|
46235
|
26837
|
116
|
5
|
6d8458db33ef21c45489d3605cccaa4ac4cb4c89
|
0
|
inspect
|
1
|
name: Read complete candidate lint results after r name: Read complete candidate lint results after resource repair
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess
root=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26829')
report=json.loads((root/'receipt.json').read_text())
issues=[]
for suffix in ['stdout','stderr']:
p=root/('LINT_GO.'+suffix)
if not p.is_file():continue
for line in p.read_text(errors='replace').splitlines():
if re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line):continue
if re.search(r'\.go:\d|missing or invalid copyright header|issues?:|^make:',line):issues.append(line[-600:])
chunks=[issues[i:i+24] for i in range(0,len(issues),24)] or [[]]
for i,chunk in enumerate(chunks):
print('GITEA_LINT_DIAGNOSTICS_JSON '+json.dumps({'kind':'CandidateLintReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'validationStatus':report['status'],'index':i,'chunks':len(chunks),'issues':chunk,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37639
|
1
|
1793533750
|
1793533750
|
1793533747
|
1793533751
|
|
0
|
|
0
|
Edit
Delete
|
|
46236
|
26838
|
116
|
5
|
48943943e24ee85a36f154c6ae8a238921e26850
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37641
|
2
|
1793533840
|
1793533844
|
1793533838
|
1793533844
|
|
0
|
|
0
|
Edit
Delete
|
|
46237
|
26838
|
116
|
5
|
48943943e24ee85a36f154c6ae8a238921e26850
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37642
|
2
|
1793533844
|
1793533846
|
1793533838
|
1793533847
|
|
0
|
|
0
|
Edit
Delete
|
|
46244
|
26839
|
116
|
5
|
126b2e92b788caa79f2cfc6cc6f14c736ee54fac
|
0
|
export
|
1
|
name: Read screened custom files for complete lint name: Read screened custom files for complete lint repair
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-source-review.yml]
workflow_dispatch:
jobs:
export:
name: export
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Screen only known source changes and produce a review archive
run: |
set -eu
python3 <<'PY'
import base64, datetime, hashlib, io, json, os, pathlib, re, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
analysis=base/'analysis-26765'
receipt=json.loads((analysis/'receipt.json').read_text())
if receipt.get('status')!='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED':raise RuntimeError('VERIFIED_BASELINE_REQUIRED')
source=base/'reviewed-26829'/'candidate-source'
live=pathlib.Path('/root/gitea-src')
upstream=analysis/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(base),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_OPTIONAL_LOCKS':'0','GIT_TERMINAL_PROMPT':'0'}
def git(path,*args):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(path),*args],capture_output=True,timeout=30,env=env)
return r.returncode,r.stdout
code,head=git(upstream,'rev-parse','HEAD')
if code or head.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_OFFICIAL_SOURCE_REQUIRED')
# Export only files that require manual conflict or migration review.
# Already textually merged files and additive files stay on the server for native testing.
paths=['models/repo/commit_sync_log.go', 'models/repo/commit_sync_status.go', 'models/repo/hidden_file.go', 'modules/git/pktline.go', 'routers/web/repo/commit.go', 'routers/web/repo/githttp.go', 'routers/web/repo/hidden_file.go', 'routers/web/repo/setting/setting.go', 'routers/web/repo/sync_records.go', 'services/gitpull/filter.go', 'services/gitpull/matcher.go', 'services/repository/auto_sync_deploy.go']
def public_literals(text):
return set(re.findall(r'["\']([^"\'\n]{8,})["\']',text))
def suspicious(text,public,is_git_test=False):
issues=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
public_ssh=bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])) and any(m.group(0) in v for v in public)
if not public_ssh:issues.append('credential-prefix-or-private-key')
if re.search(r'https?://[^/\s:@]+:[^/\s@]+@',text):issues.append('credential-in-url')
for match in re.finditer(r'(?i)(?:[A-Za-z0-9_]*(?:password|passwd|secret|token|api_?key|access_?key|private_?key)[A-Za-z0-9_]*)\s*(?::=|=|:)\s*["\']([^"\'\n]{8,})["\']',text):
value=match.group(1)
if value not in public:issues.append('nonpublic-credential-literal')
for match in re.finditer(r'(?i)(?:Bearer|Basic)\s+[A-Za-z0-9_+/=.-]{12,}',text):
if not any(match.group(0) in literal for literal in public):issues.append('nonpublic-authorization-literal')
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in public and len(set(value))>8 and not is_git_test:issues.append('nonpublic-long-opaque-literal')
if not is_git_test:
for value in re.findall(r'["\']([A-Fa-f0-9]{32,128})["\']',text):
if value not in public and len(set(value))>3:issues.append('nonpublic-long-hex-literal')
return sorted(set(issues))
payload={};manifest=[];refused=[]
for name in paths:
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts or not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options'] or rel.suffix not in ['.go','.tmpl','.json']:raise RuntimeError('SOURCE_EXPORT_PATH_REFUSED')
p=source/name
if p.is_symlink() or not p.is_file():raise RuntimeError('SOURCE_EXPORT_NONREGULAR_FILE')
data=p.read_bytes()
if len(data)>2*1024*1024:raise RuntimeError('SOURCE_FILE_SIZE_LIMIT')
rc,public=git(upstream,'show','HEAD:'+name)
known=public_literals(public.decode(errors='replace')) if rc==0 else set()
# Never export authorization-looking comment text, even when it is likely prose.
text=data.decode('utf-8')
text=re.sub(r'(?m)^(\s*//[^\n]*?)(?i:Basic|Bearer)\s+[A-Za-z0-9_+/=.-]{12,}[^\n]*$',r'\1[REDACTED_AUTHORIZATION_LOOKING_COMMENT]',text)
data=text.encode('utf-8')
candidates=[(name,data)]
for archive_name,body in candidates:
problems=suspicious(body.decode('utf-8'),known,name.startswith('modules/git/') and name.endswith('_test.go'))
if problems:
text=body.decode('utf-8');classification=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
classification.append({'category':'prefix','publicSshAlgorithm':bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])),'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for m in re.finditer(r'(?i)(Bearer|Basic)\s+([A-Za-z0-9_+/=.-]{12,})',text):
line=text[text.rfind('\n',0,m.start())+1:m.start()]
valid=False
if m.group(1).lower()=='basic':
try:
decoded=base64.b64decode(m.group(2)+'='*((-len(m.group(2)))%4),validate=True).decode('utf-8')
valid=':' in decoded and decoded.isprintable()
except Exception:pass
classification.append({'category':'authorization','scheme':m.group(1).lower(),'commentLine':line.lstrip().startswith('//'),'validPrintableBasicCredential':valid,'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in known and len(set(value))>8 and not (name.startswith('modules/git/') and name.endswith('_test.go')):
classification.append({'category':'opaque','publicGitSmartHttpMime':value in ['application/x-git-upload-pack-advertisement','application/x-git-receive-pack-advertisement','application/x-git-upload-pack-result','application/x-git-receive-pack-result']})
refused.append({'path':archive_name,'reasons':problems,'classification':classification});continue
payload[archive_name]=body
manifest.append({'path':archive_name,'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest()})
report={'kind':'GiteaCustomSourceReviewExport','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceBaselineFingerprint':receipt['sourceFingerprint'],'upstreamCommit':head.decode().strip(),'serviceChanges':False,'databaseOrConfigurationExported':False,'registrationOrCredentialFilesRead':False,'refusedFiles':refused}
if refused:
report['status']='BLOCKED_CREDENTIAL_SCREENING';print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')));raise SystemExit(1)
if sum(len(v) for v in payload.values())>8*1024*1024:raise RuntimeError('SOURCE_EXPORT_SIZE_LIMIT')
work=base/('export-'+runid);work.mkdir(mode=0o700)
index={'kind':'GiteaCustomSourceReviewManifest','sourceBaselineFingerprint':receipt['sourceFingerprint'],'originalSourceHead':'287bf811487c04cd90bcf07aa04905cbaf2e4c2d','upstreamCommit':head.decode().strip(),'files':manifest,'scope':'Selected code only, not a system backup; no database, config, registration, environment, key or dependency cache files'}
payload['manifest.json']=(json.dumps(index,ensure_ascii=False,indent=2)+'\n').encode()
target=work/'gitea-custom-source.tar.gz'
with tarfile.open(target,'w:gz') as archive:
for name,body in sorted(payload.items()):
entry=tarfile.TarInfo(name);entry.size=len(body);entry.mode=0o600;entry.mtime=0;archive.addfile(entry,io.BytesIO(body))
report.update({'status':'SOURCE_CODE_SCREENED_AND_PACKED','fileCount':len(manifest),'archiveBytes':target.stat().st_size,'archiveSha256':hashlib.sha256(target.read_bytes()).hexdigest(),'privateArchive':str(target)})
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')))
for name,body in sorted(payload.items()):
if name=='manifest.json':continue
encoded=base64.b64encode(body).decode()
chunks=[encoded[i:i+8000] for i in range(0,len(encoded),8000)]
for i,chunk in enumerate(chunks):
print('GITEA_GIT_SOURCE_FILE_JSON '+json.dumps({'path':name,'sha256':hashlib.sha256(body).hexdigest(),'index':i,'chunks':len(chunks),'data':chunk},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
...
