| workflow_payload |
name: Analyze complete Gitea customization from ve name: Analyze complete Gitea customization from verified reference
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-complete-customization.yml]
workflow_dispatch:
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Preserve all committed and working source differences in a private candidate
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, io, json, os, pathlib, re, shutil, socket, subprocess, tarfile
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.is_symlink() or not base.is_dir() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('complete-analysis-'+runid);work.mkdir(mode=0o700)
live=pathlib.Path('/root/gitea-src');snapshot=base/'stage-26762'/'baseline-source'
history=base/'analysis-26765'/'candidate-source'
reference='d6496c61561d90f56f0b5ec3f75d4de8e36a5c9f';target='146cc3eec57174711eac0e0a0c7b38670c6e3922'
ranking=json.loads((base/'fingerprint-26773'/'receipt.json').read_text())
if ranking.get('selectedReference')!=reference or ranking.get('topReferences',[{}])[0].get('matchingSourceBlobs')!=5788 or not ranking.get('searchCompleted'):raise RuntimeError('VERIFIED_REFERENCE_REQUIRED')
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def git(repo,*args,timeout=60):
return subprocess.run(['git','--no-optional-locks','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','credential.helper=','-c','core.askPass=','-c','http.extraHeader=','-c','core.hooksPath=/dev/null','-C',str(repo),*args],env=env,capture_output=True,timeout=timeout)
if git(live,'rev-parse','HEAD').stdout.decode().strip()!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('LIVE_SOURCE_HEAD_CHANGED')
def fingerprint(root):
h=hashlib.sha256();count=0
for parent,dirs,files in os.walk(root):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(parent)/name
if p.is_symlink() or not p.is_file():continue
d=hashlib.sha256()
with open(p,'rb') as f:
for block in iter(lambda:f.read(1024*1024),b''):d.update(block)
h.update(str(p.relative_to(root)).encode()+b'\0'+d.digest());count+=1
return h.hexdigest(),count
expected='a5534f2aa03220a02efecac6753f0edcb99db7e8a3da323a1bac3390e2793d74'
if fingerprint(live)!=(expected,6064) or fingerprint(snapshot)!=(expected,6064):raise RuntimeError('LIVE_OR_SAVED_SOURCE_CHANGED')
report={'kind':'GiteaCompleteCustomizationAnalysis','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'releaseEligible':False,'sourceFingerprint':expected,'referenceCommit':reference,'referenceMethod':'Exact file comparison reference; not a Git ancestor','upstreamCommit':target,'privateWorkspace':str(work),'liveSourceServiceDatabaseChanged':False}
def emit(stage):
report['stage']=stage;print('GITEA_COMPLETE_CUSTOMIZATION_JSON '+json.dumps(report,separators=(',',':')),flush=True)
emit('PREPARING_COMPLETE_CUSTOMIZATION')
candidate=work/'candidate-source'
r=git(work,'clone','--shared','--no-checkout',str(history),str(candidate))
if r.returncode:raise RuntimeError('PRIVATE_CANDIDATE_CLONE_FAILED')
r=git(candidate,'checkout','--detach',target)
if r.returncode:raise RuntimeError('FIXED_CANDIDATE_CHECKOUT_FAILED')
def names(repo,*args):
r=git(repo,*args)
if r.returncode:raise RuntimeError('SOURCE_PATH_INVENTORY_FAILED')
return {x for x in r.stdout.decode().splitlines() if x}
committed=names(history,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only',reference,'287bf811487c04cd90bcf07aa04905cbaf2e4c2d')
working=names(live,'diff','--no-ext-diff','--no-textconv','--no-renames','--name-only','HEAD')
untracked=names(live,'ls-files','--others','--exclude-standard')
ignored=names(live,'ls-files','--others','--ignored','--exclude-standard')
source_sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch(r'[0-9a-f]{40}',source_sha):raise RuntimeError('FIXED_JOB_SOURCE_SHA_REQUIRED')
bare=pathlib.Path('/home/git/repositories/luoanwu/enterprise-platform.git')
if bare.is_symlink() or not bare.is_dir():raise RuntimeError('EXPECTED_SOURCE_REPOSITORY_REQUIRED')
packed=git(bare,'show',source_sha+':ops/gitea-r1/upstream-reference-d6496c6.tar.gz')
if packed.returncode or hashlib.sha256(packed.stdout).hexdigest()!='a7d3f17e4810eca2294cf110790a6332d0681c909b2393b3a2ae20455c3a2322':raise RuntimeError('PUBLIC_REFERENCE_ARCHIVE_MISMATCH')
listing=git(history,'ls-tree','-r','-z','--format=%(objecttype) %(objectname) %(path)',reference)
if listing.returncode:raise RuntimeError('OFFICIAL_REFERENCE_TREE_UNAVAILABLE')
reference_tree={}
for row in listing.stdout.split(b'\0'):
if not row:continue
kind,oid,path=row.split(b' ',2)
if kind==b'blob':reference_tree[path.decode()]=oid.decode()
public_base={}
with tarfile.open(fileobj=io.BytesIO(packed.stdout),mode='r:gz') as archive:
members=archive.getmembers()
