|
46407
|
26910
|
116
|
5
|
63e4dc2d4fee49fe7bab80b0d076349ea6ebd94e
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37784
|
1
|
1793579034
|
1793579036
|
1793579033
|
1793579037
|
|
0
|
|
0
|
Edit
Delete
|
|
46429
|
26915
|
116
|
5
|
135dcf751613b903b449be1852b697472becb3ef
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37798
|
1
|
1793580544
|
1793580556
|
1793580291
|
1793580557
|
|
0
|
|
0
|
Edit
Delete
|
|
46155
|
26820
|
116
|
5
|
99377766818e8de375eb4b5d5e14b24b83a08fc2
|
0
|
inspect
|
1
|
name: Read only obsolete owner guard source window name: Read only obsolete owner guard source windows
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-owner-guard-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,json,os
p=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26819/candidate-source/routers/web/repo/setting/setting.go')
text=p.read_text().splitlines()
windows=[]
for i,line in enumerate(text):
if 'ctx.Repo.IsOwner' in line:windows.append({'line':i+1,'source':text[max(0,i-12):i+17]})
print('GITEA_PERMISSION_SOURCE_DIAG_JSON '+json.dumps({'kind':'PermissionSourceReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'windows':windows,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37608
|
1
|
1793531041
|
1793531041
|
1793531040
|
1793531041
|
|
0
|
|
0
|
Edit
Delete
|
|
46117
|
26789
|
116
|
5
|
84b806bef243feb21c6a4cd6e94abbefd237d506
|
0
|
validate
|
1
|
name: Read maintenance writer and ingress boundari name: Read maintenance writer and ingress boundaries
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-maintenance-boundary.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/inspect-maintenance-boundary.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'inspect-maintenance-boundary.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_MAINTENANCE_BOUNDARY_JSON '+json.dumps({'kind':'GiteaMaintenanceBoundary','ci':{'sourceSha':sha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37570
|
2
|
1793528161
|
1793528161
|
1793528030
|
1793528161
|
|
0
|
|
0
|
Edit
Delete
|
|
46176
|
26827
|
116
|
5
|
52b7cb7a5070dec181dfeb09205b1dade0793adf
|
0
|
inspect
|
1
|
name: Read maintenance storage and ingress preflig name: Read maintenance storage and ingress preflight only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-preflight.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess,hashlib,shutil
def command(args):return subprocess.run(args,capture_output=True,timeout=90)
sizes={}
for path in ['/home/git','/usr/local/bin/data','/opt/gitea-runner','/var/lib/eios-r1-maintenance']:
r=command(['du','-s','-B1','--',path])
sizes[path]=int(r.stdout.split()[0]) if r.returncode==0 else None
def meta(name):
p=pathlib.Path(name)
if not p.exists():return {'path':name,'exists':False}
st=p.lstat();value={'path':name,'exists':True,'uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'bytes':st.st_size,'symlink':p.is_symlink()}
if p.is_file() and not p.is_symlink():value['sha256']=hashlib.sha256(p.read_bytes()).hexdigest()
return value
ssh=command(['/usr/sbin/sshd','-T']);selected={}
for line in ssh.stdout.decode().splitlines():
key,_,value=line.partition(' ')
if key in ['authorizedkeysfile','authorizedkeyscommand','passwordauthentication','kbdinteractiveauthentication','denyusers','allowusers','authenticationmethods','usepam']:selected[key]=value
status=command(['passwd','-S','git']).stdout.decode().split();account_status=status[:2]
configs=[]
for name in ['/etc/nginx/conf.d/gitea-http-redirect.conf','/etc/nginx/conf.d/gitea-https.conf']:
p=pathlib.Path(name);configs.append({'path':name,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'serverBlocks':len(re.findall(r'(?m)^\s*server\s*\{',p.read_text()))})
services={}
for name in ['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','nginx.service','ssh.service','docker.service']:
r=command(['systemctl','show',name,'--property=MainPID,ActiveState,FragmentPath']);services[name]=dict(line.split('=',1) for line in r.stdout.decode().splitlines() if '=' in line)
report={'kind':'GiteaMaintenanceWindowReadOnlyPreflight','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'mutations':False,'releaseEligible':False,'allocatedBytes':sizes,'filesystemFreeBytes':shutil.disk_usage('/var/lib/eios-r1-maintenance').free,'sshPolicy':selected,'gitAccountPasswordStatus':account_status,'nginxConfigs':configs,'services':services,'customHelperMetadata':[meta('/usr/local/bin/rsync_commit.sh'),meta('/home/git/.ssh/authorized_keys2')]}
print('GITEA_WINDOW_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37615
|
1
|
1793532667
|
1793532736
|
1793532044
|
1793532737
|
|
0
|
|
0
|
Edit
Delete
|
|
46285
|
26866
|
116
|
5
|
77fc39379e3218373ef76be1c588e758af11249f
|
0
|
inspect
|
1
|
name: Read maintenance storage and ingress preflig name: Read maintenance storage and ingress preflight only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-preflight.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess,hashlib,shutil
def command(args):return subprocess.run(args,capture_output=True,timeout=90)
sizes={}
for path in ['/home/git','/usr/local/bin/data','/opt/gitea-runner','/var/lib/eios-r1-maintenance']:
r=command(['du','-s','-B1','--',path])
sizes[path]=int(r.stdout.split()[0]) if r.returncode==0 else None
def meta(name):
p=pathlib.Path(name)
if not p.exists():return {'path':name,'exists':False}