|
export
|
null
|
["ubuntu-latest"]
|
37649
|
2
|
1793533896
|
1793533896
|
1793533895
|
1793533896
|
|
0
|
|
0
|
Edit
Delete
|
|
46245
|
26840
|
116
|
5
|
a4bd8af6742eff0a1972ff27168ed6a3afe726df
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37650
|
2
|
1793533916
|
1793533920
|
1793533914
|
1793533920
|
|
0
|
|
0
|
Edit
Delete
|
|
46246
|
26840
|
116
|
5
|
a4bd8af6742eff0a1972ff27168ed6a3afe726df
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37651
|
2
|
1793533920
|
1793533924
|
1793533914
|
1793533924
|
|
0
|
|
0
|
Edit
Delete
|
|
46253
|
26841
|
116
|
5
|
093e09c0a46348fd3cdc27d7cf7dde53c7b080dd
|
0
|
export
|
1
|
name: Read screened lint files excluding separatel name: Read screened lint files excluding separately reviewed HTTP handler
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-source-review.yml]
workflow_dispatch:
jobs:
export:
name: export
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Screen only known source changes and produce a review archive
run: |
set -eu
python3 <<'PY'
import base64, datetime, hashlib, io, json, os, pathlib, re, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
analysis=base/'analysis-26765'
receipt=json.loads((analysis/'receipt.json').read_text())
if receipt.get('status')!='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED':raise RuntimeError('VERIFIED_BASELINE_REQUIRED')
source=base/'reviewed-26829'/'candidate-source'
live=pathlib.Path('/root/gitea-src')
upstream=analysis/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(base),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_OPTIONAL_LOCKS':'0','GIT_TERMINAL_PROMPT':'0'}
def git(path,*args):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(path),*args],capture_output=True,timeout=30,env=env)
return r.returncode,r.stdout
code,head=git(upstream,'rev-parse','HEAD')
if code or head.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_OFFICIAL_SOURCE_REQUIRED')
# Export only files that require manual conflict or migration review.
# Already textually merged files and additive files stay on the server for native testing.
paths=['models/repo/commit_sync_log.go', 'models/repo/commit_sync_status.go', 'models/repo/hidden_file.go', 'modules/git/pktline.go', 'routers/web/repo/commit.go', 'routers/web/repo/hidden_file.go', 'routers/web/repo/setting/setting.go', 'routers/web/repo/sync_records.go', 'services/gitpull/filter.go', 'services/gitpull/matcher.go', 'services/repository/auto_sync_deploy.go']
def public_literals(text):
return set(re.findall(r'["\']([^"\'\n]{8,})["\']',text))
def suspicious(text,public,is_git_test=False):
issues=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
public_ssh=bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])) and any(m.group(0) in v for v in public)
if not public_ssh:issues.append('credential-prefix-or-private-key')
if re.search(r'https?://[^/\s:@]+:[^/\s@]+@',text):issues.append('credential-in-url')
for match in re.finditer(r'(?i)(?:[A-Za-z0-9_]*(?:password|passwd|secret|token|api_?key|access_?key|private_?key)[A-Za-z0-9_]*)\s*(?::=|=|:)\s*["\']([^"\'\n]{8,})["\']',text):
value=match.group(1)
if value not in public:issues.append('nonpublic-credential-literal')
for match in re.finditer(r'(?i)(?:Bearer|Basic)\s+[A-Za-z0-9_+/=.-]{12,}',text):
if not any(match.group(0) in literal for literal in public):issues.append('nonpublic-authorization-literal')
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in public and len(set(value))>8 and not is_git_test:issues.append('nonpublic-long-opaque-literal')
if not is_git_test:
for value in re.findall(r'["\']([A-Fa-f0-9]{32,128})["\']',text):
if value not in public and len(set(value))>3:issues.append('nonpublic-long-hex-literal')
return sorted(set(issues))
payload={};manifest=[];refused=[]
for name in paths:
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts or not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options'] or rel.suffix not in ['.go','.tmpl','.json']:raise RuntimeError('SOURCE_EXPORT_PATH_REFUSED')
p=source/name
if p.is_symlink() or not p.is_file():raise RuntimeError('SOURCE_EXPORT_NONREGULAR_FILE')
data=p.read_bytes()
if len(data)>2*1024*1024:raise RuntimeError('SOURCE_FILE_SIZE_LIMIT')
rc,public=git(upstream,'show','HEAD:'+name)
known=public_literals(public.decode(errors='replace')) if rc==0 else set()
