| workflow_payload |
name: Action source diagnostic (no release)
"o name: Action source diagnostic (no release)
"on":
workflow_dispatch:
jobs:
anonymous-source-diagnostic:
name: Anonymous Action source reachability (diagnostic only)
runs-on: ubuntu-latest
if: ${{ github.repository == 'luoanwu/enterprise-platform' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/codex/gitea-hostfix-20261016') }}
steps:
- name: Probe official public upstream and Gitea mirrors without credentials
run: |
set -eu
node <<'NODE'
const { spawnSync } = require('node:child_process');
const { mkdtempSync, rmSync } = require('node:fs');
const { tmpdir } = require('node:os');
const { join } = require('node:path');
const sources = [
['actions/checkout', 'actions-checkout', 'v4'],
['actions/setup-node', 'actions-setup-node', 'v4'],
['actions/upload-artifact', 'actions-upload-artifact', 'v3'],
['actions/download-artifact', 'actions-download-artifact', 'v3'],
['sigstore/cosign-installer', 'sigstore-cosign-installer', 'v3'],
];
const observation = {
purpose: 'read-only network diagnosis; not release acceptance',
observedAt: new Date().toISOString(),
repository: process.env.GITHUB_REPOSITORY ?? null,
sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null,
githubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
giteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null,
runnerName: process.env.RUNNER_NAME ?? null,
probes: [],
};
const workspace = mkdtempSync(join(tmpdir(), 'action-source-anonymous-'));
const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_CONFIG_')));
const env = { ...inherited, HOME: workspace, XDG_CONFIG_HOME: workspace, CURL_HOME: workspace,
GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '/bin/false', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
try {
for (const [official, mirror, tag] of sources) {
for (const [provider, repository] of [['github', official], ['gitea', `luoanwu/${mirror}`]]) {
const host = provider === 'github' ? 'github.com' : 'gitea.g-hi.com';
const ref = `refs/tags/${tag}`;
const result = spawnSync('git', ['-c', 'credential.helper=', '-c', 'core.askPass=',
'-c', 'http.extraHeader=', 'ls-remote', `https://${host}/${repository}.git`, ref],
{ env, cwd: workspace, encoding: 'utf8', timeout: 15000, maxBuffer: 1024 * 1024 });
const lines = (result.stdout ?? '').trim().split('\n').filter(Boolean);
const match = lines.length === 1 ? /^([0-9a-f]{40})\s+(refs\/tags\/[^\s]+)$/.exec(lines[0]) : null;
const verified = result.status === 0 && match?.[2] === ref;
observation.probes.push({ provider, repository, tag, exitCode: result.status,
timedOut: result.error?.code === 'ETIMEDOUT', verified, sha: verified ? match[1] : null });
}
}
observation.status = observation.probes.every(p => p.verified) ? 'reachable' : 'blocked';
console.log('ACTION_SOURCE_DIAGNOSTIC ' + JSON.stringify(observation));
process.exitCode = observation.status === 'reachable' ? 0 : 1;
} finally { rmSync(workspace, { recursive: true, force: true }); }
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
... |