st=p.lstat();value={'path':name,'exists':True,'uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'bytes':st.st_size,'symlink':p.is_symlink()}
if p.is_file() and not p.is_symlink():value['sha256']=hashlib.sha256(p.read_bytes()).hexdigest()
return value
ssh=command(['/usr/sbin/sshd','-T']);selected={}
for line in ssh.stdout.decode().splitlines():
key,_,value=line.partition(' ')
if key in ['authorizedkeysfile','authorizedkeyscommand','passwordauthentication','kbdinteractiveauthentication','denyusers','allowusers','authenticationmethods','usepam']:selected[key]=value
status=command(['passwd','-S','git']).stdout.decode().split();account_status=status[:2]
configs=[]
for name in ['/etc/nginx/conf.d/gitea-http-redirect.conf','/etc/nginx/conf.d/gitea-https.conf']:
p=pathlib.Path(name);configs.append({'path':name,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'serverBlocks':len(re.findall(r'(?m)^\s*server\s*\{',p.read_text()))})
services={}
for name in ['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','nginx.service','ssh.service','docker.service']:
r=command(['systemctl','show',name,'--property=MainPID,ActiveState,FragmentPath']);services[name]=dict(line.split('=',1) for line in r.stdout.decode().splitlines() if '=' in line)
maintenanceChildren={}
for child in pathlib.Path('/var/lib/eios-r1-maintenance/build-cache').iterdir():
if child.is_dir() and re.fullmatch(r'[A-Za-z0-9_.-]+',child.name):
r=command(['du','-s','-B1','--',str(child)])
maintenanceChildren[child.name]=int(r.stdout.split()[0]) if r.returncode==0 else None
report={'maintenanceChildrenBytes':maintenanceChildren,'kind':'GiteaMaintenanceWindowReadOnlyPreflight','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'mutations':False,'releaseEligible':False,'allocatedBytes':sizes,'filesystemFreeBytes':shutil.disk_usage('/var/lib/eios-r1-maintenance').free,'sshPolicy':selected,'gitAccountPasswordStatus':account_status,'nginxConfigs':configs,'services':services,'customHelperMetadata':[meta('/home/git/gitea/scripts/rsync_commit.sh'),meta('/home/git/.ssh/authorized_keys2')]}
report['cacheChildrenScope']='/var/lib/eios-r1-maintenance/build-cache'
import configparser,sqlite3
c=configparser.ConfigParser(interpolation=None,strict=False);c.read_string('[DEFAULT]\n'+pathlib.Path('/home/git/gitea/config/app.ini').read_text())
report['storageLocations']={}
for section in c.sections():
if section in ['repository','lfs','attachment','picture','storage','actions','packages'] or section.startswith(('storage.','storage@')):
report['storageLocations'][section]={k:v for k,v in c.items(section,raw=True) if k.lower() in ['root','path','storage_type','type','artifact_path','log_path']}
db=sqlite3.connect('file:/home/git/gitea/data/gitea.db?mode=ro',uri=True)
report['actionSchemas']={t:[r[1] for r in db.execute('pragma table_info('+t+')')] for t in ['action_run','action_run_job','action_task']}
report['runningTasksByRunner']=[list(r) for r in db.execute('select runner_id,status,count(*) from action_task where status not in (1,2,3,4) group by runner_id,status')]
report['firewallTools']={name:bool(shutil.which(name)) for name in ['iptables','ip6tables','nft','sshd']}
db.close()
print('GITEA_WINDOW_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37690
|
1
|
1793543157
|
1793543170
|
1793543157
|
1793543170
|
|
0
|
|
0
|
Edit
Delete
|
|
46284
|
26865
|
116
|
5
|
4346f236a2d9a309229559d335f3bb16508c8595
|
0
|
inspect
|
1
|
name: Read maintenance storage and ingress preflig name: Read maintenance storage and ingress preflight only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-preflight.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess,hashlib,shutil
def command(args):return subprocess.run(args,capture_output=True,timeout=90)
sizes={}
for path in ['/home/git','/usr/local/bin/data','/opt/gitea-runner','/var/lib/eios-r1-maintenance']:
r=command(['du','-s','-B1','--',path])
sizes[path]=int(r.stdout.split()[0]) if r.returncode==0 else None
def meta(name):
p=pathlib.Path(name)
if not p.exists():return {'path':name,'exists':False}
st=p.lstat();value={'path':name,'exists':True,'uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'bytes':st.st_size,'symlink':p.is_symlink()}
if p.is_file() and not p.is_symlink():value['sha256']=hashlib.sha256(p.read_bytes()).hexdigest()
return value
ssh=command(['/usr/sbin/sshd','-T']);selected={}
for line in ssh.stdout.decode().splitlines():
key,_,value=line.partition(' ')
if key in ['authorizedkeysfile','authorizedkeyscommand','passwordauthentication','kbdinteractiveauthentication','denyusers','allowusers','authenticationmethods','usepam']:selected[key]=value
status=command(['passwd','-S','git']).stdout.decode().split();account_status=status[:2]
configs=[]
for name in ['/etc/nginx/conf.d/gitea-http-redirect.conf','/etc/nginx/conf.d/gitea-https.conf']:
p=pathlib.Path(name);configs.append({'path':name,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'serverBlocks':len(re.findall(r'(?m)^\s*server\s*\{',p.read_text()))})
services={}
for name in ['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','nginx.service','ssh.service','docker.service']:
r=command(['systemctl','show',name,'--property=MainPID,ActiveState,FragmentPath']);services[name]=dict(line.split('=',1) for line in r.stdout.decode().splitlines() if '=' in line)
maintenanceChildren={}
for child in pathlib.Path('/var/lib/eios-r1-maintenance').iterdir():
if child.is_dir() and re.fullmatch(r'[A-Za-z0-9_.-]+',child.name):
