c7b4283bea
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794320952
|
1794316668
|
1794320952
|
|
0
|
|
0
|
Edit
Delete
|
|
48702
|
27298
|
116
|
5
|
186d60bd10c6176a72cdf235d3ab050fba3f2ccd
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794324089
|
1794320953
|
1794324089
|
|
0
|
|
0
|
Edit
Delete
|
|
48711
|
27300
|
116
|
5
|
25d66ed9273526459bdced6de951fbec15b27ee1
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794353362
|
1794324089
|
1794353362
|
|
0
|
|
0
|
Edit
Delete
|
|
48719
|
27301
|
116
|
5
|
7133b2caf84769a38d4c5b5c7f4f68f42e7cfcac
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794356635
|
1794353362
|
1794356635
|
|
0
|
|
0
|
Edit
Delete
|
|
48727
|
27302
|
116
|
5
|
497d455f77edd1603c6fa7875dd72019e3d4f0fb
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794358645
|
1794356636
|
1794358645
|
|
0
|
|
0
|
Edit
Delete
|
|
48737
|
27305
|
116
|
5
|
2f0d327f805c28927391dc095a5f830ea7d15a2b
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794360703
|
1794358646
|
1794360703
|
|
0
|
|
0
|
Edit
Delete
|
|
48745
|
27306
|
116
|
5
|
b4688a9ff6e9f742672bd9c2cb87af958da15fc8
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794361712
|
1794360703
|
1794361712
|
|
0
|
|
0
|
Edit
Delete
|
|
48753
|
27307
|
116
|
5
|
e626636459a3430e5ab75ac23cf32d74cf678932
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794365814
|
1794361713
|
1794365814
|
|
0
|
|
0
|
Edit
Delete
|
|
48761
|
27308
|
116
|
5
|
ca7310a3411a335bb6f35d70c7b9eb4f7766242f
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794370322
|
1794365815
|
1794370322
|
|
0
|
|
0
|
Edit
Delete
|
|
48769
|
27309
|
116
|
5
|
cbae30c07677ddd0e4fd582703a41bd7fcfb5655
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794373119
|
1794370323
|
1794373119
|
|
0
|
|
0
|
Edit
Delete
|
|
48777
|
27310
|
116
|
5
|
6b550f774c997ada6a2d06e7fbdcf551260ea289
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794375432
|
1794373120
|
1794375432
|
|
0
|
|
0
|
Edit
Delete
|
|
48786
|
27312
|
116
|
5
|
7d6b7d75892f1f28e1144f544f8fad5376af13a2
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
7
|
0
|
0
|
1794375432
|
1794375432
|
|
0
|
|
0
|
Edit
Delete
|
|
48400
|
27214
|
116
|
5
|
d12fc9bb01efc157a4947c2d607b1a2a9e35a636
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39137
|
4
|
1794207986
|
1794207986
|
1794207971
|
1794207986
|
|
1
|
|
0
|
Edit
Delete
|
|
48408
|
27215
|
116
|
5
|
917e1b9307d1578ec352d2d268bfd7af6374daa3
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39145
|
4
|
1794208122
|
1794208122
|
1794208106
|
1794208122
|
|
1
|
|
0
|
Edit
Delete
|
|
48424
|
27224
|
116
|
5
|
6b9db637ea841951ff531fed3e4df061e59aa716
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39161
|
4
|
1794214549
|
1794214550
|
1794214532
|
1794214550
|
|
1
|
|
0
|
Edit
Delete
|
|
48432
|
27225
|
116
|
5
|
20f1fc0b88e22905168f17f2e02bf92be0cd6146
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39171
|
4
|
1794214765
|
1794214766
|
1794214746
|
1794214766
|
|
1
|
|
0
|
Edit
Delete
|
|
48440
|
27226
|
116
|
5
|
faa73dbad6b60884a1f0ed7ff3fb578d32d15bdc
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39179
|
4
|
1794214787
|
1794214787
|
1794214754
|
1794214787
|
|
1
|
|
0
|
Edit
Delete
|
|
48464
|
27229
|
116
|
5
|
603bbc82757c1238c7f0dcd688be33dda8d11635
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39203
|
4
|
1794214867
|
1794214867
|
1794214848
|
1794214867
|
|
1
|
|
0
|
Edit
Delete
|
|
48472
|
27230
|
116
|
5
|
e3c84561a83ef27e443c6e1121f7edfc0d28f1e2
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39209
|
4
|
1794214879
|
1794214879
|
1794214859
|
