|
45702
|
26701
|
117
|
5
|
cc86d29cd7c61f8b0e8182d69f26df9d99dc4265
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
37236
|
1
|
1793433390
|
1793433418
|
1793432257
|
1793433418
|
|
0
|
|
0
|
Edit
Delete
|
|
45711
|
26703
|
117
|
5
|
94878611f4b47fcf6276266bdf0b5fb85fd1a29f
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
37240
|
1
|
1793436468
|
1793436487
|
1793434052
|
1793436487
|
|
0
|
|
0
|
Edit
Delete
|
|
45736
|
26707
|
117
|
5
|
57bdcd0f857bce921b0ac500aa30a58f56e7c8a8
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
37243
|
1
|
1793436495
|
1793436511
|
1793436266
|
1793436512
|
|
0
|
|
0
|
Edit
Delete
|
|
45777
|
26713
|
117
|
5
|
96ac7c9a7ec42c334f7704b371b7621f1d8fb36b
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
37290
|
1
|
1793453339
|
1793453356
|
1793453329
|
1793453357
|
|
0
|
|
0
|
Edit
Delete
|
|
45888
|
26731
|
83
|
5
|
5fde73a0bef06f57d7a26283eeb369c65cf309e0
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
37364
|
1
|
1793511169
|
1793511184
|
1793511145
|
1793511185
|
|
0
|
|
0
|
Edit
Delete
|
|
45889
|
26731
|
83
|
5
|
5fde73a0bef06f57d7a26283eeb369c65cf309e0
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
37365
|
1
|
1793511187
|
1793511187
|
1793511145
|
1793511187
|
|
1
|
|
0
|
Edit
Delete
|
|
45940
|
26739
|
83
|
5
|
993f9bcc5a826fea26e142210fc6a8670e9e7b90
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
37409
|
1
|
1793516147
|
1793516161
|
1793516086
|
1793516162
|
|
0
|
|
0
|
Edit
Delete
|
|
45941
|
26739
|
83
|
5
|
993f9bcc5a826fea26e142210fc6a8670e9e7b90
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
37414
|
1
|
1793516289
|
1793516289
|
1793516086
|
1793516289
|
|
1
|
|
0
|
Edit
Delete
|
|
46007
|
26749
|
116
|
5
|
1a6575250e19bdc11d9cb8e08539b1dd7fd86a9b
|
0
|
Observe existing runner maintenance boundary
|
1
|
name: Runner maintenance access diagnostic (read o name: Runner maintenance access diagnostic (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-diagnostic.yml]
workflow_dispatch:
jobs:
observe:
name: Observe existing runner maintenance boundary
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read execution identity and existing service metadata
run: |
set -eu
if ! command -v node >/dev/null 2>&1; then
echo 'RUNNER_MAINTENANCE_READONLY_UNAVAILABLE node-not-installed'
exit 2
fi
node <<'NODE'
const fs = require('node:fs');
const os = require('node:os');
const { spawnSync } = require('node:child_process');
const commands = [];
function run(command, args) {
const allowed = { systemctl: ['list-unit-files', 'show'], docker: ['version', 'info', 'ps', 'inspect'] };
const sudoListOnly = command === 'sudo' && JSON.stringify(args) === '["-n","-l"]';
if (!sudoListOnly && !allowed[command]?.includes(args[0])) throw new Error('READ_ONLY_OPERATION_NOT_ALLOWED');
const r = spawnSync(command, args, { encoding: 'utf8', timeout: 5000, maxBuffer: 256 * 1024, input: '' });
commands.push({ command, args, exitCode: r.status, errorCode: r.error?.code ?? null });
return { ok: r.status === 0, stdout: r.stdout ?? '' };
}
function safePath(value) {
if (typeof value !== 'string' || value.length > 300 || /[\r\n]/.test(value)) return 'UNAVAILABLE';
return /secret|credential|token|password|private/i.test(value) ? 'REDACTED_PRIVATE_PATH' : value;
}
function metadata(path) {
try {
const stat = fs.statSync(path);
const access = mode => { try { fs.accessSync(path, mode); return true; } catch { return false; } };
return { path, exists: true, uid: stat.uid, gid: stat.gid, mode: (stat.mode & 0o777).toString(8),
readable: access(fs.constants.R_OK), writable: access(fs.constants.W_OK),
socket: stat.isSocket(), directory: stat.isDirectory() };
} catch { return { path, exists: false }; }
}
function publicFile(path) {
try { return fs.readFileSync(path, 'utf8').slice(0, 8192); } catch { return null; }
}
const report = {
kind: 'RunnerMaintenanceReadOnlyDiagnostic', schemaVersion: 1, observedAtUTC: new Date().toISOString(),
releaseEligible: false, purpose: 'Execution-boundary and existing maintenance-capability observation only',
ci: { repository: process.env.GITHUB_REPOSITORY ?? null, sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null, rawGithubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
rawGiteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null, runnerName: process.env.RUNNER_NAME ?? null },
execution: { hostname: os.hostname(), platform: os.platform(), arch: os.arch(),
uid: process.getuid?.(), gid: process.getgid?.(), groups: process.getgroups?.(),
rootInExecutionContext: process.getuid?.() === 0,
dockerMarker: fs.existsSync('/.dockerenv'), containerEnvMarker: fs.existsSync('/run/.containerenv'),
pid1Command: publicFile('/proc/1/comm')?.trim() ?? null,
uidMap: publicFile('/proc/self/uid_map')?.trim() ?? null },
commonPathMetadataOnly: [
'/var/run/docker.sock', '/run/docker.sock', '/etc/gitea/app.ini',
'/data/gitea/conf/app.ini', '/var/lib/gitea', '/data/gitea', '/data/git/repositories',
'/etc/act_runner/config.yaml', '/etc/gitea-runner/config.yaml',
].map(metadata),
services: [], docker: { accessible: false, relatedContainers: [] },
nonInteractiveSudo: { listingAvailable: false, unrestrictedRuleObserved: false, relevantCommandNames: [] },
};
const osRelease = publicFile('/etc/os-release');
report.execution.osName = osRelease?.match(/^PRETTY_NAME="?([^"\n]+)"?$/m)?.[1] ?? null;
const units = run('systemctl', ['list-unit-files', '--type=service', '--no-legend', '--no-pager']);
if (units.ok) {
const names = units.stdout.split('\n').map(l => l.trim().split(/\s+/)[0])
.filter(n => /^(?:gitea|act[-_]?runner|gitea[-_]?runner)[\w@.-]*\.service$/i.test(n)).slice(0, 20);
for (const name of names) {
const r = run('systemctl', ['show', name, '--no-pager', '--property=LoadState,ActiveState,FragmentPath,User']);
const properties = {};
if (r.ok) for (const line of r.stdout.split('\n')) {
const m = /^(LoadState|ActiveState|FragmentPath|User)=(.*)$/.exec(line);
if (m) properties[m[1]] = m[1] === 'FragmentPath' ? safePath(m[2]) : m[2].slice(0, 150);
}
report.services.push({ name, querySucceeded: r.ok, properties });
}
}
const sudo = run('sudo', ['-n', '-l']);
report.nonInteractiveSudo.listingAvailable = sudo.ok;
if (sudo.ok) {
report.nonInteractiveSudo.unrestrictedRuleObserved = /^\s*\([^)\n]+\)\s*(?:NOPASSWD:\s*)?ALL\s*$/m.test(sudo.stdout);
report.nonInteractiveSudo.relevantCommandNames = ['systemctl','docker','podman','pg_dump','pg_restore','mysqldump','gitea','act_runner','gitea-runner']
.filter(n => sudo.stdout.includes(n));
}
const version = run('docker', ['version', '--format', '{{.Server.Version}}']);
report.docker.accessible = version.ok;
report.docker.serverVersion = version.ok ? version.stdout.trim().slice(0, 80) : null;
if (version.ok) {
const info = run('docker', ['info', '--format', '{{json .Name}}']);
if (info.ok) { try { report.docker.daemonName = JSON.parse(info.stdout); } catch {} }
const list = run('docker', ['ps', '-a', '--format', '{{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}']);
if (list.ok) for (const line of list.stdout.split('\n')) {
const [id, name, image, status] = line.split('\t');
if (!/^[a-f0-9]{12,64}$/.test(id ?? '') || !/gitea|act[-_]?runner|gitea[-_]?runner/i.test((name ?? '') + ' ' + (image ?? ''))) continue;
if (report.docker.relatedContainers.length >= 15) break;
const container = { id, name, image, status };
const mounts = run('docker', ['inspect', '--format', '{{json .Mounts}}', id]);
if (mounts.ok) {
try { container.mounts = JSON.parse(mounts.stdout).map(m => ({
type: m.Type, source: safePath(m.Source), destination: safePath(m.Destination), rw: m.RW,
})); } catch { container.mounts = 'UNPARSEABLE'; }
}
const workingDir = run('docker', ['inspect', '--format', '{{index .Config.Labels "com.docker.compose.project.working_dir"}}', id]);
if (workingDir.ok) container.composeWorkingDirectory = safePath(workingDir.stdout.trim());
const configFiles = run('docker', ['inspect', '--format', '{{index .Config.Labels "com.docker.compose.project.config_files"}}', id]);
if (configFiles.ok) container.composeConfigFiles = safePath(configFiles.stdout.trim());
report.docker.relatedContainers.push(container);
}
}
report.commands = commands;
report.boundaries = {
repositorySecretsRequested: false, environmentDumped: false, secretConfigContentsRead: false,
dockerEnvironmentInspected: false, privilegedServiceCommandExecuted: false, dockerMutationExecuted: false,
credentialOrPermissionChanges: false, arbitraryNetworkProbes: false, backupsOrServiceChanges: false,
contextRootOrDockerAccessIsNotProofOfGiteaHostOwnership: true,
};
report.conclusion = 'DIAGNOSTIC_ONLY: maintenance admission requires verified target, authorized service control, complete storage inventory and tested backup/restore; unknowns are not passes';
console.log('RUNNER_MAINTENANCE_READONLY_JSON ' + JSON.stringify(report));
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37471
|
1
|
1793520113
|
1793520116
|
1793519845
|
1793520116
|
|
0
|
|
0
|
Edit
Delete
|
|
46008
|
26750
|
116
|
5
|
b2cff86c1cba9e7f9bc40991ed1abc1e73cc281c
|
0
|
Read existing Gitea and runner service layout
|
1
|
name: Runner maintenance inventory (read only)
name: Runner maintenance inventory (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-inventory.yml]
workflow_dispatch:
jobs:
inventory:
name: Read existing Gitea and runner service layout
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read whitelisted deployment metadata without secret output
run: |
set -eu
node <<'NODE'
const fs = require('node:fs');
const path = require('node:path');
const os = require('node:os');
const { spawnSync } = require('node:child_process');
if (process.getuid?.() !== 0 || os.hostname() !== 'iZ2zed3pt2nygf9dy1a9d2Z') throw new Error('EXPECTED_RUNNER_HOST_IDENTITY_REQUIRED');
const commands = [];
function run(command, args) {
const allowed = ['systemctl','sha256sum','df','ps','go','git','getent'];
const versionOnly = path.isAbsolute(command) && args.length === 1 && args[0] === '--version';
if (!allowed.includes(command) && !versionOnly) throw new Error('READ_ONLY_COMMAND_NOT_ALLOWED');
const r = spawnSync(command, args, { encoding:'utf8', timeout:8000, maxBuffer:256*1024, input:'' });
// Never log argv/stdout: startup definitions may contain sensitive values.
commands.push({ command: path.isAbsolute(command) ? path.basename(command) : command, exitCode:r.status, errorCode:r.error?.code ?? null });
return { ok:r.status === 0, stdout:r.stdout ?? '' };
}
function publicPath(p) {
return typeof p === 'string' && p.length <= 400 && !/[\r\n]/.test(p) && !/secret|credential|token|password|private/i.test(p) ? p : 'REDACTED_OR_INVALID_PATH';
}
function meta(p) {
try { const s=fs.statSync(p);return {path:publicPath(p),exists:true,uid:s.uid,gid:s.gid,mode:(s.mode&0o777).toString(8),bytes:s.size,directory:s.isDirectory()}; }
catch { return {path:publicPath(p),exists:false}; }
}
function link(p) { try{return fs.readlinkSync(p);}catch{return null;} }
function splitArgs(s) { return (s.match(/"[^"]*"|'[^']*'|[^\s]+/g) ?? []).map(x=>x.replace(/^(['"])(.*)\1$/,'$2')); }
function flag(args,names) {
for(let i=0;i<args.length;i++) for(const n of names) {
if(args[i]===n) return args[i+1] ?? null;
if(args[i].startsWith(n+'=')) return args[i].slice(n.length+1);
}
return null;
}
const report={kind:'RunnerMaintenanceServiceInventory',schemaVersion:1,observedAtUTC:new Date().toISOString(),
releaseEligible:false,ci:{sourceSha:process.env.GITHUB_SHA??null,runId:process.env.GITHUB_RUN_ID??null},
hostname:os.hostname(),services:[],configs:[],paths:[],sourceTrees:[],tools:{},commands};
const units=['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','gitea-webhook.service'];
let giteaArgs=[],giteaBase=null,giteaConfig=null,runnerDir=null;
for(const unit of units) {
const r=run('systemctl',['show',unit,'--no-pager','--property=User,WorkingDirectory,ExecStart,MainPID,FragmentPath,RootDirectory,RootImage']);
if(!r.ok){report.services.push({unit,querySucceeded:false});continue;}
const p={};
for(const l of r.stdout.split('\n')) {const i=l.indexOf('=');if(i>=0)p[l.slice(0,i)]=l.slice(i+1);}
const start=p.ExecStart??'';
const executable=/\bpath=([^ ;]+)\s*;/.exec(start)?.[1] ?? null;
const argv=/argv\[\]=(.*?)\s*;\s*ignore_errors=/s.exec(start)?.[1] ?? '';
const args=splitArgs(argv);
const pid=/^[1-9][0-9]*$/.test(p.MainPID??'')?p.MainPID:null;
const actualExe=pid?link('/proc/'+pid+'/exe'):null;
const actualCwd=pid?link('/proc/'+pid+'/cwd'):null;
const item={unit,user:p.User??null,workingDirectory:publicPath(p.WorkingDirectory??''),
unitFile:publicPath(p.FragmentPath??''),rootDirectory:publicPath(p.RootDirectory??''),
rootImage:publicPath(p.RootImage??''),executable:executable?publicPath(executable):null,
processExecutable:actualExe?publicPath(actualExe):null,processWorkingDirectory:actualCwd?publicPath(actualCwd):null,
scripts:args.filter(x=>path.isAbsolute(x)&&/\.(?:py|js|mjs|cjs|sh)$/.test(x)).map(publicPath),
configFlag:flag(args,['--config','-c'])?publicPath(flag(args,['--config','-c'])):null};
if(unit==='gitea.service'||unit==='gitea-runner.service') {
const binary=actualExe && !actualExe.endsWith(' (deleted)')?actualExe:executable;
if(binary&&path.isAbsolute(binary)&&fs.existsSync(binary)){
const sum=run('sha256sum',[binary]);item.binarySha256=sum.ok?sum.stdout.match(/^[a-f0-9]{64}/)?.[0]??null:null;
const version=run(binary,['--version']);item.version=version.ok?version.stdout.trim().slice(0,400):null;
const go=run('go',['version','-m',binary]);
item.goBuild=go.ok?go.stdout.split('\n').map(l=>l.trim()).filter(l=>/^(?:path|mod)\s+(?:code\.gitea\.io|github\.com\/go-gitea|gitea\.com\/gitea)/.test(l)||/^build\s+vcs(?:\.revision|\.time|\.modified)?=/.test(l)):null;
}
}
report.services.push(item);
if(unit==='gitea.service'){
giteaArgs=args;giteaBase=flag(args,['--work-path','-w'])||actualCwd||p.WorkingDirectory||path.dirname(executable??'/');
giteaConfig=flag(args,['--config','-c']);
}
if(unit==='gitea-runner.service')runnerDir=actualCwd||p.WorkingDirectory;
}
if(giteaConfig && !path.isAbsolute(giteaConfig))giteaConfig=path.resolve(giteaBase,giteaConfig);
const configCandidates=[giteaConfig,path.join(giteaBase||'/nonexistent','custom/conf/app.ini'),
'/etc/gitea/app.ini','/home/git/gitea/custom/conf/app.ini','/home/git/gitea/conf/app.ini'].filter(Boolean);
const safeKeys={
database:['DB_TYPE','HOST','NAME','USER','PATH','SCHEMA','SSL_MODE','CHARSET'],
server:['APP_DATA_PATH','ROOT_URL','DOMAIN','HTTP_ADDR','HTTP_PORT','SSH_DOMAIN','SSH_PORT','START_SSH_SERVER','LOCAL_ROOT_URL'],
repository:['ROOT'],actions:['ENABLED','DEFAULT_ACTIONS_URL','MAX_RERUN_ATTEMPTS','ARTIFACT_RETENTION_DAYS'],
log:['MODE','ROOT_PATH'],
};
const storageKeys=['STORAGE_TYPE','PATH','MINIO_ENDPOINT','MINIO_BUCKET','MINIO_BASE_PATH','MINIO_LOCATION','MINIO_USE_SSL','SERVE_DIRECT'];
const configPaths=new Set();
for(const p of [...new Set(configCandidates)]) {
report.paths.push(meta(p));
if(!fs.existsSync(p)||!fs.statSync(p).isFile()||fs.statSync(p).size>1024*1024)continue;
if(/\/(?:\.secrets|\.evidence-private)\//.test(p))throw new Error('RESTRICTED_PATH_REFUSED');
const ini=fs.readFileSync(p,'utf8');let section='DEFAULT';const selected={};
for(const line of ini.split('\n')) {
const s=line.trim();if(!s||s.startsWith(';')||s.startsWith('#'))continue;
const h=/^\[([^\]]+)\]$/.exec(s);if(h){section=h[1].toLowerCase();continue;}
const m=/^([A-Za-z0-9_]+)\s*=\s*(.*)$/.exec(s);if(!m)continue;
const key=m[1].toUpperCase();
const storage=/^(?:storage(?:\.|$)|lfs$|attachment$|packages$)/.test(section);
if(!(safeKeys[section]??[]).includes(key)&&!(storage&&storageKeys.includes(key)))continue;
let value=m[2].trim().replace(/^(['"])(.*)\1$/,'$2');
if(/PASSW|TOKEN|SECRET|CREDENTIAL|PRIVATE_KEY/i.test(value)){value='REDACTED_SENSITIVE_REFERENCE';}
else if(value.includes('@')){value=value.replace(/[^/@\s]+@/g,'REDACTED@');}
(selected[section]??={})[key]=value.slice(0,500);
if((key==='PATH'||key==='ROOT'||key==='APP_DATA_PATH'||key==='ROOT_PATH')&&path.isAbsolute(value))configPaths.add(value);
}
const sum=run('sha256sum',[p]);
report.configs.push({path:publicPath(p),sha256:sum.ok?sum.stdout.match(/^[a-f0-9]{64}/)?.[0]??null:null,selectedNonSecretFields:selected});
}
for(const p of configPaths)report.paths.push(meta(p));
if(runnerDir){report.runnerWorkingDirectory=publicPath(runnerDir);report.runnerRegistrationMetadataOnly=meta(path.join(runnerDir,'.runner'));}
for(const dir of [...new Set([giteaBase,runnerDir].filter(Boolean))]){
const git=run('git',['-C',dir,'rev-parse','--show-toplevel']);
if(!git.ok)continue;
const root=git.stdout.trim();const head=run('git',['-C',root,'rev-parse','HEAD']);
const status=run('git',['--no-optional-locks','-C',root,'status','--porcelain','--untracked-files=no']);
report.sourceTrees.push({root:publicPath(root),head:head.ok?head.stdout.trim():null,trackedDirty:status.ok?status.stdout.trim().length>0:null});
}
const processes=run('ps',['-eo','pid=,comm=']);
report.relevantProcessNames=processes.ok?processes.stdout.split('\n').map(l=>l.trim().split(/\s+/)).filter(a=>/^(?:postgres|mysqld|mariadbd|sqlite3|gitea|act_runner|gitea-runner|nginx)$/.test(a[1]??'')).map(a=>({pid:Number(a[0]),command:a[1]})).slice(0,30):[];
const disk=run('df',['-Pk','/']);
report.rootFilesystem=disk.ok?disk.stdout.trim().split('\n').slice(-1)[0].trim().split(/\s+/).slice(1,6):null;
for(const tool of ['pg_dump','pg_restore','mysqldump','mariadb-dump','sqlite3','python3','tar','unzip','curl','git','go']){
report.tools[tool]=['/usr/bin/','/usr/local/bin/','/bin/'].map(p=>p+tool).find(p=>fs.existsSync(p))??null;
}
report.boundaries={configBodyPrinted:false,secretValuesPrinted:false,environmentRead:false,registrationBodyRead:false,serviceChanges:false,backupsOrUpgrades:false};
report.conclusion='READ_ONLY_INVENTORY_ONLY: target/storage/backup-restore and fixed-version compatibility still require verification before maintenance';
console.log('RUNNER_MAINTENANCE_INVENTORY_JSON '+JSON.stringify(report));
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37478
|
1
|
1793520334
|
1793520336
|
1793520334
|
1793520336
|
|
0
|
|
0
|
Edit
Delete
|
|
46010
|
26752
|
116
|
5
|
d55b0f60f2be02e655419627c2cdbc4a428a721a
|
0
|
Verify actual storage capacity and schema metadata
|
1
|
name: Runner maintenance storage preflight (read o name: Runner maintenance storage preflight (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-preflight.yml]
workflow_dispatch:
jobs:
preflight:
name: Verify actual storage capacity and schema metadata
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read storage sizes and public build metadata
run: |
set -eu
python3 <<'PY'
import configparser, datetime, hashlib, json, mmap, os, pathlib, socket, sqlite3, struct, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z': raise RuntimeError('EXPECTED_HOST_REQUIRED')
config_path=pathlib.Path('/home/git/gitea/config/app.ini')
if hashlib.sha256(config_path.read_bytes()).hexdigest()!='8923b93032ec5c303317b02a7011f756c0ee8e6c2756d4cd4286dd9b5c54d072': raise RuntimeError('CONFIG_CHANGED_REINVENTORY_REQUIRED')
report={'kind':'RunnerMaintenanceStoragePreflight','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sizes':[],'storageSections':[]}
def command(args,timeout=40):
r=subprocess.run(args,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=timeout)
return r.returncode,r.stdout
for p in ['/home/git/gitea','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/root/gitea-ext','/root/gitea-code-review']:
if not pathlib.Path(p).exists(): continue
code,out=command(['du','-sx','--block-size=1',p])
report['sizes'].append({'path':p,'bytes':int(out.split()[0]) if code==0 else None,'exitCode':code})
st=os.statvfs('/')
report['rootFilesystem']={'availableBytes':st.f_bavail*st.f_frsize,'totalBytes':st.f_blocks*st.f_frsize}