r=command(['du','-s','-B1','--',str(child)])
maintenanceChildren[child.name]=int(r.stdout.split()[0]) if r.returncode==0 else None
report={'maintenanceChildrenBytes':maintenanceChildren,'kind':'GiteaMaintenanceWindowReadOnlyPreflight','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'mutations':False,'releaseEligible':False,'allocatedBytes':sizes,'filesystemFreeBytes':shutil.disk_usage('/var/lib/eios-r1-maintenance').free,'sshPolicy':selected,'gitAccountPasswordStatus':account_status,'nginxConfigs':configs,'services':services,'customHelperMetadata':[meta('/home/git/gitea/scripts/rsync_commit.sh'),meta('/home/git/.ssh/authorized_keys2')]}
print('GITEA_WINDOW_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37689
|
1
|
1793543013
|
1793543088
|
1793543011
|
1793543092
|
|
0
|
|
0
|
Edit
Delete
|
|
46118
|
26790
|
116
|
5
|
4761299cdaaca88b5b95ff037fb05c2fa82f8ce1
|
0
|
validate
|
1
|
name: Read maintenance boundary with legacy INI ro name: Read maintenance boundary with legacy INI root keys
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-maintenance-boundary.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/inspect-maintenance-boundary.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'inspect-maintenance-boundary.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_MAINTENANCE_BOUNDARY_JSON '+json.dumps({'kind':'GiteaMaintenanceBoundary','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37571
|
1
|
1793528817
|
1793528819
|
1793528815
|
1793528820
|
|
0
|
|
0
|
Edit
Delete
|
|
46148
|
26813
|
116
|
5
|
c094f851975bfe8321f36bf10b2f2b250bf46b24
|
0
|
inspect
|
1
|
name: Read isolated old restore failure log only
& name: Read isolated old restore failure log only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-old-restore-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os
p=pathlib.Path('/var/lib/eios-r1-maintenance/old-database-restore-26810/old-server.log')
lines=[]
for line in p.read_text(errors='replace').splitlines():
if re.search(r'(?i)password|secret|authorization|://[^ /]+@|access.?token|private.?key|query=',line):continue
lines.append(line[-700:])
print('GITEA_OLD_RESTORE_DIAG_JSON '+json.dumps({'kind':'OldRestoreReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'screenedOldServerLog':lines[-45:],'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37601
|
1
|
1793530510
|
1793530510
|
1793530509
|
1793530510
|
|
0
|
|
0
|
Edit
Delete
|
|
46362
|
26887
|
116
|
5
|
6dc4536a0a03845c08e23ef5acb92853d0ce3287
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37753
|
1
|
1793576485
|
1793576486
|
1793576483
|
1793576486
|
|
0
|
|
0
|
Edit
Delete
|
|
46363
|
26888
|
116
|
5
|
6ea0b17636c8bf6cd800d60ed68209e2b0918440
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37754
|
1
|
1793576547
|
1793576548
|
1793576546
|
1793576548
|
|
0
|
|
0
|
Edit
Delete
|
|
46364
|
26889
|
116
|
5
|
6e733bafd0ab9ea36a1123c3420ebd127b137dbc
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37755
|
1
|
1793576593
|
1793576595
|
1793576591
|
1793576595
|
|
0
|
|
0
|
Edit
Delete
|
|
46365
|
26890
|
116
|
5
|
eba30cb45d19ed03c874149a59ae59fa8191fb3c
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37756
|
1
|
1793576737
|
1793576739
|
1793576737
|
1793576739
|
|
0
|
|
0
|
Edit
Delete
|
|
46366
|
26891
|
116
|
5
|
132242831c47ddf83dd30ccf6005fe40c565595d
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37757
|
1
|
1793576776
|
1793576778
|
1793576774
|
1793576778
|
|
0
|
|
0
|
Edit
Delete
|
|
46368
|
26893
|
116
|
5
|
d624393d61f2f9df1fbcf328e79d7a0cb790df93
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37759
|
1
|
1793576871
|
1793576873
|
1793576827
|
1793576874
|
|
0
|
|
0
|
Edit
Delete
|
|
46370
|
26895
|
116
|
5
|
7deb5e8b421c6e687df6419e51d1c755fa987e3b
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37761
|
1
|
1793577060
|
1793577066
|
1793577053
|
1793577066
|
|
0
|
|
0
|
Edit
Delete
|
|
46372
|
26897
|
116
|
5
|
21ab6ee9097752d2c8b942a63667e3af7d61de54
|
0
|
observe
|
1
|
name: Read fixed controlled maintenance window res name: Read fixed controlled maintenance window result
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-readback.yml]
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read public receipt and selected service identity without mutation
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/read-controlled-window.py'],capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_READBACK_UNAVAILABLE')
exec(compile(result.stdout,'read-controlled-window.py','exec'))
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37763
|
1
|
1793577151
|
1793577155
|
1793577144
|
1793577156
|
|
0
|
|
0
|
Edit
Delete
|
|
46167
|
26825
|
116
|
5
|
6cc52a6d035eb77b23c9241fdedd57b30dd9ea99
|
0
|
inspect
|
1
|
name: Read exact candidate lint diagnostic locatio name: Read exact candidate lint diagnostic locations only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess
root=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26822')
report=json.loads((root/'receipt.json').read_text())
issues=[]
for suffix in ['stdout','stderr']:
p=root/('LINT_GO.'+suffix)
if not p.is_file():continue
for line in p.read_text(errors='replace').splitlines():
if re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line):continue
if re.search(r'\.go:\d|missing or invalid copyright header|issues?:|^make:',line):issues.append(line[-600:])
chunks=[issues[i:i+24] for i in range(0,len(issues),24)] or [[]]
