| workflow_payload |
name: Diagnose fixed candidate clone without chang name: Diagnose fixed candidate clone without changing validated source
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-fixed-build-git-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import hashlib,json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
os.umask(0o077)
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance');source=base/'reviewed-26848/candidate-source'
if base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077:raise RuntimeError('PRIVATE_BASE_REQUIRED')
old=base/'build-26852';work=base/('build-git-diagnostic-'+runid);work.mkdir(mode=0o700)
env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(work),'LANG':'C.UTF-8','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0','GIT_OPTIONAL_LOCKS':'0'}
def screen(data):return [line[-700:] for line in data.decode(errors='replace').splitlines() if not re.search(r'(?i)password|secret|authorization|://[^ /]+@|BEGIN .*PRIVATE KEY',line)][-8:]
def command(cwd,args):
r=subprocess.run(['git','--no-optional-locks','-c','safe.directory='+str(source),'-c','safe.directory='+str(work/'candidate-source'),'-c','core.hooksPath=/dev/null','-c','credential.helper=','-C',str(cwd),*args],env=env,capture_output=True,timeout=120)
return {'operation':args[0],'exitCode':r.returncode,'stdoutBytes':len(r.stdout),'screenedStderr':screen(r.stderr)}
observations=[command(source,['rev-parse','HEAD']),command(source,['ls-files','-z']),command(source,['ls-files','--others','--exclude-standard','-z']),command(work,['clone','--no-local','--depth=1','--no-checkout',str(source),str(work/'candidate-source')])]
prior=[]
for name in ['candidate-source','candidate-source/.git','candidate-source/.git/HEAD','candidate-source/.git/shallow']:
p=old/name;prior.append({'path':name,'exists':p.exists(),'symlink':p.is_symlink(),'uid':p.stat().st_uid if p.exists() else None})
print('GITEA_BUILD_GIT_DIAG_JSON '+json.dumps({'kind':'FixedBuildGitDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':runid},'priorBuildMetadata':prior,'operations':observations,'validatedSourceModified':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
... |