# Gitea INI permits top-level APP_NAME/RUN_USER before its first section.
cfg=configparser.RawConfigParser(strict=False);cfg.read_string('[DEFAULT]\n'+config_path.read_text())
for section in cfg.sections():
if section.lower().startswith(('storage','lfs','attachment','packages','actions')):
report['storageSections'].append({'section':section,'keys':[k for k in cfg[section] if not any(x in k.lower() for x in ['secret','password','token','access_key'])]})
db='/home/git/gitea/data/gitea.db'
connection=sqlite3.connect('file:'+db+'?mode=ro',uri=True,timeout=10)
connection.execute('PRAGMA query_only=ON')
tables={r[0] for r in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
report['database']={'path':db,'sqliteVersion':sqlite3.sqlite_version,'tableCount':len(tables),'hasAttemptTable':'action_run_attempt' in tables}
if 'version' in tables:
columns=[r[1] for r in connection.execute('PRAGMA table_info("version")')]
col=next((x for x in columns if x.lower()=='version'),None)
if col: report['database']['schemaVersions']=[r[0] for r in connection.execute('SELECT "'+col.replace('"','""')+'" FROM "version" LIMIT 5')]
report['database']['journalMode']=connection.execute('PRAGMA journal_mode').fetchone()[0]
connection.close()
def go_build(path):
try:
with open(path,'rb') as f, mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0:return {'format':'not-found'}
ptr_size=data[at+14];flags=data[at+15]
if not flags&2:return {'format':'pointer-layout','pointerSize':ptr_size,'flags':flags}
pos=at+32
def readvar(pos):
value=0;shift=0
for i in range(10):
b=data[pos];pos+=1;value|=(b&127)<<shift
if b<128:return value,pos
shift+=7
raise ValueError('invalid-varint')
size,pos=readvar(pos);version=bytes(data[pos:pos+size]).decode(errors='replace');pos+=size
size,pos=readvar(pos);mod=bytes(data[pos:pos+size]).decode(errors='replace')
selected=[]
for line in mod.splitlines():
if line.startswith('path\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('mod\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('build\tvcs'): selected.append(line[:200])
return {'format':'inline','goVersion':version,'selectedModuleFields':selected}
except Exception as e:return {'errorClass':type(e).__name__}
report['giteaGoBuild']=go_build('/usr/local/bin/gitea')
report['runnerGoBuild']=go_build('/opt/gitea-runner/act-runner')
for p in ['/home/git/gitea/custom','/home/git/gitea/config','/usr/local/bin/data','/opt/gitea-runner']:
root=pathlib.Path(p)
if not root.is_dir():continue
children=[]
for child in sorted(root.iterdir()):
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','token','password','credential','private']):continue
if p=='/opt/gitea-runner' and child.name not in ['config.yaml','config.yml','act-runner','act_runner']:continue
children.append({'name':child.name,'directory':child.is_dir(),'bytes':child.stat().st_size})
report.setdefault('layoutMetadata',[]).append({'path':p,'children':children[:30]})
report['boundaries']={'serviceChanges':False,'dataWrites':False,'secretValuesPrinted':False,'backupsOrUpgrades':False}
print('RUNNER_MAINTENANCE_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
preflight
|
null
|
["ubuntu-latest"]
|
37480
|
1
|
1793520610
|
1793520612
|
1793520609
|
1793520612
|
|
0
|
|
0
|
Edit
Delete
|
|
46011
|
26753
|
116
|
5
|
43749e863bb29a4099fef7730f962c9bde7ba4ba
|
0
|
Verify actual storage capacity and schema metadata
|
1
|
name: Runner maintenance storage preflight (read o name: Runner maintenance storage preflight (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-preflight.yml]
workflow_dispatch:
jobs:
preflight:
name: Verify actual storage capacity and schema metadata
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read storage sizes and public build metadata
run: |
set -eu
python3 <<'PY'
import configparser, datetime, hashlib, json, mmap, os, pathlib, socket, sqlite3, struct, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z': raise RuntimeError('EXPECTED_HOST_REQUIRED')
config_path=pathlib.Path('/home/git/gitea/config/app.ini')
if hashlib.sha256(config_path.read_bytes()).hexdigest()!='8923b93032ec5c303317b02a7011f756c0ee8e6c2756d4cd4286dd9b5c54d072': raise RuntimeError('CONFIG_CHANGED_REINVENTORY_REQUIRED')
report={'kind':'RunnerMaintenanceStoragePreflight','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sizes':[],'storageSections':[]}
def command(args,timeout=40):
r=subprocess.run(args,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=timeout)
return r.returncode,r.stdout
for p in ['/home/git/gitea','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/root/gitea-ext','/root/gitea-code-review']:
if not pathlib.Path(p).exists(): continue
code,out=command(['du','-sx','--block-size=1',p])
report['sizes'].append({'path':p,'bytes':int(out.split()[0]) if code==0 else None,'exitCode':code})
st=os.statvfs('/')
report['rootFilesystem']={'availableBytes':st.f_bavail*st.f_frsize,'totalBytes':st.f_blocks*st.f_frsize}
# Gitea INI permits top-level APP_NAME/RUN_USER before its first section.
cfg=configparser.RawConfigParser(strict=False);cfg.read_string('[DEFAULT]\n'+config_path.read_text())
for section in cfg.sections():
if section.lower().startswith(('storage','lfs','attachment','packages','actions')):
report['storageSections'].append({'section':section,'keys':[k for k in cfg[section] if not any(x in k.lower() for x in ['secret','password','token','access_key'])]})
db='/home/git/gitea/data/gitea.db'
connection=sqlite3.connect('file:'+db+'?mode=ro',uri=True,timeout=10)
connection.execute('PRAGMA query_only=ON')
tables={r[0] for r in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
report['database']={'path':db,'sqliteVersion':sqlite3.sqlite_version,'tableCount':len(tables),'hasAttemptTable':'action_run_attempt' in tables}
if 'version' in tables:
columns=[r[1] for r in connection.execute('PRAGMA table_info("version")')]
col=next((x for x in columns if x.lower()=='version'),None)
if col: report['database']['schemaVersions']=[r[0] for r in connection.execute('SELECT "'+col.replace('"','""')+'" FROM "version" LIMIT 5')]
report['database']['journalMode']=connection.execute('PRAGMA journal_mode').fetchone()[0]
connection.close()
def go_build(path):
try:
with open(path,'rb') as f, mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0:return {'format':'not-found'}
ptr_size=data[at+14];flags=data[at+15]
if not flags&2:return {'format':'pointer-layout','pointerSize':ptr_size,'flags':flags}
pos=at+32
def readvar(pos):
value=0;shift=0
for i in range(10):
b=data[pos];pos+=1;value|=(b&127)<<shift
if b<128:return value,pos
shift+=7
raise ValueError('invalid-varint')
size,pos=readvar(pos);version=bytes(data[pos:pos+size]).decode(errors='replace');pos+=size
size,pos=readvar(pos);mod=bytes(data[pos:pos+size]).decode(errors='replace')
selected=[]
for line in mod.splitlines():
if line.startswith('path\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('mod\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('build\tvcs'): selected.append(line[:200])
return {'format':'inline','goVersion':version,'selectedModuleFields':selected}
except Exception as e:return {'errorClass':type(e).__name__}
report['giteaGoBuild']=go_build('/usr/local/bin/gitea')
report['runnerGoBuild']=go_build('/opt/gitea-runner/act-runner')
for p in ['/home/git/gitea/custom','/home/git/gitea/config','/usr/local/bin/data','/opt/gitea-runner']:
root=pathlib.Path(p)
if not root.is_dir():continue
children=[]
for child in sorted(root.iterdir()):
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','token','password','credential','private']):continue
if p=='/opt/gitea-runner' and child.name not in ['config.yaml','config.yml','act-runner','act_runner']:continue
children.append({'name':child.name,'directory':child.is_dir(),'bytes':child.stat().st_size})
report.setdefault('layoutMetadata',[]).append({'path':p,'children':children[:30]})
report['sourceCandidates']=[]
for base in ['/root','/opt','/home/git','/usr/local/src','/srv']:
root=pathlib.Path(base)
if not root.is_dir():continue
for candidate in root.iterdir():
if not candidate.is_dir() or 'gitea' not in candidate.name.lower() or candidate.name.startswith('.'):continue
for project in [candidate,candidate/'gitea',candidate/'src']:
if not (project/'.git').exists():continue
code,head=command(['git','--no-optional-locks','-C',str(project),'rev-parse','HEAD'])
sc,dirty=command(['git','--no-optional-locks','-C',str(project),'status','--porcelain','--untracked-files=no'])
rc,origin=command(['git','--no-optional-locks','-C',str(project),'remote','get-url','origin'])
import re
safe_origin=re.sub(r'://[^/@]+@','://REDACTED@',origin.strip()).split('?',1)[0]
report['sourceCandidates'].append({'path':str(project),'head':head.strip() if code==0 else None,'trackedDirty':bool(dirty.strip()) if sc==0 else None,'origin':safe_origin if rc==0 else None})
report['sizeBreakdown']=[]
for parent in ['/home/git/gitea','/root/gitea-code-review']:
for child in pathlib.Path(parent).iterdir():
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','credential','token','password','private']):continue
if not child.is_dir():continue
code,out=command(['du','-sx','--block-size=1',str(child)])
report['sizeBreakdown'].append({'path':str(child),'bytes':int(out.split()[0]) if code==0 else None})
cfgfile=pathlib.Path('/opt/gitea-runner/config.yaml')
if cfgfile.is_file():
selected={};parent=None
allowed={'log':{'level'},'runner':{'capacity','timeout','shutdown_timeout','fetch_timeout','fetch_interval','file'},'container':{'network','privileged','docker_host'},'cache':{'enabled','dir','host','port'}}
for line in cfgfile.read_text().splitlines():
if not line.strip() or line.lstrip().startswith('#'):continue
if not line.startswith((' ','\t')):parent=line.split(':',1)[0].strip();continue
if ':' not in line:continue
key,value=line.strip().split(':',1)
if key in allowed.get(parent,set()):selected[parent+'.'+key]=value.strip()[:200]
report['runnerConfigWhitelist']=selected
report['boundaries']={'serviceChanges':False,'dataWrites':False,'secretValuesPrinted':False,'backupsOrUpgrades':False}
print('RUNNER_MAINTENANCE_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
preflight
|
null
|
["ubuntu-latest"]
|
37481
|
1
|
1793520767
|
1793520770
|
1793520766
|
1793520770
|
|
0
|
|
0
|
Edit
Delete
|
|
46020
|
26755
|
116
|
5
|
f24a6b3ed9c82f3ee43458ef7d9f61ba6eab585b
|
0
|
Verify actual storage capacity and schema metadata
|
1
|
name: Runner maintenance storage preflight (read o name: Runner maintenance storage preflight (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-preflight.yml]
workflow_dispatch:
jobs:
preflight:
name: Verify actual storage capacity and schema metadata
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read storage sizes and public build metadata
run: |
set -eu
python3 <<'PY'
import configparser, datetime, hashlib, json, mmap, os, pathlib, socket, sqlite3, struct, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z': raise RuntimeError('EXPECTED_HOST_REQUIRED')
config_path=pathlib.Path('/home/git/gitea/config/app.ini')
if hashlib.sha256(config_path.read_bytes()).hexdigest()!='8923b93032ec5c303317b02a7011f756c0ee8e6c2756d4cd4286dd9b5c54d072': raise RuntimeError('CONFIG_CHANGED_REINVENTORY_REQUIRED')
report={'kind':'RunnerMaintenanceStoragePreflight','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sizes':[],'storageSections':[]}
def command(args,timeout=40):
r=subprocess.run(args,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=timeout)
return r.returncode,r.stdout
for p in ['/home/git/gitea','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/root/gitea-ext','/root/gitea-code-review']:
if not pathlib.Path(p).exists(): continue
code,out=command(['du','-sx','--block-size=1',p])
report['sizes'].append({'path':p,'bytes':int(out.split()[0]) if code==0 else None,'exitCode':code})
st=os.statvfs('/')
report['rootFilesystem']={'availableBytes':st.f_bavail*st.f_frsize,'totalBytes':st.f_blocks*st.f_frsize}