for i,chunk in enumerate(chunks):
print('GITEA_LINT_DIAGNOSTICS_JSON '+json.dumps({'kind':'CandidateLintReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'validationStatus':report['status'],'index':i,'chunks':len(chunks),'issues':chunk,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37612
|
1
|
1793532655
|
1793532655
|
1793531916
|
1793532655
|
|
0
|
|
0
|
Edit
Delete
|
|
46235
|
26837
|
116
|
5
|
6d8458db33ef21c45489d3605cccaa4ac4cb4c89
|
0
|
inspect
|
1
|
name: Read complete candidate lint results after r name: Read complete candidate lint results after resource repair
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess
root=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26829')
report=json.loads((root/'receipt.json').read_text())
issues=[]
for suffix in ['stdout','stderr']:
p=root/('LINT_GO.'+suffix)
if not p.is_file():continue
for line in p.read_text(errors='replace').splitlines():
if re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line):continue
if re.search(r'\.go:\d|missing or invalid copyright header|issues?:|^make:',line):issues.append(line[-600:])
chunks=[issues[i:i+24] for i in range(0,len(issues),24)] or [[]]
for i,chunk in enumerate(chunks):
print('GITEA_LINT_DIAGNOSTICS_JSON '+json.dumps({'kind':'CandidateLintReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'validationStatus':report['status'],'index':i,'chunks':len(chunks),'issues':chunk,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37639
|
1
|
1793533750
|
1793533750
|
1793533747
|
1793533751
|
|
0
|
|
0
|
Edit
Delete
|
|
46279
|
26860
|
116
|
5
|
578b0f3e2fa5d1a0b8c9d70cc909a8ad88fa5e71
|
0
|
inspect
|
1
|
name: Read actual candidate CLI version output onl name: Read actual candidate CLI version output only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-version-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
stored=(base/'build-26857/BINARY_VERSION.stdout').read_text(errors='replace').strip()
r=subprocess.run(['runuser','-u','git','--','env','-i','PATH=/usr/local/bin:/usr/bin:/bin','HOME='+str(base/'candidate-database-rehearsal-26858/git-home'),'USER=git','LOGNAME=git',str(base/'candidate-database-rehearsal-26858/gitea.candidate'),'--version'],capture_output=True,timeout=20)
observed=r.stdout.decode(errors='replace').strip()
def safe(text):
if len(text)>500 or re.search(r'(?i)password|secret|authorization|BEGIN .*PRIVATE KEY|://[^ /]+@',text):return 'OUTPUT_REFUSED'
return text
print('GITEA_CLI_VERSION_DIAG_JSON '+json.dumps({'kind':'CandidateCLIVersionReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'builtVersionOutput':safe(stored),'privateCopyVersionOutput':safe(observed),'exitCode':r.returncode,'screenedStderr':safe(r.stderr.decode(errors='replace').strip()),'databaseWritten':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37684
|
1
|
1793538086
|
1793538086
|
1793538085
|
1793538086
|
|
0
|
|
0
|
Edit
Delete
|
|
41678
|
25959
|
116
|
5
|
8447d7b7b205e0591d598784c6c6145cfff1dfe8
|
0
|
Public Action mirror job-token reachability (diagn Public Action mirror job-token reachability (diagnostic only)...
|
1
|
name: Public mirror job-token diagnostic (no relea name: Public mirror job-token diagnostic (no release)
"on":
push:
branches: [codex/gitea-hostfix-20261016]
paths: [.gitea/workflows/job-token-mirror-diagnostic.yml]
workflow_dispatch:
jobs:
public-mirror-job-token:
name: Public Action mirror job-token reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe public mirrors using the existing read-only job token
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, writeFileSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const workspace = mkdtempSync(join(tmpdir(), 'public-mirror-job-token-'));
const observation = { purpose: 'public mirror reachability only; not release acceptance',
observedAt: new Date().toISOString(), sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null, githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
credentialSource: 'existing short-lived contents:read job token', probes: [] };
try {
const token = process.env.MIRROR_READ_TOKEN;
if (!token || /[\r\n]/.test(token)) throw new Error('JOB_TOKEN_UNAVAILABLE');
const config = join(workspace, 'gitconfig');
const authorization = Buffer.from(`x-access-token:${token}`).toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${authorization}\n`,
{ mode: 0o600, flag: 'wx' });
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'MIRROR_READ_TOKEN' && !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: '1' };
for (const [repository, tag] of [['actions-checkout','v4'],['actions-setup-node','v4'],
['actions-upload-artifact','v3'],['actions-download-artifact','v3'],['sigstore-cosign-installer','v3']]) {
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','ls-remote',`https://gitea.g-hi.com/luoanwu/${repository}.git`,ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
observation.probes.push({ repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', verified, sha: verified ? match[1] : null });
}
observation.status = observation.probes.every(p => p.verified) ? 'reachable' : 'blocked';
} catch { observation.status = 'unavailable'; }
finally { rmSync(workspace, { recursive: true, force: true }); }
console.log('PUBLIC_MIRROR_JOB_TOKEN_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
NODE
shell: bash
env:
MIRROR_READ_TOKEN: ${{ github.token }}
timeout-minutes: "2"
permissions:
contents: read
...
