| workflow_payload |
name: Rehearse R1 branch protection in private syn name: Rehearse R1 branch protection in private synthetic instance
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate synthetic administrator denials and allowed merges only
run: |
set -eu
python3 <<'PY'
import ast,os,pathlib,re,subprocess,tempfile
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_SHA_REQUIRED')
with tempfile.TemporaryDirectory(prefix='protection-probe-',dir='/var/lib/eios-r1-maintenance') as td:
paths=['ci/rehearse-run-attempt.py','ci/test-rehearse-run-attempt.py','ci/rehearse-branch-protection.py','ci/test-rehearse-branch-protection.py','docs/evidence/gitea-ci-2026-10-11/main-protection.proposed.json']
for name in paths:
p=subprocess.run(['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':'+name],capture_output=True,timeout=30)
if p.returncode:raise RuntimeError('FIXED_PROTECTION_SOURCE_UNAVAILABLE')
if name.endswith('.py'):ast.parse(p.stdout)
pathlib.Path(td,pathlib.Path(name).name).write_bytes(p.stdout)
for name in ['test-rehearse-run-attempt.py','test-rehearse-branch-protection.py']:
subprocess.run(['python3','-B',str(pathlib.Path(td,name))],check=True,timeout=30)
subprocess.run(['python3','-B',str(pathlib.Path(td,'rehearse-run-attempt.py')),'--protection-only'],check=True,timeout=700)
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
... |