if len({m.name for m in members})!=len(members) or not all(m.isfile() and m.size<=2*1024*1024 for m in members) or sum(m.size for m in members)>8*1024*1024:raise RuntimeError('REFERENCE_ARCHIVE_STRUCTURE_REFUSED')
manifest=json.loads(archive.extractfile('manifest.json').read())
if manifest.get('referenceCommit')!=reference or manifest.get('upstreamRepository')!='https://github.com/go-gitea/gitea':raise RuntimeError('PUBLIC_REFERENCE_SOURCE_MISMATCH')
if {m.name for m in members}!={'manifest.json','LICENSE.upstream'}|{'files/'+v['path'] for v in manifest['files']}:raise RuntimeError('REFERENCE_ARCHIVE_MEMBER_MISMATCH')
for item in manifest['files']:
name=item['path'];part=pathlib.PurePosixPath(name)
if part.is_absolute() or '..' in part.parts:raise RuntimeError('REFERENCE_PATH_REFUSED')
body=archive.extractfile('files/'+name).read()
oid=hashlib.sha1(b'blob '+str(len(body)).encode()+b'\0'+body).hexdigest()
if oid!=reference_tree.get(name) or oid!=item['gitBlob'] or hashlib.sha256(body).hexdigest()!=item['sha256'] or len(body)!=item['bytes']:raise RuntimeError('OFFICIAL_REFERENCE_BLOB_MISMATCH')
public_base[name]=body
report['publicReferenceInput']={'sourceSha':source_sha,'archiveSha256':hashlib.sha256(packed.stdout).hexdigest(),'filesVerifiedAgainstOfficialGitTree':len(public_base),'historicalBlobNetworkRequired':False}
report['ignoredProductionGoFiles']=sorted(p for p in ignored if p.endswith('.go') and p.split('/',1)[0] in ['models','modules','routers','services'] and '/node_modules/' not in p)
report['snapshotOnlyEntries']=[];report['customizationMerge']=[]
merge=work/'merge-inputs';merge.mkdir(mode=0o700)
MISSING=object()
for number,name in enumerate(sorted(committed|working|untracked)):
rel=pathlib.PurePosixPath(name)
if rel.is_absolute() or '..' in rel.parts:raise RuntimeError('UNSAFE_SOURCE_PATH')
if not rel.parts or rel.parts[0] not in ['models','modules','routers','services','templates','options']:
if name=='IMPLEMENTATION_PLAN.md':report['implementationPlanRetainedInBaseline']=True
report['snapshotOnlyEntries'].append(name if not any(x in name.lower() for x in ['.env','secret','credential','password','.pem','.key']) else 'SENSITIVE_PATH_NOT_EXPORTED')
continue
if name.startswith('models/migrations/'):
report['customizationMerge'].append({'path':name,'status':'HELD_FOR_EXPLICIT_MIGRATION_BRIDGE'});continue
p=snapshot/name;out=candidate/name
if p.is_symlink() or out.is_symlink():raise RuntimeError('SYMLINK_CUSTOMIZATION_REVIEW_REQUIRED')
if name in reference_tree and name not in public_base:raise RuntimeError('PUBLIC_REFERENCE_INPUT_PATH_MISSING')
ancestor=public_base[name].replace(b'code.gitea.io/gitea',b'gitea.dev') if name in public_base else None
theirs=p.read_bytes().replace(b'code.gitea.io/gitea',b'gitea.dev') if p.is_file() else None
ours=out.read_bytes() if out.is_file() else None
state=None
if theirs==ancestor:state='UPSTREAM_UPDATE_RETAINED_NO_CUSTOM_DELTA'
elif ours==theirs:state='ALREADY_IDENTICAL'
elif ancestor is None and ours is None and theirs is not None:
out.parent.mkdir(parents=True,exist_ok=True);out.write_bytes(theirs);state='CUSTOM_ADDITION_PRESERVED'
elif theirs is None:
if ours==ancestor:
out.unlink();state='CUSTOM_DELETION_PRESERVED'
else:state='DELETE_MODIFY_REVIEW_REQUIRED'
elif ours is None:state='UPSTREAM_DELETION_REVIEW_REQUIRED'
elif name.startswith('options/locale/') and name.endswith('.json'):
b=json.loads(ancestor) if ancestor is not None else {};o=json.loads(ours);t=json.loads(theirs)
if not all(isinstance(v,dict) for v in [b,o,t]):raise RuntimeError('LOCALE_OBJECT_REQUIRED')
result=dict(o);conflicts=[]
for key in set(b)|set(t):
bv=b.get(key,MISSING);ov=o.get(key,MISSING);tv=t.get(key,MISSING)
if tv==bv:continue
if ov==bv or ov==tv:
if tv is MISSING:result.pop(key,None)
else:result[key]=tv
else:conflicts.append(key)
if conflicts:state='SEMANTIC_REVIEW_REQUIRED';report.setdefault('localeConflictKeys',{})[name]=sorted(conflicts)
else:
out.write_text(json.dumps(result,ensure_ascii=False,indent=2)+'\n');state='LOCALE_THREE_WAY_KEYS_MERGED'
elif ancestor is None:state='ADD_ADD_REVIEW_REQUIRED'
else:
a=merge/(str(number)+'.ours');b=merge/(str(number)+'.base');c=merge/(str(number)+'.theirs')
a.write_bytes(ours);b.write_bytes(ancestor);c.write_bytes(theirs)
r=git(work,'merge-file','-p',str(a),str(b),str(c))
if r.returncode==0:out.write_bytes(r.stdout);state='TEXTUAL_MERGE_CLEAN_SEMANTICS_UNVERIFIED'
else:
(merge/(str(number)+'.conflicted')).write_bytes(r.stdout);state='SEMANTIC_REVIEW_REQUIRED'
report['customizationMerge'].append({'path':name,'status':state})
report['status']='COMPLETE_COMMITTED_AND_WORKING_CUSTOMIZATION_ANALYZED'
report['candidateBuilt']=False;report['candidateMigrated']=False
if fingerprint(live)!=(expected,6064):raise RuntimeError('LIVE_SOURCE_CHANGED_DURING_ANALYSIS')
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit('COMPLETE')
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
... |