|
public-mirror-job-token
|
null
|
["ubuntu-latest"]
|
34213
|
1
|
1792202675
|
1792202676
|
1792202675
|
1792202676
|
|
0
|
|
0
|
Edit
Delete
|
|
41687
|
25961
|
116
|
5
|
9a1adb09eed117b7fc9487b20f7617cf2242465e
|
0
|
Public Action mirror job-token reachability (diagn Public Action mirror job-token reachability (diagnostic only)...
|
1
|
name: Public mirror job-token diagnostic (no relea name: Public mirror job-token diagnostic (no release)
"on":
push:
branches: [codex/gitea-hostfix-20261016]
paths: [.gitea/workflows/job-token-mirror-diagnostic.yml]
workflow_dispatch:
jobs:
public-mirror-job-token:
name: Public Action mirror job-token reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe public mirrors using the existing read-only job token
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, writeFileSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const workspace = mkdtempSync(join(tmpdir(), 'public-mirror-job-token-'));
const observation = { purpose: 'public mirror reachability only; not release acceptance',
observedAt: new Date().toISOString(), sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null, githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
credentialSource: 'existing short-lived contents:read job token', probes: [] };
try {
const token = process.env.MIRROR_READ_TOKEN;
if (!token || /[\r\n]/.test(token)) throw new Error('JOB_TOKEN_UNAVAILABLE');
const config = join(workspace, 'gitconfig');
const authorization = Buffer.from(`x-access-token:${token}`).toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${authorization}\n`,
{ mode: 0o600, flag: 'wx' });
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'MIRROR_READ_TOKEN' && !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: '1' };
for (const [repository, tag] of [['actions-checkout','v4'],['actions-setup-node','v4'],
['actions-upload-artifact','v3'],['actions-download-artifact','v3'],['sigstore-cosign-installer','v3']]) {
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','ls-remote',`https://gitea.g-hi.com/luoanwu/${repository}.git`,ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
const destination = join(workspace, repository);
const clone = verified ? spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','-c','init.templateDir=','clone','--no-checkout',
'--depth','1','--single-branch','--branch',tag,`https://gitea.g-hi.com/luoanwu/${repository}.git`,destination],
{ env, cwd: workspace, encoding: 'utf8', timeout: 45000, maxBuffer: 1024 * 1024 }) : null;
const downloaded = clone?.status === 0;
const storedRef = downloaded ? spawnSync('git',['rev-parse',`refs/tags/${tag}`],
{ env, cwd: destination, encoding: 'utf8', timeout: 5000 }) : null;
const manifest = downloaded ? spawnSync('git',['cat-file','-e','HEAD:action.yml'],
{ env, cwd: destination, encoding: 'utf8', timeout: 5000 }) : null;
const cloneVerified = downloaded && storedRef?.status === 0 && storedRef.stdout.trim() === match[1] && manifest?.status === 0;
observation.probes.push({ repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', refVerified: verified,
cloneExitCode: clone?.status ?? null, cloneTimedOut: clone?.error?.code === 'ETIMEDOUT',
actionManifestPresent: manifest?.status === 0, verified: cloneVerified, sha: verified ? match[1] : null });
}
const invalid = Buffer.from('x-access-token:diagnostic-intentionally-invalid').toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${invalid}\n`, { mode: 0o600 });
const denied = spawnSync('git',['-c','credential.helper=','-c','core.askPass=','-c','http.followRedirects=false',
'ls-remote','https://gitea.g-hi.com/luoanwu/actions-checkout.git','refs/tags/v4'],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
observation.invalidToken = { exitCode: denied.status, timedOut: denied.error?.code === 'ETIMEDOUT',
rejected: denied.status === 128 && /Authentication failed|401|403/.test(denied.stderr ?? '') };
observation.status = observation.probes.every(p => p.verified) && observation.invalidToken.rejected ? 'reachable' : 'blocked';
} catch { observation.status = 'unavailable'; }
finally { rmSync(workspace, { recursive: true, force: true }); }
console.log('PUBLIC_MIRROR_JOB_TOKEN_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
NODE
shell: bash
env:
MIRROR_READ_TOKEN: ${{ github.token }}
timeout-minutes: "5"
permissions:
contents: read
...
