|
39893
|
25662
|
137
|
5
|
949feb2413d6458794dcd2491c4babbbce0c15c1
|
0
|
Basic validation
|
1
|
name: Basic validation
"on":
pull_requ name: Basic validation
"on":
pull_request:
paths-ignore:
- '**.md'
push:
branches:
- main
- releases/*
paths-ignore:
- '**.md'
jobs:
call-basic-validation:
name: Basic validation
runs-on: []
uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
with:
node-version: 24.x
...
|
call-basic-validation
|
null
|
[]
|
33228
|
2
|
1791845102
|
1791845102
|
1791844714
|
1791845103
|
|
0
|
|
0
|
Edit
Delete
|
|
2753
|
2008
|
15
|
5
|
3297c7711625c00beb0aad652f83c78708a44c42
|
0
|
test
|
1
|
name: AutoDance CI/CD Pipeline
"on":
p name: AutoDance CI/CD Pipeline
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
test:
name: test
runs-on: ubuntu-latest
env:
DATABASE_URL: "postgresql://testuser:testpassword@localhost:5432/autodance_test"
REDIS_URL: "redis://localhost:6379"
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Install Pnpm
uses: pnpm/action-setup@v3
with:
version: "8"
- name: Get pnpm store directory
run: |
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
shell: bash
- name: Setup pnpm cache
uses: actions/cache@v4
with:
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
path: ${{ env.STORE_PATH }}
restore-keys: |
${{ runner.os }}-pnpm-store-
- name: Install Dependencies
run: pnpm install
- name: Database Migration
run: pnpm -r prisma migrate reset --force
- name: Build Shared Packages
run: pnpm -r build --filter ./shared/*
- name: Run TypeScript Tests
run: pnpm -r test --coverage
- name: Setup Python
uses: actions/setup-python@v5
with:
cache: pip
python-version: "3.12"
- name: Run Audio Service Tests
run: |
pip install -r requirements.txt
pip install pytest pytest-asyncio httpx
pytest tests
working-directory: services/audio-service
- name: Run Lyrics Service Tests
run: |
pip install -r requirements.txt
pip install pytest
pytest tests
working-directory: services/lyrics-service
- name: Upload Coverage
uses: actions/upload-artifact@v4
with:
name: code-coverage
path: coverage/
services:
postgres:
image: postgres:15
env:
POSTGRES_DB: autodance_test
POSTGRES_PASSWORD: testpassword
POSTGRES_USER: testuser
ports:
- 5432:5432
options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
...
|
test
|
null
|
["ubuntu-latest"]
|
1984
|
2
|
1772435348
|
1772435378
|
1772435346
|
1772435378
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2752
|
2007
|
15
|
5
|
b648dd7be05490cb3a2fc8c3a2fde4616e02f55f
|
0
|
test
|
1
|
name: AutoDance CI/CD Pipeline
"on":
p name: AutoDance CI/CD Pipeline
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
test:
name: test
runs-on: ubuntu-latest
env:
DATABASE_URL: "postgresql://testuser:testpassword@localhost:5432/autodance_test"
REDIS_URL: "redis://localhost:6379"
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Install Pnpm
uses: pnpm/action-setup@v3
with:
version: "8"
- name: Get pnpm store directory
run: |
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
shell: bash
- name: Setup pnpm cache
uses: actions/cache@v4
with:
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
path: ${{ env.STORE_PATH }}
restore-keys: |
${{ runner.os }}-pnpm-store-
- name: Install Dependencies
run: pnpm install
- name: Database Migration
run: pnpm -r prisma migrate reset --force
- name: Build Shared Packages
run: pnpm -r build --filter ./shared/*
- name: Run All Tests
run: pnpm -r test --coverage
- name: Upload Coverage
uses: actions/upload-artifact@v4
with:
name: code-coverage
path: coverage/
services:
postgres:
image: postgres:15
env:
POSTGRES_DB: autodance_test
POSTGRES_PASSWORD: testpassword
POSTGRES_USER: testuser
ports:
- 5432:5432
options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
...
|
test
|
null
|
["ubuntu-latest"]
|
1983
|
2
|
1772435142
|
1772435204
|
1772435141
|
1772435204
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2
|
1
|
3
|
4
|
f6b6a3099bdc2128ef1527c4935844f1e9358dac
|
0
|
test
|
0
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [master, main, develop]
tags: ['v*']
pull_request:
branches: [master, main]
jobs:
test:
name: test
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Set up JDK 11
uses: actions/setup-java@v3
with:
cache: gradle
distribution: temurin
java-version: "11"
- name: Grant execute permission for gradlew
run: chmod +x gradlew
- name: Run unit tests
run: ./gradlew test
- name: Run lint check
run: ./gradlew lint
continue-on-error: true
- if: always()
name: Upload test results
uses: actions/upload-artifact@v3
with:
name: test-results
path: |
build/reports/tests/
build/reports/lint-results.html
retention-days: "7"
...
|
test
|
["build"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1770360030
|
1770362252
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
1
|
1
|
3
|
4
|
f6b6a3099bdc2128ef1527c4935844f1e9358dac
|
0
|
build
|
1
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [master, main, develop]
tags: ['v*']
pull_request:
branches: [master, main]
jobs:
build:
name: build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Set up JDK 11
uses: actions/setup-java@v3
with:
cache: gradle
distribution: temurin
java-version: "11"
- name: Grant execute permission for gradlew
run: chmod +x gradlew
- name: Build Debug APK
run: ./gradlew assembleDebug
- if: startsWith(github.ref, 'refs/tags/')
name: Build Release AAR
run: ./gradlew assembleRelease
- name: Upload Debug artifacts
uses: actions/upload-artifact@v3
with:
name: debug-build
path: build/outputs/
retention-days: "7"
- if: startsWith(github.ref, 'refs/tags/')
name: Upload Release artifacts
uses: actions/upload-artifact@v3
with:
name: release-build
path: build/outputs/
retention-days: "30"
...
