| workflow_payload |
name: Locate official Gitea reference by file fing name: Locate official Gitea reference by file fingerprints
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-reference-fingerprint.yml]
workflow_dispatch:
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Compare public source fingerprints without claiming Git ancestry
run: |
set -eu
python3 <<'PY'
import datetime, json, os, pathlib, re, socket, subprocess, time
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('fingerprint-'+runid);work.mkdir(mode=0o700)
source=pathlib.Path('/root/gitea-src');official=base/'analysis-26765'/'candidate-source'
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(where,*args,timeout=30):
r=subprocess.run(['git','--no-optional-locks','-c','core.hooksPath=/dev/null','-C',str(where),*args],env=env,capture_output=True,timeout=timeout)
if r.returncode:raise RuntimeError('GIT_METADATA_QUERY_FAILED')
return r.stdout
head=git(source,'rev-parse','HEAD').decode().strip()
if head!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('SOURCE_HEAD_CHANGED')
if git(official,'rev-parse','HEAD').decode().strip()!='146cc3eec57174711eac0e0a0c7b38670c6e3922':raise RuntimeError('OFFICIAL_HEAD_CHANGED')
def tree(repo,commit):
result={}
for row in git(repo,'ls-tree','-r','-z','--format=%(objecttype) %(objectname) %(path)',commit,timeout=30).split(b'\0'):
if not row:continue
kind,oid,name=row.split(b' ',2)
if kind==b'blob':result[name]=oid
return result
root_tree=tree(source,head)
report={'kind':'GiteaOfficialReferenceFingerprintProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceHead':head,'sourceCommittedFiles':len(root_tree),'officialHistoryHead':'146cc3eec57174711eac0e0a0c7b38670c6e3922','liveSourceServiceDatabaseChanged':False,'method':'Exact Git blob fingerprints against bounded official first-parent history; reference selection does not assert ancestry'}
commits=git(official,'rev-list','--first-parent','--max-count=800','--before=2026-03-19T00:00:00Z','refs/tags/v1.27.3').decode().splitlines()
report['candidateCount']=len(commits)
def emit(stage):
report['stage']=stage;print('GITEA_OFFICIAL_REFERENCE_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('COMPARING_PUBLIC_TREE_FINGERPRINTS')
ranked=[];start=time.monotonic()
for index,commit in enumerate(commits):
if time.monotonic()-start>240:break
official_tree=tree(official,commit)
matches=sum(official_tree.get(p)==h for p,h in root_tree.items())
shared=sum(p in official_tree for p in root_tree)
ranked.append({'commit':commit,'matchingSourceBlobs':matches,'sharedPaths':shared,'officialFiles':len(official_tree),'order':index})
if (index+1)%100==0:
report['comparedCount']=len(ranked);report['bestMatchesSoFar']=max(r['matchingSourceBlobs'] for r in ranked);emit('COMPARING_PUBLIC_TREE_FINGERPRINTS')
ranked.sort(key=lambda r:(-r['matchingSourceBlobs'],r['order']))
report['comparedCount']=len(ranked);report['searchCompleted']=len(ranked)==len(commits);report['elapsedSeconds']=round(time.monotonic()-start,3);report['topReferences']=ranked[:8]
if not ranked:raise RuntimeError('NO_PUBLIC_REFERENCES_COMPARED')
best=ranked[0];official_tree=tree(official,best['commit'])
diff=[]
for p in sorted(set(root_tree)|set(official_tree)):
if root_tree.get(p)==official_tree.get(p):continue
name=p.decode('utf-8',errors='replace')
sensitive=any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key'])
diff.append({'path':'SENSITIVE_PATH_NOT_EXPORTED' if sensitive else name,'status':'modified' if p in root_tree and p in official_tree else ('source-only' if p in root_tree else 'official-only')})
report['selectedReference']=best['commit']
report['selectedReferenceMetadata']=git(official,'show','-s','--format=%H %cI',best['commit']).decode().strip()
report['committedTreeDifferenceCount']=len(diff)
report['committedTreeDifferences']=diff[:150];report['differencesTruncated']=len(diff)>150
report['status']='REFERENCE_FINGERPRINT_COMPARISON_COMPLETE'
(work/'full-tree-difference.private.json').write_text(json.dumps(diff,indent=2)+'\n')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
... |