|
46261
|
26843
|
116
|
5
|
15b98a800956f95b00345d1e472e6cdc09685890
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://github.com/sigstore/cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
37667
|
4
|
1793534093
|
1793534093
|
1793534074
|
1793534093
|
|
1
|
|
0
|
Edit
Delete
|
|
46262
|
26843
|
116
|
5
|
15b98a800956f95b00345d1e472e6cdc09685890
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
37668
|
2
|
1793534095
|
1793534104
|
1793534074
|
1793534105
|
|
1
|
|
0
|
Edit
Delete
|
|
46263
|
26844
|
116
|
5
|
15ec90f68eb512ec03ff9df8ad6af3144980fd24
|
0
|
validate
|
1
|
name: Validate repaired custom code with original name: Validate repaired custom code with original full lint rules
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37662
|
2
|
1793534082
|
1793534084
|
1793534076
|
1793534084
|
|
0
|
|
0
|
Edit
Delete
|
|
46264
|
26845
|
116
|
5
|
5cd143a56bf582a26f04956a83f88fa37e3ed252
|
0
|
validate
|
1
|
name: Validate custom lint fixes with exact owner name: Validate custom lint fixes with exact owner permission guards
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37669
|
2
|
1793534105
|
1793534228
|
1793534101
|
1793534228
|
|
0
|
|
0
|
Edit
Delete
|
|
46265
|
26846
|
116
|
5
|
cfbc9ccbd635119db7d2ecad32983ea54f717acf
|
0
|
validate
|
1
|
name: Validate full candidate after unused HTTP im name: Validate full candidate after unused HTTP import cleanup
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37670
|
2
|
1793534284
|
1793534940
|
1793534284
|
1793534940
|
|
0
|
|
0
|
Edit
Delete
|
|
46266
|
26847
|
116
|
5
|
f645d7a173609fc827032b40df8a63990903db99
|
0
|
inspect
|
1
|
name: Probe rootless daemon custody using only a t name: Probe rootless daemon custody using only a temporary nonsecret marker
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-custody-probe.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Test prospective same UID credential custody without reading credentials
run: |
set -eu
python3 <<'PY'
import datetime,json,os,pathlib,pwd,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
account=pwd.getpwnam('eios-runner')
if account.pw_uid!=994 or account.pw_dir!='/var/lib/eios-runner':raise RuntimeError('ACCOUNT_MISMATCH')
marker=pathlib.Path(account.pw_dir)/('r1-nonsecret-custody-probe-'+runid)
# This marker is deliberately public test data, never a token, configuration or registration file.
fd=os.open(marker,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
with os.fdopen(fd,'w') as f:f.write('EIOS_R1_PUBLIC_CUSTODY_TEST\n')
os.chown(marker,994,984)
image='docker.gitea.com/runner-images@sha256:b8eb33018cf1b9cbdfd6b3ca0b69a2f7b5f257de60a394c763a784c549b94b53'
args=['runuser','-u','eios-runner','--','env','-i','PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin','HOME=/var/lib/eios-runner','XDG_RUNTIME_DIR=/run/user/994','docker','--host','unix:///run/user/994/docker.sock','run','--rm','--pull=never','--network=none','--cap-drop=ALL','--security-opt=no-new-privileges','--memory=128m','--cpus=0.5','--pids-limit=64','--mount','type=bind,src='+str(marker)+',dst=/probe,readonly',image,'sh','-ec','test "$(cat /probe)" = EIOS_R1_PUBLIC_CUSTODY_TEST']
try:result=subprocess.run(args,capture_output=True,timeout=90)
finally:marker.unlink()
report={'kind':'RootlessSameUIDCustodyProbe','ci':{'runId':runid,'sourceSha':os.environ.get('GITHUB_SHA')},'observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'actualCredentialsRead':False,'productionServicesChanged':False,'temporaryPublicMarkerRemoved':not marker.exists(),'sameUIDMode0600MarkerReadableViaDocker':result.returncode==0,'dockerExitCode':result.returncode,'releaseEligible':False}
print('GITEA_CUSTODY_PROBE_JSON '+json.dumps(report,separators=(',',':')),flush=True)
if result.returncode:raise SystemExit(1)
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37671
|
1
|
1793534940
|
1793534941
|
1793534393
|
1793534941
|
|
0
|
|
0
|
Edit
Delete
|
|
46267
|
26848
|
116
|
5
|
2a90bb9a9e8211819f88004f29294b0ed6924f5b
|
0
|
validate
|
1
|
name: Validate candidate with per checkout lint an name: Validate candidate with per checkout lint and compiler caches
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-validation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-reviewed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-reviewed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37672
|
2
|
1793535057
|
1793536450
|
1793535055
|
1793536450
|
|
0
|
|
0
|
Edit
Delete
|
|
46268
|
26849
|
116
|
5
|
a1a1ebb99bf6dd5c2dad22d181437acdd3c756f4