|
build
|
null
|
["ubuntu-latest"]
|
1
|
2
|
1770362250
|
1770362250
|
1770360030
|
1770362251
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2118
|
1379
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Unit Tests
|
0
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
env:
GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=2
JAVA_VERSION: "17"
jobs:
unit-test:
name: Unit Tests
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: ${{ env.JAVA_VERSION }}
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Run Unit Tests
run: ./gradlew testDebugUnitTest --stacktrace
- if: always()
name: Upload Test Results
uses: actions/upload-artifact@v4
with:
name: unit-test-results
path: |
**/build/reports/tests/
**/build/test-results/
retention-days: "14"
- if: always()
name: Publish Test Report
uses: mikepenz/action-junit-report@v4
with:
fail_on_failure: "true"
report_paths: '**/build/test-results/**/TEST-*.xml'
require_tests: "false"
- if: always()
name: Test Summary
run: |
echo "## Unit Test Results" >> $GITHUB_STEP_SUMMARY
if [ -f "app/build/test-results/testDebugUnitTest/TEST-*.xml" ]; then
echo "Tests executed successfully" >> $GITHUB_STEP_SUMMARY
fi
timeout-minutes: "20"
...
|
unit-test
|
["build"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1772248014
|
1772248310
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2120
|
1379
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
UI Tests (API ${{ matrix.api-level }}) (30, x86_64 UI Tests (API ${{ matrix.api-level }}) (30, x86_64, google_apis)...
|
0
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
env:
GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=2
JAVA_VERSION: "17"
jobs:
ui-test:
name: UI Tests (API ${{ matrix.api-level }}) (30, x86_64, google_apis)
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: ${{ env.JAVA_VERSION }}
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Enable KVM
run: |
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
sudo udevadm control --reload-rules
sudo udevadm trigger --name-match=kvm
- name: Gradle Cache
uses: actions/cache@v4
with:
key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
path: |
~/.gradle/caches
~/.gradle/wrapper
restore-keys: |
gradle-${{ runner.os }}-
- id: avd-cache
name: AVD Cache
uses: actions/cache@v4
with:
key: avd-${{ matrix.api-level }}-${{ matrix.target }}
path: |
~/.android/avd/*
~/.android/adb*
- if: steps.avd-cache.outputs.cache-hit != 'true'
name: Create AVD and Generate Snapshot
uses: reactivecircus/android-emulator-runner@v2
with:
api-level: ${{ matrix.api-level }}
arch: ${{ matrix.arch }}
disable-animations: "false"
emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
force-avd-creation: "false"
profile: Nexus 6
script: echo "Generated AVD snapshot for caching."
target: ${{ matrix.target }}
- name: Run Instrumented Tests
uses: reactivecircus/android-emulator-runner@v2
with:
api-level: ${{ matrix.api-level }}
arch: ${{ matrix.arch }}
disable-animations: "true"
emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
force-avd-creation: "false"
profile: Nexus 6
script: ./gradlew connectedDebugAndroidTest --stacktrace || true
target: ${{ matrix.target }}
- if: always()
name: Upload UI Test Results
uses: actions/upload-artifact@v4
with:
name: ui-test-results-api${{ matrix.api-level }}
path: |
**/build/reports/androidTests/
**/build/outputs/androidTest-results/
retention-days: "14"
timeout-minutes: "45"
strategy:
fail-fast: "false"
matrix:
api-level:
- 30
arch:
- x86_64
target:
- google_apis
...
|
ui-test
|
["build"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1772248014
|
1772248310
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2119
|
1379
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
UI Tests (API ${{ matrix.api-level }}) (26, x86_64 UI Tests (API ${{ matrix.api-level }}) (26, x86_64, default)...
|
0
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
env:
GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=2
JAVA_VERSION: "17"
jobs:
ui-test:
name: UI Tests (API ${{ matrix.api-level }}) (26, x86_64, default)
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: ${{ env.JAVA_VERSION }}
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Enable KVM
run: |
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
sudo udevadm control --reload-rules
sudo udevadm trigger --name-match=kvm
- name: Gradle Cache
uses: actions/cache@v4
with:
key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
path: |
~/.gradle/caches
~/.gradle/wrapper
restore-keys: |
gradle-${{ runner.os }}-
- id: avd-cache
name: AVD Cache
uses: actions/cache@v4
with:
key: avd-${{ matrix.api-level }}-${{ matrix.target }}
path: |
~/.android/avd/*
~/.android/adb*
- if: steps.avd-cache.outputs.cache-hit != 'true'
name: Create AVD and Generate Snapshot
uses: reactivecircus/android-emulator-runner@v2
with:
api-level: ${{ matrix.api-level }}
arch: ${{ matrix.arch }}
disable-animations: "false"
emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
force-avd-creation: "false"
profile: Nexus 6
script: echo "Generated AVD snapshot for caching."
target: ${{ matrix.target }}
- name: Run Instrumented Tests
uses: reactivecircus/android-emulator-runner@v2
with:
api-level: ${{ matrix.api-level }}
arch: ${{ matrix.arch }}
disable-animations: "true"
emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
force-avd-creation: "false"
profile: Nexus 6
script: ./gradlew connectedDebugAndroidTest --stacktrace || true
target: ${{ matrix.target }}
- if: always()
name: Upload UI Test Results
uses: actions/upload-artifact@v4
with:
name: ui-test-results-api${{ matrix.api-level }}
path: |
**/build/reports/androidTests/
**/build/outputs/androidTest-results/
retention-days: "14"
timeout-minutes: "45"
strategy:
fail-fast: "false"
matrix:
api-level:
- 26
arch:
- x86_64
target:
- default
...
|
ui-test
|
["build"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1772248014
|
1772248310
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2121
|
1379
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Security Scan
|
0
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
env:
GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=2
JAVA_VERSION: "17"
jobs:
security-scan:
name: Security Scan
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: java
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: ${{ env.JAVA_VERSION }}
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build for CodeQL
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:java
timeout-minutes: "20"
...