# Gitea INI permits top-level APP_NAME/RUN_USER before its first section.
cfg=configparser.RawConfigParser(strict=False);cfg.read_string('[DEFAULT]\n'+config_path.read_text())
for section in cfg.sections():
if section.lower().startswith(('storage','lfs','attachment','packages','actions')):
report['storageSections'].append({'section':section,'keys':[k for k in cfg[section] if not any(x in k.lower() for x in ['secret','password','token','access_key'])]})
db='/home/git/gitea/data/gitea.db'
connection=sqlite3.connect('file:'+db+'?mode=ro',uri=True,timeout=10)
connection.execute('PRAGMA query_only=ON')
tables={r[0] for r in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
report['database']={'path':db,'sqliteVersion':sqlite3.sqlite_version,'tableCount':len(tables),'hasAttemptTable':'action_run_attempt' in tables}
if 'version' in tables:
columns=[r[1] for r in connection.execute('PRAGMA table_info("version")')]
col=next((x for x in columns if x.lower()=='version'),None)
if col: report['database']['schemaVersions']=[r[0] for r in connection.execute('SELECT "'+col.replace('"','""')+'" FROM "version" LIMIT 5')]
report['database']['journalMode']=connection.execute('PRAGMA journal_mode').fetchone()[0]
connection.close()
def go_build(path):
try:
with open(path,'rb') as f, mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0:return {'format':'not-found'}
ptr_size=data[at+14];flags=data[at+15]
if not flags&2:return {'format':'pointer-layout','pointerSize':ptr_size,'flags':flags}
pos=at+32
def readvar(pos):
value=0;shift=0
for i in range(10):
b=data[pos];pos+=1;value|=(b&127)<<shift
if b<128:return value,pos
shift+=7
raise ValueError('invalid-varint')
size,pos=readvar(pos);version=bytes(data[pos:pos+size]).decode(errors='replace');pos+=size
size,pos=readvar(pos);mod=bytes(data[pos:pos+size]).decode(errors='replace')
selected=[]
for line in mod.splitlines():
if line.startswith('path\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('mod\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('build\tvcs'): selected.append(line[:200])
return {'format':'inline','goVersion':version,'selectedModuleFields':selected}
except Exception as e:return {'errorClass':type(e).__name__}
report['giteaGoBuild']=go_build('/usr/local/bin/gitea')
report['runnerGoBuild']=go_build('/opt/gitea-runner/act-runner')
for p in ['/home/git/gitea/custom','/home/git/gitea/config','/usr/local/bin/data','/opt/gitea-runner']:
root=pathlib.Path(p)
if not root.is_dir():continue
children=[]
for child in sorted(root.iterdir()):
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','token','password','credential','private']):continue
if p=='/opt/gitea-runner' and child.name not in ['config.yaml','config.yml','act-runner','act_runner']:continue
children.append({'name':child.name,'directory':child.is_dir(),'bytes':child.stat().st_size})
report.setdefault('layoutMetadata',[]).append({'path':p,'children':children[:30]})
report['sourceCandidates']=[]
for base in ['/root','/opt','/home/git','/usr/local/src','/srv']:
root=pathlib.Path(base)
if not root.is_dir():continue
for candidate in root.iterdir():
if not candidate.is_dir() or 'gitea' not in candidate.name.lower() or candidate.name.startswith('.'):continue
for project in [candidate,candidate/'gitea',candidate/'src']:
if not (project/'.git').exists():continue
code,head=command(['git','--no-optional-locks','-C',str(project),'rev-parse','HEAD'])
sc,dirty=command(['git','--no-optional-locks','-C',str(project),'status','--porcelain','--untracked-files=no'])
rc,origin=command(['git','--no-optional-locks','-C',str(project),'remote','get-url','origin'])
import re
safe_origin=re.sub(r'://[^/@]+@','://REDACTED@',origin.strip()).split('?',1)[0]
dc,delta=command(['git','--no-optional-locks','-C',str(project),'diff','--numstat'])
changed=[]
if dc==0:
for row in delta.splitlines():
fields=row.split('\t',2)
if len(fields)!=3:continue
name=fields[2]
if any(x in name.lower() for x in ['secret','credential','token','password','private','.env']):name='REDACTED_SENSITIVE_PATH'
changed.append({'added':fields[0],'removed':fields[1],'path':name})
report['sourceCandidates'].append({'path':str(project),'head':head.strip() if code==0 else None,'trackedDirty':bool(dirty.strip()) if sc==0 else None,'origin':safe_origin if rc==0 else None,'changedFiles':changed[:60]})
report['sizeBreakdown']=[]
for parent in ['/home/git/gitea','/root/gitea-code-review']:
for child in pathlib.Path(parent).iterdir():
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','credential','token','password','private']):continue
if not child.is_dir():continue
code,out=command(['du','-sx','--block-size=1',str(child)])
report['sizeBreakdown'].append({'path':str(child),'bytes':int(out.split()[0]) if code==0 else None})
cfgfile=pathlib.Path('/opt/gitea-runner/config.yaml')
if cfgfile.is_file():
selected={};parent=None
allowed={'log':{'level'},'runner':{'capacity','timeout','shutdown_timeout','fetch_timeout','fetch_interval','file'},'container':{'network','privileged','docker_host'},'cache':{'enabled','dir','host','port'}}
for line in cfgfile.read_text().splitlines():
if not line.strip() or line.lstrip().startswith('#'):continue
if not line.startswith((' ','\t')):parent=line.split(':',1)[0].strip();continue
if ':' not in line:continue
key,value=line.strip().split(':',1)
if key in allowed.get(parent,set()):selected[parent+'.'+key]=value.strip()[:200]
report['runnerConfigWhitelist']=selected
report['extraTools']={}
for executable in ['/usr/local/go/bin/go','/usr/bin/node','/usr/bin/gpg','/usr/bin/zstd','/usr/bin/nsenter','/usr/bin/systemd-run']:
if not pathlib.Path(executable).is_file():continue
args=[executable,'version'] if executable.endswith('/go') else [executable,'--version']
code,version=command(args,timeout=10)
report['extraTools'][executable]={'exists':True,'versionFirstLine':version.splitlines()[0][:200] if code==0 and version.splitlines() else None}
import urllib.request,urllib.error,re
report['officialChecksumReachability']=[]
for url in ['https://dl.gitea.com/gitea/28.2.0/gitea-28.2.0-linux-amd64.sha256','https://dl.gitea.com/gitea-runner/5.0.0/gitea-runner-5.0.0-linux-amd64.sha256']:
item={'url':url}
try:
with urllib.request.urlopen(url,timeout=15) as response:
body=response.read(4096).decode();item['httpStatus']=response.status
match=re.search(r'\b[a-f0-9]{64}\b',body);item['sha256']=match.group(0) if match else None
except Exception as error:item.update({'errorClass':type(error).__name__,'httpStatus':getattr(error,'code',None)})
report['officialChecksumReachability'].append(item)
report['boundaries']={'serviceChanges':False,'dataWrites':False,'secretValuesPrinted':False,'backupsOrUpgrades':False}
print('RUNNER_MAINTENANCE_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
preflight
|
null
|
["ubuntu-latest"]
|
37490
|
1
|
1793520919
|
1793520926
|
1793520918
|
1793520927
|
|
0
|
|
0
|
Edit
Delete
|
|
46037
|
26758
|
116
|
5
|
02740b6b7da73e4541fa136c6ef7a6ae003c0f67
|
0
|
Verify current custom build without service change Verify current custom build without service changes...
|
1
|
name: Gitea offline build identity check
"on&# name: Gitea offline build identity check
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-offline-repro.yml]
workflow_dispatch:
jobs:
reproduce:
name: Verify current custom build without service changes
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce offline in private resource-limited workspace
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, mmap, os, pathlib, socket, subprocess, re
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
source=pathlib.Path('/root/gitea-src')
binary=pathlib.Path('/usr/local/bin/gitea')
def sha(p):
h=hashlib.sha256()
with open(p,'rb') as f:
for b in iter(lambda:f.read(1024*1024),b''):h.update(b)
return h.hexdigest()
if sha(binary)!='640efd1256fe5ace902a1185bd6fdedd063ec1eec08422aceded8cc9559a8dc9':raise RuntimeError('RUNNING_BINARY_CHANGED')
with open(binary,'rb') as f,mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0 or not data[at+15]&2:raise RuntimeError('INLINE_BUILD_INFO_REQUIRED')
def varint(pos):
n=0;shift=0
for i in range(10):
b=data[pos];pos+=1;n|=(b&127)<<shift
if b<128:return n,pos
shift+=7
raise RuntimeError('INVALID_BUILD_INFO')
pos=at+32;n,pos=varint(pos);goversion=bytes(data[pos:pos+n]).decode();pos+=n
n,pos=varint(pos);module=bytes(data[pos:pos+n]).decode(errors='replace')
settings={}
for line in module.splitlines():
if line.startswith('build\t') and '=' in line[6:]:
k,v=line[6:].split('=',1);settings[k]=v
report={'kind':'GiteaOfflineReproducibilityProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'requiredGoVersion':goversion,'status':'PREPARING','liveServicesChanged':False,'liveDataChanged':False,'sourceWritten':False,'newCredentials':False}
candidates=[pathlib.Path('/usr/local/go/bin/go')]
for root in ['/root/go/pkg/mod/golang.org','/root/sdk','/usr/local','/opt']:
p=pathlib.Path(root)
if not p.is_dir():continue
for d in p.iterdir():
if d.is_dir() and (d.name.startswith('toolchain@') or d.name.startswith('go')):
candidates.append(d/'bin/go')
compiler=None
report['toolchains']=[]
for p in dict.fromkeys(candidates):
if not p.is_file():continue
r=subprocess.run([str(p),'version'],capture_output=True,text=True,timeout=10,env={'PATH':'/usr/bin:/bin','GOTOOLCHAIN':'local'})
text=r.stdout.strip() if r.returncode==0 else ''
report['toolchains'].append({'path':str(p),'version':text[:150]})
if goversion in text.split():compiler=p
def emit():
print('GITEA_OFFLINE_REPRO_JSON '+json.dumps(report,separators=(',',':')))
if compiler is None:
report['status']='BLOCKED_MATCHING_TOOLCHAIN_NOT_FOUND';emit();raise SystemExit(0)
if settings.get('-buildmode','exe')!='exe' or settings.get('-compiler','gc')!='gc':
report['status']='BLOCKED_UNSUPPORTED_BUILD_SETTINGS';emit();raise SystemExit(0)
linkflags=settings.get('-ldflags','')
if re.search(r'password|secret|token|private.?key',linkflags,re.I):
report['status']='BLOCKED_SENSITIVE_LINK_FLAGS';emit();raise SystemExit(0)
def fingerprint():
h=hashlib.sha256();count=0
for root,dirs,files in os.walk(source):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(root)/name
if p.is_symlink() or not p.is_file():continue
h.update(str(p.relative_to(source)).encode()+b'\0'+bytes.fromhex(sha(p)));count+=1
return h.hexdigest(),count
before,count=fingerprint();report['inputFingerprintBefore']=before;report['inputFiles']=count
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.exists() and (base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077):raise RuntimeError('PRIVATE_WORKSPACE_PERMISSIONS_REQUIRED')
base.mkdir(mode=0o700,exist_ok=True)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('repro-'+runid);work.mkdir(mode=0o700)
for name in ['cache','tmp']:(work/name).mkdir(mode=0o700)
args=[str(compiler),'build','-mod=readonly','-p','2','-o',str(work/'gitea')]
for setting in ['-tags','-trimpath','-asmflags','-gcflags','-ldflags']:
if setting in settings:args.append(setting+'='+settings[setting])
args.append('.')
unit='eios-r1-repro-'+runid
command=['systemd-run','--quiet','--wait','--collect','--unit='+unit,'--working-directory='+str(source),
'--property=User=root','--property=Nice=10','--property=CPUQuota=150%','--property=MemoryMax=2G',
'--property=PrivateNetwork=yes','--property=ProtectSystem=strict','--property=ProtectHome=read-only',
'--property=PrivateTmp=yes','--property=ReadWritePaths='+str(work),
'--property=StandardOutput=file:'+str(work/'build.stdout'),'--property=StandardError=file:'+str(work/'build.stderr'),
'--setenv=PATH=/usr/bin:/bin','--setenv=GOTOOLCHAIN=local','--setenv=GOPROXY=off','--setenv=GOSUMDB=off',
'--setenv=GOMODCACHE=/root/go/pkg/mod','--setenv=GOCACHE='+str(work/'cache'),'--setenv=TMPDIR='+str(work/'tmp'),
'--setenv=GIT_OPTIONAL_LOCKS=0']+args
r=subprocess.run(command,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=1200)
report['buildExitCode']=r.returncode
after,_=fingerprint();report['inputFingerprintAfter']=after
if before!=after:report['status']='BLOCKED_SOURCE_CHANGED_DURING_BUILD'
elif r.returncode!=0:report['status']='OFFLINE_REPRO_BUILD_FAILED'
elif (work/'gitea').is_file():
report['reproducedSha256']=sha(work/'gitea')
report['matchesRunningBinary']=report['reproducedSha256']==sha(binary)
report['status']='REPRODUCED_MATCH' if report['matchesRunningBinary'] else 'REPRODUCED_DIFFERENT_HASH'
else:report['status']='OFFLINE_REPRO_OUTPUT_MISSING'
report['privateWorkspace']=str(work);report['networkIsolated']=True;report['liveSourceReadOnly']=True
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit()
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
reproduce
|
null
|
["ubuntu-latest"]
|
37507
|
1
|
1793521559
|
1793522041
|
1793521558
|
1793522041
|
|
0
|
|
0
|
Edit
Delete
|
|
46038
|
26759
|
116
|
5
|
246c4232d67843cc6f47fd8e49d04eb906873ecd
|
0
|
inspect
|
1
|
name: Gitea migration identity (read only)
"on name: Gitea migration identity (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-migration-identity.yml]
workflow_dispatch:
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read migration mapping and schema column names
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, os, pathlib, re, socket, sqlite3, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
source=pathlib.Path('/root/gitea-src')
env=dict(os.environ,GIT_OPTIONAL_LOCKS='0')
def git(*args):
r=subprocess.run(['git','--no-optional-locks','-C',str(source),*args],capture_output=True,text=True,timeout=30,env=env)
if r.returncode:raise RuntimeError('SOURCE_READ_FAILED')
return r.stdout
head=git('rev-parse','HEAD').strip()
if head!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('SOURCE_BASE_CHANGED')
report={'kind':'GiteaMigrationIdentityProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sourceHead':head,'serviceChanges':False,'databaseWrites':False}
path='models/migrations/migrations.go'
current=(source/path).read_text()
base=git('show','HEAD:'+path)
# This emits migration code only, from two fixed source paths; never configuration or row data.
def entries(text):
return [{'number':int(m.group(1)), 'description':m.group(2), 'function':m.group(3)} for m in re.finditer(r'newMigration\(\s*(\d+)\s*,\s*"([^"]+)"\s*,\s*([a-zA-Z0-9_.]+)',text)]
report['baseMigrationEntries']=entries(base)
report['workingMigrationEntries']=entries(current)
report['migrationFileSha256']=hashlib.sha256(current.encode()).hexdigest()
delta=git('diff','--no-ext-diff','--unified=3','HEAD','--',path,'models/migrations/v1_22/v299.go')
# Any unexpectedly embedded credential literal stops export, without printing it.
if re.search(r'(?:password|secret|token|private.?key)\s*[:=]\s*["\'][^"\']{8,}["\']',delta,re.I):raise RuntimeError('SENSITIVE_LITERAL_REFUSED')
report['migrationSourceDiff']=delta
report['goModuleHeader']=[x for x in (source/'go.mod').read_text().splitlines()[:6] if x.startswith(('module ','go ','toolchain '))]
connection=sqlite3.connect('file:/home/git/gitea/data/gitea.db?mode=ro',uri=True,timeout=15)
connection.execute('PRAGMA query_only=ON')
tables={row[0] for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
selected=['version','action_run','action_run_job','action_run_attempt','action_artifact','protected_branch','repository','team','user']
report['schemaColumns']={t:[r[1] for r in connection.execute('PRAGMA table_info("'+t+'")')] if t in tables else None for t in selected}
report['schemaVersion']=connection.execute('SELECT version FROM version WHERE id=1').fetchone()[0]
connection.close()
print('GITEA_MIGRATION_IDENTITY_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37510
|
1
|
1793522135
|
1793522135
|
1793521654
|
1793522136
|
|
1
|
|
0
|
Edit
Delete
|
|
46065
|
26765
|
116
|
5
|
61a8b9152ddd161ce816e35f6faa075933995d31
|
0
|
analyze
|
1
|
name: Gitea private compatibility analysis
"on name: Gitea private compatibility analysis
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-upgrade-analysis.yml]
workflow_dispatch:
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify saved baseline and analyze official fixed-source compatibility
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, os, pathlib, re, shutil, socket, sqlite3, subprocess, time
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
source=pathlib.Path('/root/gitea-src')
def sha(p):
h=hashlib.sha256()
with open(p,'rb') as f:
for b in iter(lambda:f.read(1024*1024),b''):h.update(b)
return h.hexdigest()
if sha('/usr/local/bin/gitea')!='640efd1256fe5ace902a1185bd6fdedd063ec1eec08422aceded8cc9559a8dc9':raise RuntimeError('INSTALLED_BINARY_CHANGED')
def source_files():
paths=[]
for root,dirs,files in os.walk(source):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(root)/name
if not p.is_symlink() and p.is_file():paths.append(p)
return paths
def fingerprint(paths):
h=hashlib.sha256()
for p in paths:h.update(str(p.relative_to(source)).encode()+b'\0'+bytes.fromhex(sha(p)))
return h.hexdigest()
paths=source_files();before=fingerprint(paths)
if before!='a5534f2aa03220a02efecac6753f0edcb99db7e8a3da323a1bac3390e2793d74':raise RuntimeError('REPRODUCED_SOURCE_CHANGED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
if shutil.disk_usage(base).free<40*1024**3:raise RuntimeError('STAGING_FREE_SPACE_REQUIRED')
work=base/('analysis-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
report={'kind':'GiteaUpgradeCompatibilityAnalysis','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'privateWorkspace':str(work),'liveServiceChanges':False,'liveDatabaseWrites':False,'fullConsistentBackup':False,'sourceFingerprint':before}
def emit(stage):
report['stage']=stage;print('GITEA_UPGRADE_ANALYSIS_JSON '+json.dumps(report,separators=(',',':')),flush=True)
def git(args,cwd=source,timeout=300):
return subprocess.run(['git','-c','credential.helper=','-c','core.askPass=','-c','http.extraHeader=','-c','core.hooksPath=/dev/null',*args],cwd=cwd,env=env,stdin=subprocess.DEVNULL,capture_output=True,timeout=timeout)
emit('PREPARING')
snapshot=base/'stage-26762'/'baseline-source'
h=hashlib.sha256()
for p in paths:
target=snapshot/p.relative_to(source)
if target.is_symlink() or not target.is_file():raise RuntimeError('BASELINE_SNAPSHOT_MISSING')
h.update(str(p.relative_to(source)).encode()+b'\0'+bytes.fromhex(sha(target)))
if h.hexdigest()!=before:raise RuntimeError('BASELINE_SNAPSHOT_FINGERPRINT_MISMATCH')
parent=base/'stage-26762'
if sha(parent/'gitea.previous')!='640efd1256fe5ace902a1185bd6fdedd063ec1eec08422aceded8cc9559a8dc9':raise RuntimeError('BASELINE_BINARY_MISMATCH')
verify=git(['bundle','verify',str(parent/'baseline.bundle')])
if verify.returncode:raise RuntimeError('BASELINE_BUNDLE_VERIFY_FAILED')
report['verifiedBaseline']={'path':str(parent),'sourceFingerprint':h.hexdigest(),'bundleSha256':sha(parent/'baseline.bundle'),'patchSha256':sha(parent/'baseline-working.patch'),'binarySha256':sha(parent/'gitea.previous')}
report['databaseSnapshot']='NOT_OBTAINED; prior online backup reached deadline; no retry in this job'
emit('BASELINE_FILES_AND_BUNDLE_VERIFIED')
upstream=work/'candidate-source'
r=git(['clone','--depth','1','--branch','v1.27.3','--filter=blob:none','https://github.com/go-gitea/gitea.git',str(upstream)],cwd=work,timeout=600)
(work/'upstream-fetch.stdout').write_bytes(r.stdout);(work/'upstream-fetch.stderr').write_bytes(r.stderr)
if r.returncode:
report['status']='UPSTREAM_FETCH_FAILED';report['fetchExitCode']=r.returncode;emit('STOPPED_BEFORE_CANDIDATE_BUILD');raise SystemExit(0)
head=git(['rev-parse','HEAD'],cwd=upstream)
if head.returncode or head.stdout.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_UPSTREAM_COMMIT_MISMATCH')
report['upstream']={'tag':'v1.27.3','commit':head.stdout.decode().strip(),'purpose':'compatibility analysis candidate, not selected for deployment'}
changed=git(['diff','--name-only','--diff-filter=ACMRT','HEAD'])
if changed.returncode:raise RuntimeError('SOURCE_CHANGED_PATHS_UNAVAILABLE')
report['customizationMerge']=[]
merge=work/'merge-inputs';merge.mkdir(mode=0o700)
for i,name in enumerate(changed.stdout.decode().splitlines()):
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts:raise RuntimeError('UNSAFE_SOURCE_PATH')
