| workflow_payload |
name: Observe selected storage metadata only witho name: Observe selected storage metadata only without admission
"on":
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Observe fixed selected ODB and restore metadata without maintenance
run: |
set -eu
python3 <<'PY'
import json,os,pathlib,re,socket,stat,subprocess,tempfile
def preflight_odb_graph(objects,allowed):
# This self-contained function is mechanically copied into the workflow loader.
# Traverse no-follow metadata BEFORE reading any alternates or Git object data.
import os,pathlib,stat,hashlib
def reject():raise RuntimeError('ODB_BOUNDARY_PREFLIGHT_REQUIRED')
def ident(st):return (st.st_dev,st.st_ino,st.st_mode,st.st_size,st.st_mtime_ns,st.st_nlink)
def open_dir(path):
fd=os.open('/',os.O_RDONLY|os.O_DIRECTORY)
try:
for part in path.parts[1:]:
other=os.open(part,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=fd);os.close(fd);fd=other
return fd
except BaseException:os.close(fd);raise
objects=pathlib.Path(os.path.abspath(objects));allowed=pathlib.Path(os.path.abspath(allowed));seen={}
def visit(path,depth):
if path in seen:return
if depth>8 or len(seen)>=64 or not path.is_relative_to(allowed):reject()
fd=open_dir(path);metadata={}
def scan(parent,prefix):
metadata[prefix]=ident(os.fstat(parent))
if len(metadata)>1000000:reject()
for name in os.listdir(parent):
st=os.stat(name,dir_fd=parent,follow_symlinks=False);key=prefix+'/'+name
if stat.S_ISREG(st.st_mode):metadata[key]=ident(st)
elif stat.S_ISDIR(st.st_mode):
child=os.open(name,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=parent)
try:scan(child,key)
finally:os.close(child)
else:reject()
if len(metadata)>1000000:reject()
try:
scan(fd,'');seen[path]=(metadata,None)
if '/info/alternates' not in metadata:return
info=os.open('info',os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=fd)
try:
item=os.open('alternates',os.O_RDONLY|os.O_NOFOLLOW,dir_fd=info)
try:
before=os.fstat(item)
if not stat.S_ISREG(before.st_mode) or before.st_nlink!=1 or before.st_size>65536 or ident(before)!=metadata['/info/alternates']:reject()
raw=b''
while len(raw)<=65536:
chunk=os.read(item,min(65537-len(raw),8192))
if not chunk:break
raw+=chunk
if len(raw)!=before.st_size or ident(os.fstat(item))!=ident(before) or ident(os.stat('alternates',dir_fd=info,follow_symlinks=False))!=ident(before):reject()
finally:os.close(item)
finally:os.close(info)
seen[path]=(metadata,hashlib.sha256(raw).hexdigest())
for line in raw.decode('utf-8').splitlines():
if not line or line.startswith('"') or any(ord(c)<32 for c in line):reject()
other=pathlib.Path(line);visit(pathlib.Path(os.path.abspath(other if other.is_absolute() else path/other)),depth+1)
finally:os.close(fd)
try:visit(objects,0)
except (OSError,UnicodeError,ValueError):reject()
return seen
sha=os.environ.get('GITHUB_SHA','');run=os.environ.get('GITHUB_RUN_ID','')
if not re.fullmatch('[0-9a-f]{40}',sha) or not re.fullmatch('[1-9][0-9]{0,11}',run) or os.environ.get('GITHUB_REF')!='refs/heads/codex/runner-maintenance-diagnostic-20261101':raise RuntimeError('FIXED_OBSERVER_CONTEXT_REQUIRED')
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');details=base.lstat()
if not stat.S_ISDIR(details.st_mode) or details.st_uid!=0 or details.st_mode&0o077 or base.resolve()!=base:raise RuntimeError('PRIVATE_OBSERVER_BASE_REQUIRED')
os.umask(0o077)
try:
preflight_odb_graph(pathlib.Path('/home/git/repositories/luoanwu/enterprise-platform.git/objects'),pathlib.Path('/home/git/repositories'))
with tempfile.TemporaryDirectory(prefix='storage-facts-loader-'+run+'-',dir=base) as name:
view=pathlib.Path(name);(view/'objects').mkdir();(view/'refs').mkdir();(view/'HEAD').write_text('ref: refs/heads/observer\n')
env={'PATH':'/usr/bin:/bin','HOME':'/nonexistent','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_SYSTEM':'/dev/null','GIT_CONFIG_GLOBAL':'/dev/null','GIT_NO_REPLACE_OBJECTS':'1','GIT_OPTIONAL_LOCKS':'0','GIT_NO_LAZY_FETCH':'1','GIT_TERMINAL_PROMPT':'0','GIT_OBJECT_DIRECTORY':'/home/git/repositories/luoanwu/enterprise-platform.git/objects'}
result=subprocess.run(['/usr/bin/git','-c','core.hooksPath=/dev/null','-c','core.fsmonitor=false','-c','protocol.allow=never','--git-dir='+str(view),'show',sha+':ops/gitea-r1/window-storage-facts.py'],env=env,capture_output=True,timeout=20)
if result.returncode or result.stderr:raise RuntimeError('FIXED_OBSERVER_SOURCE_REQUIRED')
exec(compile(result.stdout,'window-storage-facts.py','exec'))
except Exception as error:
message=str(error);safe=message if isinstance(error,RuntimeError) and re.fullmatch('[A-Z_]+',message) else type(error).__name__
print('GITEA_STORAGE_FACTS_OBSERVER_JSON '+json.dumps({'schema':'eios-r1-storage-facts-observation/1','kind':'GiteaReadOnlyStorageFactsObservation','ci':{'runId':run,'sourceSha':sha},'status':'OBSERVATION_FAILED_NOT_ADMISSION','error':safe,'admissionEligible':False,'releaseEligible':False,'productionServicesChanged':False,'productionFilesRemoved':0}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "8"
permissions:
contents: read
... |