|
security-scan
|
["build"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1772248014
|
1772248310
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2122
|
1379
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
CI Complete
|
1
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
env:
GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=2
JAVA_VERSION: "17"
jobs:
ci-complete:
name: CI Complete
runs-on: ubuntu-latest
if: always()
steps:
- name: Check Results
run: |
echo "## CI Pipeline Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "| Stage | Status |" >> $GITHUB_STEP_SUMMARY
echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
echo "| Build | ${{ needs.build.result }} |" >> $GITHUB_STEP_SUMMARY
echo "| Unit Tests | ${{ needs.unit-test.result }} |" >> $GITHUB_STEP_SUMMARY
echo "| UI Tests | ${{ needs.ui-test.result }} |" >> $GITHUB_STEP_SUMMARY
echo "| Security Scan | ${{ needs.security-scan.result }} |" >> $GITHUB_STEP_SUMMARY
- if: ${{ needs.build.result == 'failure' || needs.unit-test.result == 'failure' }}
name: CI Status
run: exit 1
...
|
ci-complete
|
["build","unit-test","ui-test& ["build","unit-test","ui-test","security-scan"]...
|
["ubuntu-latest"]
|
1359
|
2
|
1772249370
|
1772249370
|
1772248014
|
1772249371
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2117
|
1379
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Build & Lint
|
1
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
env:
GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=2
JAVA_VERSION: "17"
jobs:
build:
name: Build & Lint
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: ${{ env.JAVA_VERSION }}
- name: Grant Execute Permission
run: chmod +x ./gradlew
- id: version
name: Extract Version
run: |
VERSION_NAME=$(grep "versionName" app/build.gradle | sed "s/.*\"\(.*\)\".*/\1/")
VERSION_CODE=$(grep "versionCode" app/build.gradle | sed 's/[^0-9]*//g')
echo "name=$VERSION_NAME" >> $GITHUB_OUTPUT
echo "code=$VERSION_CODE" >> $GITHUB_OUTPUT
echo "Version: $VERSION_NAME ($VERSION_CODE)"
- name: Validate Gradle Wrapper
uses: gradle/actions/wrapper-validation@v3
- name: Run Lint
run: ./gradlew lint --stacktrace
continue-on-error: true
- if: always()
name: Upload Lint Results
uses: actions/upload-artifact@v4
with:
name: lint-results
path: |
**/build/reports/lint-results*.html
**/build/reports/lint-results*.xml
retention-days: "14"
- name: Build Debug APK
run: ./gradlew assembleDebug --stacktrace
- name: Upload Debug APK
uses: actions/upload-artifact@v4
with:
name: debug-apk
path: |
app/build/outputs/apk/debug/*.apk
printer/build/outputs/apk/debug/*.apk
retention-days: "7"
- name: Build Summary
run: |
echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
echo "- **Version**: ${{ steps.version.outputs.name }} (${{ steps.version.outputs.code }})" >> $GITHUB_STEP_SUMMARY
echo "- **Branch**: ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
echo "- **Commit**: ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
timeout-minutes: "30"
outputs:
version_code: ${{ steps.version.outputs.code }}
version_name: ${{ steps.version.outputs.name }}
...
|
build
|
null
|
["ubuntu-latest"]
|
1357
|
2
|
1772248015
|
1772248308
|
1772248014
|
1772248309
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
46082
|
26775
|
116
|
5
|
f213a196ad7e7b8e857045d36bf6977243ceaca1
|
0
|
analyze
|
1
|
name: Analyze complete Gitea customization from ve name: Analyze complete Gitea customization from verified reference
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-complete-customization.yml]
workflow_dispatch:
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Preserve all committed and working source differences in a private candidate
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, os, pathlib, shutil, socket, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('complete-analysis-'+runid);work.mkdir(mode=0o700)
live=pathlib.Path('/root/gitea-src');snapshot=base/'stage-26762'/'baseline-source'
history=base/'analysis-26765'/'candidate-source'
reference='d6496c61561d90f56f0b5ec3f75d4de8e36a5c9f';target='146cc3eec57174711eac0e0a0c7b38670c6e3922'
ranking=json.loads((base/'fingerprint-26773'/'receipt.json').read_text())
if ranking.get('selectedReference')!=reference or ranking.get('topReferences',[{}])[0].get('matchingSourceBlobs')!=5788 or not ranking.get('searchCompleted'):raise RuntimeError('VERIFIED_REFERENCE_REQUIRED')
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(repo,*args,timeout=60):
return subprocess.run(['git','--no-optional-locks','-c','credential.helper=','-c','core.askPass=','-c','http.extraHeader=','-c','core.hooksPath=/dev/null','-C',str(repo),*args],env=env,capture_output=True,timeout=timeout)
if git(live,'rev-parse','HEAD').stdout.decode().strip()!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('LIVE_SOURCE_HEAD_CHANGED')
def fingerprint(root):
h=hashlib.sha256();count=0
for parent,dirs,files in os.walk(root):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(parent)/name
if p.is_symlink() or not p.is_file():continue
d=hashlib.sha256()
with open(p,'rb') as f:
for block in iter(lambda:f.read(1024*1024),b''):d.update(block)
h.update(str(p.relative_to(root)).encode()+b'\0'+d.digest());count+=1
return h.hexdigest(),count
expected='a5534f2aa03220a02efecac6753f0edcb99db7e8a3da323a1bac3390e2793d74'
if fingerprint(live)!=(expected,6064) or fingerprint(snapshot)!=(expected,6064):raise RuntimeError('LIVE_OR_SAVED_SOURCE_CHANGED')
