Compare commits
13
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 agent-exec-transport
|
48c8b608ce | ||
|
agent-exec-transport
|
49c6b54b46 | ||
|
agent-exec-transport
|
7b3227d669 | ||
|
agent-exec-transport
|
4a343c68d4 | ||
|
agent-exec-transport
|
7df19b3f58 | ||
|
agent-exec-transport
|
1191cee681 | ||
|
agent-exec-transport
|
0df91e1ead | ||
|
agent-exec-transport
|
7f79399354 | ||
|
agent-exec-transport
|
90d3b64fed | ||
|
agent-exec-transport
|
0951822361 | ||
|
agent-exec-transport
|
ecbed09074 | ||
|
agent-exec-transport
|
e66d6324eb | ||
|
agent-exec-transport
|
26ad9a732f |
+60
-17
@@ -35,7 +35,9 @@ jobs:
|
||||
parsed_server = urlsplit(SERVER)
|
||||
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
|
||||
sys.exit("Checkout server must be the platform-injected http(s) URL")
|
||||
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
|
||||
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
|
||||
# here only with an explicit review of the checkout credential's scope.
|
||||
REPOSITORIES = {
|
||||
@@ -124,7 +126,7 @@ jobs:
|
||||
if not repository or fields.get("path") != name:
|
||||
raise ValueError("Submodule path is outside the reviewed allowlist")
|
||||
trusted_url = f"{SERVER}/weichen/{repository}.git"
|
||||
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
|
||||
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
|
||||
raise ValueError("Submodule URL is outside the reviewed allowlist")
|
||||
for name in entries:
|
||||
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
|
||||
@@ -244,7 +246,9 @@ jobs:
|
||||
parsed_server = urlsplit(SERVER)
|
||||
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
|
||||
sys.exit("Checkout server must be the platform-injected http(s) URL")
|
||||
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
|
||||
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
|
||||
# here only with an explicit review of the checkout credential's scope.
|
||||
REPOSITORIES = {
|
||||
@@ -333,7 +337,7 @@ jobs:
|
||||
if not repository or fields.get("path") != name:
|
||||
raise ValueError("Submodule path is outside the reviewed allowlist")
|
||||
trusted_url = f"{SERVER}/weichen/{repository}.git"
|
||||
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
|
||||
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
|
||||
raise ValueError("Submodule URL is outside the reviewed allowlist")
|
||||
for name in entries:
|
||||
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
|
||||
@@ -425,19 +429,22 @@ jobs:
|
||||
set -euo pipefail
|
||||
# 凭据纪律与 Checkout 块同源：经 GIT_CONFIG_* 环境注入 URL 级 token 头，
|
||||
# 不落文件/命令行；allowlist 扩项 = Agent-System-RDM 及其 pins（同一
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
|
||||
# https 基址后再取。只追加 pin 的三个 40 位 hex，不 source pin 文件。
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL（新旧两形态均改写）以
|
||||
# insteadOf 改写到受信 https 基址后再取。只追加 pin 的三个 40 位 hex，
|
||||
# 不 source pin 文件。
|
||||
SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
|
||||
scheme="${GITHUB_SERVER_URL%%://*}"
|
||||
export GIT_CONFIG_COUNT=4
|
||||
export GIT_CONFIG_COUNT=5
|
||||
export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
|
||||
export GIT_CONFIG_VALUE_0="always"
|
||||
export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
|
||||
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
|
||||
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
export GIT_CONFIG_KEY_3="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_3="/dev/null"
|
||||
export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
export GIT_CONFIG_KEY_4="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_4="/dev/null"
|
||||
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
|
||||
mapfile -t pins < <(python3 - <<'PY'
|
||||
import pathlib
|
||||
@@ -476,6 +483,7 @@ jobs:
|
||||
-u GIT_CONFIG_KEY_1 -u GIT_CONFIG_VALUE_1 \
|
||||
-u GIT_CONFIG_KEY_2 -u GIT_CONFIG_VALUE_2 \
|
||||
-u GIT_CONFIG_KEY_3 -u GIT_CONFIG_VALUE_3 \
|
||||
-u GIT_CONFIG_KEY_4 -u GIT_CONFIG_VALUE_4 \
|
||||
-u SUBMODULE_TOKEN \
|
||||
"$@"
|
||||
}
|
||||
@@ -504,7 +512,8 @@ jobs:
|
||||
done
|
||||
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
|
||||
GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3 \
|
||||
GIT_CONFIG_KEY_4 GIT_CONFIG_VALUE_4
|
||||
unset SUBMODULE_TOKEN
|
||||
- name: Install Node 22
|
||||
run: |
|
||||
@@ -569,7 +578,9 @@ jobs:
|
||||
parsed_server = urlsplit(SERVER)
|
||||
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
|
||||
sys.exit("Checkout server must be the platform-injected http(s) URL")