|
0
|
validate
|
1
|
name: Build fixed candidate only if validation run name: Build fixed candidate only if validation run 26848 fully passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37673
|
2
|
1793536450
|
1793536450
|
1793535116
|
1793536450
|
|
0
|
|
0
|
Edit
Delete
|
|
46269
|
26850
|
116
|
5
|
f05a642ae8252c6f18435f5bf929515f3cf962d7
|
0
|
validate
|
1
|
name: Rehearse copied database only after fixed bu name: Rehearse copied database only after fixed build 26849 passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-rehearsal.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/rehearse-candidate-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'rehearse-candidate-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37674
|
2
|
1793536452
|
1793536464
|
1793535198
|
1793536464
|
|
0
|
|
0
|
Edit
Delete
|
|
46270
|
26851
|
116
|
5
|
1a992ce3f8423df3d2ddfffd0d3a7527cb027806
|
0
|
validate
|
1
|
name: Revalidate same fixed checkout after native name: Revalidate same fixed checkout after native lint timeout
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-revalidation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/revalidate-reviewed-checkout.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'revalidate-reviewed-checkout.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37675
|
1
|
1793536584
|
1793536760
|
1793536584
|
1793536760
|
|
0
|
|
0
|
Edit
Delete
|
|
46271
|
26852
|
116
|
5
|
fcba9bb90cfe824b31f327b3507da3150c45263e
|
0
|
validate
|
1
|
name: Build fixed candidate only if same checkout name: Build fixed candidate only if same checkout revalidation 26851 fully passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37676
|
2
|
1793536761
|
1793536761
|
1793536635
|
1793536762
|
|
0
|
|
0
|
Edit
Delete
|
|
46272
|
26853
|
116
|
5
|
e1c6f2edb85e7a266adb72402f75650a1a314e4d
|
0
|
validate
|
1
|
name: Rehearse copied database only after fixed bu name: Rehearse copied database only after fixed build 26852 passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-rehearsal.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/rehearse-candidate-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'rehearse-candidate-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37677
|
2
|
1793536763
|
1793536769
|
1793536744
|
1793536769
|
|
0
|
|
0
|
Edit
Delete
|
|
46273
|
26854
|
116
|
5
|
a3f7b224ce22822cdca006dd7a0c24a423a7b498
|
0
|
inspect
|
1
|
name: Diagnose fixed candidate clone without chang name: Diagnose fixed candidate clone without changing validated source
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-build-git-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import hashlib,json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');source=base/'reviewed-26848/candidate-source'
if base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
old=base/'build-26852';work=base/('build-git-diagnostic-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def screen(data):return [line[-700:] for line in data.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line)][-8:]
def command(cwd,args):
r=subprocess.run(['git','--no-optional-locks','-c','safe.directory='+str(source),'-c','safe.directory='+str(work/'candidate-source'),'-c','core.hooksPath=/dev/null','-c','credential.helper=','-C',str(cwd),*args],env=env,capture_output=True,timeout=120)
return {'operation':args[0],'exitCode':r.returncode,'stdoutBytes':len(r.stdout),'screenedStderr':screen(r.stderr)}
observations=[command(source,['rev-parse','HEAD']),command(source,['ls-files','-z']),command(source,['ls-files','--others','--exclude-standard','-z']),command(work,['clone','--no-local','--depth=1','--no-checkout',str(source),str(work/'candidate-source')])]
prior=[]
for name in ['candidate-source','candidate-source/.git','candidate-source/.git/HEAD','candidate-source/.git/shallow']:
p=old/name;prior.append({'path':name,'exists':p.exists(),'symlink':p.is_symlink(),'uid':p.stat().st_uid if p.exists() else None})
print('GITEA_BUILD_GIT_DIAG_JSON '+json.dumps({'kind':'FixedBuildGitDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'priorBuildMetadata':prior,'operations':observations,'validatedSourceModified':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37678
|
1
|
1793536883
|
1793536883
|
1793536881
|
1793536883
|
|
0
|
|
0
|
Edit
Delete
|
|
46274
|
26855
|
116
|
5
|
5767b2a296173417b676193da09987c0710b166c
|
0
|
validate
|
1
|
name: Build validated candidate using exact privat name: Build validated candidate using exact private git directory trust