report={'kind':'GiteaCompleteCustomizationAnalysis','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceFingerprint':expected,'referenceCommit':reference,'referenceMethod':'Exact file comparison reference; not a Git ancestor','upstreamCommit':target,'privateWorkspace':str(work),'liveSourceServiceDatabaseChanged':False}
def emit(stage):
report['stage']=stage;print('GITEA_COMPLETE_CUSTOMIZATION_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('PREPARING_COMPLETE_CUSTOMIZATION')
candidate=work/'candidate-source'
r=git(work,'clone','--shared','--no-checkout',str(history),str(candidate))
if r.returncode:raise RuntimeError('PRIVATE_CANDIDATE_CLONE_FAILED')
r=git(candidate,'checkout','--detach',target)
if r.returncode:raise RuntimeError('FIXED_CANDIDATE_CHECKOUT_FAILED')
def names(repo,*args):
r=git(repo,*args)
if r.returncode:raise RuntimeError('SOURCE_PATH_INVENTORY_FAILED')
return {x for x in r.stdout.decode().splitlines() if x}
committed=names(history,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only',reference,'287bf811487c04cd90bcf07aa04905cbaf2e4c2d')
working=names(live,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only','HEAD')
untracked=names(live,'ls-files','--others','--exclude-standard')
ignored=names(live,'ls-files','--others','--ignored','--exclude-standard')
report['ignoredProductionGoFiles']=sorted(p for p in ignored if p.endswith('.go') and p.split('/',1)[0] in ['models','modules','routers','services'] and '/node_modules/' not in p)
report['snapshotOnlyEntries']=[];report['customizationMerge']=[]
merge=work/'merge-inputs';merge.mkdir(mode=0o700)
MISSING=object()
for number,name in enumerate(sorted(committed|working|untracked)):
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts:raise RuntimeError('UNSAFE_SOURCE_PATH')
if not rel.parts or rel.parts[0] not in ['models','modules','routers','services','templates','options']:
if name=='IMPLEMENTATION_PLAN.md':report['implementationPlanRetainedInBaseline']=True
report['snapshotOnlyEntries'].append(name if not any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key']) else 'SENSITIVE_PATH_NOT_EXPORTED')
continue
if name.startswith('models/migrations/'):
report['customizationMerge'].append({'path':name,'status':'HELD_FOR_EXPLICIT_MIGRATION_BRIDGE'});continue
p=snapshot/name;out=candidate/name
if p.is_symlink() or out.is_symlink():raise RuntimeError('SYMLINK_CUSTOMIZATION_REVIEW_REQUIRED')
rc,base_blob=git(history,'show',reference+':'+name)
ancestor=base_blob.replace(b'code.gitea.io/gitea',b'gitea.dev') if rc==0 else None
theirs=p.read_bytes().replace(b'code.gitea.io/gitea',b'gitea.dev') if p.is_file() else None
ours=out.read_bytes() if out.is_file() else None
state=None
if theirs==ancestor:state='UPSTREAM_UPDATE_RETAINED_NO_CUSTOM_DELTA'
elif ours==theirs:state='ALREADY_IDENTICAL'
elif ancestor is None and ours is None and theirs is not None:
out.parent.mkdir(parents=True,exist_ok=True);out.write_bytes(theirs);state='CUSTOM_ADDITION_PRESERVED'
elif theirs is None:
if ours==ancestor:
out.unlink();state='CUSTOM_DELETION_PRESERVED'
else:state='DELETE_MODIFY_REVIEW_REQUIRED'
elif ours is None:state='UPSTREAM_DELETION_REVIEW_REQUIRED'
elif name.startswith('options/locale/') and name.endswith('.json'):
b=json.loads(ancestor) if ancestor is not None else {};o=json.loads(ours);t=json.loads(theirs)
if not all(isinstance(v,dict) for v in [b,o,t]):raise RuntimeError('LOCALE_OBJECT_REQUIRED')
result=dict(o);conflicts=[]
for key in set(b)|set(t):
bv=b.get(key,MISSING);ov=o.get(key,MISSING);tv=t.get(key,MISSING)
if tv==bv:continue
if ov==bv or ov==tv:
if tv is MISSING:result.pop(key,None)
else:result[key]=tv
else:conflicts.append(key)
if conflicts:state='SEMANTIC_REVIEW_REQUIRED';report.setdefault('localeConflictKeys',{})[name]=sorted(conflicts)
else:
out.write_text(json.dumps(result,ensure_ascii=False,indent=2)+'\n');state='LOCALE_THREE_WAY_KEYS_MERGED'
elif ancestor is None:state='ADD_ADD_REVIEW_REQUIRED'
else:
a=merge/(str(number)+'.ours');b=merge/(str(number)+'.base');c=merge/(str(number)+'.theirs')
a.write_bytes(ours);b.write_bytes(ancestor);c.write_bytes(theirs)
r=git(work,'merge-file','-p',str(a),str(b),str(c))
if r.returncode==0:out.write_bytes(r.stdout);state='TEXTUAL_MERGE_CLEAN_SEMANTICS_UNVERIFIED'
else:
(merge/(str(number)+'.conflicted')).write_bytes(r.stdout);state='SEMANTIC_REVIEW_REQUIRED'
report['customizationMerge'].append({'path':name,'status':state})
report['status']='COMPLETE_COMMITTED_AND_WORKING_CUSTOMIZATION_ANALYZED'
report['candidateBuilt']=False;report['candidateMigrated']=False
if fingerprint(live)!=(expected,6064):raise RuntimeError('LIVE_SOURCE_CHANGED_DURING_ANALYSIS')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
analyze
|
null
|
["ubuntu-latest"]
|
37543
|
2
|
1793524457
|
1793524470
|
1793524455
|
1793524470
|
|
0
|
|
0
|
Edit
Delete
|
|
46083
|
26776
|
116
|
5
|
4d50038a152fa8e9392fc904b941be90317651ec
|
0
|
analyze
|
1
|
name: Analyze complete Gitea customization from ve name: Analyze complete Gitea customization from verified reference
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-complete-customization.yml]
workflow_dispatch:
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Preserve all committed and working source differences in a private candidate
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, os, pathlib, shutil, socket, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('complete-analysis-'+runid);work.mkdir(mode=0o700)
