| workflow_payload |
name: Read maintenance storage and ingress preflig name: Read maintenance storage and ingress preflight only
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-window-preflight.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read only fixed private synthetic test failure
run: |
set -eu
python3 <<'PYCODE'
import pathlib,re,json,os,subprocess,hashlib,shutil
def command(args):return subprocess.run(args,capture_output=True,timeout=90)
sizes={}
for path in ['/home/git','/usr/local/bin/data','/opt/gitea-runner','/var/lib/eios-r1-maintenance']:
r=command(['du','-s','-B1','--',path])
sizes[path]=int(r.stdout.split()[0]) if r.returncode==0 else None
def meta(name):
p=pathlib.Path(name)
if not p.exists():return {'path':name,'exists':False}
st=p.lstat();value={'path':name,'exists':True,'uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'bytes':st.st_size,'symlink':p.is_symlink()}
if p.is_file() and not p.is_symlink():value['sha256']=hashlib.sha256(p.read_bytes()).hexdigest()
return value
ssh=command(['/usr/sbin/sshd','-T']);selected={}
for line in ssh.stdout.decode().splitlines():
key,_,value=line.partition(' ')
if key in ['authorizedkeysfile','authorizedkeyscommand','passwordauthentication','kbdinteractiveauthentication','denyusers','allowusers','authenticationmethods','usepam']:selected[key]=value
status=command(['passwd','-S','git']).stdout.decode().split();account_status=status[:2]
configs=[]
for name in ['/etc/nginx/conf.d/gitea-http-redirect.conf','/etc/nginx/conf.d/gitea-https.conf']:
p=pathlib.Path(name);configs.append({'path':name,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'serverBlocks':len(re.findall(r'(?m)^\s*server\s*\{',p.read_text()))})
services={}
for name in ['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','nginx.service','ssh.service','docker.service']:
r=command(['systemctl','show',name,'--property=MainPID,ActiveState,FragmentPath']);services[name]=dict(line.split('=',1) for line in r.stdout.decode().splitlines() if '=' in line)
maintenanceChildren={}
for child in pathlib.Path('/var/lib/eios-r1-maintenance/build-cache').iterdir():
if child.is_dir() and re.fullmatch(r'[A-Za-z0-9_.-]+',child.name):
r=command(['du','-s','-B1','--',str(child)])
maintenanceChildren[child.name]=int(r.stdout.split()[0]) if r.returncode==0 else None
report={'maintenanceChildrenBytes':maintenanceChildren,'kind':'GiteaMaintenanceWindowReadOnlyPreflight','ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'mutations':False,'releaseEligible':False,'allocatedBytes':sizes,'filesystemFreeBytes':shutil.disk_usage('/var/lib/eios-r1-maintenance').free,'sshPolicy':selected,'gitAccountPasswordStatus':account_status,'nginxConfigs':configs,'services':services,'customHelperMetadata':[meta('/home/git/gitea/scripts/rsync_commit.sh'),meta('/home/git/.ssh/authorized_keys2')]}
report['cacheChildrenScope']='/var/lib/eios-r1-maintenance/build-cache'
import configparser,sqlite3
c=configparser.ConfigParser(interpolation=None,strict=False);c.read_string('[DEFAULT]\n'+pathlib.Path('/home/git/gitea/config/app.ini').read_text())
report['storageLocations']={}
for section in c.sections():
if section in ['repository','lfs','attachment','picture','storage','actions','packages'] or section.startswith(('storage.','storage@')):
report['storageLocations'][section]={k:v for k,v in c.items(section,raw=True) if k.lower() in ['root','path','storage_type','type','artifact_path','log_path']}
db=sqlite3.connect('file:/home/git/gitea/data/gitea.db?mode=ro',uri=True)
report['actionSchemas']={t:[r[1] for r in db.execute('pragma table_info('+t+')')] for t in ['action_run','action_run_job','action_task']}
report['runningTasksByRunner']=[list(r) for r in db.execute('select runner_id,status,count(*) from action_task where status not in (1,2,3,4) group by runner_id,status')]
report['firewallTools']={name:bool(shutil.which(name)) for name in ['iptables','ip6tables','nft','sshd']}
db.close()
print('GITEA_WINDOW_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')),flush=True)
PYCODE
shell: bash
timeout-minutes: "10"
permissions:
contents: read
... |