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37679
|
2
|
1793536929
|
1793536930
|
1793536929
|
1793536930
|
|
0
|
|
0
|
Edit
Delete
|
|
46275
|
26856
|
116
|
5
|
a490b4ac15698abf44bb7890a70f0e4ce0c1d602
|
0
|
inspect
|
1
|
name: Verify isolated private Git configuration fo name: Verify isolated private Git configuration for upload pack trust
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-build-git-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import hashlib,json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');source=base/'reviewed-26848/candidate-source'
if base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
old=base/'build-26852';work=base/('build-git-diagnostic-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def screen(data):return [line[-700:] for line in data.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line)][-8:]
def command(cwd,args):
r=subprocess.run(['git','--no-optional-locks','-c','safe.directory='+str(source),'-c','safe.directory='+str(work/'candidate-source'),'-c','core.hooksPath=/dev/null','-c','credential.helper=','-C',str(cwd),*args],env=env,capture_output=True,timeout=120)
return {'operation':args[0],'exitCode':r.returncode,'stdoutBytes':len(r.stdout),'screenedStderr':screen(r.stderr)}
isolated_config=work/'isolated.gitconfig'
isolated_config.write_text('[safe]\n\tdirectory = '+str(source)+'\n\tdirectory = '+str(source/'.git')+'\n')
os.chmod(isolated_config,0o600)
env['GIT_CONFIG_GLOBAL']=str(isolated_config)
observations=[command(work,['clone','--no-local','--depth=1','--no-checkout',str(source),str(work/'candidate-source')])]
if observations[-1]['exitCode']:
env['GIT_CONFIG_GLOBAL']='/dev/null'
observations.append(command(work,['clone','--no-local','--depth=1','--no-checkout','--upload-pack=git -c safe.directory='+str(source)+' -c safe.directory='+str(source/'.git')+' upload-pack',str(source),str(work/'candidate-source-explicit-upload-pack')]))
prior=[]
for name in ['candidate-source','candidate-source/.git','candidate-source/.git/HEAD','candidate-source/.git/shallow']:
p=old/name;prior.append({'path':name,'exists':p.exists(),'symlink':p.is_symlink(),'uid':p.stat().st_uid if p.exists() else None})
print('GITEA_BUILD_GIT_DIAG_JSON '+json.dumps({'kind':'FixedBuildGitDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'priorBuildMetadata':prior,'operations':observations,'validatedSourceModified':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37680
|
1
|
1793537031
|
1793537032
|
1793537030
|
1793537032
|
|
0
|
|
0
|
Edit
Delete
|
|
46276
|
26857
|
116
|
5
|
c7d68a55baac98f653785de381d8e38b705e61d1
|
0
|
validate
|
1
|
name: Build validated candidate using isolated tas name: Build validated candidate using isolated task private Git config
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37681
|
1
|
1793537105
|
1793537395
|
1793537105
|
1793537395
|
|
0
|
|
0
|
Edit
Delete
|
|
46277
|
26858
|
116
|
5
|
92a63617fc34559094d2e39f67cfd12131bbcaee
|
0
|
validate
|
1
|
name: Rehearse copied database only after fixed bu name: Rehearse copied database only after fixed build 26857 passes
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-rehearsal.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/rehearse-candidate-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'rehearse-candidate-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37682
|
2
|
1793537396
|
1793537442
|
1793537282
|
1793537443
|
|
0
|
|
0
|
Edit
Delete
|
|
46278
|
26859
|
116
|
5
|
876799432d08424ff9d08fa16ba538fb75dfefcc
|
0
|
validate
|
1
|
name: Finalize migrated private database without r name: Finalize migrated private database without rerunning migration
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-finalize.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/finish-candidate-database-rehearsal.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'finish-candidate-database-rehearsal.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37683
|
2
|
1793537907
|
1793537971
|
1793537906
|
1793537971
|
|
0
|
|
0
|
Edit
Delete
|
|
46279
|
26860
|
116
|
5
|
578b0f3e2fa5d1a0b8c9d70cc909a8ad88fa5e71
|
0
|
inspect
|
1
|
name: Read actual candidate CLI version output onl name: Read actual candidate CLI version output only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-version-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
stored=(base/'build-26857/BINARY_VERSION.stdout').read_text(errors='replace').strip()