live=pathlib.Path('/root/gitea-src');snapshot=base/'stage-26762'/'baseline-source'
history=base/'analysis-26765'/'candidate-source'
reference='d6496c61561d90f56f0b5ec3f75d4de8e36a5c9f';target='146cc3eec57174711eac0e0a0c7b38670c6e3922'
ranking=json.loads((base/'fingerprint-26773'/'receipt.json').read_text())
if ranking.get('selectedReference')!=reference or ranking.get('topReferences',[{}])[0].get('matchingSourceBlobs')!=5788 or not ranking.get('searchCompleted'):raise RuntimeError('VERIFIED_REFERENCE_REQUIRED')
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(repo,*args,timeout=60):
return subprocess.run(['git','--no-optional-locks','-c','credential.helper=','-c','core.askPass=','-c','http.extraHeader=','-c','core.hooksPath=/dev/null','-C',str(repo),*args],env=env,capture_output=True,timeout=timeout)
if git(live,'rev-parse','HEAD').stdout.decode().strip()!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('LIVE_SOURCE_HEAD_CHANGED')
def fingerprint(root):
h=hashlib.sha256();count=0
for parent,dirs,files in os.walk(root):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(parent)/name
if p.is_symlink() or not p.is_file():continue
d=hashlib.sha256()
with open(p,'rb') as f:
for block in iter(lambda:f.read(1024*1024),b''):d.update(block)
h.update(str(p.relative_to(root)).encode()+b'\0'+d.digest());count+=1
return h.hexdigest(),count
expected='a5534f2aa03220a02efecac6753f0edcb99db7e8a3da323a1bac3390e2793d74'
if fingerprint(live)!=(expected,6064) or fingerprint(snapshot)!=(expected,6064):raise RuntimeError('LIVE_OR_SAVED_SOURCE_CHANGED')
report={'kind':'GiteaCompleteCustomizationAnalysis','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceFingerprint':expected,'referenceCommit':reference,'referenceMethod':'Exact file comparison reference; not a Git ancestor','upstreamCommit':target,'privateWorkspace':str(work),'liveSourceServiceDatabaseChanged':False}
def emit(stage):
report['stage']=stage;print('GITEA_COMPLETE_CUSTOMIZATION_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('PREPARING_COMPLETE_CUSTOMIZATION')
candidate=work/'candidate-source'
r=git(work,'clone','--shared','--no-checkout',str(history),str(candidate))
if r.returncode:raise RuntimeError('PRIVATE_CANDIDATE_CLONE_FAILED')
r=git(candidate,'checkout','--detach',target)
if r.returncode:raise RuntimeError('FIXED_CANDIDATE_CHECKOUT_FAILED')
def names(repo,*args):
r=git(repo,*args)
if r.returncode:raise RuntimeError('SOURCE_PATH_INVENTORY_FAILED')
return {x for x in r.stdout.decode().splitlines() if x}
committed=names(history,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only',reference,'287bf811487c04cd90bcf07aa04905cbaf2e4c2d')
working=names(live,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only','HEAD')
untracked=names(live,'ls-files','--others','--exclude-standard')
ignored=names(live,'ls-files','--others','--ignored','--exclude-standard')
report['ignoredProductionGoFiles']=sorted(p for p in ignored if p.endswith('.go') and p.split('/',1)[0] in ['models','modules','routers','services'] and '/node_modules/' not in p)
report['snapshotOnlyEntries']=[];report['customizationMerge']=[]
merge=work/'merge-inputs';merge.mkdir(mode=0o700)
MISSING=object()
for number,name in enumerate(sorted(committed|working|untracked)):
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts:raise RuntimeError('UNSAFE_SOURCE_PATH')
if not rel.parts or rel.parts[0] not in ['models','modules','routers','services','templates','options']:
if name=='IMPLEMENTATION_PLAN.md':report['implementationPlanRetainedInBaseline']=True
report['snapshotOnlyEntries'].append(name if not any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key']) else 'SENSITIVE_PATH_NOT_EXPORTED')
continue
if name.startswith('models/migrations/'):
report['customizationMerge'].append({'path':name,'status':'HELD_FOR_EXPLICIT_MIGRATION_BRIDGE'});continue
p=snapshot/name;out=candidate/name
if p.is_symlink() or out.is_symlink():raise RuntimeError('SYMLINK_CUSTOMIZATION_REVIEW_REQUIRED')
original=git(history,'show',reference+':'+name)
ancestor=original.stdout.replace(b'code.gitea.io/gitea',b'gitea.dev') if original.returncode==0 else None
theirs=p.read_bytes().replace(b'code.gitea.io/gitea',b'gitea.dev') if p.is_file() else None
ours=out.read_bytes() if out.is_file() else None
state=None
if theirs==ancestor:state='UPSTREAM_UPDATE_RETAINED_NO_CUSTOM_DELTA'
elif ours==theirs:state='ALREADY_IDENTICAL'
elif ancestor is None and ours is None and theirs is not None:
out.parent.mkdir(parents=True,exist_ok=True);out.write_bytes(theirs);state='CUSTOM_ADDITION_PRESERVED'
elif theirs is None:
if ours==ancestor:
out.unlink();state='CUSTOM_DELETION_PRESERVED'
else:state='DELETE_MODIFY_REVIEW_REQUIRED'
elif ours is None:state='UPSTREAM_DELETION_REVIEW_REQUIRED'
elif name.startswith('options/locale/') and name.endswith('.json'):
b=json.loads(ancestor) if ancestor is not None else {};o=json.loads(ours);t=json.loads(theirs)
if not all(isinstance(v,dict) for v in [b,o,t]):raise RuntimeError('LOCALE_OBJECT_REQUIRED')
result=dict(o);conflicts=[]
for key in set(b)|set(t):
bv=b.get(key,MISSING);ov=o.get(key,MISSING);tv=t.get(key,MISSING)
if tv==bv:continue
if ov==bv or ov==tv:
if tv is MISSING:result.pop(key,None)
else:result[key]=tv
else:conflicts.append(key)
if conflicts:state='SEMANTIC_REVIEW_REQUIRED';report.setdefault('localeConflictKeys',{})[name]=sorted(conflicts)