# Never export authorization-looking comment text, even when it is likely prose.
text=data.decode('utf-8')
text=re.sub(r'(?m)^(\s*//[^\n]*?)(?i:Basic|Bearer)\s+[A-Za-z0-9_+/=.-]{12,}[^\n]*$',r'\1[REDACTED_AUTHORIZATION_LOOKING_COMMENT]',text)
data=text.encode('utf-8')
candidates=[(name,data)]
for archive_name,body in candidates:
problems=suspicious(body.decode('utf-8'),known,name.startswith('modules/git/') and name.endswith('_test.go'))
if problems:
text=body.decode('utf-8');classification=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
classification.append({'category':'prefix','publicSshAlgorithm':bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])),'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for m in re.finditer(r'(?i)(Bearer|Basic)\s+([A-Za-z0-9_+/=.-]{12,})',text):
line=text[text.rfind('\n',0,m.start())+1:m.start()]
valid=False
if m.group(1).lower()=='basic':
try:
decoded=base64.b64decode(m.group(2)+'='*((-len(m.group(2)))%4),validate=True).decode('utf-8')
valid=':' in decoded and decoded.isprintable()
except Exception:pass
classification.append({'category':'authorization','scheme':m.group(1).lower(),'commentLine':line.lstrip().startswith('//'),'validPrintableBasicCredential':valid,'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in known and len(set(value))>8 and not (name.startswith('modules/git/') and name.endswith('_test.go')):
classification.append({'category':'opaque','publicGitSmartHttpMime':value in ['application/x-git-upload-pack-advertisement','application/x-git-receive-pack-advertisement','application/x-git-upload-pack-result','application/x-git-receive-pack-result']})
refused.append({'path':archive_name,'reasons':problems,'classification':classification});continue
payload[archive_name]=body
manifest.append({'path':archive_name,'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest()})
report={'kind':'GiteaCustomSourceReviewExport','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceBaselineFingerprint':receipt['sourceFingerprint'],'upstreamCommit':head.decode().strip(),'serviceChanges':False,'databaseOrConfigurationExported':False,'registrationOrCredentialFilesRead':False,'refusedFiles':refused}
if refused:
report['status']='BLOCKED_CREDENTIAL_SCREENING';print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')));raise SystemExit(1)
if sum(len(v) for v in payload.values())>8*1024*1024:raise RuntimeError('SOURCE_EXPORT_SIZE_LIMIT')
work=base/('export-'+runid);work.mkdir(mode=0o700)
index={'kind':'GiteaCustomSourceReviewManifest','sourceBaselineFingerprint':receipt['sourceFingerprint'],'originalSourceHead':'287bf811487c04cd90bcf07aa04905cbaf2e4c2d','upstreamCommit':head.decode().strip(),'files':manifest,'scope':'Selected code only, not a system backup; no database, config, registration, environment, key or dependency cache files'}
payload['manifest.json']=(json.dumps(index,ensure_ascii=False,indent=2)+'\n').encode()
target=work/'gitea-custom-source.tar.gz'
with tarfile.open(target,'w:gz') as archive:
for name,body in sorted(payload.items()):
entry=tarfile.TarInfo(name);entry.size=len(body);entry.mode=0o600;entry.mtime=0;archive.addfile(entry,io.BytesIO(body))
report.update({'status':'SOURCE_CODE_SCREENED_AND_PACKED','fileCount':len(manifest),'archiveBytes':target.stat().st_size,'archiveSha256':hashlib.sha256(target.read_bytes()).hexdigest(),'privateArchive':str(target)})
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')))
for name,body in sorted(payload.items()):
if name=='manifest.json':continue
encoded=base64.b64encode(body).decode()
chunks=[encoded[i:i+8000] for i in range(0,len(encoded),8000)]
for i,chunk in enumerate(chunks):
print('GITEA_GIT_SOURCE_FILE_JSON '+json.dumps({'path':name,'sha256':hashlib.sha256(body).hexdigest(),'index':i,'chunks':len(chunks),'data':chunk},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
...
|
export
|
null
|
["ubuntu-latest"]
|
37652
|
1
|
1793533924
|
1793533924
|
1793533920
|
1793533925
|
|
0
|
|
0
|
Edit
Delete
|
|
46254
|
26842
|
116
|
5
|
1e93ce65273c624562e316cf3d2cde5750f502cc
|
0
|
export
|
1
|
name: Review HTTP custom helpers with opaque liter name: Review HTTP custom helpers with opaque literals redacted
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-http-lint-review.yml]
workflow_dispatch:
jobs:
export:
name: export
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Screen only known source changes and produce a review archive
run: |
set -eu
python3 <<'PY'
import base64, datetime, hashlib, io, json, os, pathlib, re, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
analysis=base/'analysis-26765'
receipt=json.loads((analysis/'receipt.json').read_text())
if receipt.get('status')!='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED':raise RuntimeError('VERIFIED_BASELINE_REQUIRED')
source=base/'reviewed-26829'/'candidate-source'
live=pathlib.Path('/root/gitea-src')
upstream=analysis/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(base),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_OPTIONAL_LOCKS':'0','GIT_TERMINAL_PROMPT':'0'}
def git(path,*args):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(path),*args],capture_output=True,timeout=30,env=env)
return r.returncode,r.stdout
code,head=git(upstream,'rev-parse','HEAD')
if code or head.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_OFFICIAL_SOURCE_REQUIRED')
# Export only files that require manual conflict or migration review.
# Already textually merged files and additive files stay on the server for native testing.
paths=['routers/web/repo/githttp.go']
def public_literals(text):
return set(re.findall(r'["\']([^"\'\n]{8,})["\']',text))
def suspicious(text,public,is_git_test=False):
issues=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
public_ssh=bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])) and any(m.group(0) in v for v in public)
if not public_ssh:issues.append('credential-prefix-or-private-key')
if re.search(r'https?://[^/\s:@]+:[^/\s@]+@',text):issues.append('credential-in-url')
for match in re.finditer(r'(?i)(?:[A-Za-z0-9_]*(?:password|passwd|secret|token|api_?key|access_?key|private_?key)[A-Za-z0-9_]*)\s*(?::=|=|:)\s*["\']([^"\'\n]{8,})["\']',text):
value=match.group(1)
if value not in public:issues.append('nonpublic-credential-literal')
for match in re.finditer(r'(?i)(?:Bearer|Basic)\s+[A-Za-z0-9_+/=.-]{12,}',text):
if not any(match.group(0) in literal for literal in public):issues.append('nonpublic-authorization-literal')
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in public and len(set(value))>8 and not is_git_test:issues.append('nonpublic-long-opaque-literal')
if not is_git_test:
for value in re.findall(r'["\']([A-Fa-f0-9]{32,128})["\']',text):
if value not in public and len(set(value))>3:issues.append('nonpublic-long-hex-literal')
return sorted(set(issues))
payload={};manifest=[];refused=[]
for name in paths:
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts or not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options'] or rel.suffix not in ['.go','.tmpl','.json']:raise RuntimeError('SOURCE_EXPORT_PATH_REFUSED')
p=source/name
if p.is_symlink() or not p.is_file():raise RuntimeError('SOURCE_EXPORT_NONREGULAR_FILE')
data=p.read_bytes()
if len(data)>2*1024*1024:raise RuntimeError('SOURCE_FILE_SIZE_LIMIT')
rc,public=git(upstream,'show','HEAD:'+name)
known=public_literals(public.decode(errors='replace')) if rc==0 else set()
# Never export authorization-looking comment text, even when it is likely prose.
text=data.decode('utf-8')
text=re.sub(r'(?m)^(\s*//[^\n]*?)(?i:Basic|Bearer)\s+[A-Za-z0-9_+/=.-]{12,}[^\n]*$',r'\1[REDACTED_AUTHORIZATION_LOOKING_COMMENT]',text)