# Existing migration edits are retained in the baseline; do not transplant the legacy migration list.
if name.startswith('models/migrations/'):
report['customizationMerge'].append({'path':name,'status':'HELD_FOR_EXPLICIT_MIGRATION_BRIDGE'});continue
target=upstream/name
if not target.is_file() or target.is_symlink():
report['customizationMerge'].append({'path':name,'status':'TARGET_PATH_CHANGED_REVIEW_REQUIRED'});continue
original_blob=git(['show','HEAD:'+name])
if original_blob.returncode:raise RuntimeError('BASE_BLOB_READ_FAILED')
theirs=(source/name).read_bytes().replace(b'code.gitea.io/gitea',b'gitea.dev')
ancestor=original_blob.stdout.replace(b'code.gitea.io/gitea',b'gitea.dev')
a=merge/(str(i)+'.ours');b=merge/(str(i)+'.base');c=merge/(str(i)+'.theirs')
a.write_bytes(target.read_bytes());b.write_bytes(ancestor);c.write_bytes(theirs)
m=git(['merge-file','-p',str(a),str(b),str(c)],cwd=work,timeout=30)
if m.returncode==0:
target.write_bytes(m.stdout);state='TEXTUAL_MERGE_CLEAN_SEMANTICS_UNVERIFIED'
elif 1<=m.returncode<=127:
(merge/(str(i)+'.conflicted')).write_bytes(m.stdout);state='SEMANTIC_REVIEW_REQUIRED'
else:state='MERGE_TOOL_FAILED'
report['customizationMerge'].append({'path':name,'status':state})
untracked=git(['ls-files','--others','--exclude-standard'])
if untracked.returncode:raise RuntimeError('UNTRACKED_SOURCE_INVENTORY_FAILED')
report['untrackedCustomization']=[]
for name in untracked.stdout.decode().splitlines():
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts:raise RuntimeError('UNSAFE_UNTRACKED_PATH')
if not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options']:continue
if rel.suffix not in ['.go','.tmpl','.json']:continue
p=source/name;target=upstream/name
if p.is_symlink() or not p.is_file():continue
if target.exists():state='COLLISION_REVIEW_REQUIRED'
else:
target.parent.mkdir(parents=True,exist_ok=True)
target.write_bytes(p.read_bytes().replace(b'code.gitea.io/gitea',b'gitea.dev'))
state='PRESERVED_FROM_REPRODUCED_BASELINE_SEMANTICS_UNVERIFIED'
report['untrackedCustomization'].append({'path':name,'status':state})
report['status']='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED'
report['candidateBuilt']=False;report['candidateMigrationExecuted']=False;report['sourceFingerprintAfter']=fingerprint(paths)
if report['sourceFingerprintAfter']!=before:raise RuntimeError('LIVE_SOURCE_CHANGED_DURING_PREPARATION')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('PREPARED_FOR_REVIEW')
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
...
|
analyze
|
null
|
["ubuntu-latest"]
|
37520
|
1
|
1793522902
|
1793522920
|
1793522621
|
1793522920
|
|
0
|
|
0
|
Edit
Delete
|
|
46066
|
26766
|
116
|
5
|
ca016ace1582ae89162d78541d6536840b0f2c97
|
0
|
inspect
|
1
|
name: Gitea migration identity (read only)
"on name: Gitea migration identity (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-migration-identity.yml]
workflow_dispatch:
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read migration mapping and schema column names
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, os, pathlib, re, socket, sqlite3, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
source=pathlib.Path('/root/gitea-src')
env=dict(os.environ,GIT_OPTIONAL_LOCKS='0')
def git(*args):
r=subprocess.run(['git','--no-optional-locks','-C',str(source),*args],capture_output=True,text=True,timeout=30,env=env)
if r.returncode:raise RuntimeError('SOURCE_READ_FAILED')
return r.stdout
head=git('rev-parse','HEAD').strip()
if head!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('SOURCE_BASE_CHANGED')
report={'kind':'GiteaMigrationIdentityProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sourceHead':head,'serviceChanges':False,'databaseWrites':False}
path='models/migrations/migrations.go'
current=(source/path).read_text()
base=git('show','HEAD:'+path)
# This emits migration code only, from two fixed source paths; never configuration or row data.
def entries(text):
return [{'number':int(m.group(1)), 'description':m.group(2), 'function':m.group(3)} for m in re.finditer(r'newMigration\(\s*(\d+)\s*,\s*"([^"]+)"\s*,\s*([a-zA-Z0-9_.]+)',text)]
report['baseMigrationEntries']=entries(base)[-50:]
report['workingMigrationEntries']=entries(current)[-50:]
report['migrationFileSha256']=hashlib.sha256(current.encode()).hexdigest()
delta=git('diff','--no-ext-diff','--unified=3','HEAD','--',path,'models/migrations/v1_22/v299.go')
# Any unexpectedly embedded credential literal stops export, without printing it.
if re.search(r'(?:password|secret|token|private.?key)\s*[:=]\s*["\'][^"\']{8,}["\']',delta,re.I):raise RuntimeError('SENSITIVE_LITERAL_REFUSED')
report['migrationSourceDiff']=delta[:18000]
report['migrationSourceDiffTruncated']=len(delta)>18000
report['migrationSourceDiffSha256']=hashlib.sha256(delta.encode()).hexdigest()
report['goModuleHeader']=[x for x in (source/'go.mod').read_text().splitlines()[:6] if x.startswith(('module ','go ','toolchain '))]
connection=sqlite3.connect('file:/home/git/gitea/data/gitea.db?mode=ro',uri=True,timeout=15)
connection.execute('PRAGMA query_only=ON')
tables={row[0] for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
selected=['version','action_run','action_run_job','action_run_attempt','action_artifact','protected_branch','repository','team','user']
report['schemaColumns']={t:[r[1] for r in connection.execute('PRAGMA table_info("'+t+'")')] if t in tables else None for t in selected}
report['schemaVersion']=connection.execute('SELECT version FROM version WHERE id=1').fetchone()[0]
connection.close()
print('GITEA_MIGRATION_IDENTITY_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37521
|
1
|
1793522920
|
1793522921
|
1793522697
|
1793522921
|
|
0
|
|
0
|
Edit
Delete
|
|
46067
|
26767
|
116
|
5
|
60974a766a52e7c45de627042ae4183c4462d2dc
|
0
|
inspect
|
1
|
name: Gitea maintenance capacity (read only)
" name: Gitea maintenance capacity (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-maintenance-capacity.yml]
workflow_dispatch:
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read capacity, isolation capabilities and file mode metadata
run: |
set -eu
python3 <<'PY'
import datetime, json, os, pathlib, re, socket, stat
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
report={'kind':'GiteaMaintenanceCapacityProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'writes':False}
report['cpuCount']=os.cpu_count()
report['memoryKiB']={k:int(v.split()[0]) for k,v in (line.split(':',1) for line in pathlib.Path('/proc/meminfo').read_text().splitlines()) if k in ['MemTotal','MemAvailable']}
cpu=pathlib.Path('/proc/cpuinfo').read_text()
report['hardwareVirtualizationFlagPresent']=any(x in cpu.split() for x in ['vmx','svm'])
report['devices']={p:{'exists':pathlib.Path(p).exists(),'readWrite':os.access(p,os.R_OK|os.W_OK),'characterDevice':stat.S_ISCHR(os.stat(p).st_mode) if pathlib.Path(p).exists() else False} for p in ['/dev/kvm','/dev/fuse']}
report['toolPresence']={p:pathlib.Path(p).is_file() for p in ['/usr/bin/qemu-system-x86_64','/usr/bin/dockerd-rootless.sh','/usr/bin/rootlesskit','/usr/bin/slirp4netns','/usr/bin/newuidmap','/usr/bin/fusermount3']}
report['mounts']=[]
for line in pathlib.Path('/proc/self/mountinfo').read_text().splitlines():
pre,post=line.split(' - ',1);fields=pre.split();fstype=post.split()[0];mount=fields[4]
if fstype not in ['ext4','xfs','btrfs','zfs','nfs','nfs4','fuse.sshfs'] or mount.startswith(('/var/lib/docker','/run/')):continue
try:
fs=os.statvfs(mount)
report['mounts'].append({'path':mount,'filesystem':fstype,'availableBytes':fs.f_bavail*fs.f_frsize,'totalBytes':fs.f_blocks*fs.f_frsize})
except OSError:pass
report['privatePathPermissions']=[]
for name in ['/home/git','/home/git/gitea','/home/git/gitea/config/app.ini','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/opt/gitea-runner/.runner']:
p=pathlib.Path(name)
if not p.exists():continue
s=p.stat();report['privatePathPermissions'].append({'path':name,'mode':oct(stat.S_IMODE(s.st_mode)),'uid':s.st_uid,'gid':s.st_gid})
selected={};parent=None
for line in pathlib.Path('/opt/gitea-runner/config.yaml').read_text().splitlines():
if not line.strip() or line.lstrip().startswith('#'):continue
if not line.startswith((' ','\t')):parent=line.split(':',1)[0].strip();continue
if ':' not in line:continue
key,value=line.strip().split(':',1)
if parent=='runner' and key=='labels':
value=value.strip()
selected['labelsConfiguredInYaml']=bool(value)
if parent=='container' and key in ['privileged','docker_host']:
value=value.strip().strip('"\'')
if value in ['true','false','-','']:selected[key]=value
else:selected[key]='CUSTOM_VALUE_NOT_EXPORTED'
report['runnerExecutorConfiguration']=selected
print('GITEA_MAINTENANCE_CAPACITY_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37528
|
1
|
1793522985
|
1793522985
|
1793522983
|
1793522985
|
|
0
|
|
0
|
Edit
Delete
|
|
46068
|
26768
|
116
|
5
|
40769bdad3adf44ff656aa94a6c331826295a12b
|
0
|
repair
|
1
|
name: Repair runner registration file permissions
name: Repair runner registration file permissions
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-runner-permissions.yml]
workflow_dispatch:
jobs:
repair:
name: repair
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Limit existing root-owned registration to owner read-write
run: |
set -eu
python3 <<'PY'
import datetime, json, os, pathlib, socket, stat, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_RECEIPT_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
stamp=datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%S%fZ')
target=base/('registration-permissions-'+runid+'-'+stamp+'.json')
def unit():
r=subprocess.run(['systemctl','show','gitea-runner.service','-p','User','-p','ActiveState','-p','MainPID'],capture_output=True,text=True,check=True,timeout=10)
return dict(row.split('=',1) for row in r.stdout.splitlines() if '=' in row)
before_unit=unit()
if before_unit.get('User') not in ['','root'] or before_unit.get('ActiveState')!='active' or not before_unit.get('MainPID','').isdigit():raise RuntimeError('ACTIVE_ROOT_RUNNER_REQUIRED')
path=pathlib.Path('/opt/gitea-runner/.runner')
parent=path.parent.lstat()
if not stat.S_ISDIR(parent.st_mode) or parent.st_uid!=0 or stat.S_IMODE(parent.st_mode)&0o022:raise RuntimeError('PROTECTED_REGISTRATION_DIRECTORY_REQUIRED')
fd=os.open(path,os.O_RDONLY|os.O_NOFOLLOW)
try:
before=os.fstat(fd)
if not stat.S_ISREG(before.st_mode) or before.st_uid!=0 or before.st_gid!=0 or before.st_nlink!=1:raise RuntimeError('EXPECTED_ROOT_REGISTRATION_FILE_REQUIRED')
mode=stat.S_IMODE(before.st_mode)
if mode not in [0o644,0o600]:raise RuntimeError('UNEXPECTED_REGISTRATION_PERMISSIONS')
if mode!=0o600:os.fchmod(fd,0o600)
after=os.fstat(fd);current=path.lstat()
if (after.st_dev,after.st_ino)!=(current.st_dev,current.st_ino):raise RuntimeError('REGISTRATION_PATH_CHANGED')
if (after.st_dev,after.st_ino,after.st_size,after.st_mtime_ns)!=(before.st_dev,before.st_ino,before.st_size,before.st_mtime_ns):raise RuntimeError('REGISTRATION_CONTENT_METADATA_CHANGED')
if stat.S_IMODE(after.st_mode)!=0o600:raise RuntimeError('PERMISSION_REPAIR_FAILED')
finally:os.close(fd)
after_unit=unit()
if after_unit!=before_unit:raise RuntimeError('RUNNER_SERVICE_STATE_CHANGED')
report={'kind':'GiteaRunnerRegistrationPermissionRepair','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'path':str(path),'beforeMode':oct(mode),'afterMode':'0o600','ownerUid':0,'ownerGid':0,'changed':mode!=0o600,'contentRead':False,'contentWritten':False,'contentMetadataUnchanged':True,'runnerServiceBefore':before_unit,'runnerServiceAfter':after_unit,'serviceRestarted':False,'giteaBinaryOrDatabaseChanged':False,'fullExecutorIsolationAccepted':False}
with open(target,'x') as f:json.dump(report,f,indent=2);f.write('\n')
print('GITEA_RUNNER_PERMISSION_REPAIR_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
repair
|
null
|
["ubuntu-latest"]
|
37529
|
1
|
1793523139
|
1793523139
|
1793523138
|
1793523139
|
|
0
|
|
0
|
Edit
Delete
|
|
46071
|
26771
|
116
|
5
|
fc9741d6f8dca2a2f251ac2e1b15b724030e7a02
|
0
|
export
|
1
|
name: Export screened Gitea customization for revi name: Export screened Gitea customization for review
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-source-review-export.yml]
workflow_dispatch:
jobs:
export:
name: export
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Screen only known source changes and produce a review archive
run: |
set -eu
python3 <<'PY'
import base64, datetime, hashlib, io, json, os, pathlib, re, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
analysis=base/'analysis-26765'
receipt=json.loads((analysis/'receipt.json').read_text())
if receipt.get('status')!='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED':raise RuntimeError('VERIFIED_BASELINE_REQUIRED')
source=base/'stage-26762'/'baseline-source'
live=pathlib.Path('/root/gitea-src')
upstream=analysis/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(base),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_OPTIONAL_LOCKS':'0','GIT_TERMINAL_PROMPT':'0'}
def git(path,*args):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(path),*args],capture_output=True,timeout=30,env=env)
return r.returncode,r.stdout
code,head=git(upstream,'rev-parse','HEAD')
if code or head.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_OFFICIAL_SOURCE_REQUIRED')
