| workflow_payload |
name: Validate fixed R1 attempt capability prerequ name: Validate fixed R1 attempt capability prerequisite only
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate actual fixed proof and fail-closed guard without starting maintenance
run: |
set -eu
python3 <<'PY'
import ast,importlib.util,json,os,pathlib,re,subprocess,tempfile
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_SHA_REQUIRED')
with tempfile.TemporaryDirectory(prefix='attempt-capability-',dir='/var/lib/eios-r1-maintenance') as td:
names=['window-support.py','test-window-support.py','test-attempt-capability.py','attempt-capability-27220.public.json','window-controller.py','launch-controlled-window.py']
for name in names:
r=subprocess.run(['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/'+name],capture_output=True,timeout=30)
if r.returncode:raise RuntimeError('FIXED_GUARD_SOURCE_REQUIRED')
if name.endswith('.py'):ast.parse(r.stdout)
pathlib.Path(td,name).write_bytes(r.stdout)
for name in ['test-attempt-capability.py','test-window-support.py']:
subprocess.run(['python3','-B',str(pathlib.Path(td,name))],check=True,timeout=30)
spec=importlib.util.spec_from_file_location('support',pathlib.Path(td,'window-support.py'));support=importlib.util.module_from_spec(spec);spec.loader.exec_module(support)
controller=ast.parse(pathlib.Path(td,'window-controller.py').read_text());digests={}
for node in controller.body:
if isinstance(node,ast.Assign):
for target in node.targets:
if isinstance(target,ast.Name) and target.id in ['NEW_SHA','RUNNER_SHA']:digests[target.id]=ast.literal_eval(node.value)
proof=json.loads(pathlib.Path('/var/lib/eios-r1-maintenance/attempt-rehearsal-27220/receipt.json').read_text())
result=support.assert_attempt_capability(proof,{'runId':'27220','sourceSha':'21d10b9609e6bbff2f268421a47d953f21cdbbb4'},digests['NEW_SHA'],digests['RUNNER_SHA'])
result.update(ci={'runId':os.environ['GITHUB_RUN_ID'],'sourceSha':sha},nativeUnitTests=15,maintenanceStarted=False,servicesChanged=False,cloudResourcesChanged=False)
print('R1_ATTEMPT_CAPABILITY_JSON '+json.dumps(result))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
... |