# Review copy only: every nonpublic opaque literal is removed before unchanged screening.
original_sha=hashlib.sha256(data).hexdigest()
redactions=[]
def redact(match):
value=match.group(1)
if value in known or len(set(value))<=8:return match.group(0)
redactions.append({'line':text.count('\n',0,match.start())+1,'length':len(value)})
return '"[REDACTED_NONPUBLIC_LITERAL]"'
text=re.sub(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',redact,text)
print('GITEA_HTTP_REDACTIONS_JSON '+json.dumps({'path':name,'originalSha256':original_sha,'reviewCopyOnly':True,'redactions':redactions}),flush=True)
data=text.encode('utf-8')
candidates=[(name,data)]
for archive_name,body in candidates:
problems=suspicious(body.decode('utf-8'),known,name.startswith('modules/git/') and name.endswith('_test.go'))
if problems:
text=body.decode('utf-8');classification=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
classification.append({'category':'prefix','publicSshAlgorithm':bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])),'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for m in re.finditer(r'(?i)(Bearer|Basic)\s+([A-Za-z0-9_+/=.-]{12,})',text):
line=text[text.rfind('\n',0,m.start())+1:m.start()]
valid=False
if m.group(1).lower()=='basic':
try:
decoded=base64.b64decode(m.group(2)+'='*((-len(m.group(2)))%4),validate=True).decode('utf-8')
valid=':' in decoded and decoded.isprintable()
except Exception:pass
classification.append({'category':'authorization','scheme':m.group(1).lower(),'commentLine':line.lstrip().startswith('//'),'validPrintableBasicCredential':valid,'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in known and len(set(value))>8 and not (name.startswith('modules/git/') and name.endswith('_test.go')):
classification.append({'category':'opaque','publicGitSmartHttpMime':value in ['application/x-git-upload-pack-advertisement','application/x-git-receive-pack-advertisement','application/x-git-upload-pack-result','application/x-git-receive-pack-result']})
refused.append({'path':archive_name,'reasons':problems,'classification':classification});continue
payload[archive_name]=body
manifest.append({'path':archive_name,'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest()})
report={'kind':'GiteaCustomSourceReviewExport','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceBaselineFingerprint':receipt['sourceFingerprint'],'upstreamCommit':head.decode().strip(),'serviceChanges':False,'databaseOrConfigurationExported':False,'registrationOrCredentialFilesRead':False,'refusedFiles':refused}
if refused:
report['status']='BLOCKED_CREDENTIAL_SCREENING';print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')));raise SystemExit(1)
if sum(len(v) for v in payload.values())>8*1024*1024:raise RuntimeError('SOURCE_EXPORT_SIZE_LIMIT')
work=base/('export-'+runid);work.mkdir(mode=0o700)
index={'kind':'GiteaCustomSourceReviewManifest','sourceBaselineFingerprint':receipt['sourceFingerprint'],'originalSourceHead':'287bf811487c04cd90bcf07aa04905cbaf2e4c2d','upstreamCommit':head.decode().strip(),'files':manifest,'scope':'Selected code only, not a system backup; no database, config, registration, environment, key or dependency cache files'}
payload['manifest.json']=(json.dumps(index,ensure_ascii=False,indent=2)+'\n').encode()
target=work/'gitea-custom-source.tar.gz'
with tarfile.open(target,'w:gz') as archive:
for name,body in sorted(payload.items()):
entry=tarfile.TarInfo(name);entry.size=len(body);entry.mode=0o600;entry.mtime=0;archive.addfile(entry,io.BytesIO(body))
report.update({'status':'SOURCE_CODE_SCREENED_AND_PACKED','fileCount':len(manifest),'archiveBytes':target.stat().st_size,'archiveSha256':hashlib.sha256(target.read_bytes()).hexdigest(),'privateArchive':str(target)})
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')))
for name,body in sorted(payload.items()):
if name=='manifest.json':continue
encoded=base64.b64encode(body).decode()
chunks=[encoded[i:i+8000] for i in range(0,len(encoded),8000)]
for i,chunk in enumerate(chunks):
print('GITEA_GIT_SOURCE_FILE_JSON '+json.dumps({'path':name,'sha256':hashlib.sha256(body).hexdigest(),'index':i,'chunks':len(chunks),'data':chunk},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
...
|
export
|
null
|
["ubuntu-latest"]
|
37658
|
1
|
1793533951
|
1793533951
|
1793533943
|
1793533951
|
|
0
|
|
0
|
Edit
Delete
|
|
46255
|
26843
|
116
|
5
|
15b98a800956f95b00345d1e472e6cdc09685890
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37660
|
2
|
1793534075
|
1793534079
|
1793534074
|
1793534079
|
|
0
|
|
0
|
Edit
Delete
|
|
46256
|
26843
|
116
|
5
|
15b98a800956f95b00345d1e472e6cdc09685890
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37661
|
2
|
1793534079
|
1793534082
|
1793534074
|
1793534082
|
|
0
|
|
0
|
Edit
Delete
|
|
46263
|
26844
|
116
|
5
|
15ec90f68eb512ec03ff9df8ad6af3144980fd24
|
0
|
validate
|
1
|
name: Validate repaired custom code with original name: Validate repaired custom code with original full lint rules
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37662
|
2
|
1793534082
|
1793534084
|
1793534076
|
1793534084
|
|
0
|
|
0
|
Edit
Delete
|
|
46264
|
26845
|
116
|
5
|
5cd143a56bf582a26f04956a83f88fa37e3ed252
|
0
|
validate
|
1
|
name: Validate custom lint fixes with exact owner name: Validate custom lint fixes with exact owner permission guards
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37669
|
2
|
1793534105
|
1793534228
|
1793534101
|
1793534228
|
|
0
|
|
0
|
Edit
Delete
|
|
46265
|
26846
|
116
|
5
|
cfbc9ccbd635119db7d2ecad32983ea54f717acf
|
0
|
validate
|
1
|
name: Validate full candidate after unused HTTP im name: Validate full candidate after unused HTTP import cleanup
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37670
|
2
|
1793534284
|
1793534940
|
1793534284
|
1793534940
|
|
0
|
|
0
|
Edit
Delete
|
|
46266
|
26847
|
116
|
5
|
f645d7a173609fc827032b40df8a63990903db99
|
0
|
inspect
|
1
|
name: Probe rootless daemon custody using only a t name: Probe rootless daemon custody using only a temporary nonsecret marker
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-custody-probe.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Test prospective same UID credential custody without reading credentials
run: |
set -eu
python3 <<'PY'
import datetime,json,os,pathlib,pwd,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
account=pwd.getpwnam('eios-runner')
if account.pw_uid!=994 or account.pw_dir!='/var/lib/eios-runner':raise RuntimeError('ACCOUNT_MISMATCH')
marker=pathlib.Path(account.pw_dir)/('r1-nonsecret-custody-probe-'+runid)
