| workflow_payload |
name: Public mirror job-token diagnostic (no relea name: Public mirror job-token diagnostic (no release)
"on":
push:
branches: [codex/gitea-hostfix-20261016]
paths: [.gitea/workflows/job-token-mirror-diagnostic.yml]
workflow_dispatch:
jobs:
public-mirror-job-token:
name: Public Action mirror job-token reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe public mirrors using the existing read-only job token
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, writeFileSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const workspace = mkdtempSync(join(tmpdir(), 'public-mirror-job-token-'));
const observation = { purpose: 'public mirror reachability only; not release acceptance',
observedAt: new Date().toISOString(), sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null, githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
credentialSource: 'existing short-lived contents:read job token', probes: [] };
try {
const token = process.env.MIRROR_READ_TOKEN;
if (!token || /[\r\n]/.test(token)) throw new Error('JOB_TOKEN_UNAVAILABLE');
const config = join(workspace, 'gitconfig');
const authorization = Buffer.from(`x-access-token:${token}`).toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${authorization}\n`,
{ mode: 0o600, flag: 'wx' });
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'MIRROR_READ_TOKEN' && !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: config, GIT_CONFIG_NOSYSTEM: '1' };
for (const [repository, tag] of [['actions-checkout','v4'],['actions-setup-node','v4'],
['actions-upload-artifact','v3'],['actions-download-artifact','v3'],['sigstore-cosign-installer','v3']]) {
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','ls-remote',`https://gitea.g-hi.com/luoanwu/${repository}.git`,ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
const destination = join(workspace, repository);
const clone = verified ? spawnSync('git', ['-c','credential.helper=','-c','core.askPass=',
'-c','http.followRedirects=false','-c','init.templateDir=','clone','--no-checkout',
'--depth','1','--single-branch','--branch',tag,`https://gitea.g-hi.com/luoanwu/${repository}.git`,destination],
{ env, cwd: workspace, encoding: 'utf8', timeout: 45000, maxBuffer: 1024 * 1024 }) : null;
const downloaded = clone?.status === 0;
const storedRef = downloaded ? spawnSync('git',['rev-parse',`refs/tags/${tag}`],
{ env, cwd: destination, encoding: 'utf8', timeout: 5000 }) : null;
const manifest = downloaded ? spawnSync('git',['cat-file','-e','HEAD:action.yml'],
{ env, cwd: destination, encoding: 'utf8', timeout: 5000 }) : null;
const cloneVerified = downloaded && storedRef?.status === 0 && storedRef.stdout.trim() === match[1] && manifest?.status === 0;
observation.probes.push({ repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', refVerified: verified,
cloneExitCode: clone?.status ?? null, cloneTimedOut: clone?.error?.code === 'ETIMEDOUT',
actionManifestPresent: manifest?.status === 0, verified: cloneVerified, sha: verified ? match[1] : null });
}
const invalid = Buffer.from('x-access-token:diagnostic-intentionally-invalid').toString('base64');
writeFileSync(config, `[http "https://gitea.g-hi.com/"]\n\textraHeader = Authorization: Basic ${invalid}\n`, { mode: 0o600 });
const denied = spawnSync('git',['-c','credential.helper=','-c','core.askPass=','-c','http.followRedirects=false',
'ls-remote','https://gitea.g-hi.com/luoanwu/actions-checkout.git','refs/tags/v4'],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
observation.invalidToken = { exitCode: denied.status, timedOut: denied.error?.code === 'ETIMEDOUT',
rejected: denied.status === 128 && /Authentication failed|401|403/.test(denied.stderr ?? '') };
observation.status = observation.probes.every(p => p.verified) && observation.invalidToken.rejected ? 'reachable' : 'blocked';
} catch { observation.status = 'unavailable'; }
finally { rmSync(workspace, { recursive: true, force: true }); }
console.log('PUBLIC_MIRROR_JOB_TOKEN_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
NODE
shell: bash
env:
MIRROR_READ_TOKEN: ${{ github.token }}
timeout-minutes: "5"
permissions:
contents: read
... |