| workflow_payload |
name: Verify bounded independent full mirror witho name: Verify bounded independent full mirror without changing production
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify tests and read-only live source in a limited private unit
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,shutil,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not run.isdigit() or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_JOB_IDENTITY_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('independent-mirror-'+run);work.mkdir(mode=0o700)
for name in ['restore-independent-mirror.py','test-independent-mirror.py']:
r=subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,'show',sha+':ops/gitea-r1/'+name],capture_output=True,timeout=30)
if r.returncode:raise RuntimeError('FIXED_MIRROR_SOURCE_REQUIRED')
ast.parse(r.stdout);(work/name).write_bytes(r.stdout)
code=r'''import datetime,importlib.util,json,pathlib,shutil,subprocess,sys
root=pathlib.Path(__file__).parent
subprocess.run([sys.executable,'-B',str(root/'test-independent-mirror.py')],check=True,timeout=60)
spec=importlib.util.spec_from_file_location('mirror',root/'restore-independent-mirror.py');m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
source=pathlib.Path('/home/git/repositories/luoanwu/enterprise-platform.git');block=4096
budget=m.source_geometry(source,block)
if shutil.disk_usage(root).free<budget['cloneAllocationBound']+9*1024**3:raise RuntimeError('PRIVATE_PROBE_SPACE_REQUIRED')
result=m.independent_mirror(source,root/'clone.git',block)
result.update(kind='R1IndependentMirrorNativeProbe',observedAtUTC=datetime.datetime.now(datetime.timezone.utc).isoformat(),productionSourceReadOnly=True,productionFileBodiesExported=False,productionConfigurationChanged=False,consistentBackupVerified=False,windowAdmissionGranted=False,releaseEligible=False)
(root/'receipt.json').write_text(json.dumps(result,indent=2)+'\n')
'''
(work/'probe.py').write_text(code)
for p in [work,*work.iterdir()]:os.chown(p,1000,1000)
props=['User=git','Group=git','Nice=15','CPUQuota=50%','MemoryMax=512M','TasksMax=32','RuntimeMaxSec=600','TimeoutStopSec=15','ProtectSystem=strict','ProtectHome=tmpfs','PrivateNetwork=yes','PrivateTmp=yes','PrivateDevices=yes','NoNewPrivileges=yes','CapabilityBoundingSet=','TemporaryFileSystem=/var/lib/eios-r1-maintenance:ro,mode=0755','BindPaths='+str(work),'BindReadOnlyPaths='+repo,'ReadWritePaths='+str(work),'InaccessiblePaths=-/opt/gitea-runner -/usr/local/bin/data -/run/docker.sock -/run/dbus/system_bus_socket -/run/systemd/private','StandardOutput=file:'+str(work/'native.stdout'),'StandardError=file:'+str(work/'native.stderr')]
r=subprocess.run(['systemd-run','--quiet','--wait','--collect','--unit=eios-r1-independent-mirror-'+run,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'probe.py')],capture_output=True,timeout=660)
if r.returncode:raise RuntimeError('READONLY_INDEPENDENT_MIRROR_PROBE_FAILED')
result=json.loads((work/'receipt.json').read_text());result['ci']={'runId':run,'sourceSha':sha}
# The bounded unit has exited; remove only the exact new scratch copy.
clone=work/'clone.git'
if clone.is_symlink() or clone.parent!=work or not clone.is_dir():raise RuntimeError('OWNED_MIRROR_COPY_REQUIRED')
shutil.rmtree(clone);result['ownedScratchCopyRemoved']=True
(work/'receipt.json').write_text(json.dumps(result,indent=2)+'\n')
print('R1_INDEPENDENT_MIRROR_JSON '+json.dumps(result))
PY
shell: bash
timeout-minutes: "15"
permissions:
contents: read
... |