| workflow_payload |
name: Inspect private bounded memory restore layou name: Inspect private bounded memory restore layout without admission
"on":
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Test and measure complete restore placement without mounts or service changes
run: |
set -eu
python3 <<'PY'
import ast,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not run.isdigit() or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_JOB_IDENTITY_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-layout-'+run);work.mkdir(mode=0o700)
for name in ['inspect-memory-restore.py','memory-restore-layout.py','test-memory-restore-layout.py','window-support.py','window-metadata-capacity.py','restore-independent-mirror.py','inspect-restore-resources.py']:
r=subprocess.run(['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/'+name],capture_output=True,timeout=30)
if r.returncode:raise RuntimeError('FIXED_MEMORY_LAYOUT_SOURCE_REQUIRED')
ast.parse(r.stdout);(work/name).write_bytes(r.stdout)
subprocess.run(['python3','-B',str(work/'test-memory-restore-layout.py')],check=True,timeout=30)
props=['User=root','Nice=15','CPUQuota=50%','MemoryMax=512M','TasksMax=32','RuntimeMaxSec=360','TimeoutStopSec=15','ProtectSystem=strict','ProtectHome=read-only','PrivateTmp=yes','PrivateDevices=yes','NoNewPrivileges=yes','ReadWritePaths='+str(work),'StandardOutput=file:'+str(work/'native.stdout'),'StandardError=file:'+str(work/'native.stderr')]
r=subprocess.run(['systemd-run','--quiet','--wait','--collect','--unit=eios-r1-memory-layout-'+run,'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'inspect-memory-restore.py')],capture_output=True,timeout=420)
if r.returncode:raise RuntimeError('READONLY_MEMORY_LAYOUT_INSPECTION_FAILED')
print((work/'native.stdout').read_text())
PY
shell: bash
timeout-minutes: "8"
permissions:
contents: read
... |