# Export only files that require manual conflict or migration review.
# Already textually merged files and additive files stay on the server for native testing.
paths=sorted({r['path'] for r in receipt['customizationMerge'] if r['status'] in ['SEMANTIC_REVIEW_REQUIRED','HELD_FOR_EXPLICIT_MIGRATION_BRIDGE']})
def public_literals(text):
return set(re.findall(r'["\']([^"\'\n]{8,})["\']',text))
def suspicious(text,public,is_git_test=False):
issues=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
public_ssh=bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])) and any(m.group(0) in v for v in public)
if not public_ssh:issues.append('credential-prefix-or-private-key')
if re.search(r'https?://[^/\s:@]+:[^/\s@]+@',text):issues.append('credential-in-url')
for match in re.finditer(r'(?i)(?:[A-Za-z0-9_]*(?:password|passwd|secret|token|api_?key|access_?key|private_?key)[A-Za-z0-9_]*)\s*(?::=|=|:)\s*["\']([^"\'\n]{8,})["\']',text):
value=match.group(1)
if value not in public:issues.append('nonpublic-credential-literal')
for match in re.finditer(r'(?i)(?:Bearer|Basic)\s+[A-Za-z0-9_+/=.-]{12,}',text):
if not any(match.group(0) in literal for literal in public):issues.append('nonpublic-authorization-literal')
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in public and len(set(value))>8 and not is_git_test:issues.append('nonpublic-long-opaque-literal')
if not is_git_test:
for value in re.findall(r'["\']([A-Fa-f0-9]{32,128})["\']',text):
if value not in public and len(set(value))>3:issues.append('nonpublic-long-hex-literal')
return sorted(set(issues))
payload={};manifest=[];refused=[]
for name in paths:
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts or not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options'] or rel.suffix not in ['.go','.tmpl','.json']:raise RuntimeError('SOURCE_EXPORT_PATH_REFUSED')
p=source/name
if p.is_symlink() or not p.is_file():raise RuntimeError('SOURCE_EXPORT_NONREGULAR_FILE')
data=p.read_bytes()
if len(data)>2*1024*1024:raise RuntimeError('SOURCE_FILE_SIZE_LIMIT')
rc,public=git(upstream,'show','HEAD:'+name)
known=public_literals(public.decode(errors='replace')) if rc==0 else set()
candidates=[('current/'+name,data)]
rc,old=git(live,'show','HEAD:'+name)
if rc==0:candidates.append(('base/'+name,old))
for archive_name,body in candidates:
problems=suspicious(body.decode('utf-8'),known,name.startswith('modules/git/') and name.endswith('_test.go'))
if problems:
text=body.decode('utf-8');classification=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
classification.append({'category':'prefix','publicSshAlgorithm':bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])),'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for m in re.finditer(r'(?i)(Bearer|Basic)\s+([A-Za-z0-9_+/=.-]{12,})',text):
line=text[text.rfind('\n',0,m.start())+1:m.start()]
valid=False
if m.group(1).lower()=='basic':
try:
decoded=base64.b64decode(m.group(2)+'='*((-len(m.group(2)))%4),validate=True).decode('utf-8')
valid=':' in decoded and decoded.isprintable()
except Exception:pass
classification.append({'category':'authorization','scheme':m.group(1).lower(),'commentLine':line.lstrip().startswith('//'),'validPrintableBasicCredential':valid,'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in known and len(set(value))>8 and not (name.startswith('modules/git/') and name.endswith('_test.go')):
classification.append({'category':'opaque','publicGitSmartHttpMime':value in ['application/x-git-upload-pack-advertisement','application/x-git-receive-pack-advertisement','application/x-git-upload-pack-result','application/x-git-receive-pack-result']})
refused.append({'path':archive_name,'reasons':problems,'classification':classification});continue
payload[archive_name]=body
manifest.append({'path':archive_name,'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest()})
report={'kind':'GiteaCustomSourceReviewExport','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceBaselineFingerprint':receipt['sourceFingerprint'],'upstreamCommit':head.decode().strip(),'serviceChanges':False,'databaseOrConfigurationExported':False,'registrationOrCredentialFilesRead':False,'refusedFiles':refused}
if refused:
report['status']='BLOCKED_CREDENTIAL_SCREENING';print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')));raise SystemExit(1)
if sum(len(v) for v in payload.values())>8*1024*1024:raise RuntimeError('SOURCE_EXPORT_SIZE_LIMIT')
work=base/('export-'+runid);work.mkdir(mode=0o700)
index={'kind':'GiteaCustomSourceReviewManifest','sourceBaselineFingerprint':receipt['sourceFingerprint'],'originalSourceHead':'287bf811487c04cd90bcf07aa04905cbaf2e4c2d','upstreamCommit':head.decode().strip(),'files':manifest,'scope':'Selected code only, not a system backup; no database, config, registration, environment, key or dependency cache files'}
payload['manifest.json']=(json.dumps(index,ensure_ascii=False,indent=2)+'\n').encode()
target=work/'gitea-custom-source.tar.gz'
with tarfile.open(target,'w:gz') as archive:
for name,body in sorted(payload.items()):
entry=tarfile.TarInfo(name);entry.size=len(body);entry.mode=0o600;entry.mtime=0;archive.addfile(entry,io.BytesIO(body))
report.update({'status':'SOURCE_CODE_SCREENED_AND_PACKED','fileCount':len(manifest),'archiveBytes':target.stat().st_size,'archiveSha256':hashlib.sha256(target.read_bytes()).hexdigest(),'privateArchive':str(target)})
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
- name: Upload screened source code for the authorized maintenance review
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: gitea-custom-source-${{ github.sha }}-${{ github.run_id }}
path: /var/lib/eios-r1-maintenance/export-${{ github.run_id }}/gitea-custom-source.tar.gz
retention-days: "1"
timeout-minutes: "15"
permissions:
contents: read
...
|
export
|
null
|
["ubuntu-latest"]
|
37532
|
1
|
1793523526
|
1793523529
|
1793523526
|
1793523529
|
|
0
|
|
0
|
Edit
Delete
|
|
46072
|
26772
|
116
|
5
|
0d9c557d7e288e62a71638faab3a8507eac1cd7b
|
0
|
inspect
|
1
|
name: Verify full Gitea customization ancestry
name: Verify full Gitea customization ancestry
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-customization-ancestry.yml]
workflow_dispatch:
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Locate official common ancestor without writing live source refs
run: |
set -eu
python3 <<'PY'
import datetime, json, os, pathlib, socket, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('ancestry-'+runid);work.mkdir(mode=0o700)
source=pathlib.Path('/root/gitea-src');candidate=base/'analysis-26765'/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(where,*args,timeout=30):
return subprocess.run(['git','-c','credential.helper=','-c','core.askPass=','-c','http.extraHeader=','-c','core.hooksPath=/dev/null','-C',str(where),*args],env=env,capture_output=True,timeout=timeout)
r=git(source,'rev-parse','HEAD')
if r.returncode or r.stdout.decode().strip()!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('SOURCE_HEAD_CHANGED')
r=git(candidate,'rev-parse','HEAD')
if r.returncode or r.stdout.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('UPSTREAM_HEAD_CHANGED')
report={'kind':'GiteaCustomizationAncestryProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'liveSourceOrServiceChanged':False,'privateGitHistoryFetchOnly':True}
r=git(source,'log','--first-parent','-12','--format=%H %P %cI')
report['sourceFirstParentMetadata']=r.stdout.decode().splitlines() if r.returncode==0 else []
report['sourceShallow']=git(source,'rev-parse','--is-shallow-repository').stdout.decode().strip()
def emit(stage):
report['stage']=stage;print('GITEA_CUSTOM_ANCESTRY_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('FETCHING_OFFICIAL_HISTORY_PRIVATELY')
shallow=git(candidate,'rev-parse','--is-shallow-repository').stdout.decode().strip()
args=['fetch','--no-tags','--filter=blob:none']
if shallow=='true':args.append('--unshallow')
args+=['https://github.com/go-gitea/gitea.git','refs/tags/v1.27.3']
r=git(candidate,*args,timeout=600)
(work/'official-fetch.stdout').write_bytes(r.stdout);(work/'official-fetch.stderr').write_bytes(r.stderr)
if r.returncode:
report['status']='OFFICIAL_HISTORY_FETCH_FAILED';report['exitCode']=r.returncode;emit('STOPPED');raise SystemExit(0)
r=git(candidate,'fetch','--no-tags',str(source),'HEAD:refs/heads/maintenance-current-custom-base',timeout=300)
(work/'custom-fetch.stdout').write_bytes(r.stdout);(work/'custom-fetch.stderr').write_bytes(r.stderr)
if r.returncode:
report['status']='CUSTOM_HISTORY_FETCH_FAILED';report['exitCode']=r.returncode;emit('STOPPED');raise SystemExit(0)
r=git(candidate,'merge-base','--all','146cc3eec57174711eac0e0a0c7b38670c6e3922','287bf811487c04cd90bcf07aa04905cbaf2e4c2d')
commons=r.stdout.decode().splitlines() if r.returncode==0 else []
report['commonAncestors']=commons
if len(commons)!=1:
report['status']='NO_UNIQUE_VERIFIABLE_COMMON_ANCESTOR';emit('STOPPED');raise SystemExit(0)
common=commons[0]
r=git(candidate,'show','-s','--format=%H %cI',common)
report['commonAncestorMetadata']=r.stdout.decode().strip() if r.returncode==0 else None
r=git(candidate,'diff','--no-ext-diff','--no-textconv','--numstat',common,'287bf811487c04cd90bcf07aa04905cbaf2e4c2d',timeout=120)
if r.returncode:raise RuntimeError('COMMITTED_FORK_DIFF_FAILED')
rows=[]
for line in r.stdout.decode().splitlines():
fields=line.split('\t',2)
if len(fields)!=3:continue
name=fields[2]
if any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key']):name='SENSITIVE_PATH_NOT_EXPORTED'
rows.append({'added':fields[0],'removed':fields[1],'path':name})
report['committedForkChangedFileCount']=len(rows)
report['committedForkDelta']=rows[:120]
report['committedForkDeltaTruncated']=len(rows)>120
report['status']='COMMON_ANCESTOR_AND_COMMITTED_CUSTOMIZATION_IDENTIFIED'
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "20"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37533
|
1
|
1793523921
|
1793523932
|
1793523920
|
1793523932
|
|
0
|
|
0
|
Edit
Delete
|
|
46073
|
26773
|
116
|
5
|
76238b5a54238e0e6f5486504b85c4fddc0b0a0e
|
0
|
inspect
|
1
|
name: Locate official Gitea reference by file fing name: Locate official Gitea reference by file fingerprints
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reference-fingerprint.yml]
workflow_dispatch:
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Compare public source fingerprints without claiming Git ancestry
run: |
set -eu
python3 <<'PY'
import datetime, json, os, pathlib, re, socket, subprocess, time
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('fingerprint-'+runid);work.mkdir(mode=0o700)
source=pathlib.Path('/root/gitea-src');official=base/'analysis-26765'/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(where,*args,timeout=30):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(where),*args],env=env,capture_output=True,timeout=timeout)
if r.returncode:raise RuntimeError('GIT_METADATA_QUERY_FAILED')
return r.stdout
head=git(source,'rev-parse','HEAD').decode().strip()
if head!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('SOURCE_HEAD_CHANGED')
if git(official,'rev-parse','HEAD').decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('OFFICIAL_HEAD_CHANGED')
def tree(repo,commit):
result={}
for row in git(repo,'ls-tree','-r','-z','--format=%(objecttype) %(objectname) %(path)',commit,timeout=30).split(b'\0'):
if not row:continue
kind,oid,name=row.split(b' ',2)
if kind==b'blob':result[name]=oid
return result
root_tree=tree(source,head)
report={'kind':'GiteaOfficialReferenceFingerprintProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceHead':head,'sourceCommittedFiles':len(root_tree),'officialHistoryHead':'146cc3eec57174711eac0e0a0c7b38670c6e3922','liveSourceServiceDatabaseChanged':False,'method':'Exact Git blob fingerprints against bounded official first-parent history; reference selection does not assert ancestry'}
commits=git(official,'rev-list','--first-parent','--max-count=800','--before=2026-03-19T00:00:00Z','refs/tags/v1.27.3').decode().splitlines()
report['candidateCount']=len(commits)
def emit(stage):
report['stage']=stage;print('GITEA_OFFICIAL_REFERENCE_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('COMPARING_PUBLIC_TREE_FINGERPRINTS')
ranked=[];start=time.monotonic()
for index,commit in enumerate(commits):
if time.monotonic()-start>240:break
official_tree=tree(official,commit)
matches=sum(official_tree.get(p)==h for p,h in root_tree.items())
shared=sum(p in official_tree for p in root_tree)
ranked.append({'commit':commit,'matchingSourceBlobs':matches,'sharedPaths':shared,'officialFiles':len(official_tree),'order':index})
if (index+1)%100==0:
report['comparedCount']=len(ranked);report['bestMatchesSoFar']=max(r['matchingSourceBlobs'] for r in ranked);emit('COMPARING_PUBLIC_TREE_FINGERPRINTS')
ranked.sort(key=lambda r:(-r['matchingSourceBlobs'],r['order']))
report['comparedCount']=len(ranked);report['searchCompleted']=len(ranked)==len(commits);report['elapsedSeconds']=round(time.monotonic()-start,3);report['topReferences']=ranked[:8]
if not ranked:raise RuntimeError('NO_PUBLIC_REFERENCES_COMPARED')
best=ranked[0];official_tree=tree(official,best['commit'])
diff=[]
for p in sorted(set(root_tree)|set(official_tree)):
if root_tree.get(p)==official_tree.get(p):continue
name=p.decode('utf-8',errors='replace')
sensitive=any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key'])
diff.append({'path':'SENSITIVE_PATH_NOT_EXPORTED' if sensitive else name,'status':'modified' if p in root_tree and p in official_tree else ('source-only' if p in root_tree else 'official-only')})
report['selectedReference']=best['commit']
report['selectedReferenceMetadata']=git(official,'show','-s','--format=%H %cI',best['commit']).decode().strip()
report['committedTreeDifferenceCount']=len(diff)
report['committedTreeDifferences']=diff[:150];report['differencesTruncated']=len(diff)>150
report['status']='REFERENCE_FINGERPRINT_COMPARISON_COMPLETE'
(work/'full-tree-difference.private.json').write_text(json.dumps(diff,indent=2)+'\n')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37534
|
1
|
1793524164
|
1793524179
|
1793524163
|
1793524180
|
|
0
|
|
0
|
Edit
Delete
|
|
46092
|
26778
|
116
|
5
|
68b62aa8581bdd0cd72b21110405e56ef57975ee
|
0
|
analyze
|
1
|
name: Analyze complete Gitea customization from ve name: Analyze complete Gitea customization from verified reference
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-complete-customization.yml]
workflow_dispatch:
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Preserve all committed and working source differences in a private candidate
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, io, json, os, pathlib, re, shutil, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('complete-analysis-'+runid);work.mkdir(mode=0o700)
live=pathlib.Path('/root/gitea-src');snapshot=base/'stage-26762'/'baseline-source'
history=base/'analysis-26765'/'candidate-source'
reference='d6496c61561d90f56f0b5ec3f75d4de8e36a5c9f';target='146cc3eec57174711eac0e0a0c7b38670c6e3922'
ranking=json.loads((base/'fingerprint-26773'/'receipt.json').read_text())
if ranking.get('selectedReference')!=reference or ranking.get('topReferences',[{}])[0].get('matchingSourceBlobs')!=5788 or not ranking.get('searchCompleted'):raise RuntimeError('VERIFIED_REFERENCE_REQUIRED')
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(repo,*args,timeout=60):
return subprocess.run(['git','--no-optional-locks','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','credential.helper=','-c','core.askPass=','-c','http.extraHeader=','-c','core.hooksPath=/dev/null','-C',str(repo),*args],env=env,capture_output=True,timeout=timeout)
if git(live,'rev-parse','HEAD').stdout.decode().strip()!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('LIVE_SOURCE_HEAD_CHANGED')
def fingerprint(root):
h=hashlib.sha256();count=0
for parent,dirs,files in os.walk(root):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(parent)/name
if p.is_symlink() or not p.is_file():continue
d=hashlib.sha256()
with open(p,'rb') as f:
for block in iter(lambda:f.read(1024*1024),b''):d.update(block)
h.update(str(p.relative_to(root)).encode()+b'\0'+d.digest());count+=1
return h.hexdigest(),count
expected='a5534f2aa03220a02efecac6753f0edcb99db7e8a3da323a1bac3390e2793d74'
if fingerprint(live)!=(expected,6064) or fingerprint(snapshot)!=(expected,6064):raise RuntimeError('LIVE_OR_SAVED_SOURCE_CHANGED')
report={'kind':'GiteaCompleteCustomizationAnalysis','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceFingerprint':expected,'referenceCommit':reference,'referenceMethod':'Exact file comparison reference; not a Git ancestor','upstreamCommit':target,'privateWorkspace':str(work),'liveSourceServiceDatabaseChanged':False}
def emit(stage):
report['stage']=stage;print('GITEA_COMPLETE_CUSTOMIZATION_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('PREPARING_COMPLETE_CUSTOMIZATION')
candidate=work/'candidate-source'
r=git(work,'clone','--shared','--no-checkout',str(history),str(candidate))
if r.returncode:raise RuntimeError('PRIVATE_CANDIDATE_CLONE_FAILED')
r=git(candidate,'checkout','--detach',target)
if r.returncode:raise RuntimeError('FIXED_CANDIDATE_CHECKOUT_FAILED')
def names(repo,*args):
r=git(repo,*args)
if r.returncode:raise RuntimeError('SOURCE_PATH_INVENTORY_FAILED')
return {x for x in r.stdout.decode().splitlines() if x}
committed=names(history,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only',reference,'287bf811487c04cd90bcf07aa04905cbaf2e4c2d')
working=names(live,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only','HEAD')
untracked=names(live,'ls-files','--others','--exclude-standard')
ignored=names(live,'ls-files','--others','--ignored','--exclude-standard')