|
||||
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
|
||||
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
|
||||
# here only with an explicit review of the checkout credential's scope.
|
||||
REPOSITORIES = {
|
||||
@@ -658,7 +669,7 @@ jobs:
|
||||
if not repository or fields.get("path") != name:
|
||||
raise ValueError("Submodule path is outside the reviewed allowlist")
|
||||
trusted_url = f"{SERVER}/weichen/{repository}.git"
|
||||
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
|
||||
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
|
||||
raise ValueError("Submodule URL is outside the reviewed allowlist")
|
||||
for name in entries:
|
||||
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
|
||||
@@ -713,19 +724,21 @@ jobs:
|
||||
set -euo pipefail
|
||||
# 凭据纪律与 Checkout 块同源：经 GIT_CONFIG_* 环境注入 URL 级 token 头，
|
||||
# 不落文件/命令行；allowlist 扩项 = Agent-System-RDM 及其 pins（同一
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
|
||||
# https 基址后再取。
|
||||
# 组件集合），由本 PR 评审背书。SSH pins URL（新旧两形态均改写）以
|
||||
# insteadOf 改写到受信 https 基址后再取。
|
||||
SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
|
||||
scheme="${GITHUB_SERVER_URL%%://*}"
|
||||
export GIT_CONFIG_COUNT=4
|
||||
export GIT_CONFIG_COUNT=5
|
||||
export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
|
||||
export GIT_CONFIG_VALUE_0="always"
|
||||
export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
|
||||
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
|
||||
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
export GIT_CONFIG_KEY_3="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_3="/dev/null"
|
||||
export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
export GIT_CONFIG_KEY_4="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_4="/dev/null"
|
||||
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
|
||||
# 凭据环境须保持到 pins 子模块取完（insteadOf + token 头覆盖嵌套 SSH URL），
|
||||
# 之后再 unset。
|
||||
@@ -733,20 +746,50 @@ jobs:
|
||||
echo "RDM commit: $(git -C rdm rev-parse HEAD)"
|
||||
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
|
||||
GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
|
||||
GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3 \
|
||||
GIT_CONFIG_KEY_4 GIT_CONFIG_VALUE_4
|
||||
unset SUBMODULE_TOKEN
|
||||
make -C rdm build
|
||||
- name: Run real-combination lifecycle gates (SQLite, U3, required)
|
||||
env:
|
||||
SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
|
||||
GIT_TRACE: "1"
|
||||
SVC_RDM_ORIGIN: ${{ github.server_url }}/weichen/Agent-System-RDM.git
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# 路径变量在脚本内解析（YAML env: 不做 shell 展开）。
|
||||
export SVC_TEST_REAL=1
|
||||
env -u SUBMODULE_TOKEN make -C rdm product
|
||||
export SVC_REAL_BIN="$PWD/bin/agent-system"
|
||||
export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
|
||||
export SVC_RDM_ORIGIN="$PWD/rdm"
|
||||
export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm-product"
|
||||
export SVC_RDM_SRC_DIR="$PWD/rdm"
|
||||
# CI 无 SSH key：把受信基址与 URL 级 token 头经环境交给套件（仅环境传递）。
|
||||
export SVC_CI_GIT_SERVER="${GITHUB_SERVER_URL%/}"
|
||||
export SVC_CI_GIT_TOKEN="${SUBMODULE_TOKEN}"
|
||||
mkdir -p "$HOME/.ssh"
|
||||
printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > "$HOME/.ssh/id_ed25519"
|
||||
printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" > "$HOME/.ssh/known_hosts"
|
||||
chmod 700 "$HOME/.ssh" && chmod 600 "$HOME/.ssh/id_ed25519" "$HOME/.ssh/known_hosts"
|
||||
export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/id_ed25519 -o IdentitiesOnly=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
|
||||
# 套件经 SVC_RDM_SRC_DIR 物化嵌套 pins 时，RDM .gitmodules 的 SSH URL
|
||||
# （新旧两形态）无凭据；按本 job Clone 步骤同源 insteadOf 改写到受信基址并带 token 头。
|
||||
SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
|
||||
scheme="${GITHUB_SERVER_URL%%://*}"
|
||||
export GIT_CONFIG_COUNT=5
|
||||
export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
|
||||
export GIT_CONFIG_VALUE_0="always"
|
||||
export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
|
||||
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
|
||||
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
|
||||
export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
export GIT_CONFIG_KEY_4="core.hooksPath"
|
||||
export GIT_CONFIG_VALUE_4="/dev/null"
|
||||
export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
|
||||
git config --global --unset-all "http.$SERVER/.extraheader" 2>/dev/null || true
|
||||
git config --global --add "http.$SERVER/.extraheader" "AUTHORIZATION: token $SUBMODULE_TOKEN"
|
||||
git config --global --unset-all "url.$SERVER/weichen/.insteadOf" 2>/dev/null || true
|
||||
git config --global --add "url.$SERVER/weichen/.insteadOf" "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
|
||||
git config --global --add "url.$SERVER/weichen/.insteadOf" "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
|
||||
python3 -m unittest tests.test_svc_realcombo -v
|
||||
|
||||
@@ -78,6 +78,15 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
|
||||
self.assertTrue(self.real_bin.is_file() and os.access(self.real_bin, os.X_OK),
|
||||
"SVC_REAL_BIN 不可执行：%s" % self.real_bin)
|
||||
|
||||
def svc(self, *args, check=True, env=None, timeout=120):
|
||||
proc = subprocess.run(
|
||||
["bash", str(self.root / "scripts" / "svc.sh"), *map(str, args)],
|
||||
cwd=self.root, env=env if env is not None else self.env, text=True,
|
||||
stdout=subprocess.PIPE, stderr=subprocess.STDOUT, timeout=timeout)
|
||||
if check:
|
||||
self.assertEqual(proc.returncode, 0, proc.stdout)
|
||||
return proc
|
||||
|
||||
def manifest(self, name):
|
||||
p = self.runtime(name) / "manifest.json"
|
||||
return json.loads(p.read_text(encoding="utf-8")) if p.exists() else None
|
||||
@@ -244,7 +253,7 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
|
||||
"SVC_RDM_ORIGIN": RDM_ORIGIN})
|
||||
agent_port = free_test_port()
|
||||
result = self.svc("rcf", "deploy", "--from", "rdm", "--port", str(agent_port),
|
||||
env=env, check=False)
|
||||
env=env, check=False, timeout=300)
|
||||
if result.returncode != 0:
|
||||
log = self.runtime("rcf") / "svc.log"
|
||||
tail = log.read_text(encoding="utf-8", errors="replace")[-2000:] \
|
||||
|
||||
Reference in New Issue
Block a user