# This marker is deliberately public test data, never a token, configuration or registration file.
fd=os.open(marker,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
with os.fdopen(fd,'w') as f:f.write('EIOS_R1_PUBLIC_CUSTODY_TEST\n')
os.chown(marker,994,984)
image='docker.gitea.com/runner-images@sha256:b8eb33018cf1b9cbdfd6b3ca0b69a2f7b5f257de60a394c763a784c549b94b53'
args=['runuser','-u','eios-runner','--','env','-i','PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin','HOME=/var/lib/eios-runner','XDG_RUNTIME_DIR=/run/user/994','docker','--host','unix:///run/user/994/docker.sock','run','--rm','--pull=never','--network=none','--cap-drop=ALL','--security-opt=no-new-privileges','--memory=128m','--cpus=0.5','--pids-limit=64','--mount','type=bind,src='+str(marker)+',dst=/probe,readonly',image,'sh','-ec','test "$(cat /probe)" = EIOS_R1_PUBLIC_CUSTODY_TEST']
try:result=subprocess.run(args,capture_output=True,timeout=90)
finally:marker.unlink()
report={'kind':'RootlessSameUIDCustodyProbe','ci':{'runId':runid,'sourceSha':os.environ.get('GITHUB_SHA')},'observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'actualCredentialsRead':False,'productionServicesChanged':False,'temporaryPublicMarkerRemoved':not marker.exists(),'sameUIDMode0600MarkerReadableViaDocker':result.returncode==0,'dockerExitCode':result.returncode,'releaseEligible':False}
print('GITEA_CUSTODY_PROBE_JSON '+json.dumps(report,separators=(',',':')),flush=True)
if result.returncode:raise SystemExit(1)
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37671
|
1
|
1793534940
|
1793534941
|
1793534393
|
1793534941
|
|
0
|
|
0
|
Edit
Delete
|
|
46267
|
26848
|
116
|
5
|
2a90bb9a9e8211819f88004f29294b0ed6924f5b
|
0
|
validate
|
1
|
name: Validate candidate with per checkout lint an name: Validate candidate with per checkout lint and compiler caches
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37672
|
2
|
1793535057
|
1793536450
|
1793535055
|
1793536450
|
|
0
|
|
0
|
Edit
Delete
|
|
46268
|
26849
|
116
|
5
|
a1a1ebb99bf6dd5c2dad22d181437acdd3c756f4
|
0
|
validate
|
1
|
name: Build fixed candidate only if validation run name: Build fixed candidate only if validation run 26848 fully passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37673
|
2
|
1793536450
|
1793536450
|
1793535116
|
1793536450
|
|
0
|
|
0
|
Edit
Delete
|
|
46269
|
26850
|
116
|
5
|
f05a642ae8252c6f18435f5bf929515f3cf962d7
|
0
|
validate
|
1
|
name: Rehearse copied database only after fixed bu name: Rehearse copied database only after fixed build 26849 passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-rehearsal.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/rehearse-candidate-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'rehearse-candidate-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37674
|
2
|
1793536452
|
1793536464
|
1793535198
|
1793536464
|
|
0
|
|
0
|
Edit
Delete
|
|
46270
|
26851
|
116
|
5
|
1a992ce3f8423df3d2ddfffd0d3a7527cb027806
|
0
|
validate
|
1
|
name: Revalidate same fixed checkout after native name: Revalidate same fixed checkout after native lint timeout
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-revalidation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/revalidate-reviewed-checkout.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'revalidate-reviewed-checkout.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37675
|
1
|
1793536584
|
1793536760
|
1793536584
|
1793536760
|
|
0
|
|
0
|
Edit
Delete
|
|
46271
|
26852
|
116
|
5
|
fcba9bb90cfe824b31f327b3507da3150c45263e
|
0
|
validate
|
1
|
name: Build fixed candidate only if same checkout name: Build fixed candidate only if same checkout revalidation 26851 fully passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37676
|
2
|
1793536761
|
1793536761
|
1793536635
|
1793536762
|
|
0
|
|
0
|
Edit
Delete
|
|
46272
|
26853
|
116
|
5
|
e1c6f2edb85e7a266adb72402f75650a1a314e4d
|
0
|
validate
|
1
|
name: Rehearse copied database only after fixed bu name: Rehearse copied database only after fixed build 26852 passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-rehearsal.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/rehearse-candidate-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'rehearse-candidate-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37677
|
2
|
1793536763
|
1793536769
|
1793536744
|
1793536769
|
|
0
|
|
0
|
Edit
Delete
|
|
46273
|
26854
|
116
|
5
|
a3f7b224ce22822cdca006dd7a0c24a423a7b498
|
0
|
inspect
|
1
|
name: Diagnose fixed candidate clone without chang name: Diagnose fixed candidate clone without changing validated source
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-build-git-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import hashlib,json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');source=base/'reviewed-26848/candidate-source'
if base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
old=base/'build-26852';work=base/('build-git-diagnostic-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def screen(data):return [line[-700:] for line in data.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line)][-8:]
def command(cwd,args):
r=subprocess.run(['git','--no-optional-locks','-c','safe.directory='+str(source),'-c','safe.directory='+str(work/'candidate-source'),'-c','core.hooksPath=/dev/null','-c','credential.helper=','-C',str(cwd),*args],env=env,capture_output=True,timeout=120)
return {'operation':args[0],'exitCode':r.returncode,'stdoutBytes':len(r.stdout),'screenedStderr':screen(r.stderr)}
observations=[command(source,['rev-parse','HEAD']),command(source,['ls-files','-z']),command(source,['ls-files','--others','--exclude-standard','-z']),command(work,['clone','--no-local','--depth=1','--no-checkout',str(source),str(work/'candidate-source')])]
prior=[]
for name in ['candidate-source','candidate-source/.git','candidate-source/.git/HEAD','candidate-source/.git/shallow']:
p=old/name;prior.append({'path':name,'exists':p.exists(),'symlink':p.is_symlink(),'uid':p.stat().st_uid if p.exists() else None})
print('GITEA_BUILD_GIT_DIAG_JSON '+json.dumps({'kind':'FixedBuildGitDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'priorBuildMetadata':prior,'operations':observations,'validatedSourceModified':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37678
|
1
|
1793536883
|
1793536883
|
1793536881
|
1793536883
|
|
0
|
|
0
|
Edit
Delete
|
|
46274
|
26855
|
116
|
5
|
5767b2a296173417b676193da09987c0710b166c
|
0
|
validate
|
1
|
name: Build validated candidate using exact privat name: Build validated candidate using exact private git directory trust
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37679
|
2
|
1793536929
|
1793536930
|
1793536929
|
1793536930
|
|
0
|
|
0
|
Edit
Delete
|
|
46275
|
26856
|
116
|
5
|
a490b4ac15698abf44bb7890a70f0e4ce0c1d602
|
0
|
inspect
|
1
|
name: Verify isolated private Git configuration fo name: Verify isolated private Git configuration for upload pack trust
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-build-git-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import hashlib,json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');source=base/'reviewed-26848/candidate-source'
if base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
old=base/'build-26852';work=base/('build-git-diagnostic-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def screen(data):return [line[-700:] for line in data.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line)][-8:]
def command(cwd,args):
r=subprocess.run(['git','--no-optional-locks','-c','safe.directory='+str(source),'-c','safe.directory='+str(work/'candidate-source'),'-c','core.hooksPath=/dev/null','-c','credential.helper=','-C',str(cwd),*args],env=env,capture_output=True,timeout=120)
