| workflow_payload |
name: Verify fixed Gitea v4 cross-job artifacts
&# name: Verify fixed Gitea v4 cross-job artifacts
"on":
workflow_dispatch:
jobs:
produce:
name: produce
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- name: Write public identity fixture without overriding runtime context
run: |
python3 <<'PYTHON'
import json,os,pathlib,re
sha=os.environ['GITHUB_SHA'];run=os.environ['GITHUB_RUN_ID']
if not re.fullmatch('[0-9a-f]{40}',sha) or not re.fullmatch('[1-9][0-9]*',run):raise RuntimeError('GENUINE_WORKFLOW_IDENTITY_REQUIRED')
p=pathlib.Path('artifact-public-fixture');p.mkdir()
(p/'receipt.json').write_text(json.dumps({'kind':'R1PublicArtifactV4Fixture','ci':{'sourceSha':sha,'runId':run},'nativeAttempt':os.environ.get('GITHUB_RUN_ATTEMPT'),'productionDataIncluded':False,'releaseEligible':False},sort_keys=True)+'\n')
PYTHON
shell: bash
- uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: r1-v4-public-fixture-${{ github.run_id }}
path: artifact-public-fixture/receipt.json
retention-days: "2"
timeout-minutes: "12"
permissions:
contents: read
... |