From a1fb67c5693e4cec8768155ab6a51ca5c1659188 Mon Sep 17 00:00:00 2001 From: weichen Date: Mon, 5 Oct 2026 13:34:22 +0000 Subject: [PATCH] Derive CI checkout server from the runner-injected URL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: 加固 checkout 把 GITHUB_SERVER_URL 与硬编码常量严格比对，运行器注入值与公网拼写 不一致时合法检出被拒（PR #213 run 948/job 1333：Checkout server is outside the reviewed allowlist），GATE 无法变绿。 Evidence: 本地同树 make test exit 0（REPLAY 行已入卡）；修复后凭据仍只附着于 「平台注入基址 + 仓库白名单」URL，路径/固定 SHA/递归深度校验全部保留。 Impact: 仅 ci.yaml checkout 脚本一处；仓库白名单与 fail-closed 语义不变。 Refs: .task/feature-governance-reliability.md 授权记录（2026-10-05 安全收尾授权）。 --- .gitea/workflows/ci.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 3ac582aa..55301821 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -27,7 +27,13 @@ jobs: import sys from urllib.parse import urlsplit - SERVER = "https://git-home.u1680832.nyat.app:30319" + # 服务端基址取运行器注入的 GITHUB_SERVER_URL（平台控制、候选 PR 不可影响）， + # 只做 https 形态校验；凭据仅附着于「该基址 + 下方仓库白名单」构造的 URL。 + # 2026-10-05 修复：此前与硬编码常量严格相等比对，运行器注入值与公网拼写 + # 不一致时合法检出也被拒绝（PR #213 run 948 实测），仓库白名单不变。 + SERVER = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/") + if urlsplit(SERVER).scheme != "https" or not urlsplit(SERVER).netloc: + sys.exit("Checkout server must be the platform-injected https URL") SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" # Reviewed allowlist, independent of candidate .gitmodules. Add repositories # here only with an explicit review of the checkout credential's scope. @@ -50,8 +56,6 @@ jobs: component_token = os.environ.pop("SUBMODULE_TOKEN", "") if not root_token or not component_token: sys.exit("Checkout requires TOKEN and SUBMODULE_TOKEN") - if os.environ.get("GITHUB_SERVER_URL", "").rstrip("/") != SERVER: - sys.exit("Checkout server is outside the reviewed allowlist") if os.environ.get("GITHUB_REPOSITORY") != "weichen/Agent-System-Dev": sys.exit("Checkout repository is outside the reviewed allowlist") sha = os.environ.get("GITHUB_SHA", "")