return {'operation':args[0],'exitCode':r.returncode,'stdoutBytes':len(r.stdout),'screenedStderr':screen(r.stderr)}
isolated_config=work/'isolated.gitconfig'
isolated_config.write_text('[safe]\n\tdirectory = '+str(source)+'\n\tdirectory = '+str(source/'.git')+'\n')
os.chmod(isolated_config,0o600)
env['GIT_CONFIG_GLOBAL']=str(isolated_config)
observations=[command(work,['clone','--no-local','--depth=1','--no-checkout',str(source),str(work/'candidate-source')])]
if observations[-1]['exitCode']:
env['GIT_CONFIG_GLOBAL']='/dev/null'
observations.append(command(work,['clone','--no-local','--depth=1','--no-checkout','--upload-pack=git -c safe.directory='+str(source)+' -c safe.directory='+str(source/'.git')+' upload-pack',str(source),str(work/'candidate-source-explicit-upload-pack')]))
prior=[]
for name in ['candidate-source','candidate-source/.git','candidate-source/.git/HEAD','candidate-source/.git/shallow']:
p=old/name;prior.append({'path':name,'exists':p.exists(),'symlink':p.is_symlink(),'uid':p.stat().st_uid if p.exists() else None})
print('GITEA_BUILD_GIT_DIAG_JSON '+json.dumps({'kind':'FixedBuildGitDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'priorBuildMetadata':prior,'operations':observations,'validatedSourceModified':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37680
|
1
|
1793537031
|
1793537032
|
1793537030
|
1793537032
|
|
0
|
|
0
|
Edit
Delete
|
|
46276
|
26857
|
116
|
5
|
c7d68a55baac98f653785de381d8e38b705e61d1
|
0
|
validate
|
1
|
name: Build validated candidate using isolated tas name: Build validated candidate using isolated task private Git config
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37681
|
1
|
1793537105
|
1793537395
|
1793537105
|
1793537395
|
|
0
|
|
0
|
Edit
Delete
|
|
46277
|
26858
|
116
|
5
|
92a63617fc34559094d2e39f67cfd12131bbcaee
|
0
|
validate
|
1
|
name: Rehearse copied database only after fixed bu name: Rehearse copied database only after fixed build 26857 passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-rehearsal.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/rehearse-candidate-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'rehearse-candidate-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37682
|
2
|
1793537396
|
1793537442
|
1793537282
|
1793537443
|
|
0
|
|
0
|
Edit
Delete
|
|
46278
|
26859
|
116
|
5
|
876799432d08424ff9d08fa16ba538fb75dfefcc
|
0
|
validate
|
1
|
name: Finalize migrated private database without r name: Finalize migrated private database without rerunning migration
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-finalize.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/finish-candidate-database-rehearsal.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'finish-candidate-database-rehearsal.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37683
|
2
|
1793537907
|
1793537971
|
1793537906
|
1793537971
|
|
0
|
|
0
|
Edit
Delete
|
|
46279
|
26860
|
116
|
5
|
578b0f3e2fa5d1a0b8c9d70cc909a8ad88fa5e71
|
0
|
inspect
|
1
|
name: Read actual candidate CLI version output onl name: Read actual candidate CLI version output only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-version-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
stored=(base/'build-26857/BINARY_VERSION.stdout').read_text(errors='replace').strip()
r=subprocess.run(['runuser','-u','git','--','env','-i','PATH=/usr/local/bin:/usr/bin:/bin','HOME='+str(base/'candidate-database-rehearsal-26858/git-home'),'USER=git','LOGNAME=git',str(base/'candidate-database-rehearsal-26858/gitea.candidate'),'--version'],capture_output=True,timeout=20)
observed=r.stdout.decode(errors='replace').strip()
def safe(text):
if len(text)>500 or re.search(r'(?i)password|secret|authorization|BEGIN .*PRIVATE KEY|://[^ /]+@',text):return 'OUTPUT_REFUSED'
return text
print('GITEA_CLI_VERSION_DIAG_JSON '+json.dumps({'kind':'CandidateCLIVersionReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'builtVersionOutput':safe(stored),'privateCopyVersionOutput':safe(observed),'exitCode':r.returncode,'screenedStderr':safe(r.stderr.decode(errors='replace').strip()),'databaseWritten':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37684
|
1
|
1793538086
|
1793538086
|
1793538085
|
1793538086
|
|
0
|
|
0
|
Edit
Delete
|
|
46280
|
26861
|
116
|
5
|
c092cf99e8eb7c16356f1be88209c4ebbc12816b
|
0
|
validate
|
1
|
name: Finalize private database with tested actual name: Finalize private database with tested actual CLI version format
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-finalize.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/finish-candidate-database-rehearsal.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'finish-candidate-database-rehearsal.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37685
|
1
|
1793538258
|
1793538352
|
1793538256
|
1793538353
|
|
0
|
|
0
|
Edit
Delete
|
|
46281
|
26862
|
116
|
5
|
176ef800c75586d22886a922e7610e7f18591156
|
0
|
validate
|
1
|
name: Separate runner registration custody from ro name: Separate runner registration custody from rootless Docker UID
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-runner-custody.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-runner-custody.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-runner-custody.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_RUNNER_CUSTODY_JSON '+json.dumps({'kind':'GiteaRunnerSeparateCredentialCustody','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37686
|
2
|
1793542883
|
1793542883
|
1793542882
|
1793542884
|
|
0
|
|
0
|
Edit
Delete
|
|
46282
|
26863
|
116
|
5
|
9e38cc4712c33edb1a30352ddc1e16d7c7719919
|
0
|
inspect
|
1
|
name: Inspect rootless socket custody metadata
name: Inspect rootless socket custody metadata
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-runner-custody-inspect.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- run: |
python3 <<'PYCODE'
import os,pathlib,pwd,stat,json,socket
assert os.geteuid()==0 and socket.gethostname()=='iZ2zed3pt2nygf9dy1a9d2Z'
paths=['/run/user/994','/run/user/994/docker.sock','/var/lib/eios-runner/.config/systemd/user/docker.service']
out={}
for name in paths:
p=pathlib.Path(name);s=p.lstat()
out[name]={'uid':s.st_uid,'gid':s.st_gid,'mode':oct(stat.S_IMODE(s.st_mode)),'socket':stat.S_ISSOCK(s.st_mode),'symlink':p.is_symlink()}
try:a=pwd.getpwnam('eios-runner-agent');out['agent']={'uid':a.pw_uid,'gid':a.pw_gid}
except KeyError:out['agent']=None
print('GITEA_CUSTODY_METADATA_JSON '+json.dumps({'kind':'RootlessSocketCustodyMetadata','ci':{'sourceSha':os.environ['GITHUB_SHA'],'runId':os.environ['GITHUB_RUN_ID']},'metadata':out,'liveWrites':False,'releaseEligible':False}))
PYCODE
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37687
|
1
|
1793542913
|
1793542913
|
1793542913
|
1793542914
|
|
0
|
|
0
|
Edit
Delete
|
|
46283
|
26864
|
116
|
5
|
55d905e88a8db82e0505715319c0acc808b15c46
|
0
|
validate
|
1
|
name: Separate runner registration custody from ro name: Separate runner registration custody from rootless Docker UID
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-runner-custody.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-runner-custody.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-runner-custody.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_RUNNER_CUSTODY_JSON '+json.dumps({'kind':'GiteaRunnerSeparateCredentialCustody','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37688
|
1
|
1793542949
|
1793542951
|
1793542948
|
1793542951
|
|
0
|
|
0
|
Edit
Delete
|
|
46284
|
26865
|
116
|
5
|
4346f236a2d9a309229559d335f3bb16508c8595
|
0
|
inspect
|
1
|
name: Read maintenance storage and ingress preflig name: Read maintenance storage and ingress preflight only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-preflight.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess,hashlib,shutil