r=subprocess.run(['runuser','-u','git','--','env','-i','PATH=/usr/local/bin:/usr/bin:/bin','HOME='+str(base/'candidate-database-rehearsal-26858/git-home'),'USER=git','LOGNAME=git',str(base/'candidate-database-rehearsal-26858/gitea.candidate'),'--version'],capture_output=True,timeout=20)
observed=r.stdout.decode(errors='replace').strip()
def safe(text):
if len(text)>500 or re.search(r'(?i)password|secret|authorization|BEGIN .*PRIVATE KEY|://[^ /]+@',text):return 'OUTPUT_REFUSED'
return text
print('GITEA_CLI_VERSION_DIAG_JSON '+json.dumps({'kind':'CandidateCLIVersionReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'builtVersionOutput':safe(stored),'privateCopyVersionOutput':safe(observed),'exitCode':r.returncode,'screenedStderr':safe(r.stderr.decode(errors='replace').strip()),'databaseWritten':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37684
|
1
|
1793538086
|
1793538086
|
1793538085
|
1793538086
|
|
0
|
|
0
|
Edit
Delete
|
|
46280
|
26861
|
116
|
5
|
c092cf99e8eb7c16356f1be88209c4ebbc12816b
|
0
|
validate
|
1
|
name: Finalize private database with tested actual name: Finalize private database with tested actual CLI version format
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-finalize.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/finish-candidate-database-rehearsal.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'finish-candidate-database-rehearsal.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37685
|
1
|
1793538258
|
1793538352
|
1793538256
|
1793538353
|
|
0
|
|
0
|
Edit
Delete
|
|
37813
|
25331
|
125
|
16
|
958ef4eaa9c5c873973a94474f7ffb6ab9c16cd2
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
31822
|
2
|
1791611084
|
1791611174
|
1791611083
|
1791611175
|
|
0
|
|
0
|
Edit
Delete
|
|
38032
|
25368
|
125
|
16
|
06556f73ea74b431979b8b819de8e85358843b49
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
31959
|
3
|
1791627069
|
1791628278
|
1791626275
|
1791628278
|
|
0
|
|
0
|
Edit
Delete
|
|
39359
|
25576
|
125
|
16
|
4bda2cc02706e1c64d5cd23c233673a0b32d0a72
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
32810
|
2
|
1791733916
|
1791741278
|
1791733915
|
1791741278
|
|
0
|
|
0
|
Edit
Delete
|
|
39612
|
25614
|
125
|
16
|
4bda2cc02706e1c64d5cd23c233673a0b32d0a72
|
0
|
audit
|
1
|
name: dependency-security
"on":
workfl name: dependency-security
"on":
workflow_dispatch:
schedule:
- cron: '0 2 * * 1'
jobs:
audit:
name: audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify -Psecurity-audit dependency-check:aggregate
env:
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
- if: always()
uses: actions/upload-artifact@v4
with:
name: dependency-security
path: target/dependency-check-report.*
timeout-minutes: "45"
permissions:
contents: read
...
|
audit
|
null
|
["ubuntu-latest"]
|
32972
|
2
|
1791770416
|
1791770637
|
1791770415
|
1791770637
|
|
0
|
|
0
|
Edit
Delete
|
|
39730
|
25633
|
125
|
16
|
faac5481c1cca66e4708222686b6588a43938150
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
33081
|
2
|
1791818109
|
1791818322
|
1791818107
|
1791818322
|
|
0
|
|
0
|
Edit
Delete
|
|
40496
|
25776
|
125
|
16
|
85e2c17b4829f451e34f938ca6c11354a0b17f30
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
33397
|
2
|
1791872390
|
1791872616
|
1791852703
|
1791872617
|
|
0
|
|
0
|
Edit
Delete
|
|
40752
|
25818
|
125
|
16
|
ff5ee33515b0a21b6ba738d00c52373fabfaa50d
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
33440
|
3
|
1791877969
|
1791878086
|
1791877967
|
1791878086
|
|
0
|
|
0
|
Edit
Delete
|
|
40753
|
25819
|
125
|
16
|
ff5ee33515b0a21b6ba738d00c52373fabfaa50d
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
33441
|
3
|
1791878088
|
1791878106
|
1791877984
|
1791878106
|
|
0
|
|
0
|
Edit
Delete
|
|
40754
|
25820
|
125
|
16
|
cf70e039ad30edff8e3a51877be4561ed564e95f
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
33442
|
2
|
1791901404
|
1791901619
|
1791901403
|
1791901620
|
|
0
|
|
0
|
Edit
Delete
|
|
40755
|
25821
|
125
|
16
|
695ea4d16f5066a81e3808b0ba4432b2a69cbd87
|
0
|
baseline
|
1
|
name: verify
"on": [push, pull_request]
jo name: verify
"on": [push, pull_request]
jobs:
baseline:
name: baseline
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
cache: maven
distribution: temurin
java-version: "25"
- run: ./mvnw -B -ntp verify
- if: always()
uses: actions/upload-artifact@v4
with:
name: test-reports
path: |
**/target/surefire-reports/*.xml
**/target/failsafe-reports/*.xml
timeout-minutes: "20"
permissions:
contents: read
...
|
baseline
|
null
|
["ubuntu-latest"]
|
33443
|
2
|
1791901620
|
1791901831
|
1791901432
|
1791901831
|
|
0
|
|
0
|
Edit
Delete
|