agent-exec transport 582044353218600c28874a495382ed1f/942b3679ac0e

.gitea/workflows/ci.yaml

@@ -35,7 +35,9 @@ jobs:
           parsed_server = urlsplit(SERVER)
           if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
               sys.exit("Checkout server must be the platform-injected http(s) URL")
+          # Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
           SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
           # Reviewed allowlist, independent of candidate .gitmodules. Add repositories
           # here only with an explicit review of the checkout credential's scope.
           REPOSITORIES = {
@@ -124,7 +126,7 @@ jobs:
                   if not repository or fields.get("path") != name:
                       raise ValueError("Submodule path is outside the reviewed allowlist")
                   trusted_url = f"{SERVER}/weichen/{repository}.git"
-                  if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
+                  if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
                       raise ValueError("Submodule URL is outside the reviewed allowlist")
               for name in entries:
                   url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
@@ -244,7 +246,9 @@ jobs:
           parsed_server = urlsplit(SERVER)
           if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
               sys.exit("Checkout server must be the platform-injected http(s) URL")
+          # Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
           SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
           # Reviewed allowlist, independent of candidate .gitmodules. Add repositories
           # here only with an explicit review of the checkout credential's scope.
           REPOSITORIES = {
@@ -333,7 +337,7 @@ jobs:
                   if not repository or fields.get("path") != name:
                       raise ValueError("Submodule path is outside the reviewed allowlist")
                   trusted_url = f"{SERVER}/weichen/{repository}.git"
-                  if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
+                  if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
                       raise ValueError("Submodule URL is outside the reviewed allowlist")
               for name in entries:
                   url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
@@ -425,19 +429,22 @@ jobs:
           set -euo pipefail
           # 凭据纪律与 Checkout 块同源：经 GIT_CONFIG_* 环境注入 URL 级 token 头，
           # 不落文件/命令行；allowlist 扩项 = Agent-System-RDM 及其 pins（同一
-          # 组件集合），由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
+          # 组件集合），由本 PR 评审背书。SSH pins URL（新旧两形态均改写）以
-          # https 基址后再取。只追加 pin 的三个 40 位 hex，不 source pin 文件。
+          # insteadOf 改写到受信 https 基址后再取。只追加 pin 的三个 40 位 hex，
+          # 不 source pin 文件。
           SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
           scheme="${GITHUB_SERVER_URL%%://*}"
-          export GIT_CONFIG_COUNT=4
+          export GIT_CONFIG_COUNT=5
           export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
           export GIT_CONFIG_VALUE_0="always"
           export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
           export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
           export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
           export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
-          export GIT_CONFIG_KEY_3="core.hooksPath"
+          export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
-          export GIT_CONFIG_VALUE_3="/dev/null"
+          export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
+          export GIT_CONFIG_KEY_4="core.hooksPath"
+          export GIT_CONFIG_VALUE_4="/dev/null"
           git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
           mapfile -t pins < <(python3 - <<'PY'
           import pathlib
@@ -476,6 +483,7 @@ jobs:
               -u GIT_CONFIG_KEY_1 -u GIT_CONFIG_VALUE_1 \
               -u GIT_CONFIG_KEY_2 -u GIT_CONFIG_VALUE_2 \
               -u GIT_CONFIG_KEY_3 -u GIT_CONFIG_VALUE_3 \
+              -u GIT_CONFIG_KEY_4 -u GIT_CONFIG_VALUE_4 \
               -u SUBMODULE_TOKEN \
               "$@"
           }
@@ -504,7 +512,8 @@ jobs:
           done
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
-                GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
+                GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3 \
+                GIT_CONFIG_KEY_4 GIT_CONFIG_VALUE_4
           unset SUBMODULE_TOKEN
       - name: Install Node 22
         run: |
@@ -569,7 +578,9 @@ jobs:
           parsed_server = urlsplit(SERVER)
           if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
               sys.exit("Checkout server must be the platform-injected http(s) URL")
+          # Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
           SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
           # Reviewed allowlist, independent of candidate .gitmodules. Add repositories
           # here only with an explicit review of the checkout credential's scope.
           REPOSITORIES = {
@@ -658,7 +669,7 @@ jobs:
                   if not repository or fields.get("path") != name:
                       raise ValueError("Submodule path is outside the reviewed allowlist")
                   trusted_url = f"{SERVER}/weichen/{repository}.git"
-                  if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
+                  if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
                       raise ValueError("Submodule URL is outside the reviewed allowlist")
               for name in entries:
                   url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
@@ -713,19 +724,21 @@ jobs:
           set -euo pipefail
           # 凭据纪律与 Checkout 块同源：经 GIT_CONFIG_* 环境注入 URL 级 token 头，
           # 不落文件/命令行；allowlist 扩项 = Agent-System-RDM 及其 pins（同一
-          # 组件集合），由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
+          # 组件集合），由本 PR 评审背书。SSH pins URL（新旧两形态均改写）以
-          # https 基址后再取。
+          # insteadOf 改写到受信 https 基址后再取。
           SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
           scheme="${GITHUB_SERVER_URL%%://*}"
-          export GIT_CONFIG_COUNT=4
+          export GIT_CONFIG_COUNT=5
           export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
           export GIT_CONFIG_VALUE_0="always"
           export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
           export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
           export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
           export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
-          export GIT_CONFIG_KEY_3="core.hooksPath"
+          export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
-          export GIT_CONFIG_VALUE_3="/dev/null"
+          export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
+          export GIT_CONFIG_KEY_4="core.hooksPath"
+          export GIT_CONFIG_VALUE_4="/dev/null"
           git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
           # 凭据环境须保持到 pins 子模块取完（insteadOf + token 头覆盖嵌套 SSH URL），
           # 之后再 unset。
@@ -733,20 +746,53 @@ jobs:
           echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
-                GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
+                GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3 \
+                GIT_CONFIG_KEY_4 GIT_CONFIG_VALUE_4
           unset SUBMODULE_TOKEN
           make -C rdm build
       - name: Run real-combination lifecycle gates (SQLite, U3, required)
         env:
           SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
+          GIT_TRACE: "1"
+          SVC_RDM_ORIGIN: ${{ github.server_url }}/weichen/Agent-System-RDM.git
         run: |
           set -euo pipefail
           # 路径变量在脚本内解析（YAML env: 不做 shell 展开）。
           export SVC_TEST_REAL=1
+          env -u SUBMODULE_TOKEN make -C rdm product
           export SVC_REAL_BIN="$PWD/bin/agent-system"
-          export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
+          export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm-product"
-          export SVC_RDM_ORIGIN="$PWD/rdm"
+          export SVC_RDM_SRC_DIR="$PWD/rdm"
           # CI 无 SSH key：把受信基址与 URL 级 token 头经环境交给套件（仅环境传递）。
           export SVC_CI_GIT_SERVER="${GITHUB_SERVER_URL%/}"
           export SVC_CI_GIT_TOKEN="${SUBMODULE_TOKEN}"
+          mkdir -p "$HOME/.ssh"
+          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > "$HOME/.ssh/id_ed25519"
+          printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" > "$HOME/.ssh/known_hosts"
+          chmod 700 "$HOME/.ssh" && chmod 600 "$HOME/.ssh/id_ed25519" "$HOME/.ssh/known_hosts"
+          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/id_ed25519 -o IdentitiesOnly=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          # 套件经 SVC_RDM_SRC_DIR 物化嵌套 pins 时，RDM .gitmodules 的 SSH URL
+          # （新旧两形态）无凭据；按本 job Clone 步骤同源 insteadOf 改写到受信基址并带 token 头。
+          SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
+          scheme="${GITHUB_SERVER_URL%%://*}"
+          export GIT_CONFIG_COUNT=5
+          export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
+          export GIT_CONFIG_VALUE_0="always"
+          export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
+          export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
+          export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
+          export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
+          export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
+          export GIT_CONFIG_KEY_4="core.hooksPath"
+          export GIT_CONFIG_VALUE_4="/dev/null"
+          export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
+          git config --global --unset-all "http.$SERVER/.extraheader" 2>/dev/null || true
+          git config --global --add "http.$SERVER/.extraheader" "AUTHORIZATION: token $SUBMODULE_TOKEN"
+          git config --global --unset-all "url.$SERVER/weichen/.insteadOf" 2>/dev/null || true
+          git config --global --add "url.$SERVER/weichen/.insteadOf" "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          git config --global --add "url.$SERVER/weichen/.insteadOf" "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
+          git config --system --replace-all "url.http://172.17.0.1:3000/weichen/.insteadOf" "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" || true
+          git config --system --add "url.http://172.17.0.1:3000/weichen/.insteadOf" "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
+          git config --system --replace-all "http.http://172.17.0.1:3000/.extraheader" "AUTHORIZATION: token $SUBMODULE_TOKEN"
           python3 -m unittest tests.test_svc_realcombo -v

