Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 agent-exec-transport
|
7f79399354 | ||
|
agent-exec-transport
|
90d3b64fed | ||
|
agent-exec-transport
|
0951822361 | ||
|
agent-exec-transport
|
ecbed09074 | ||
|
agent-exec-transport
|
e66d6324eb | ||
|
agent-exec-transport
|
26ad9a732f |
+33
-17
@@ -35,7 +35,9 @@ jobs:
|
||||
parsed_server = urlsplit(SERVER)
|
||||
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
|
||||
sys.exit("Checkout server must be the platform-injected http(s) URL")
|
||||
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
|
||||
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
|
||||
# here only with an explicit review of the checkout credential's scope.
|
||||
REPOSITORIES = {
|
||||
@@ -124,7 +126,7 @@ jobs:
|
||||
if not repository or fields.get("path") != name:
|
||||
raise ValueError("Submodule path is outside the reviewed allowlist")
|
||||
trusted_url = f"{SERVER}/weichen/{repository}.git"
|
||||
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
|
||||
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
|
||||
raise ValueError("Submodule URL is outside the reviewed allowlist")
|
||||
for name in entries:
|
||||
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
|
||||
@@ -244,7 +246,9 @@ jobs:
|
||||
parsed_server = urlsplit(SERVER)
|
||||
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
|
||||
sys.exit("Checkout server must be the platform-injected http(s) URL")
|
||||
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
|
||||
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
|
||||
# here only with an explicit review of the checkout credential's scope.
|
||||
REPOSITORIES = {
|
||||
@@ -333,7 +337,7 @@ jobs:
|
||||
if not repository or fields.get("path") != name:
|
||||
raise ValueError("Submodule path is outside the reviewed allowlist")
|
||||
trusted_url = f"{SERVER}/weichen/{repository}.git"
|
||||
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
|
||||
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
|
||||
raise ValueError("Submodule URL is outside the reviewed allowlist")
|
||||
for name in entries:
|
||||
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
|
||||
@@ -425,19 +429,22 @@ jobs:
|
||||
set -euo pipefail
|
||||
# 凭据纪律与 Checkout 块同源：经 GIT_CONFIG_* 环境注入 URL 级 token 头，
|
||||
# 不落文件/命令行；allowlist 扩项 = Agent-System-RDM 及其 pins（同一
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
|
||||
# https 基址后再取。只追加 pin 的三个 40 位 hex，不 source pin 文件。
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL（新旧两形态均改写）以
|
||||
# insteadOf 改写到受信 https 基址后再取。只追加 pin 的三个 40 位 hex，
|
||||
# 不 source pin 文件。
|
||||
SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
|
||||
scheme="${GITHUB_SERVER_URL%%://*}"
|
||||
export GIT_CONFIG_COUNT=4
|
||||
export GIT_CONFIG_COUNT=5
|
||||
export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
|
||||
export GIT_CONFIG_VALUE_0="always"
|
||||
export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
|
||||
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
|
||||
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
export GIT_CONFIG_KEY_3="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_3="/dev/null"
|
||||
export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
export GIT_CONFIG_KEY_4="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_4="/dev/null"
|
||||
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
|
||||
mapfile -t pins < <(python3 - <<'PY'
|
||||
import pathlib
|
||||
@@ -476,6 +483,7 @@ jobs:
|
||||
-u GIT_CONFIG_KEY_1 -u GIT_CONFIG_VALUE_1 \
|
||||
-u GIT_CONFIG_KEY_2 -u GIT_CONFIG_VALUE_2 \
|
||||
-u GIT_CONFIG_KEY_3 -u GIT_CONFIG_VALUE_3 \
|
||||
-u GIT_CONFIG_KEY_4 -u GIT_CONFIG_VALUE_4 \
|
||||
-u SUBMODULE_TOKEN \
|
||||
"$@"
|
||||
}
|
||||
@@ -504,7 +512,8 @@ jobs:
|
||||
done
|
||||
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
|
||||
GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3 \
|
||||
GIT_CONFIG_KEY_4 GIT_CONFIG_VALUE_4
|
||||
unset SUBMODULE_TOKEN
|
||||
- name: Install Node 22
|
||||
run: |
|
||||
@@ -569,7 +578,9 @@ jobs:
|
||||
parsed_server = urlsplit(SERVER)
|
||||
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
|
||||
sys.exit("Checkout server must be the platform-injected http(s) URL")