source_sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch(r'[0-9a-f]{40}',source_sha):raise RuntimeError('FIXED_JOB_SOURCE_SHA_REQUIRED')
bare=pathlib.Path('/home/git/repositories/luoanwu/enterprise-platform.git')
if bare.is_symlink() or not bare.is_dir():raise RuntimeError('EXPECTED_SOURCE_REPOSITORY_REQUIRED')
packed=git(bare,'show',source_sha+':ops/gitea-r1/upstream-reference-d6496c6.tar.gz')
if packed.returncode or hashlib.sha256(packed.stdout).hexdigest()!='a7d3f17e4810eca2294cf110790a6332d0681c909b2393b3a2ae20455c3a2322':raise RuntimeError('PUBLIC_REFERENCE_ARCHIVE_MISMATCH')
listing=git(history,'ls-tree','-r','-z','--format=%(objecttype) %(objectname) %(path)',reference)
if listing.returncode:raise RuntimeError('OFFICIAL_REFERENCE_TREE_UNAVAILABLE')
reference_tree={}
for row in listing.stdout.split(b'\0'):
if not row:continue
kind,oid,path=row.split(b' ',2)
if kind==b'blob':reference_tree[path.decode()]=oid.decode()
public_base={}
with tarfile.open(fileobj=io.BytesIO(packed.stdout),mode='r:gz') as archive:
members=archive.getmembers()
if len({m.name for m in members})!=len(members) or not all(m.isfile() and m.size<=2*1024*1024 for m in members) or sum(m.size for m in members)>8*1024*1024:raise RuntimeError('REFERENCE_ARCHIVE_STRUCTURE_REFUSED')
manifest=json.loads(archive.extractfile('manifest.json').read())
if manifest.get('referenceCommit')!=reference or manifest.get('upstreamRepository')!='https://github.com/go-gitea/gitea':raise RuntimeError('PUBLIC_REFERENCE_SOURCE_MISMATCH')
if {m.name for m in members}!={'manifest.json','LICENSE.upstream'}|{'files/'+v['path'] for v in manifest['files']}:raise RuntimeError('REFERENCE_ARCHIVE_MEMBER_MISMATCH')
for item in manifest['files']:
name=item['path'];part=pathlib.PurePosixPath(name)
if part.is_absolute() or '..' in part.parts:raise RuntimeError('REFERENCE_PATH_REFUSED')
body=archive.extractfile('files/'+name).read()
oid=hashlib.sha1(b'blob '+str(len(body)).encode()+b'\0'+body).hexdigest()
if oid!=reference_tree.get(name) or oid!=item['gitBlob'] or hashlib.sha256(body).hexdigest()!=item['sha256'] or len(body)!=item['bytes']:raise RuntimeError('OFFICIAL_REFERENCE_BLOB_MISMATCH')
public_base[name]=body
report['publicReferenceInput']={'sourceSha':source_sha,'archiveSha256':hashlib.sha256(packed.stdout).hexdigest(),'filesVerifiedAgainstOfficialGitTree':len(public_base),'historicalBlobNetworkRequired':False}
report['ignoredProductionGoFiles']=sorted(p for p in ignored if p.endswith('.go') and p.split('/',1)[0] in ['models','modules','routers','services'] and '/node_modules/' not in p)
report['snapshotOnlyEntries']=[];report['customizationMerge']=[]
merge=work/'merge-inputs';merge.mkdir(mode=0o700)
MISSING=object()
for number,name in enumerate(sorted(committed|working|untracked)):
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts:raise RuntimeError('UNSAFE_SOURCE_PATH')
if not rel.parts or rel.parts[0] not in ['models','modules','routers','services','templates','options']:
if name=='IMPLEMENTATION_PLAN.md':report['implementationPlanRetainedInBaseline']=True
report['snapshotOnlyEntries'].append(name if not any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key']) else 'SENSITIVE_PATH_NOT_EXPORTED')
continue
if name.startswith('models/migrations/'):
report['customizationMerge'].append({'path':name,'status':'HELD_FOR_EXPLICIT_MIGRATION_BRIDGE'});continue
p=snapshot/name;out=candidate/name
if p.is_symlink() or out.is_symlink():raise RuntimeError('SYMLINK_CUSTOMIZATION_REVIEW_REQUIRED')
if name in reference_tree and name not in public_base:raise RuntimeError('PUBLIC_REFERENCE_INPUT_PATH_MISSING')
ancestor=public_base[name].replace(b'code.gitea.io/gitea',b'gitea.dev') if name in public_base else None
theirs=p.read_bytes().replace(b'code.gitea.io/gitea',b'gitea.dev') if p.is_file() else None
ours=out.read_bytes() if out.is_file() else None
state=None
if theirs==ancestor:state='UPSTREAM_UPDATE_RETAINED_NO_CUSTOM_DELTA'
elif ours==theirs:state='ALREADY_IDENTICAL'
elif ancestor is None and ours is None and theirs is not None:
out.parent.mkdir(parents=True,exist_ok=True);out.write_bytes(theirs);state='CUSTOM_ADDITION_PRESERVED'
elif theirs is None:
if ours==ancestor:
out.unlink();state='CUSTOM_DELETION_PRESERVED'
else:state='DELETE_MODIFY_REVIEW_REQUIRED'
elif ours is None:state='UPSTREAM_DELETION_REVIEW_REQUIRED'
elif name.startswith('options/locale/') and name.endswith('.json'):
b=json.loads(ancestor) if ancestor is not None else {};o=json.loads(ours);t=json.loads(theirs)
if not all(isinstance(v,dict) for v in [b,o,t]):raise RuntimeError('LOCALE_OBJECT_REQUIRED')
result=dict(o);conflicts=[]
for key in set(b)|set(t):
bv=b.get(key,MISSING);ov=o.get(key,MISSING);tv=t.get(key,MISSING)
if tv==bv:continue
if ov==bv or ov==tv:
if tv is MISSING:result.pop(key,None)
else:result[key]=tv
else:conflicts.append(key)
if conflicts:state='SEMANTIC_REVIEW_REQUIRED';report.setdefault('localeConflictKeys',{})[name]=sorted(conflicts)
else:
out.write_text(json.dumps(result,ensure_ascii=False,indent=2)+'\n');state='LOCALE_THREE_WAY_KEYS_MERGED'
elif ancestor is None:state='ADD_ADD_REVIEW_REQUIRED'
else:
a=merge/(str(number)+'.ours');b=merge/(str(number)+'.base');c=merge/(str(number)+'.theirs')
a.write_bytes(ours);b.write_bytes(ancestor);c.write_bytes(theirs)
r=git(work,'merge-file','-p',str(a),str(b),str(c))
if r.returncode==0:out.write_bytes(r.stdout);state='TEXTUAL_MERGE_CLEAN_SEMANTICS_UNVERIFIED'
else:
(merge/(str(number)+'.conflicted')).write_bytes(r.stdout);state='SEMANTIC_REVIEW_REQUIRED'
report['customizationMerge'].append({'path':name,'status':state})
report['status']='COMPLETE_COMMITTED_AND_WORKING_CUSTOMIZATION_ANALYZED'
report['candidateBuilt']=False;report['candidateMigrated']=False
if fingerprint(live)!=(expected,6064):raise RuntimeError('LIVE_SOURCE_CHANGED_DURING_ANALYSIS')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
analyze
|
null
|
["ubuntu-latest"]
|
37553
|
1
|
1793525015
|
1793525024
|
1793525014
|
1793525024
|
|
0
|
|
0
|
Edit
Delete
|
|
46114
|
26786
|
116
|
5
|
93d0a763c88a7f4110535a1ed2aad4958dd677bd
|
0
|
validate
|
1
|
name: Prepare fixed frontend tools and isolated ru name: Prepare fixed frontend tools and isolated runner candidate
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-runtime-tools.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/prepare-runtime-tools.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-runtime-tools.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_RUNTIME_TOOLS_JSON '+json.dumps({'kind':'GiteaMaintenanceRuntimeTools','ci':{'sourceSha':sha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise
PY
shell: bash
timeout-minutes: "90"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37567
|
1
|
1793526987
|
1793527113
|
1793526985
|
1793527113
|
|
0
|
|
0
|
Edit
Delete
|
|
46115
|
26787
|
117
|
5
|
902a276ddf898b0360c227c0b4663bb46505e253
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
37568
|
1
|
1793527113
|
1793527134
|
1793527010
|
1793527134
|
|
0
|
|
0
|
Edit
Delete
|
|
46118
|
26790
|
116
|
5
|
4761299cdaaca88b5b95ff037fb05c2fa82f8ce1
|
0
|
validate
|
1
|
name: Read maintenance boundary with legacy INI ro name: Read maintenance boundary with legacy INI root keys
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-maintenance-boundary.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/inspect-maintenance-boundary.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'inspect-maintenance-boundary.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_MAINTENANCE_BOUNDARY_JSON '+json.dumps({'kind':'GiteaMaintenanceBoundary','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37571
|
1
|
1793528817
|
1793528819
|
1793528815
|
1793528820
|
|
0
|
|
0
|
Edit
Delete
|
|
46123
|
26795
|
116
|
5
|
56fb5db0157e53e9781664f499e19dd85b037d3b
|
0
|
inspect
|
1
|
name: Read private candidate failed test details
& name: Read private candidate failed test details
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-failed-test-detail.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json
root=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26793')
text=(root/'TARGETED_TESTS.stdout').read_text(errors='replace').splitlines()
for i,line in enumerate(text):
if '--- FAIL: TestToActionArtifact' in line:
lines=text[i:i+28]
assert not any(re.search(r'(?i)password|secret|authorization|BEGIN .*PRIVATE KEY|://[^ /]+@',s) for s in lines)
print('SYNTHETIC_TEST_FAILURE '+json.dumps(lines))
p=root/'candidate-source/modules/git/packfile_test.go'
lines=p.read_text().splitlines()
print('PACKFILE_TEST_TYPE '+json.dumps(lines[220:260]))
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37576
|
1
|
1793529187
|
1793529187
|
1793529186
|
1793529187
|
|
0
|
|
0
|
Edit
Delete
|
|
46127
|
26799
|
116
|
5
|
6b396956cefb01a465ec8d236c32094f7de53477
|
0
|
validate
|
1
|
name: Prepare explicitly approved dedicated runner name: Prepare explicitly approved dedicated runner identity
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-identity.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-rootless-identity.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-rootless-identity.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_ROOTLESS_IDENTITY_JSON '+json.dumps({'kind':'GiteaRootlessIdentity','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37580
|
1
|
1793529539
|
1793529553
|
1793529446
|
1793529553
|
|
0
|
|
0
|
Edit
Delete
|
|
46128
|
26800
|
116
|
5
|
14b408aad51b82532a3f3c4fc5f95053073b6179
|
0
|
validate
|
1
|
name: Create read only snapshot as database owner name: Create read only snapshot as database owner with isolated output
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-database-snapshot.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/snapshot-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'snapshot-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_DATABASE_SNAPSHOT_JSON '+json.dumps({'kind':'GiteaDatabaseSnapshot','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37581
|
1
|
1793529554
|
1793529630
|
1793529489
|
1793529630
|
|
0
|
|
0
|
Edit
Delete
|
|
46138
|
26803
|
117
|
5
|
f3ac8c240985eeca66982a3a5f7327318d3a2462
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
37591
|
1
|
1793529781
|
1793529797
|
1793529781
|
1793529798
|
|
0
|
|
0
|
Edit
Delete
|
|
46141
|
26806
|
116
|
5
|
a7f71fed666a2cbc34f044ddd15b27103eeb9605
|
0
|
export
|
1
|
name: Read screened Git pack protocol source for n name: Read screened Git pack protocol source for native failures
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-git-protocol-review.yml]
workflow_dispatch:
jobs:
export:
name: export
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Screen only known source changes and produce a review archive
run: |
set -eu
python3 <<'PY'
import base64, datetime, hashlib, io, json, os, pathlib, re, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
analysis=base/'analysis-26765'
receipt=json.loads((analysis/'receipt.json').read_text())
if receipt.get('status')!='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED':raise RuntimeError('VERIFIED_BASELINE_REQUIRED')
source=base/'reviewed-26801'/'candidate-source'
live=pathlib.Path('/root/gitea-src')
upstream=analysis/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(base),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_OPTIONAL_LOCKS':'0','GIT_TERMINAL_PROMPT':'0'}
def git(path,*args):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(path),*args],capture_output=True,timeout=30,env=env)
return r.returncode,r.stdout
code,head=git(upstream,'rev-parse','HEAD')
if code or head.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_OFFICIAL_SOURCE_REQUIRED')
# Export only files that require manual conflict or migration review.
# Already textually merged files and additive files stay on the server for native testing.
paths=['modules/git/'+name for name in ['delta.go','delta_test.go','packfile.go','packfile_test.go','packwriter.go','packwriter_test.go','packreader.go'] if (source/'modules/git'/name).is_file()]
def public_literals(text):
return set(re.findall(r'["\']([^"\'\n]{8,})["\']',text))
def suspicious(text,public,is_git_test=False):
issues=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
public_ssh=bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])) and any(m.group(0) in v for v in public)
if not public_ssh:issues.append('credential-prefix-or-private-key')
if re.search(r'https?://[^/\s:@]+:[^/\s@]+@',text):issues.append('credential-in-url')
for match in re.finditer(r'(?i)(?:[A-Za-z0-9_]*(?:password|passwd|secret|token|api_?key|access_?key|private_?key)[A-Za-z0-9_]*)\s*(?::=|=|:)\s*["\']([^"\'\n]{8,})["\']',text):
value=match.group(1)
if value not in public:issues.append('nonpublic-credential-literal')
for match in re.finditer(r'(?i)(?:Bearer|Basic)\s+[A-Za-z0-9_+/=.-]{12,}',text):
if not any(match.group(0) in literal for literal in public):issues.append('nonpublic-authorization-literal')
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in public and len(set(value))>8 and not is_git_test:issues.append('nonpublic-long-opaque-literal')
if not is_git_test:
for value in re.findall(r'["\']([A-Fa-f0-9]{32,128})["\']',text):
if value not in public and len(set(value))>3:issues.append('nonpublic-long-hex-literal')
return sorted(set(issues))
payload={};manifest=[];refused=[]
for name in paths:
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts or not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options'] or rel.suffix not in ['.go','.tmpl','.json']:raise RuntimeError('SOURCE_EXPORT_PATH_REFUSED')
p=source/name
if p.is_symlink() or not p.is_file():raise RuntimeError('SOURCE_EXPORT_NONREGULAR_FILE')
data=p.read_bytes()
if len(data)>2*1024*1024:raise RuntimeError('SOURCE_FILE_SIZE_LIMIT')
rc,public=git(upstream,'show','HEAD:'+name)
known=public_literals(public.decode(errors='replace')) if rc==0 else set()
# Never export authorization-looking comment text, even when it is likely prose.
text=data.decode('utf-8')
text=re.sub(r'(?m)^(\s*//[^\n]*?)(?i:Basic|Bearer)\s+[A-Za-z0-9_+/=.-]{12,}[^\n]*$',r'\1[REDACTED_AUTHORIZATION_LOOKING_COMMENT]',text)
data=text.encode('utf-8')
candidates=[(name,data)]
for archive_name,body in candidates:
problems=suspicious(body.decode('utf-8'),known,name.startswith('modules/git/') and name.endswith('_test.go'))
if problems:
text=body.decode('utf-8');classification=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
classification.append({'category':'prefix','publicSshAlgorithm':bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])),'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for m in re.finditer(r'(?i)(Bearer|Basic)\s+([A-Za-z0-9_+/=.-]{12,})',text):
line=text[text.rfind('\n',0,m.start())+1:m.start()]
valid=False
if m.group(1).lower()=='basic':
try:
decoded=base64.b64decode(m.group(2)+'='*((-len(m.group(2)))%4),validate=True).decode('utf-8')
valid=':' in decoded and decoded.isprintable()
except Exception:pass
classification.append({'category':'authorization','scheme':m.group(1).lower(),'commentLine':line.lstrip().startswith('//'),'validPrintableBasicCredential':valid,'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in known and len(set(value))>8 and not (name.startswith('modules/git/') and name.endswith('_test.go')):
classification.append({'category':'opaque','publicGitSmartHttpMime':value in ['application/x-git-upload-pack-advertisement','application/x-git-receive-pack-advertisement','application/x-git-upload-pack-result','application/x-git-receive-pack-result']})
refused.append({'path':archive_name,'reasons':problems,'classification':classification});continue
payload[archive_name]=body
manifest.append({'path':archive_name,'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest()})
report={'kind':'GiteaCustomSourceReviewExport','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceBaselineFingerprint':receipt['sourceFingerprint'],'upstreamCommit':head.decode().strip(),'serviceChanges':False,'databaseOrConfigurationExported':False,'registrationOrCredentialFilesRead':False,'refusedFiles':refused}
if refused:
report['status']='BLOCKED_CREDENTIAL_SCREENING';print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')));raise SystemExit(1)
if sum(len(v) for v in payload.values())>8*1024*1024:raise RuntimeError('SOURCE_EXPORT_SIZE_LIMIT')
work=base/('export-'+runid);work.mkdir(mode=0o700)
index={'kind':'GiteaCustomSourceReviewManifest','sourceBaselineFingerprint':receipt['sourceFingerprint'],'originalSourceHead':'287bf811487c04cd90bcf07aa04905cbaf2e4c2d','upstreamCommit':head.decode().strip(),'files':manifest,'scope':'Selected code only, not a system backup; no database, config, registration, environment, key or dependency cache files'}
payload['manifest.json']=(json.dumps(index,ensure_ascii=False,indent=2)+'\n').encode()
target=work/'gitea-custom-source.tar.gz'
with tarfile.open(target,'w:gz') as archive:
for name,body in sorted(payload.items()):
entry=tarfile.TarInfo(name);entry.size=len(body);entry.mode=0o600;entry.mtime=0;archive.addfile(entry,io.BytesIO(body))
report.update({'status':'SOURCE_CODE_SCREENED_AND_PACKED','fileCount':len(manifest),'archiveBytes':target.stat().st_size,'archiveSha256':hashlib.sha256(target.read_bytes()).hexdigest(),'privateArchive':str(target)})
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')))
for name,body in sorted(payload.items()):
if name=='manifest.json':continue
encoded=base64.b64encode(body).decode()
chunks=[encoded[i:i+8000] for i in range(0,len(encoded),8000)]
for i,chunk in enumerate(chunks):
print('GITEA_GIT_SOURCE_FILE_JSON '+json.dumps({'path':name,'sha256':hashlib.sha256(body).hexdigest(),'index':i,'chunks':len(chunks),'data':chunk},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
...
