| workflow_payload |
name: Public mirror job-token diagnostic (no relea name: Public mirror job-token diagnostic (no release)
"on":
push:
branches: [codex/gitea-hostfix-20261016]
paths: [.gitea/workflows/job-token-mirror-diagnostic.yml]
workflow_dispatch:
jobs:
public-mirror-job-token:
name: Public Action mirror job-token reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe public mirrors using the existing read-only job token
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, writeFileSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const workspace = mkdtempSync(join(tmpdir(), 'public-mirror-job-token-'));
const observation = { purpose: 'public mirror reachability only; not release acceptance',
observedAt: new Date().toISOString(), sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null, githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
credentialSource: 'existing short-lived contents:read job token', probes: [] };
try {
const token = process.env.MIRROR_READ_TOKEN;
if (!token || /[\r\n]/.test(token)) throw new Error('JOB_TOKEN_UNAVAILABLE');
const config = join(workspace, 'gitconfig');
const authorization = Buffer.from(`x-access-token:${token}`).toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${authorization}\n`,
{ mode: 0o600, flag: 'wx' });
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'MIRROR_READ_TOKEN' && !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: '1' };
for (const [repository, tag] of [['actions-checkout','v4'],['actions-setup-node','v4'],
['actions-upload-artifact','v3'],['actions-download-artifact','v3'],['sigstore-cosign-installer','v3']]) {
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','ls-remote',`https://gitea.g-hi.com/luoanwu/${repository}.git`,ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
observation.probes.push({ repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', verified, sha: verified ? match[1] : null });
}
observation.status = observation.probes.every(p => p.verified) ? 'reachable' : 'blocked';
} catch { observation.status = 'unavailable'; }
finally { rmSync(workspace, { recursive: true, force: true }); }
console.log('PUBLIC_MIRROR_JOB_TOKEN_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
NODE
shell: bash
env:
MIRROR_READ_TOKEN: ${{ github.token }}
timeout-minutes: "2"
permissions:
contents: read
... |