def command(args):return subprocess.run(args,capture_output=True,timeout=90)
sizes={}
for path in ['/home/git','/usr/local/bin/data','/opt/gitea-runner','/var/lib/eios-r1-maintenance']:
r=command(['du','-s','-B1','--',path])
sizes[path]=int(r.stdout.split()[0]) if r.returncode==0 else None
def meta(name):
p=pathlib.Path(name)
if not p.exists():return {'path':name,'exists':False}
st=p.lstat();value={'path':name,'exists':True,'uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'bytes':st.st_size,'symlink':p.is_symlink()}
if p.is_file() and not p.is_symlink():value['sha256']=hashlib.sha256(p.read_bytes()).hexdigest()
return value
ssh=command(['/usr/sbin/sshd','-T']);selected={}
for line in ssh.stdout.decode().splitlines():
key,_,value=line.partition(' ')
if key in ['authorizedkeysfile','authorizedkeyscommand','passwordauthentication','kbdinteractiveauthentication','denyusers','allowusers','authenticationmethods','usepam']:selected[key]=value
status=command(['passwd','-S','git']).stdout.decode().split();account_status=status[:2]
configs=[]
for name in ['/etc/nginx/conf.d/gitea-http-redirect.conf','/etc/nginx/conf.d/gitea-https.conf']:
p=pathlib.Path(name);configs.append({'path':name,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'serverBlocks':len(re.findall(r'(?m)^\s*server\s*\{',p.read_text()))})
services={}
for name in ['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','nginx.service','ssh.service','docker.service']:
r=command(['systemctl','show',name,'--property=MainPID,ActiveState,FragmentPath']);services[name]=dict(line.split('=',1) for line in r.stdout.decode().splitlines() if '=' in line)
maintenanceChildren={}
for child in pathlib.Path('/var/lib/eios-r1-maintenance').iterdir():
if child.is_dir() and re.fullmatch(r'[A-Za-z0-9_.-]+',child.name):
r=command(['du','-s','-B1','--',str(child)])
maintenanceChildren[child.name]=int(r.stdout.split()[0]) if r.returncode==0 else None
report={'maintenanceChildrenBytes':maintenanceChildren,'kind':'GiteaMaintenanceWindowReadOnlyPreflight','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'mutations':False,'releaseEligible':False,'allocatedBytes':sizes,'filesystemFreeBytes':shutil.disk_usage('/var/lib/eios-r1-maintenance').free,'sshPolicy':selected,'gitAccountPasswordStatus':account_status,'nginxConfigs':configs,'services':services,'customHelperMetadata':[meta('/home/git/gitea/scripts/rsync_commit.sh'),meta('/home/git/.ssh/authorized_keys2')]}
print('GITEA_WINDOW_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37689
|
1
|
1793543013
|
1793543088
|
1793543011
|
1793543092
|
|
0
|
|
0
|
Edit
Delete
|
|
46285
|
26866
|
116
|
5
|
77fc39379e3218373ef76be1c588e758af11249f
|
0
|
inspect
|
1
|
name: Read maintenance storage and ingress preflig name: Read maintenance storage and ingress preflight only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-preflight.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess,hashlib,shutil
def command(args):return subprocess.run(args,capture_output=True,timeout=90)
sizes={}
for path in ['/home/git','/usr/local/bin/data','/opt/gitea-runner','/var/lib/eios-r1-maintenance']:
r=command(['du','-s','-B1','--',path])
sizes[path]=int(r.stdout.split()[0]) if r.returncode==0 else None
def meta(name):
p=pathlib.Path(name)
if not p.exists():return {'path':name,'exists':False}
st=p.lstat();value={'path':name,'exists':True,'uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'bytes':st.st_size,'symlink':p.is_symlink()}
if p.is_file() and not p.is_symlink():value['sha256']=hashlib.sha256(p.read_bytes()).hexdigest()
return value
ssh=command(['/usr/sbin/sshd','-T']);selected={}
for line in ssh.stdout.decode().splitlines():
key,_,value=line.partition(' ')
if key in ['authorizedkeysfile','authorizedkeyscommand','passwordauthentication','kbdinteractiveauthentication','denyusers','allowusers','authenticationmethods','usepam']:selected[key]=value
status=command(['passwd','-S','git']).stdout.decode().split();account_status=status[:2]
configs=[]
for name in ['/etc/nginx/conf.d/gitea-http-redirect.conf','/etc/nginx/conf.d/gitea-https.conf']:
p=pathlib.Path(name);configs.append({'path':name,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'serverBlocks':len(re.findall(r'(?m)^\s*server\s*\{',p.read_text()))})
services={}
for name in ['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','nginx.service','ssh.service','docker.service']:
r=command(['systemctl','show',name,'--property=MainPID,ActiveState,FragmentPath']);services[name]=dict(line.split('=',1) for line in r.stdout.decode().splitlines() if '=' in line)
maintenanceChildren={}
for child in pathlib.Path('/var/lib/eios-r1-maintenance/build-cache').iterdir():
if child.is_dir() and re.fullmatch(r'[A-Za-z0-9_.-]+',child.name):
r=command(['du','-s','-B1','--',str(child)])
maintenanceChildren[child.name]=int(r.stdout.split()[0]) if r.returncode==0 else None
report={'maintenanceChildrenBytes':maintenanceChildren,'kind':'GiteaMaintenanceWindowReadOnlyPreflight','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'mutations':False,'releaseEligible':False,'allocatedBytes':sizes,'filesystemFreeBytes':shutil.disk_usage('/var/lib/eios-r1-maintenance').free,'sshPolicy':selected,'gitAccountPasswordStatus':account_status,'nginxConfigs':configs,'services':services,'customHelperMetadata':[meta('/home/git/gitea/scripts/rsync_commit.sh'),meta('/home/git/.ssh/authorized_keys2')]}
report['cacheChildrenScope']='/var/lib/eios-r1-maintenance/build-cache'
import configparser,sqlite3
c=configparser.ConfigParser(interpolation=None,strict=False);c.read_string('[DEFAULT]\n'+pathlib.Path('/home/git/gitea/config/app.ini').read_text())
report['storageLocations']={}
for section in c.sections():
if section in ['repository','lfs','attachment','picture','storage','actions','packages'] or section.startswith(('storage.','storage@')):
report['storageLocations'][section]={k:v for k,v in c.items(section,raw=True) if k.lower() in ['root','path','storage_type','type','artifact_path','log_path']}
db=sqlite3.connect('file:/home/git/gitea/data/gitea.db?mode=ro',uri=True)
report['actionSchemas']={t:[r[1] for r in db.execute('pragma table_info('+t+')')] for t in ['action_run','action_run_job','action_task']}
report['runningTasksByRunner']=[list(r) for r in db.execute('select runner_id,status,count(*) from action_task where status not in (1,2,3,4) group by runner_id,status')]
report['firewallTools']={name:bool(shutil.which(name)) for name in ['iptables','ip6tables','nft','sshd']}
db.close()
print('GITEA_WINDOW_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37690
|
1
|
1793543157
|
1793543170
|
1793543157
|
1793543170
|
|
0
|
|
0
|
Edit
Delete
|
|
46286
|
26867
|
116
|
5
|
e35d033f6c9ba3a85010324e5bb7142aaef12cdf
|
0
|
validate
|
1
|
name: Reclaim only maintenance task compile cache
name: Reclaim only maintenance task compile cache
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-task-cache-reclaim.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/reclaim-task-compile-cache.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'reclaim-task-compile-cache.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CACHE_RECLAIM_JSON '+json.dumps({'kind':'GiteaTaskCompileCacheReclaimed','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37691
|
1
|
1793543272
|
1793543284
|
1793543272
|
1793543284
|
|
0
|
|
0
|
Edit
Delete
|
|
46287
|
26868
|
116
|
5
|
cc80f5372c17ba23c885c32639a7b593843f4bae
|
0
|
validate
|
1
|
name: Losslessly compact completed maintenance reh name: Losslessly compact completed maintenance rehearsal copies
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rehearsal-compaction.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/compact-completed-rehearsals.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'compact-completed-rehearsals.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REHEARSAL_COMPACTION_JSON '+json.dumps({'kind':'GiteaCompletedRehearsalsCompacted','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37692