else:
out.write_text(json.dumps(result,ensure_ascii=False,indent=2)+'\n');state='LOCALE_THREE_WAY_KEYS_MERGED'
elif ancestor is None:state='ADD_ADD_REVIEW_REQUIRED'
else:
a=merge/(str(number)+'.ours');b=merge/(str(number)+'.base');c=merge/(str(number)+'.theirs')
a.write_bytes(ours);b.write_bytes(ancestor);c.write_bytes(theirs)
r=git(work,'merge-file','-p',str(a),str(b),str(c))
if r.returncode==0:out.write_bytes(r.stdout);state='TEXTUAL_MERGE_CLEAN_SEMANTICS_UNVERIFIED'
else:
(merge/(str(number)+'.conflicted')).write_bytes(r.stdout);state='SEMANTIC_REVIEW_REQUIRED'
report['customizationMerge'].append({'path':name,'status':state})
report['status']='COMPLETE_COMMITTED_AND_WORKING_CUSTOMIZATION_ANALYZED'
report['candidateBuilt']=False;report['candidateMigrated']=False
if fingerprint(live)!=(expected,6064):raise RuntimeError('LIVE_SOURCE_CHANGED_DURING_ANALYSIS')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
analyze
|
null
|
["ubuntu-latest"]
|
37544
|
2
|
1793524562
|
1793524628
|
1793524560
|
1793524629
|
|
0
|
|
0
|
Edit
Delete
|
|
46092
|
26778
|
116
|
5
|
68b62aa8581bdd0cd72b21110405e56ef57975ee
|
0
|
analyze
|
1
|
name: Analyze complete Gitea customization from ve name: Analyze complete Gitea customization from verified reference
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-complete-customization.yml]
workflow_dispatch:
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Preserve all committed and working source differences in a private candidate
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, io, json, os, pathlib, re, shutil, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('complete-analysis-'+runid);work.mkdir(mode=0o700)
live=pathlib.Path('/root/gitea-src');snapshot=base/'stage-26762'/'baseline-source'
history=base/'analysis-26765'/'candidate-source'
reference='d6496c61561d90f56f0b5ec3f75d4de8e36a5c9f';target='146cc3eec57174711eac0e0a0c7b38670c6e3922'
ranking=json.loads((base/'fingerprint-26773'/'receipt.json').read_text())
if ranking.get('selectedReference')!=reference or ranking.get('topReferences',[{}])[0].get('matchingSourceBlobs')!=5788 or not ranking.get('searchCompleted'):raise RuntimeError('VERIFIED_REFERENCE_REQUIRED')
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(repo,*args,timeout=60):
return subprocess.run(['git','--no-optional-locks','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','credential.helper=','-c','core.askPass=','-c','http.extraHeader=','-c','core.hooksPath=/dev/null','-C',str(repo),*args],env=env,capture_output=True,timeout=timeout)
if git(live,'rev-parse','HEAD').stdout.decode().strip()!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('LIVE_SOURCE_HEAD_CHANGED')
def fingerprint(root):
h=hashlib.sha256();count=0
for parent,dirs,files in os.walk(root):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(parent)/name
if p.is_symlink() or not p.is_file():continue
d=hashlib.sha256()
with open(p,'rb') as f:
for block in iter(lambda:f.read(1024*1024),b''):d.update(block)
h.update(str(p.relative_to(root)).encode()+b'\0'+d.digest());count+=1
return h.hexdigest(),count
expected='a5534f2aa03220a02efecac6753f0edcb99db7e8a3da323a1bac3390e2793d74'
if fingerprint(live)!=(expected,6064) or fingerprint(snapshot)!=(expected,6064):raise RuntimeError('LIVE_OR_SAVED_SOURCE_CHANGED')
report={'kind':'GiteaCompleteCustomizationAnalysis','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceFingerprint':expected,'referenceCommit':reference,'referenceMethod':'Exact file comparison reference; not a Git ancestor','upstreamCommit':target,'privateWorkspace':str(work),'liveSourceServiceDatabaseChanged':False}
def emit(stage):
report['stage']=stage;print('GITEA_COMPLETE_CUSTOMIZATION_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('PREPARING_COMPLETE_CUSTOMIZATION')
candidate=work/'candidate-source'
r=git(work,'clone','--shared','--no-checkout',str(history),str(candidate))
if r.returncode:raise RuntimeError('PRIVATE_CANDIDATE_CLONE_FAILED')
r=git(candidate,'checkout','--detach',target)
if r.returncode:raise RuntimeError('FIXED_CANDIDATE_CHECKOUT_FAILED')
def names(repo,*args):
r=git(repo,*args)
if r.returncode:raise RuntimeError('SOURCE_PATH_INVENTORY_FAILED')
return {x for x in r.stdout.decode().splitlines() if x}
committed=names(history,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only',reference,'287bf811487c04cd90bcf07aa04905cbaf2e4c2d')
working=names(live,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only','HEAD')
untracked=names(live,'ls-files','--others','--exclude-standard')
ignored=names(live,'ls-files','--others','--ignored','--exclude-standard')
source_sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch(r'[0-9a-f]{40}',source_sha):raise RuntimeError('FIXED_JOB_SOURCE_SHA_REQUIRED')
bare=pathlib.Path('/home/git/repositories/luoanwu/enterprise-platform.git')
if bare.is_symlink() or not bare.is_dir():raise RuntimeError('EXPECTED_SOURCE_REPOSITORY_REQUIRED')
packed=git(bare,'show',source_sha+':ops/gitea-r1/upstream-reference-d6496c6.tar.gz')
if packed.returncode or hashlib.sha256(packed.stdout).hexdigest()!='a7d3f17e4810eca2294cf110790a6332d0681c909b2393b3a2ae20455c3a2322':raise RuntimeError('PUBLIC_REFERENCE_ARCHIVE_MISMATCH')
listing=git(history,'ls-tree','-r','-z','--format=%(objecttype) %(objectname) %(path)',reference)
if listing.returncode:raise RuntimeError('OFFICIAL_REFERENCE_TREE_UNAVAILABLE')