|
export
|
null
|
["ubuntu-latest"]
|
37594
|
1
|
1793529994
|
1793529994
|
1793529992
|
1793529994
|
|
0
|
|
0
|
Edit
Delete
|
|
46147
|
26812
|
116
|
5
|
488b9400ea31c0a6822f7f4ccb158c485a8a1c7c
|
0
|
inspect
|
1
|
name: Diagnose dedicated rootless daemon without c name: Diagnose dedicated rootless daemon without changing services
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-runtime-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,subprocess,os
root=pathlib.Path('/var/lib/eios-r1-maintenance')
env=['env','-i','PATH=/usr/local/bin:/usr/bin:/bin','HOME=/var/lib/eios-runner','XDG_RUNTIME_DIR=/run/user/994','DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/994/bus']
def user(args):return subprocess.run(['runuser','-u','eios-runner','--',*env,*args],capture_output=True,timeout=30)
status=user(['systemctl','--user','show','docker.service','--property=MainPID,ActiveState,SubState,ExecMainStatus,FragmentPath'])
props=dict(line.split('=',1) for line in status.stdout.decode().splitlines() if '=' in line)
journal=subprocess.run(['journalctl','_SYSTEMD_USER_UNIT=docker.service','_UID=994','-n','50','--no-pager'],capture_output=True,timeout=30)
lines=[line[-700:] for line in journal.stdout.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@',line)]
paths=[]
for p in pathlib.Path('/run/user/994').rglob('*'):
if len(paths)>=70:break
paths.append({'path':str(p),'socket':p.is_socket(),'symlink':p.is_symlink()})
print('GITEA_ROOTLESS_RUNTIME_DIAG_JSON '+json.dumps({'kind':'RootlessRuntimeReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'unit':props,'screenedJournal':lines,'runtimePaths':paths,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37600
|
1
|
1793530437
|
1793530441
|
1793530376
|
1793530442
|
|
0
|
|
0
|
Edit
Delete
|
|
46148
|
26813
|
116
|
5
|
c094f851975bfe8321f36bf10b2f2b250bf46b24
|
0
|
inspect
|
1
|
name: Read isolated old restore failure log only
& name: Read isolated old restore failure log only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-old-restore-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os
p=pathlib.Path('/var/lib/eios-r1-maintenance/old-database-restore-26810/old-server.log')
lines=[]
for line in p.read_text(errors='replace').splitlines():
if re.search(r'(?i)password|secret|authorization|://[^ /]+@|access.?token|private.?key|query=',line):continue
lines.append(line[-700:])
print('GITEA_OLD_RESTORE_DIAG_JSON '+json.dumps({'kind':'OldRestoreReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'screenedOldServerLog':lines[-45:],'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37601
|
1
|
1793530510
|
1793530510
|
1793530509
|
1793530510
|
|
0
|
|
0
|
Edit
Delete
|
|
46150
|
26815
|
116
|
5
|
c094f851975bfe8321f36bf10b2f2b250bf46b24
|
0
|
validate
|
1
|
name: Validate dedicated Docker with complete stan name: Validate dedicated Docker with complete standard system PATH
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-daemon.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-rootless-daemon.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-rootless-daemon.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_ROOTLESS_DAEMON_JSON '+json.dumps({'kind':'GiteaRootlessDaemon','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37603
|
1
|
1793530531
|
1793530533
|
1793530509
|
1793530534
|
|
0
|
|
0
|
Edit
Delete
|
|
46151
|
26816
|
116
|
5
|
62c9546ddd89b6b42d6102c67af41ca314f3c9ea
|
0
|
validate
|
1
|
name: Rehearse old restore keeping authenticated v name: Rehearse old restore keeping authenticated version API policy
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-old-database-restore.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/rehearse-old-database.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'rehearse-old-database.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_OLD_DATABASE_RESTORE_JSON '+json.dumps({'kind':'GiteaOldDatabaseRestoreRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37604
|
1
|
1793530564
|
1793530625
|
1793530562
|
1793530625
|
|
0
|
|
0
|
Edit
Delete
|
|
46153
|
26818
|
116
|
5
|
420f7580fc8a4f75162d3886f981a9e8201bc900
|
0
|
validate
|
1
|
name: Resolve official job image and test rootless name: Resolve official job image and test rootless canary
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-job-image.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/prepare-job-image.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'prepare-job-image.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_ROOTLESS_JOB_IMAGE_JSON '+json.dumps({'kind':'GiteaRootlessJobImage','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37606
|
1
|
1793530667
|
1793530771
|
1793530666
|
1793530771
|
|
0
|
|
0
|
Edit
Delete
|
|
46155
|
26820
|
116
|
5
|
99377766818e8de375eb4b5d5e14b24b83a08fc2
|
0
|
inspect
|
1
|
name: Read only obsolete owner guard source window name: Read only obsolete owner guard source windows
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-owner-guard-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,json,os
p=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26819/candidate-source/routers/web/repo/setting/setting.go')
text=p.read_text().splitlines()
windows=[]
for i,line in enumerate(text):
if 'ctx.Repo.IsOwner' in line:windows.append({'line':i+1,'source':text[max(0,i-12):i+17]})
print('GITEA_PERMISSION_SOURCE_DIAG_JSON '+json.dumps({'kind':'PermissionSourceReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'windows':windows,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37608
|
1
|
1793531041
|
1793531041
|
1793531040
|
1793531041
|
|
0
|
|
0
|
Edit
Delete
|
|
46167
|
26825
|
116
|
5
|
6cc52a6d035eb77b23c9241fdedd57b30dd9ea99
|
0
|
inspect
|
1
|
name: Read exact candidate lint diagnostic locatio name: Read exact candidate lint diagnostic locations only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess
root=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26822')
report=json.loads((root/'receipt.json').read_text())
issues=[]
for suffix in ['stdout','stderr']:
p=root/('LINT_GO.'+suffix)
if not p.is_file():continue
for line in p.read_text(errors='replace').splitlines():
if re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line):continue
if re.search(r'\.go:\d|missing or invalid copyright header|issues?:|^make:',line):issues.append(line[-600:])
chunks=[issues[i:i+24] for i in range(0,len(issues),24)] or [[]]
for i,chunk in enumerate(chunks):
print('GITEA_LINT_DIAGNOSTICS_JSON '+json.dumps({'kind':'CandidateLintReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'validationStatus':report['status'],'index':i,'chunks':len(chunks),'issues':chunk,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37612
|
1
|
1793532655
|
1793532655
|
1793531916
|
1793532655
|
|
0
|
|
0
|
Edit
Delete
|
|
46176
|
26827
|
116
|
5
|
52b7cb7a5070dec181dfeb09205b1dade0793adf
|
0
|
inspect
|
1
|
name: Read maintenance storage and ingress preflig name: Read maintenance storage and ingress preflight only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-preflight.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess,hashlib,shutil
def command(args):return subprocess.run(args,capture_output=True,timeout=90)
sizes={}
for path in ['/home/git','/usr/local/bin/data','/opt/gitea-runner','/var/lib/eios-r1-maintenance']:
r=command(['du','-s','-B1','--',path])
sizes[path]=int(r.stdout.split()[0]) if r.returncode==0 else None
def meta(name):
p=pathlib.Path(name)
if not p.exists():return {'path':name,'exists':False}
st=p.lstat();value={'path':name,'exists':True,'uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'bytes':st.st_size,'symlink':p.is_symlink()}
if p.is_file() and not p.is_symlink():value['sha256']=hashlib.sha256(p.read_bytes()).hexdigest()
return value
ssh=command(['/usr/sbin/sshd','-T']);selected={}
for line in ssh.stdout.decode().splitlines():
key,_,value=line.partition(' ')
if key in ['authorizedkeysfile','authorizedkeyscommand','passwordauthentication','kbdinteractiveauthentication','denyusers','allowusers','authenticationmethods','usepam']:selected[key]=value
status=command(['passwd','-S','git']).stdout.decode().split();account_status=status[:2]
configs=[]
for name in ['/etc/nginx/conf.d/gitea-http-redirect.conf','/etc/nginx/conf.d/gitea-https.conf']:
p=pathlib.Path(name);configs.append({'path':name,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'serverBlocks':len(re.findall(r'(?m)^\s*server\s*\{',p.read_text()))})
services={}
for name in ['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','nginx.service','ssh.service','docker.service']:
r=command(['systemctl','show',name,'--property=MainPID,ActiveState,FragmentPath']);services[name]=dict(line.split('=',1) for line in r.stdout.decode().splitlines() if '=' in line)
report={'kind':'GiteaMaintenanceWindowReadOnlyPreflight','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'mutations':False,'releaseEligible':False,'allocatedBytes':sizes,'filesystemFreeBytes':shutil.disk_usage('/var/lib/eios-r1-maintenance').free,'sshPolicy':selected,'gitAccountPasswordStatus':account_status,'nginxConfigs':configs,'services':services,'customHelperMetadata':[meta('/usr/local/bin/rsync_commit.sh'),meta('/home/git/.ssh/authorized_keys2')]}
print('GITEA_WINDOW_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37615
|
1
|
1793532667
|
1793532736
|
1793532044
|
1793532737
|
|
0
|
|
0
|
Edit
Delete
|
|
46177
|
26828
|
116
|
5
|
a451536e0fe212b0a5d07700bcf990d57356ebe1
|
0
|
inspect
|
1
|
name: Read terminated lint unit result and memory name: Read terminated lint unit result and memory metadata only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-resource-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess
unit='eios-r1-26822-lint_go.service'
r=subprocess.run(['journalctl','-u',unit,'--no-pager','-o','json'],capture_output=True,timeout=30)
messages=[]
for line in r.stdout.decode(errors='replace').splitlines():
try:message=json.loads(line).get('MESSAGE','')
except ValueError:continue
if not isinstance(message,str) or re.search(r'(?i)password|secret|authorization|://[^ /]+@',message):continue
messages.append(message[-800:])
mem={}
for line in pathlib.Path('/proc/meminfo').read_text().splitlines():
key,value=line.split(':',1)
if key in ['MemTotal','MemAvailable','SwapTotal','SwapFree']:mem[key]=value.strip()
print('GITEA_LINT_RESOURCE_DIAG_JSON '+json.dumps({'kind':'CandidateLintResourceReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'unit':unit,'screenedUnitMessages':messages[-25:],'memory':mem,'oomMentioned':any('oom' in m.lower() for m in messages),'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37622
|
1
|
1793532963
|
1793532967
|
1793532963
|
1793532968
|
|
0
|
|
0
|
Edit
Delete
|
|
46235
|
26837
|
116
|
5
|
6d8458db33ef21c45489d3605cccaa4ac4cb4c89
|
0
|
inspect
|
1
|
name: Read complete candidate lint results after r name: Read complete candidate lint results after resource repair
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess
root=pathlib.Path('/var/lib/eios-r1-maintenance/reviewed-26829')
report=json.loads((root/'receipt.json').read_text())
issues=[]
for suffix in ['stdout','stderr']:
p=root/('LINT_GO.'+suffix)
if not p.is_file():continue
for line in p.read_text(errors='replace').splitlines():
if re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line):continue
if re.search(r'\.go:\d|missing or invalid copyright header|issues?:|^make:',line):issues.append(line[-600:])
chunks=[issues[i:i+24] for i in range(0,len(issues),24)] or [[]]
for i,chunk in enumerate(chunks):
print('GITEA_LINT_DIAGNOSTICS_JSON '+json.dumps({'kind':'CandidateLintReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'validationStatus':report['status'],'index':i,'chunks':len(chunks),'issues':chunk,'mutations':False,'releaseEligible':False},separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "3"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37639
|
1
|
1793533750
|
1793533750
|
1793533747
|
1793533751
|
|
0
|
|
0
|
Edit
Delete
|
|
46253
|
26841
|
116
|
5
|
093e09c0a46348fd3cdc27d7cf7dde53c7b080dd
|
0
|
export
|
1
|
name: Read screened lint files excluding separatel name: Read screened lint files excluding separately reviewed HTTP handler
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-lint-source-review.yml]
workflow_dispatch:
jobs:
export:
name: export
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Screen only known source changes and produce a review archive
run: |
set -eu
python3 <<'PY'
import base64, datetime, hashlib, io, json, os, pathlib, re, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
analysis=base/'analysis-26765'
receipt=json.loads((analysis/'receipt.json').read_text())
if receipt.get('status')!='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED':raise RuntimeError('VERIFIED_BASELINE_REQUIRED')
source=base/'reviewed-26829'/'candidate-source'
live=pathlib.Path('/root/gitea-src')
upstream=analysis/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(base),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_OPTIONAL_LOCKS':'0','GIT_TERMINAL_PROMPT':'0'}
def git(path,*args):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(path),*args],capture_output=True,timeout=30,env=env)
return r.returncode,r.stdout
code,head=git(upstream,'rev-parse','HEAD')
if code or head.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_OFFICIAL_SOURCE_REQUIRED')
# Export only files that require manual conflict or migration review.
# Already textually merged files and additive files stay on the server for native testing.
paths=['models/repo/commit_sync_log.go', 'models/repo/commit_sync_status.go', 'models/repo/hidden_file.go', 'modules/git/pktline.go', 'routers/web/repo/commit.go', 'routers/web/repo/hidden_file.go', 'routers/web/repo/setting/setting.go', 'routers/web/repo/sync_records.go', 'services/gitpull/filter.go', 'services/gitpull/matcher.go', 'services/repository/auto_sync_deploy.go']
def public_literals(text):
return set(re.findall(r'["\']([^"\'\n]{8,})["\']',text))
def suspicious(text,public,is_git_test=False):
issues=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
public_ssh=bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])) and any(m.group(0) in v for v in public)
if not public_ssh:issues.append('credential-prefix-or-private-key')
if re.search(r'https?://[^/\s:@]+:[^/\s@]+@',text):issues.append('credential-in-url')
for match in re.finditer(r'(?i)(?:[A-Za-z0-9_]*(?:password|passwd|secret|token|api_?key|access_?key|private_?key)[A-Za-z0-9_]*)\s*(?::=|=|:)\s*["\']([^"\'\n]{8,})["\']',text):
value=match.group(1)
if value not in public:issues.append('nonpublic-credential-literal')
for match in re.finditer(r'(?i)(?:Bearer|Basic)\s+[A-Za-z0-9_+/=.-]{12,}',text):
if not any(match.group(0) in literal for literal in public):issues.append('nonpublic-authorization-literal')
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in public and len(set(value))>8 and not is_git_test:issues.append('nonpublic-long-opaque-literal')
if not is_git_test:
for value in re.findall(r'["\']([A-Fa-f0-9]{32,128})["\']',text):
if value not in public and len(set(value))>3:issues.append('nonpublic-long-hex-literal')
return sorted(set(issues))
payload={};manifest=[];refused=[]
for name in paths:
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts or not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options'] or rel.suffix not in ['.go','.tmpl','.json']:raise RuntimeError('SOURCE_EXPORT_PATH_REFUSED')
p=source/name
if p.is_symlink() or not p.is_file():raise RuntimeError('SOURCE_EXPORT_NONREGULAR_FILE')
data=p.read_bytes()
if len(data)>2*1024*1024:raise RuntimeError('SOURCE_FILE_SIZE_LIMIT')
rc,public=git(upstream,'show','HEAD:'+name)
known=public_literals(public.decode(errors='replace')) if rc==0 else set()
# Never export authorization-looking comment text, even when it is likely prose.
text=data.decode('utf-8')
text=re.sub(r'(?m)^(\s*//[^\n]*?)(?i:Basic|Bearer)\s+[A-Za-z0-9_+/=.-]{12,}[^\n]*$',r'\1[REDACTED_AUTHORIZATION_LOOKING_COMMENT]',text)
data=text.encode('utf-8')
candidates=[(name,data)]
for archive_name,body in candidates:
problems=suspicious(body.decode('utf-8'),known,name.startswith('modules/git/') and name.endswith('_test.go'))
if problems:
text=body.decode('utf-8');classification=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
classification.append({'category':'prefix','publicSshAlgorithm':bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])),'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for m in re.finditer(r'(?i)(Bearer|Basic)\s+([A-Za-z0-9_+/=.-]{12,})',text):
line=text[text.rfind('\n',0,m.start())+1:m.start()]
valid=False
if m.group(1).lower()=='basic':
try:
decoded=base64.b64decode(m.group(2)+'='*((-len(m.group(2)))%4),validate=True).decode('utf-8')
valid=':' in decoded and decoded.isprintable()
except Exception:pass
classification.append({'category':'authorization','scheme':m.group(1).lower(),'commentLine':line.lstrip().startswith('//'),'validPrintableBasicCredential':valid,'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in known and len(set(value))>8 and not (name.startswith('modules/git/') and name.endswith('_test.go')):
classification.append({'category':'opaque','publicGitSmartHttpMime':value in ['application/x-git-upload-pack-advertisement','application/x-git-receive-pack-advertisement','application/x-git-upload-pack-result','application/x-git-receive-pack-result']})
refused.append({'path':archive_name,'reasons':problems,'classification':classification});continue
payload[archive_name]=body
manifest.append({'path':archive_name,'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest()})
report={'kind':'GiteaCustomSourceReviewExport','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceBaselineFingerprint':receipt['sourceFingerprint'],'upstreamCommit':head.decode().strip(),'serviceChanges':False,'databaseOrConfigurationExported':False,'registrationOrCredentialFilesRead':False,'refusedFiles':refused}
if refused:
report['status']='BLOCKED_CREDENTIAL_SCREENING';print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')));raise SystemExit(1)
if sum(len(v) for v in payload.values())>8*1024*1024:raise RuntimeError('SOURCE_EXPORT_SIZE_LIMIT')
work=base/('export-'+runid);work.mkdir(mode=0o700)
index={'kind':'GiteaCustomSourceReviewManifest','sourceBaselineFingerprint':receipt['sourceFingerprint'],'originalSourceHead':'287bf811487c04cd90bcf07aa04905cbaf2e4c2d','upstreamCommit':head.decode().strip(),'files':manifest,'scope':'Selected code only, not a system backup; no database, config, registration, environment, key or dependency cache files'}
payload['manifest.json']=(json.dumps(index,ensure_ascii=False,indent=2)+'\n').encode()
target=work/'gitea-custom-source.tar.gz'
with tarfile.open(target,'w:gz') as archive:
for name,body in sorted(payload.items()):
entry=tarfile.TarInfo(name);entry.size=len(body);entry.mode=0o600;entry.mtime=0;archive.addfile(entry,io.BytesIO(body))
report.update({'status':'SOURCE_CODE_SCREENED_AND_PACKED','fileCount':len(manifest),'archiveBytes':target.stat().st_size,'archiveSha256':hashlib.sha256(target.read_bytes()).hexdigest(),'privateArchive':str(target)})
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')))
for name,body in sorted(payload.items()):
if name=='manifest.json':continue
encoded=base64.b64encode(body).decode()
chunks=[encoded[i:i+8000] for i in range(0,len(encoded),8000)]
for i,chunk in enumerate(chunks):
print('GITEA_GIT_SOURCE_FILE_JSON '+json.dumps({'path':name,'sha256':hashlib.sha256(body).hexdigest(),'index':i,'chunks':len(chunks),'data':chunk},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
...
