| workflow_payload |
name: Read actual candidate CLI version output onl name: Read actual candidate CLI version output only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-candidate-version-diagnostic.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce only private Git clone and print screened diagnostics
run: |
set -eu
python3 <<'PY'
import json,os,pathlib,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
base=pathlib.Path('/var/lib/eios-r1-maintenance')
stored=(base/'build-26857/BINARY_VERSION.stdout').read_text(errors='replace').strip()
r=subprocess.run(['runuser','-u','git','--','env','-i','PATH=/usr/local/bin:/usr/bin:/bin','HOME='+str(base/'candidate-database-rehearsal-26858/git-home'),'USER=git','LOGNAME=git',str(base/'candidate-database-rehearsal-26858/gitea.candidate'),'--version'],capture_output=True,timeout=20)
observed=r.stdout.decode(errors='replace').strip()
def safe(text):
if len(text)>500 or re.search(r'(?i)password|secret|authorization|BEGIN .*PRIVATE KEY|://[^ /]+@',text):return 'OUTPUT_REFUSED'
return text
print('GITEA_CLI_VERSION_DIAG_JSON '+json.dumps({'kind':'CandidateCLIVersionReadOnlyDiagnosis','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'builtVersionOutput':safe(stored),'privateCopyVersionOutput':safe(observed),'exitCode':r.returncode,'screenedStderr':safe(r.stderr.decode(errors='replace').strip()),'databaseWritten':False,'liveServicesChanged':False,'releaseEligible':False},separators=(',',':')),flush=True)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
... |