1794214879
|
|
1
|
|
0
|
Edit
Delete
|
|
48480
|
27231
|
116
|
5
|
466b845a88c99d1ac8a874660b7b8454ca2a7744
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39217
|
4
|
1794230565
|
1794230565
|
1794230547
|
1794230565
|
|
1
|
|
0
|
Edit
Delete
|
|
48488
|
27232
|
116
|
5
|
a5c0e4dfd7e5999dc720d60df98ef1e5fa86ffdc
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() && env.CANDIDATE_TAG != '' }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39225
|
4
|
1794230831
|
1794230831
|
1794230816
|
1794230831
|
|
1
|
|
0
|
Edit
Delete
|
|
31998
|
23867
|
116
|
5
|
2c26d9d48c606dcae4a86d8c8dcb1921b65f48d4
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27769
|
4
|
1789196776
|
1789196776
|
1789196750
|
1789196776
|
|
1
|
|
0
|
Edit
Delete
|
|
32004
|
23868
|
116
|
5
|
95d9793f80ea584ebb999543fbe94e9597897fe6
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27775
|
4
|
1789196907
|
1789196907
|
1789196881
|
1789196907
|
|
1
|
|
0
|
Edit
Delete
|
|
32013
|
23870
|
116
|
5
|
69e687203ec23bd576dd7610db6d5db1f2197f6e
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27783
|
4
|
1789198096
|
1789198096
|
1789198061
|
1789198096
|
|
1
|
|
0
|
Edit
Delete
|
|
32019
|
23871
|
116
|
5
|
6765c0bf1b8aab56356524c2f8e7512d7bc2eb33
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27789
|
4
|
1789198382
|
1789198382
|
1789198228
|
1789198382
|
|
1
|
|
0
|
Edit
Delete
|
|
32027
|
23874
|
116
|
5
|
99cce601d0afd37f556bc74e98d770ec1ed40271
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1789199625
|
1789199282
|
1789199625
|
|
0
|
|
0
|
Edit
Delete
|
|
32033
|
23875
|
116
|
5
|
be7334ad46324e54bebe2397365086896b6ad42b
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1789199753
|
1789199626
|
1789199753
|
|
0
|
|
0
|
Edit
Delete
|
|
32039
|
23876
|
116
|
5
|
0bceefc14d66a2f3544ff1036cbf467d80e2a9ec
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27797
|
4
|
1789200200
|
1789200200
|
1789199753
|
1789200200
|
|
1
|
|
0
|
Edit
Delete
|
|
32046
|
23878
|
116
|
5
|
6c7f04cb97ab7909f083fd60c790ecda34e9b8ee
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27804
|
4
|
1789201131
|
1789201131
|
1789201093
|
1789201131
|
|
1
|
|
0
|
Edit
Delete
|
|
32052
|
23879
|
116
|
5
|
e5aca81c94597d4cb18cc65fa5b0855d4333aaf6
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27810
|
4
|
1789201524
|
1789201524
|
1789201488
|
1789201525
|
|
1
|
|
0
|
Edit
Delete
|
|
32080
|
23884
|
116
|
5
|
0b13f1834fd75f1f6cdec1b89ddc6e639dea5f4e
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27825
|
4
|
1789205076
|
1789205077
|
1789205040
|
1789205077
|
|
1
|
|
0
|
Edit
Delete
|
|
32087
|
23885
|
116
|
5
|
b19500919a1a2e568e5a41932eec0a37eeb94747
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27832
|
4
|
1789206470
|
1789206470
|
1789206431
|
1789206470
|
|
1
|
|
0
|
Edit
Delete
|
|
32116
|
23890
|
116
|
5
|
23f6e71c1971bd243b703ddcf0ce7c4d40974a83
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27846
|
4
|
1789208201
|
1789208201
|
1789208163
|
1789208201
|
|
1
|
|
0
|
Edit
Delete
|
|
32123
|
23891
|
116
|
5
|
8a95879f7501b2874d73cf1f36f07f7673695db3
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
27855
|
4
|
1789209675
|
1789209675
|
1789208470
|
1789209675
|
|
1
|
|
0
|
Edit
Delete
|
|
32130
|
23892
|
116
|
5
|
f0956259a231da48063f98a22ad35b52a3699916
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1789209229
|
1789209155
|
1789209229
|
|
0
|
|
0
|
Edit
Delete
|
|
32138
|
23893
|
116
|
5
|
bb38f4cd0f55cd2cb76723ca12f26c19414a1817
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1789209470
|
1789209229
|
1789209470
|
|
0
|
|
0
|
Edit
Delete
|