|
||||
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
|
||||
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
|
||||
# here only with an explicit review of the checkout credential's scope.
|
||||
REPOSITORIES = {
|
||||
@@ -658,7 +669,7 @@ jobs:
|
||||
if not repository or fields.get("path") != name:
|
||||
raise ValueError("Submodule path is outside the reviewed allowlist")
|
||||
trusted_url = f"{SERVER}/weichen/{repository}.git"
|
||||
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
|
||||
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
|
||||
raise ValueError("Submodule URL is outside the reviewed allowlist")
|
||||
for name in entries:
|
||||
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
|
||||
@@ -713,19 +724,21 @@ jobs:
|
||||
set -euo pipefail
|
||||
# 凭据纪律与 Checkout 块同源：经 GIT_CONFIG_* 环境注入 URL 级 token 头，
|
||||
# 不落文件/命令行；allowlist 扩项 = Agent-System-RDM 及其 pins（同一
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
|
||||
# https 基址后再取。
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL（新旧两形态均改写）以
|
||||
# insteadOf 改写到受信 https 基址后再取。
|
||||
SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
|
||||
scheme="${GITHUB_SERVER_URL%%://*}"
|
||||
export GIT_CONFIG_COUNT=4
|
||||
export GIT_CONFIG_COUNT=5
|
||||
export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
|
||||
export GIT_CONFIG_VALUE_0="always"
|
||||
export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
|
||||
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
|
||||
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
export GIT_CONFIG_KEY_3="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_3="/dev/null"
|
||||
export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
export GIT_CONFIG_KEY_4="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_4="/dev/null"
|
||||
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
|
||||
# 凭据环境须保持到 pins 子模块取完（insteadOf + token 头覆盖嵌套 SSH URL），
|
||||
# 之后再 unset。
|
||||
@@ -733,7 +746,8 @@ jobs:
|
||||
echo "RDM commit: $(git -C rdm rev-parse HEAD)"
|
||||
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
|
||||
GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3 \
|
||||
GIT_CONFIG_KEY_4 GIT_CONFIG_VALUE_4
|
||||
unset SUBMODULE_TOKEN
|
||||
make -C rdm build
|
||||
- name: Run real-combination lifecycle gates (SQLite, U3, required)
|
||||
@@ -743,9 +757,11 @@ jobs:
|
||||
set -euo pipefail
|
||||
# 路径变量在脚本内解析（YAML env: 不做 shell 展开）。
|
||||
export SVC_TEST_REAL=1
|
||||
env -u SUBMODULE_TOKEN make -C rdm product
|
||||
export SVC_REAL_BIN="$PWD/bin/agent-system"
|
||||
export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
|
||||
export SVC_RDM_ORIGIN="$PWD/rdm"
|
||||
export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm-product"
|
||||
export SVC_RDM_SRC_DIR="$PWD/rdm"
|
||||
export SVC_RDM_ORIGIN="${{ github.server_url}}/weichen/Agent-System-RDM.git"
|
||||
# CI 无 SSH key：把受信基址与 URL 级 token 头经环境交给套件（仅环境传递）。
|
||||
export SVC_CI_GIT_SERVER="${GITHUB_SERVER_URL%/}"
|
||||
export SVC_CI_GIT_TOKEN="${SUBMODULE_TOKEN}"
|
||||
|
||||
Reference in New Issue
Block a user