|
export
|
null
|
["ubuntu-latest"]
|
37652
|
1
|
1793533924
|
1793533924
|
1793533920
|
1793533925
|
|
0
|
|
0
|
Edit
Delete
|
|
46254
|
26842
|
116
|
5
|
1e93ce65273c624562e316cf3d2cde5750f502cc
|
0
|
export
|
1
|
name: Review HTTP custom helpers with opaque liter name: Review HTTP custom helpers with opaque literals redacted
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-http-lint-review.yml]
workflow_dispatch:
jobs:
export:
name: export
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Screen only known source changes and produce a review archive
run: |
set -eu
python3 <<'PY'
import base64, datetime, hashlib, io, json, os, pathlib, re, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
analysis=base/'analysis-26765'
receipt=json.loads((analysis/'receipt.json').read_text())
if receipt.get('status')!='PRIVATE_BASELINE_VERIFIED_AND_COMPATIBILITY_ANALYZED':raise RuntimeError('VERIFIED_BASELINE_REQUIRED')
source=base/'reviewed-26829'/'candidate-source'
live=pathlib.Path('/root/gitea-src')
upstream=analysis/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(base),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_OPTIONAL_LOCKS':'0','GIT_TERMINAL_PROMPT':'0'}
def git(path,*args):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(path),*args],capture_output=True,timeout=30,env=env)
return r.returncode,r.stdout
code,head=git(upstream,'rev-parse','HEAD')
if code or head.decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('FIXED_OFFICIAL_SOURCE_REQUIRED')
# Export only files that require manual conflict or migration review.
# Already textually merged files and additive files stay on the server for native testing.
paths=['routers/web/repo/githttp.go']
def public_literals(text):
return set(re.findall(r'["\']([^"\'\n]{8,})["\']',text))
def suspicious(text,public,is_git_test=False):
issues=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
public_ssh=bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])) and any(m.group(0) in v for v in public)
if not public_ssh:issues.append('credential-prefix-or-private-key')
if re.search(r'https?://[^/\s:@]+:[^/\s@]+@',text):issues.append('credential-in-url')
for match in re.finditer(r'(?i)(?:[A-Za-z0-9_]*(?:password|passwd|secret|token|api_?key|access_?key|private_?key)[A-Za-z0-9_]*)\s*(?::=|=|:)\s*["\']([^"\'\n]{8,})["\']',text):
value=match.group(1)
if value not in public:issues.append('nonpublic-credential-literal')
for match in re.finditer(r'(?i)(?:Bearer|Basic)\s+[A-Za-z0-9_+/=.-]{12,}',text):
if not any(match.group(0) in literal for literal in public):issues.append('nonpublic-authorization-literal')
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in public and len(set(value))>8 and not is_git_test:issues.append('nonpublic-long-opaque-literal')
if not is_git_test:
for value in re.findall(r'["\']([A-Fa-f0-9]{32,128})["\']',text):
if value not in public and len(set(value))>3:issues.append('nonpublic-long-hex-literal')
return sorted(set(issues))
payload={};manifest=[];refused=[]
for name in paths:
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts or not rel.parts or rel.parts[0] not in ['models','routers','services','modules','templates','options'] or rel.suffix not in ['.go','.tmpl','.json']:raise RuntimeError('SOURCE_EXPORT_PATH_REFUSED')
p=source/name
if p.is_symlink() or not p.is_file():raise RuntimeError('SOURCE_EXPORT_NONREGULAR_FILE')
data=p.read_bytes()
if len(data)>2*1024*1024:raise RuntimeError('SOURCE_FILE_SIZE_LIMIT')
rc,public=git(upstream,'show','HEAD:'+name)
known=public_literals(public.decode(errors='replace')) if rc==0 else set()
# Never export authorization-looking comment text, even when it is likely prose.
text=data.decode('utf-8')
text=re.sub(r'(?m)^(\s*//[^\n]*?)(?i:Basic|Bearer)\s+[A-Za-z0-9_+/=.-]{12,}[^\n]*$',r'\1[REDACTED_AUTHORIZATION_LOOKING_COMMENT]',text)
# Review copy only: every nonpublic opaque literal is removed before unchanged screening.
original_sha=hashlib.sha256(data).hexdigest()
redactions=[]
def redact(match):
value=match.group(1)
if value in known or len(set(value))<=8:return match.group(0)
redactions.append({'line':text.count('\n',0,match.start())+1,'length':len(value)})
return '"[REDACTED_NONPUBLIC_LITERAL]"'
text=re.sub(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',redact,text)
print('GITEA_HTTP_REDACTIONS_JSON '+json.dumps({'path':name,'originalSha256':original_sha,'reviewCopyOnly':True,'redactions':redactions}),flush=True)
data=text.encode('utf-8')
candidates=[(name,data)]
for archive_name,body in candidates:
problems=suspicious(body.decode('utf-8'),known,name.startswith('modules/git/') and name.endswith('_test.go'))
if problems:
text=body.decode('utf-8');classification=[]
for m in re.finditer(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:ghp_|github_pat_|AKIA[0-9A-Z]{16}|sk-(?:proj-)?)[A-Za-z0-9_/-]{12,}',text):
classification.append({'category':'prefix','publicSshAlgorithm':bool(re.match(r'sk-(?:ecdsa-sha2-nistp256|ssh-ed25519)@openssh\.com',text[m.start():])),'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for m in re.finditer(r'(?i)(Bearer|Basic)\s+([A-Za-z0-9_+/=.-]{12,})',text):
line=text[text.rfind('\n',0,m.start())+1:m.start()]
valid=False
if m.group(1).lower()=='basic':
try:
decoded=base64.b64decode(m.group(2)+'='*((-len(m.group(2)))%4),validate=True).decode('utf-8')
valid=':' in decoded and decoded.isprintable()
except Exception:pass
classification.append({'category':'authorization','scheme':m.group(1).lower(),'commentLine':line.lstrip().startswith('//'),'validPrintableBasicCredential':valid,'presentInOfficialLiteral':any(m.group(0) in v for v in known)})
for value in re.findall(r'["\']([A-Za-z0-9+/=_-]{32,})["\']',text):
if value not in known and len(set(value))>8 and not (name.startswith('modules/git/') and name.endswith('_test.go')):
classification.append({'category':'opaque','publicGitSmartHttpMime':value in ['application/x-git-upload-pack-advertisement','application/x-git-receive-pack-advertisement','application/x-git-upload-pack-result','application/x-git-receive-pack-result']})
refused.append({'path':archive_name,'reasons':problems,'classification':classification});continue
payload[archive_name]=body
manifest.append({'path':archive_name,'bytes':len(body),'sha256':hashlib.sha256(body).hexdigest()})
report={'kind':'GiteaCustomSourceReviewExport','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceBaselineFingerprint':receipt['sourceFingerprint'],'upstreamCommit':head.decode().strip(),'serviceChanges':False,'databaseOrConfigurationExported':False,'registrationOrCredentialFilesRead':False,'refusedFiles':refused}
if refused:
report['status']='BLOCKED_CREDENTIAL_SCREENING';print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')));raise SystemExit(1)
if sum(len(v) for v in payload.values())>8*1024*1024:raise RuntimeError('SOURCE_EXPORT_SIZE_LIMIT')
work=base/('export-'+runid);work.mkdir(mode=0o700)
index={'kind':'GiteaCustomSourceReviewManifest','sourceBaselineFingerprint':receipt['sourceFingerprint'],'originalSourceHead':'287bf811487c04cd90bcf07aa04905cbaf2e4c2d','upstreamCommit':head.decode().strip(),'files':manifest,'scope':'Selected code only, not a system backup; no database, config, registration, environment, key or dependency cache files'}
payload['manifest.json']=(json.dumps(index,ensure_ascii=False,indent=2)+'\n').encode()
target=work/'gitea-custom-source.tar.gz'
with tarfile.open(target,'w:gz') as archive:
for name,body in sorted(payload.items()):
entry=tarfile.TarInfo(name);entry.size=len(body);entry.mode=0o600;entry.mtime=0;archive.addfile(entry,io.BytesIO(body))
report.update({'status':'SOURCE_CODE_SCREENED_AND_PACKED','fileCount':len(manifest),'archiveBytes':target.stat().st_size,'archiveSha256':hashlib.sha256(target.read_bytes()).hexdigest(),'privateArchive':str(target)})
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
print('GITEA_CUSTOM_SOURCE_EXPORT_JSON '+json.dumps(report,separators=(',',':')))
for name,body in sorted(payload.items()):
if name=='manifest.json':continue
encoded=base64.b64encode(body).decode()
chunks=[encoded[i:i+8000] for i in range(0,len(encoded),8000)]
for i,chunk in enumerate(chunks):
print('GITEA_GIT_SOURCE_FILE_JSON '+json.dumps({'path':name,'sha256':hashlib.sha256(body).hexdigest(),'index':i,'chunks':len(chunks),'data':chunk},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
...
|
export
|
null
|
["ubuntu-latest"]
|
37658
|
1
|
1793533951
|
1793533951
|
1793533943
|
1793533951
|
|
0
|
|
0
|
Edit
Delete
|
|
46266
|
26847
|
116
|
5
|
f645d7a173609fc827032b40df8a63990903db99
|
0
|
inspect
|
1
|
name: Probe rootless daemon custody using only a t name: Probe rootless daemon custody using only a temporary nonsecret marker
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-custody-probe.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Test prospective same UID credential custody without reading credentials
run: |
set -eu
python3 <<'PY'
import datetime,json,os,pathlib,pwd,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
account=pwd.getpwnam('eios-runner')
if account.pw_uid!=994 or account.pw_dir!='/var/lib/eios-runner':raise RuntimeError('ACCOUNT_MISMATCH')
marker=pathlib.Path(account.pw_dir)/('r1-nonsecret-custody-probe-'+runid)
# This marker is deliberately public test data, never a token, configuration or registration file.
fd=os.open(marker,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
with os.fdopen(fd,'w') as f:f.write('EIOS_R1_PUBLIC_CUSTODY_TEST\n')
os.chown(marker,994,984)
image='docker.gitea.com/runner-images@sha256:b8eb33018cf1b9cbdfd6b3ca0b69a2f7b5f257de60a394c763a784c549b94b53'
args=['runuser','-u','eios-runner','--','env','-i','PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin','HOME=/var/lib/eios-runner','XDG_RUNTIME_DIR=/run/user/994','docker','--host','unix:///run/user/994/docker.sock','run','--rm','--pull=never','--network=none','--cap-drop=ALL','--security-opt=no-new-privileges','--memory=128m','--cpus=0.5','--pids-limit=64','--mount','type=bind,src='+str(marker)+',dst=/probe,readonly',image,'sh','-ec','test "$(cat /probe)" = EIOS_R1_PUBLIC_CUSTODY_TEST']
try:result=subprocess.run(args,capture_output=True,timeout=90)
finally:marker.unlink()
report={'kind':'RootlessSameUIDCustodyProbe','ci':{'runId':runid,'sourceSha':os.environ.get('GITHUB_SHA')},'observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'actualCredentialsRead':False,'productionServicesChanged':False,'temporaryPublicMarkerRemoved':not marker.exists(),'sameUIDMode0600MarkerReadableViaDocker':result.returncode==0,'dockerExitCode':result.returncode,'releaseEligible':False}
print('GITEA_CUSTODY_PROBE_JSON '+json.dumps(report,separators=(',',':')),flush=True)
if result.returncode:raise SystemExit(1)
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37671
|
1
|
1793534940
|
1793534941
|
1793534393
|
1793534941
|
|
0
|
|
0
|
Edit
Delete
|
|
46270
|
26851
|
116
|
5
|
1a992ce3f8423df3d2ddfffd0d3a7527cb027806
|
0
|
validate
|
1
|
name: Revalidate same fixed checkout after native name: Revalidate same fixed checkout after native lint timeout
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reviewed-revalidation.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/revalidate-reviewed-checkout.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'revalidate-reviewed-checkout.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_REVIEWED_VALIDATION_JSON '+json.dumps({'kind':'GiteaReviewedCandidateValidation','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37675
|
1
|
1793536584
|
1793536760
|
1793536584
|
1793536760
|
|
0
|
|
0
|
Edit
Delete
|
|
46273
|
26854
|
116
|
5
|
a3f7b224ce22822cdca006dd7a0c24a423a7b498
|
0
|
inspect
|
1
|
name: Diagnose fixed candidate clone without chang name: Diagnose fixed candidate clone without changing validated source
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-build-git-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import hashlib,json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');source=base/'reviewed-26848/candidate-source'
if base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
old=base/'build-26852';work=base/('build-git-diagnostic-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def screen(data):return [line[-700:] for line in data.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line)][-8:]
def command(cwd,args):
r=subprocess.run(['git','--no-optional-locks','-c','safe.directory='+str(source),'-c','safe.directory='+str(work/'candidate-source'),'-c','core.hooksPath=/dev/null','-c','credential.helper=','-C',str(cwd),*args],env=env,capture_output=True,timeout=120)
return {'operation':args[0],'exitCode':r.returncode,'stdoutBytes':len(r.stdout),'screenedStderr':screen(r.stderr)}
observations=[command(source,['rev-parse','HEAD']),command(source,['ls-files','-z']),command(source,['ls-files','--others','--exclude-standard','-z']),command(work,['clone','--no-local','--depth=1','--no-checkout',str(source),str(work/'candidate-source')])]
prior=[]
for name in ['candidate-source','candidate-source/.git','candidate-source/.git/HEAD','candidate-source/.git/shallow']:
p=old/name;prior.append({'path':name,'exists':p.exists(),'symlink':p.is_symlink(),'uid':p.stat().st_uid if p.exists() else None})
print('GITEA_BUILD_GIT_DIAG_JSON '+json.dumps({'kind':'FixedBuildGitDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'priorBuildMetadata':prior,'operations':observations,'validatedSourceModified':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37678
|
1
|
1793536883
|
1793536883
|
1793536881
|
1793536883
|
|
0
|
|
0
|
Edit
Delete
|
|
46275
|
26856
|
116
|
5
|
a490b4ac15698abf44bb7890a70f0e4ce0c1d602
|
0
|
inspect
|
1
|
name: Verify isolated private Git configuration fo name: Verify isolated private Git configuration for upload pack trust
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-build-git-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import hashlib,json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');source=base/'reviewed-26848/candidate-source'
if base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
old=base/'build-26852';work=base/('build-git-diagnostic-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def screen(data):return [line[-700:] for line in data.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line)][-8:]
def command(cwd,args):
r=subprocess.run(['git','--no-optional-locks','-c','safe.directory='+str(source),'-c','safe.directory='+str(work/'candidate-source'),'-c','core.hooksPath=/dev/null','-c','credential.helper=','-C',str(cwd),*args],env=env,capture_output=True,timeout=120)
return {'operation':args[0],'exitCode':r.returncode,'stdoutBytes':len(r.stdout),'screenedStderr':screen(r.stderr)}
isolated_config=work/'isolated.gitconfig'
isolated_config.write_text('[safe]\n\tdirectory = '+str(source)+'\n\tdirectory = '+str(source/'.git')+'\n')
os.chmod(isolated_config,0o600)
env['GIT_CONFIG_GLOBAL']=str(isolated_config)
observations=[command(work,['clone','--no-local','--depth=1','--no-checkout',str(source),str(work/'candidate-source')])]
if observations[-1]['exitCode']:
env['GIT_CONFIG_GLOBAL']='/dev/null'
observations.append(command(work,['clone','--no-local','--depth=1','--no-checkout','--upload-pack=git -c safe.directory='+str(source)+' -c safe.directory='+str(source/'.git')+' upload-pack',str(source),str(work/'candidate-source-explicit-upload-pack')]))
prior=[]
for name in ['candidate-source','candidate-source/.git','candidate-source/.git/HEAD','candidate-source/.git/shallow']:
p=old/name;prior.append({'path':name,'exists':p.exists(),'symlink':p.is_symlink(),'uid':p.stat().st_uid if p.exists() else None})
print('GITEA_BUILD_GIT_DIAG_JSON '+json.dumps({'kind':'FixedBuildGitDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'priorBuildMetadata':prior,'operations':observations,'validatedSourceModified':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37680
|
1
|
1793537031
|
1793537032
|
1793537030
|
1793537032
|
|
0
|
|
0
|
Edit
Delete
|
|
46276
|
26857
|
116
|
5
|
c7d68a55baac98f653785de381d8e38b705e61d1
|
0
|
validate
|
1
|
name: Build validated candidate using isolated tas name: Build validated candidate using isolated task private Git config
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-candidate-build.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/build-fixed-candidate.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'build-fixed-candidate.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FIXED_BUILD_JSON '+json.dumps({'kind':'GiteaFixedCandidateBuild','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37681
|
1
|
1793537105
|
1793537395
|
1793537105
|
1793537395
|
|
0
|
|
0
|
Edit
Delete
|
|
46279
|
26860
|
116
|
5
|
578b0f3e2fa5d1a0b8c9d70cc909a8ad88fa5e71
|
0
|
inspect
|
1
|
name: Read actual candidate CLI version output onl name: Read actual candidate CLI version output only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-version-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
stored=(base/'build-26857/BINARY_VERSION.stdout').read_text(errors='replace').strip()
r=subprocess.run(['runuser','-u','git','--','env','-i','PATH=/usr/local/bin:/usr/bin:/bin','HOME='+str(base/'candidate-database-rehearsal-26858/git-home'),'USER=git','LOGNAME=git',str(base/'candidate-database-rehearsal-26858/gitea.candidate'),'--version'],capture_output=True,timeout=20)
observed=r.stdout.decode(errors='replace').strip()
def safe(text):
if len(text)>500 or re.search(r'(?i)password|secret|authorization|BEGIN .*PRIVATE KEY|://[^ /]+@',text):return 'OUTPUT_REFUSED'
return text
print('GITEA_CLI_VERSION_DIAG_JSON '+json.dumps({'kind':'CandidateCLIVersionReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'builtVersionOutput':safe(stored),'privateCopyVersionOutput':safe(observed),'exitCode':r.returncode,'screenedStderr':safe(r.stderr.decode(errors='replace').strip()),'databaseWritten':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37684
|
1
|
1793538086
|
1793538086
|
1793538085
|
1793538086
|
|
0
|
|
0
|
Edit
Delete
|
|
46280
|
26861
|
116
|
5
|
c092cf99e8eb7c16356f1be88209c4ebbc12816b
|
0
|
validate
|
1
|
name: Finalize private database with tested actual name: Finalize private database with tested actual CLI version format
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-database-finalize.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/finish-candidate-database-rehearsal.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'finish-candidate-database-rehearsal.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_CANDIDATE_DATABASE_REHEARSAL_JSON '+json.dumps({'kind':'GiteaCandidateDatabaseMigrationRehearsal','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37685
|
1
|
1793538258
|
1793538352
|
1793538256
|
1793538353
|
|
0
|
|
0
|
Edit
Delete
|