|
public-mirror-job-token
|
null
|
["ubuntu-latest"]
|
34222
|
2
|
1792203015
|
1792203018
|
1792203014
|
1792203018
|
|
0
|
|
0
|
Edit
Delete
|
|
41688
|
25962
|
116
|
5
|
eaf214d0ca1668c9905a585ae32506553c94571f
|
0
|
Public Action mirror job-token reachability (diagn Public Action mirror job-token reachability (diagnostic only)...
|
1
|
name: Public mirror job-token diagnostic (no relea name: Public mirror job-token diagnostic (no release)
"on":
push:
branches: [codex/gitea-hostfix-20261016]
paths: [.gitea/workflows/job-token-mirror-diagnostic.yml]
workflow_dispatch:
jobs:
public-mirror-job-token:
name: Public Action mirror job-token reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe public mirrors using the existing read-only job token
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, writeFileSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const https = require('node:https');
(async () => {
const workspace = mkdtempSync(join(tmpdir(), 'public-mirror-job-token-'));
const observation = { purpose: 'public mirror reachability only; not release acceptance',
observedAt: new Date().toISOString(), sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null, githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
credentialSource: 'existing short-lived contents:read job token', probes: [] };
try {
const token = process.env.MIRROR_READ_TOKEN;
if (!token || /[\r\n]/.test(token)) throw new Error('JOB_TOKEN_UNAVAILABLE');
const config = join(workspace, 'gitconfig');
const authorization = Buffer.from(`x-access-token:${token}`).toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${authorization}\n`,
{ mode: 0o600, flag: 'wx' });
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'MIRROR_READ_TOKEN' && !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: '1' };
for (const [repository, tag] of [['actions-checkout','v4'],['actions-setup-node','v4'],
['actions-upload-artifact','v3'],['actions-download-artifact','v3'],['sigstore-cosign-installer','v3']]) {
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','ls-remote',`https://gitea.g-hi.com/luoanwu/${repository}.git`,ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
const destination = join(workspace, repository);
const clone = verified ? spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','-c','init.templateDir=','clone','--no-checkout',
'--depth','1','--single-branch','--branch',tag,`https://gitea.g-hi.com/luoanwu/${repository}.git`,destination],
{ env, cwd: workspace, encoding: 'utf8', timeout: 45000, maxBuffer: 1024 * 1024 }) : null;
const downloaded = clone?.status === 0;
const storedRef = downloaded ? spawnSync('git',['rev-parse',`refs/tags/${tag}`],
{ env, cwd: destination, encoding: 'utf8', timeout: 5000 }) : null;
const manifest = downloaded ? spawnSync('git',['cat-file','-e','HEAD:action.yml'],
{ env, cwd: destination, encoding: 'utf8', timeout: 5000 }) : null;
const cloneVerified = downloaded && storedRef?.status === 0 && storedRef.stdout.trim() === match[1] && manifest?.status === 0;
observation.probes.push({ repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', refVerified: verified,
cloneExitCode: clone?.status ?? null, cloneTimedOut: clone?.error?.code === 'ETIMEDOUT',
actionManifestPresent: manifest?.status === 0, verified: cloneVerified, sha: verified ? match[1] : null });
}
const invalid = Buffer.from('x-access-token:diagnostic-intentionally-invalid').toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${invalid}\n`, { mode: 0o600 });
const denied = spawnSync('git',['-c','credential.helper=','-c','core.askPass=','-c','http.followRedirects=false',
'ls-remote','https://gitea.g-hi.com/luoanwu/actions-checkout.git','refs/tags/v4'],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const invalidHttpStatus = await new Promise(resolve => {
const request = https.get('https://gitea.g-hi.com/luoanwu/actions-checkout.git/info/refs?service=git-upload-pack',
{ headers: { Authorization: `Basic ${invalid}` } }, response => {
response.resume(); resolve(response.statusCode ?? null);
});
request.setTimeout(15000, () => request.destroy());
request.on('error', () => resolve(null));
});
observation.invalidToken = { exitCode: denied.status, timedOut: denied.error?.code === 'ETIMEDOUT',
httpStatus: invalidHttpStatus, rejected: denied.status === 128 && [401,403].includes(invalidHttpStatus) };
observation.status = observation.probes.every(p => p.verified) && observation.invalidToken.rejected ? 'reachable' : 'blocked';
} catch { observation.status = 'unavailable'; }
finally { rmSync(workspace, { recursive: true, force: true }); }
console.log('PUBLIC_MIRROR_JOB_TOKEN_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
})().catch(() => { process.exitCode = 1; });
NODE
shell: bash
env:
MIRROR_READ_TOKEN: ${{ github.token }}
timeout-minutes: "5"
permissions:
contents: read
...