|
1
|
1793543516
|
1793543625
|
1793543515
|
1793543625
|
|
0
|
|
0
|
Edit
Delete
|
|
46288
|
26869
|
116
|
5
|
4020434c2e02d518596db31bf46e5d29ef7465af
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37693
|
2
|
1793543626
|
1793543635
|
1793543592
|
1793543635
|
|
0
|
|
0
|
Edit
Delete
|
|
46289
|
26869
|
116
|
5
|
4020434c2e02d518596db31bf46e5d29ef7465af
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37694
|
2
|
1793543635
|
1793543640
|
1793543592
|
1793543640
|
|
0
|
|
0
|
Edit
Delete
|
|
46296
|
26870
|
116
|
5
|
bfdd7d28597d663c9bb14ce9d49c44ff37399750
|
0
|
validate
|
1
|
name: Validate complete window backup helpers and name: Validate complete window backup helpers and sandbox prerequisites
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-final-window-preflight.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/window-preflight.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'window-preflight.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FINAL_WINDOW_PREFLIGHT_JSON '+json.dumps({'kind':'GiteaFinalWindowPreflight','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37701
|
2
|
1793543807
|
1793543813
|
1793543806
|
1793543813
|
|
0
|
|
0
|
Edit
Delete
|
|
46297
|
26871
|
116
|
5
|
6374793938a7ba0cee6768de62ee1724f49a8a71
|
0
|
validate
|
1
|
name: Validate complete window backup helpers and name: Validate complete window backup helpers and sandbox prerequisites
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-final-window-preflight.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/window-preflight.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'window-preflight.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FINAL_WINDOW_PREFLIGHT_JSON '+json.dumps({'kind':'GiteaFinalWindowPreflight','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37702
|
1
|
1793543894
|
1793543900
|
1793543892
|
1793543900
|
|
0
|
|
0
|
Edit
Delete
|
|
46298
|
26872
|
116
|
5
|
ddface15c180c07611e942eb8676e984660363b8
|
0
|
validate
|
1
|
name: Estimate compressed backup capacity without name: Estimate compressed backup capacity without retaining archive bytes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-size-estimate.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/estimate-window-storage.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'estimate-window-storage.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_WINDOW_SIZE_ESTIMATE_JSON '+json.dumps({'kind':'GiteaWindowCompressedCapacityEstimate','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37703
|
1
|
1793543978
|
1793544292
|
1793543978
|
1793544292
|
|
0
|
|
0
|
Edit
Delete
|
|
46299
|
26873
|
116
|
5
|
e3a83c36e2210bef45fe0f5e2a9caa62e1a6735d
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37704
|
2
|
1793544293
|
1793544356
|
1793544011
|
1793544356
|
|
0
|
|
0
|
Edit
Delete
|
|
46300
|
26873
|
116
|
5
|
e3a83c36e2210bef45fe0f5e2a9caa62e1a6735d
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37705
|
2
|
1793544357
|
1793544447
|
1793544011
|
1793544447
|
|
0
|
|
0
|
Edit
Delete
|
|
46307
|
26874
|
116
|
5
|
7f67b508cdbd708f47f38ba8073b061e540aaa21
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37707
|
2
|
1793544462
|
1793544897
|
1793544330
|
1793544898
|
|
1
|
|
0
|
Edit
Delete
|
|
46308
|
26874
|
116
|
5
|
7f67b508cdbd708f47f38ba8073b061e540aaa21
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37708
|
2
|
1793544898
|
1793544902
|
1793544330
|
1793544902
|
|
1
|
|
0
|
Edit
Delete
|
|
46315
|
26875
|
116
|
5
|
d84e4c5a71e0fd04cfa96b38d384f009855d8f1d
|
0
|
validate
|
1
|
name: Inspect extra storage and named rebuildable name: Inspect extra storage and named rebuildable caches read only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-additional-storage-inspect.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/inspect-additional-storage.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'inspect-additional-storage.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_ADDITIONAL_STORAGE_JSON '+json.dumps({'kind':'GiteaAdditionalStorageReadOnlyInspection','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37706
|
1
|
1793544447
|
1793544461
|
1793544337
|
1793544461
|
|
0
|
|
0
|
Edit
Delete
|
|
46316
|
26876
|
116
|
5
|
0517ab3f843e46b91447e07f75c5b30400d915b6
|
0
|
validate
|
0
|
name: Inspect explicitly approved existing release name: Inspect explicitly approved existing release credential capability
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-existing-release-auth.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/inspect-existing-release-auth.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'inspect-existing-release-auth.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_EXISTING_RELEASE_AUTH_JSON '+json.dumps({'kind':'ExistingReleaseCredentialCapability','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
env:
EIOS_RELEASE_TOKEN: ${{ secrets.PLATFORM_NPM_PUBLISH_TOKEN }}
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793544749
|
1793544686
|
1793544749
|
|
0
|
|
0
|
Edit
Delete
|
|
46317
|
26877
|
116
|
5
|
f3e9ea997fb1a6076a27af3f36ce7af1407d8c83
|
0
|
validate
|
1
|
name: Retain source history and reclaim named rebu name: Retain source history and reclaim named rebuildable caches for full recovery
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-capacity-reclaim.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/reclaim-window-capacity.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'reclaim-window-capacity.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_WINDOW_CAPACITY_RECLAIM_JSON '+json.dumps({'kind':'GiteaWindowCapacityReclaimed','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37714
|
2
|
1793544912
|
1793544930
|
1793544750
|
1793544931
|
|
0
|
|
0
|
Edit
Delete
|
|
46318
|
26878
|
116
|
5
|
0cbe544a1aa3cce37509daf46abc260806375a77
|
0
|
validate
|
1
|
name: Inspect explicitly approved existing release name: Inspect explicitly approved existing release credential capability
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-existing-release-auth.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/inspect-existing-release-auth.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'inspect-existing-release-auth.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_EXISTING_RELEASE_AUTH_JSON '+json.dumps({'kind':'ExistingReleaseCredentialCapability','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
env:
EIOS_RELEASE_TOKEN: ${{ secrets.PLATFORM_NPM_PUBLISH_TOKEN }}
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37715
|
1
|
1793544931
|
1793544931
|
1793544817
|
1793544931
|
|
0
|
|
0
|
Edit
Delete
|
|
46319
|
26879
|
116
|
5
|
0cbe544a1aa3cce37509daf46abc260806375a77
|
0
|
validate
|
1
|
name: Retain source history and reclaim named rebu name: Retain source history and reclaim named rebuildable caches for full recovery
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-capacity-reclaim.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/reclaim-window-capacity.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'reclaim-window-capacity.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_WINDOW_CAPACITY_RECLAIM_JSON '+json.dumps({'kind':'GiteaWindowCapacityReclaimed','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37716
|
1
|
1793544933
|
1793545202
|
1793544817
|
1793545202
|
|
0
|
|
0
|
Edit
Delete
|
|
46320
|
26880
|
116
|
5
|
078f766fb789fdecef40b1c6a3ea0c752be6d332
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37717
|
2
|
1793545202
|
1793545206
|
1793544920
|
1793545206
|
|
0
|
|
0
|
Edit
Delete
|