reference_tree={}
for row in listing.stdout.split(b'\0'):
if not row:continue
kind,oid,path=row.split(b' ',2)
if kind==b'blob':reference_tree[path.decode()]=oid.decode()
public_base={}
with tarfile.open(fileobj=io.BytesIO(packed.stdout),mode='r:gz') as archive:
members=archive.getmembers()
if len({m.name for m in members})!=len(members) or not all(m.isfile() and m.size<=2*1024*1024 for m in members) or sum(m.size for m in members)>8*1024*1024:raise RuntimeError('REFERENCE_ARCHIVE_STRUCTURE_REFUSED')
manifest=json.loads(archive.extractfile('manifest.json').read())
if manifest.get('referenceCommit')!=reference or manifest.get('upstreamRepository')!='https://github.com/go-gitea/gitea':raise RuntimeError('PUBLIC_REFERENCE_SOURCE_MISMATCH')
if {m.name for m in members}!={'manifest.json','LICENSE.upstream'}|{'files/'+v['path'] for v in manifest['files']}:raise RuntimeError('REFERENCE_ARCHIVE_MEMBER_MISMATCH')
for item in manifest['files']:
name=item['path'];part=pathlib.PurePosixPath(name)
if part.is_absolute() or '..' in part.parts:raise RuntimeError('REFERENCE_PATH_REFUSED')
body=archive.extractfile('files/'+name).read()
oid=hashlib.sha1(b'blob '+str(len(body)).encode()+b'\0'+body).hexdigest()
if oid!=reference_tree.get(name) or oid!=item['gitBlob'] or hashlib.sha256(body).hexdigest()!=item['sha256'] or len(body)!=item['bytes']:raise RuntimeError('OFFICIAL_REFERENCE_BLOB_MISMATCH')
public_base[name]=body
report['publicReferenceInput']={'sourceSha':source_sha,'archiveSha256':hashlib.sha256(packed.stdout).hexdigest(),'filesVerifiedAgainstOfficialGitTree':len(public_base),'historicalBlobNetworkRequired':False}
report['ignoredProductionGoFiles']=sorted(p for p in ignored if p.endswith('.go') and p.split('/',1)[0] in ['models','modules','routers','services'] and '/node_modules/' not in p)
report['snapshotOnlyEntries']=[];report['customizationMerge']=[]
merge=work/'merge-inputs';merge.mkdir(mode=0o700)
MISSING=object()
for number,name in enumerate(sorted(committed|working|untracked)):
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts:raise RuntimeError('UNSAFE_SOURCE_PATH')
if not rel.parts or rel.parts[0] not in ['models','modules','routers','services','templates','options']:
if name=='IMPLEMENTATION_PLAN.md':report['implementationPlanRetainedInBaseline']=True
report['snapshotOnlyEntries'].append(name if not any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key']) else 'SENSITIVE_PATH_NOT_EXPORTED')
continue
if name.startswith('models/migrations/'):
report['customizationMerge'].append({'path':name,'status':'HELD_FOR_EXPLICIT_MIGRATION_BRIDGE'});continue
p=snapshot/name;out=candidate/name
if p.is_symlink() or out.is_symlink():raise RuntimeError('SYMLINK_CUSTOMIZATION_REVIEW_REQUIRED')
if name in reference_tree and name not in public_base:raise RuntimeError('PUBLIC_REFERENCE_INPUT_PATH_MISSING')
ancestor=public_base[name].replace(b'code.gitea.io/gitea',b'gitea.dev') if name in public_base else None
theirs=p.read_bytes().replace(b'code.gitea.io/gitea',b'gitea.dev') if p.is_file() else None
ours=out.read_bytes() if out.is_file() else None
state=None
if theirs==ancestor:state='UPSTREAM_UPDATE_RETAINED_NO_CUSTOM_DELTA'
elif ours==theirs:state='ALREADY_IDENTICAL'
elif ancestor is None and ours is None and theirs is not None:
out.parent.mkdir(parents=True,exist_ok=True);out.write_bytes(theirs);state='CUSTOM_ADDITION_PRESERVED'
elif theirs is None:
if ours==ancestor:
out.unlink();state='CUSTOM_DELETION_PRESERVED'
else:state='DELETE_MODIFY_REVIEW_REQUIRED'
elif ours is None:state='UPSTREAM_DELETION_REVIEW_REQUIRED'
elif name.startswith('options/locale/') and name.endswith('.json'):
b=json.loads(ancestor) if ancestor is not None else {};o=json.loads(ours);t=json.loads(theirs)
if not all(isinstance(v,dict) for v in [b,o,t]):raise RuntimeError('LOCALE_OBJECT_REQUIRED')
result=dict(o);conflicts=[]
for key in set(b)|set(t):
bv=b.get(key,MISSING);ov=o.get(key,MISSING);tv=t.get(key,MISSING)
if tv==bv:continue
if ov==bv or ov==tv:
if tv is MISSING:result.pop(key,None)
else:result[key]=tv
else:conflicts.append(key)
if conflicts:state='SEMANTIC_REVIEW_REQUIRED';report.setdefault('localeConflictKeys',{})[name]=sorted(conflicts)
else:
out.write_text(json.dumps(result,ensure_ascii=False,indent=2)+'\n');state='LOCALE_THREE_WAY_KEYS_MERGED'
elif ancestor is None:state='ADD_ADD_REVIEW_REQUIRED'
else:
a=merge/(str(number)+'.ours');b=merge/(str(number)+'.base');c=merge/(str(number)+'.theirs')
a.write_bytes(ours);b.write_bytes(ancestor);c.write_bytes(theirs)
r=git(work,'merge-file','-p',str(a),str(b),str(c))
if r.returncode==0:out.write_bytes(r.stdout);state='TEXTUAL_MERGE_CLEAN_SEMANTICS_UNVERIFIED'
else:
(merge/(str(number)+'.conflicted')).write_bytes(r.stdout);state='SEMANTIC_REVIEW_REQUIRED'
report['customizationMerge'].append({'path':name,'status':state})
report['status']='COMPLETE_COMMITTED_AND_WORKING_CUSTOMIZATION_ANALYZED'
report['candidateBuilt']=False;report['candidateMigrated']=False
if fingerprint(live)!=(expected,6064):raise RuntimeError('LIVE_SOURCE_CHANGED_DURING_ANALYSIS')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
analyze
|
null
|
["ubuntu-latest"]
|
37553
|
1
|
1793525015
|
1793525024
|
1793525014
|
1793525024
|
|
0
|
|
0
|
Edit
Delete
|
|
44613
|
26459
|
116
|
5
|
af4773923e5c956b5abbe2b2488b30b78248fdf0
|
0
|
Anonymous Action source reachability (diagnostic o Anonymous Action source reachability (diagnostic only)...