|
public-mirror-job-token
|
null
|
["ubuntu-latest"]
|
34223
|
1
|
1792203140
|
1792203142
|
1792203140
|
1792203143
|
|
0
|
|
0
|
Edit
Delete
|
|
46266
|
26847
|
116
|
5
|
f645d7a173609fc827032b40df8a63990903db99
|
0
|
inspect
|
1
|
name: Probe rootless daemon custody using only a t name: Probe rootless daemon custody using only a temporary nonsecret marker
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-custody-probe.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Test prospective same UID credential custody without reading credentials
run: |
set -eu
python3 <<'PY'
import datetime,json,os,pathlib,pwd,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
account=pwd.getpwnam('eios-runner')
if account.pw_uid!=994 or account.pw_dir!='/var/lib/eios-runner':raise RuntimeError('ACCOUNT_MISMATCH')
marker=pathlib.Path(account.pw_dir)/('r1-nonsecret-custody-probe-'+runid)
# This marker is deliberately public test data, never a token, configuration or registration file.
fd=os.open(marker,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
with os.fdopen(fd,'w') as f:f.write('EIOS_R1_PUBLIC_CUSTODY_TEST\n')
os.chown(marker,994,984)
image='docker.gitea.com/runner-images@sha256:b8eb33018cf1b9cbdfd6b3ca0b69a2f7b5f257de60a394c763a784c549b94b53'
args=['runuser','-u','eios-runner','--','env','-i','PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin','HOME=/var/lib/eios-runner','XDG_RUNTIME_DIR=/run/user/994','docker','--host','unix:///run/user/994/docker.sock','run','--rm','--pull=never','--network=none','--cap-drop=ALL','--security-opt=no-new-privileges','--memory=128m','--cpus=0.5','--pids-limit=64','--mount','type=bind,src='+str(marker)+',dst=/probe,readonly',image,'sh','-ec','test "$(cat /probe)" = EIOS_R1_PUBLIC_CUSTODY_TEST']
try:result=subprocess.run(args,capture_output=True,timeout=90)
finally:marker.unlink()
report={'kind':'RootlessSameUIDCustodyProbe','ci':{'runId':runid,'sourceSha':os.environ.get('GITHUB_SHA')},'observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'actualCredentialsRead':False,'productionServicesChanged':False,'temporaryPublicMarkerRemoved':not marker.exists(),'sameUIDMode0600MarkerReadableViaDocker':result.returncode==0,'dockerExitCode':result.returncode,'releaseEligible':False}
print('GITEA_CUSTODY_PROBE_JSON '+json.dumps(report,separators=(',',':')),flush=True)
if result.returncode:raise SystemExit(1)
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37671
|
1
|
1793534940
|
1793534941
|
1793534393
|
1793534941
|
|
0
|
|
0
|
Edit
Delete
|
|
46114
|
26786
|
116
|
5
|
93d0a763c88a7f4110535a1ed2aad4958dd677bd
|
0
|
validate
|
1
|
name: Prepare fixed frontend tools and isolated ru name: Prepare fixed frontend tools and isolated runner candidate
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-runtime-tools.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/prepare-runtime-tools.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-runtime-tools.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_RUNTIME_TOOLS_JSON '+json.dumps({'kind':'GiteaMaintenanceRuntimeTools','ci':{'sourceSha':sha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise
PY
shell: bash
timeout-minutes: "90"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37567
|
1
|
1793526987
|
1793527113
|
1793526985
|
1793527113
|
|
0
|
|
0
|
Edit
Delete
|
|
46120
|
26792
|
116
|
5
|
4761299cdaaca88b5b95ff037fb05c2fa82f8ce1
|
0
|
validate
|
1
|
name: Prepare fixed frontend tools and isolated ru name: Prepare fixed frontend tools and isolated runner candidate
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-runtime-tools.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-runtime-tools.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-runtime-tools.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_RUNTIME_TOOLS_JSON '+json.dumps({'kind':'GiteaMaintenanceRuntimeTools','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "90"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37573
|
2
|
1793528826
|
1793528873
|
1793528815
|
1793528873
|
|
0
|
|
0
|
Edit
Delete
|
|
46142
|
26807
|
116
|
5
|
c3d5f93dae5b2784f7ca96ce6cc22ff0d3464e05
|
0
|
validate
|
1
|
name: Prepare explicitly approved limited rootless name: Prepare explicitly approved limited rootless Docker daemon
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-daemon.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-rootless-daemon.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-rootless-daemon.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_ROOTLESS_DAEMON_JSON '+json.dumps({'kind':'GiteaRootlessDaemon','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37595
|
2
|
1793530022
|
1793530024
|
1793530022
|
1793530024
|
|
0
|
|
0
|
Edit
Delete
|
|
46127
|
26799
|
116
|
5
|
6b396956cefb01a465ec8d236c32094f7de53477
|
0
|
validate
|
1
|
name: Prepare explicitly approved dedicated runner name: Prepare explicitly approved dedicated runner identity
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-identity.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-rootless-identity.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-rootless-identity.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_ROOTLESS_IDENTITY_JSON '+json.dumps({'kind':'GiteaRootlessIdentity','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37580