tests/test_svc_realcombo.py

@@ -78,6 +78,15 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
             self.assertTrue(self.real_bin.is_file() and os.access(self.real_bin, os.X_OK),
                             "SVC_REAL_BIN 不可执行：%s" % self.real_bin)
 
+    def svc(self, *args, check=True, env=None, timeout=120):
+        proc = subprocess.run(
+            ["bash", str(self.root / "scripts" / "svc.sh"), *map(str, args)],
+            cwd=self.root, env=env if env is not None else self.env, text=True,
+            stdout=subprocess.PIPE, stderr=subprocess.STDOUT, timeout=timeout)
+        if check:
+            self.assertEqual(proc.returncode, 0, proc.stdout)
+        return proc
+
     def manifest(self, name):
         p = self.runtime(name) / "manifest.json"
         return json.loads(p.read_text(encoding="utf-8")) if p.exists() else None
@@ -244,7 +253,7 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
                     "SVC_RDM_ORIGIN": RDM_ORIGIN})
         agent_port = free_test_port()
         result = self.svc("rcf", "deploy", "--from", "rdm", "--port", str(agent_port),
-                          env=env, check=False)
+                          env=env, check=False, timeout=300)
         if result.returncode != 0:
             log = self.runtime("rcf") / "svc.log"
             tail = log.read_text(encoding="utf-8", errors="replace")[-2000:] \