|
1
|
name: Action source diagnostic (no release)
"o name: Action source diagnostic (no release)
"on":
workflow_dispatch:
jobs:
anonymous-source-diagnostic:
name: Anonymous Action source reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe official public upstream and Gitea mirrors without credentials
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const sources = [
['actions/checkout', 'actions-checkout', 'v4'],
['actions/setup-node', 'actions-setup-node', 'v4'],
['actions/upload-artifact', 'actions-upload-artifact', 'v3'],
['actions/download-artifact', 'actions-download-artifact', 'v3'],
['sigstore/cosign-installer', 'sigstore-cosign-installer', 'v3'],
];
const observation = {
purpose: 'read-only network diagnosis; not release acceptance',
observedAt: new Date().toISOString(),
repository: process.env.GITHUB_REPOSITORY ?? null,
sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null,
githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
runnerName: process.env.RUNNER_NAME ?? null,
probes: [],
};
const workspace = mkdtempSync(join(tmpdir(), 'action-source-anonymous-'));
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
try {
for (const [official, mirror, tag] of sources) {
for (const [provider, repository] of [['github', official], ['gitea', `luoanwu/${mirror}`]]) {
const host = provider === 'github' ? 'github.com' : 'gitea.g-hi.com';
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c', 'credential.helper=', '-c', 'core.askPass=',
'-c', 'http.extraHeader=', 'ls-remote', `https://${host}/${repository}.git`, ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
observation.probes.push({ provider, repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', verified, sha: verified ? match[1] : null });
}
}
observation.status = observation.probes.every(p => p.verified) ? 'reachable' : 'blocked';
console.log('ACTION_SOURCE_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
} finally { rmSync(workspace, { recursive: true, force: true }); }
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
anonymous-source-diagnostic
|
null
|
["ubuntu-latest"]
|
36468
|
2
|
1792924094
|
1792924100
|
1792924093
|
1792924100
|
|
0
|
|
0
|
Edit
Delete
|
|
41677
|
25958
|
116
|
5
|
c111ad2ee9f05e135bfc1634987fb1c843e79f9d
|
0
|
Anonymous Action source reachability (diagnostic o Anonymous Action source reachability (diagnostic only)...
|
1
|
name: Action source diagnostic (no release)
"o name: Action source diagnostic (no release)
"on":
push:
branches: [codex/gitea-hostfix-20261016]
workflow_dispatch:
jobs:
anonymous-source-diagnostic:
name: Anonymous Action source reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe official public upstream and Gitea mirrors without credentials
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const sources = [
['actions/checkout', 'actions-checkout', 'v4'],
['actions/setup-node', 'actions-setup-node', 'v4'],
['actions/upload-artifact', 'actions-upload-artifact', 'v3'],
['actions/download-artifact', 'actions-download-artifact', 'v3'],
['sigstore/cosign-installer', 'sigstore-cosign-installer', 'v3'],
];
const observation = {
purpose: 'read-only network diagnosis; not release acceptance',
observedAt: new Date().toISOString(),
repository: process.env.GITHUB_REPOSITORY ?? null,
sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null,
githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
runnerName: process.env.RUNNER_NAME ?? null,
probes: [],
};
const workspace = mkdtempSync(join(tmpdir(), 'action-source-anonymous-'));
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
try {
for (const [official, mirror, tag] of sources) {
for (const [provider, repository] of [['github', official], ['gitea', `luoanwu/${mirror}`]]) {
const host = provider === 'github' ? 'github.com' : 'gitea.g-hi.com';
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c', 'credential.helper=', '-c', 'core.askPass=',
'-c', 'http.extraHeader=', 'ls-remote', `https://${host}/${repository}.git`, ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
observation.probes.push({ provider, repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', verified, sha: verified ? match[1] : null });
}
}
observation.status = observation.probes.every(p => p.verified) ? 'reachable' : 'blocked';
console.log('ACTION_SOURCE_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
} finally { rmSync(workspace, { recursive: true, force: true }); }
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
anonymous-source-diagnostic
|
null
|
["ubuntu-latest"]
|
34211
|
2
|
1792202437
|
1792202499
|
1792202433
|
1792202499
|
|
0
|
|
0
|
Edit
Delete
|
|
41668
|
25956
|
116
|
5
|
a3b0595fe5e0e4a2a311408f8f2a046cd1b6550f
|
0
|
Anonymous Action source reachability (diagnostic o Anonymous Action source reachability (diagnostic only)...
|
1
|
name: Action source diagnostic (no release)
"o name: Action source diagnostic (no release)
"on":
push:
branches: [codex/gitea-hostfix-20261016]
workflow_dispatch:
jobs:
anonymous-source-diagnostic:
name: Anonymous Action source reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe official public upstream and Gitea mirrors without credentials
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const sources = [
['actions/checkout', 'actions-checkout', 'v4'],
['actions/setup-node', 'actions-setup-node', 'v4'],
['actions/upload-artifact', 'actions-upload-artifact', 'v3'],
['actions/download-artifact', 'actions-download-artifact', 'v3'],
['sigstore/cosign-installer', 'sigstore-cosign-installer', 'v3'],
];
const observation = {
purpose: 'read-only network diagnosis; not release acceptance',
observedAt: new Date().toISOString(),
repository: process.env.GITHUB_REPOSITORY ?? null,
sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null,
githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
runnerName: process.env.RUNNER_NAME ?? null,
probes: [],
};
const env = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false',
GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
for (const [official, mirror, tag] of sources) {
for (const [provider, repository] of [['github', official], ['gitea', `luoanwu/${mirror}`]]) {
const host = provider === 'github' ? 'github.com' : 'gitea.g-hi.com';
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c', 'credential.helper=', '-c', 'core.askPass=',
'-c', 'http.extraHeader=', 'ls-remote', `https://${host}/${repository}.git`, ref],
{ env, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
observation.probes.push({ provider, repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', verified, sha: verified ? match[1] : null });
}
}
observation.status = observation.probes.every(p => p.verified) ? 'reachable' : 'blocked';
console.log('ACTION_SOURCE_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
anonymous-source-diagnostic
|
null
|
["ubuntu-latest"]
|
34203
|
2
|
1792202347
|
1792202423
|
1792202346
|
1792202423
|
|
0
|
|
0
|
Edit
Delete
|