|
1
|
1793529539
|
1793529553
|
1793529446
|
1793529553
|
|
0
|
|
0
|
Edit
Delete
|
|
46398
|
26902
|
116
|
5
|
a7560b622e3b594933bda3d1c88cdd73f19a6633
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,RuntimeError) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37769
|
2
|
1793578075
|
1793578076
|
1793578021
|
1793578076
|
|
0
|
|
0
|
Edit
Delete
|
|
46399
|
26903
|
116
|
5
|
f89c8d3dfed121a0d1a84a6bf41ea075a6ca03fd
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,(RuntimeError,ValueError)) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37776
|
2
|
1793578160
|
1793578160
|
1793578159
|
1793578161
|
|
0
|
|
0
|
Edit
Delete
|
|
46404
|
26907
|
116
|
5
|
11ac9dc1eaad0663c9b25cb3fcfd175f18e7d444
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,(RuntimeError,ValueError)) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37781
|
1
|
1793578412
|
1793578412
|
1793578410
|
1793578413
|
|
0
|
|
0
|
Edit
Delete
|
|
46485
|
26927
|
116
|
5
|
4b638279784a9769b8887745def83009b257c16f
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,(RuntimeError,ValueError)) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37818
|
1
|
1793583390
|
1793583392
|
1793582932
|
1793583393
|
|
0
|
|
0
|
Edit
Delete
|
|
46564
|
26942
|
116
|
5
|
239547f23683d1c3e2f84c2924124f983680be4f
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,(RuntimeError,ValueError)) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37849
|
1
|
1793590351
|
1793590355
|
1793589268
|
1793590356
|
|
0
|
|
0
|
Edit
Delete
|
|
32073
|
23881
|
76
|
5
|
5f885a2a77b66d0ae55dff6ae8f1e2a64e087670
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
27819
|
2
|
1789203381
|
1789203381
|
1789203137
|
1789203381
|
|
1
|
|
0
|
Edit
Delete
|
|
32077
|
23883
|
83
|
5
|
df46b98835ff77c7f4675e043d0869799fbb8d08
|
0
|
Platform consumer gate
|
2
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
27822
|
1
|
1789203821
|
1789203821
|
1789203232
|
1789203821
|
|
1
|
|
0
|
Edit
Delete
|
|
32095
|
23887
|
83
|
5
|
c934bc46240daae849ad93cfacaa3b25c41b323f
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
27841
|
1
|
1789206583
|
1789206583
|
1789206499
|
1789206583
|
|
1
|
|
0
|
Edit
Delete
|
|
32113
|
23889
|
76
|
5
|
61e00f88d70ca5b4fc186baadde559375a90e339
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
27843
|
2
|
1789206591
|
1789206591
|
1789206510
|
1789206591
|
|
1
|
|
0
|
Edit
Delete
|
|
32299
|
23914
|
83
|
5
|
caf551df74c25b3bad8b1a5540f3cc8900649b2d
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28008
|
1
|
1789221322
|
1789221322
|
1789221259
|
1789221322
|
|
1
|
|
0
|
Edit
Delete
|
|
32317
|
23916
|
76
|
5
|
2e0a21b4f10ddcf54ff726c454c1f389e5c95b63
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28010
|
2
|
1789221330
|
1789221330
|
1789221263
|
1789221330
|
|
1
|
|
0
|
Edit
Delete
|
|
32329
|
23919
|
83
|
5
|
6823a38dc4626db9f396978663efbc2493a1276c
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28021
|
1
|
1789221542
|
1789221542
|
1789221489
|
1789221543
|
|
1
|
|
0
|
Edit
Delete
|
|
32444
|
23934
|
76
|
5
|
18a1b036f3dbb3f51ac773862e0cafac278bb34e
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28122
|
2
|
1789288536
|
1789288536
|
1789288508
|
1789288536
|
|
1
|
|
0
|
Edit
Delete
|
|
32505
|
23951
|
76
|
5
|
070b9440b579a7662952fe817638313fadcf01bd
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28168
|
2
|
1789407445
|
1789407445
|
1789407027
|
1789407445
|
|
1
|
|
0
|
Edit
Delete
|
|
32531
|
23954
|
76
|
5
|
23d1b7ac7da6d8779bf29f8fabd126d9f7a15493
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28181
|
2
|
1789438938
|
1789438938
|
1789438843
|
1789438939
|
|
1
|
|
0
|
Edit
Delete
|
|
32558
|
23961
|
83
|
5
|
a0ebf7769727344892ab96c1240bd809b5791430
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28209
|
1
|
1789441317
|
1789441317
|
1789440861
|
1789441317
|
|
1
|
|
0
|
Edit
Delete
|
|
32617
|
23971
|
76
|
5
|
c433d57b4aae2249bd19a085d1c520bf6baedf55
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28246
|
2
|
1789452453
|
1789452453
|
1789451260
|
1789452453
|
|
1
|
|
0
|
Edit
Delete
|
|
32621
|
23973
|
83
|
5
|
3c9f6df78f540226554cb4ecc6115741fe478c41
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28253
|
1
|
1789459053
|
1789459054
|
1789458920
|
1789459054
|
|
1
|
|
0
|
Edit
Delete
|
|
33130
|
24094
|
76
|
5
|
ea965ed902a9807d07d7d89fc173668804c6294c
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28677
|
2
|
1789718143
|
1789718143
|
1789718112
|
1789718143
|
|
1
|
|
0
|
Edit
Delete
|
|
33151
|
24099
|
76
|
5
|
614681e6e78d0385bbf043ef964bd444d8e5958b
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28684
|
2
|
1789718556
|
1789718556
|
1789718532
|
1789718557
|
|
1
|
|
0
|
Edit
Delete
|
|
33178
|
24103
|
76
|
5
|
832f9b2e5ab646a48adbf37b80db1d41092f2f7e
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28697
|
2
|
1789719175
|
1789719175
|
1789719151
|
1789719175
|
|
1
|
|
0
|
Edit
Delete
|
|
33205
|
24107
|
76
|
5
|
dcd1c1486e63a7f67a0c548158823764a0b58b21
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
28710
|
2
|
1789719730
|
1789719730
|
1789719707
|
1789719730
|
|
1
|
|
0
|
Edit
Delete
|