weichen/Logging-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[WIP] Allow Go consumers to select the logging library without a source checkout #3

Closed
weichen wants to merge 2 commits from feature/versioned-dependencies into main
pull from: feature/versioned-dependencies
merge into: :main
Conversation 0 Commits 2 Files Changed 27
+549 -69
27 changed files with 549 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+494 -3
View File
@@ -7,14 +7,505 @@ on:
jobs:
vet-and-test:
runs-on: nightly
env:
GOTOOLCHAIN: local
GOWORK: "off"
GOPROXY: https://goproxy.cn,direct
steps:
- uses: actions/checkout@v4
- run: go vet ./... && go test -count=1 ./...
- name: Checkout
env:
TOKEN: ${{ secrets.GITHUB_TOKEN }}
SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
run: &trusted_acquisition_1 |
set -euo pipefail
python3 - <<'PY_TRUSTED'
# Trusted workflow code only: never import or execute checkout scripts here.
# Token scopes, workflow provenance and runner isolation are platform NOT_RUN.
import json
import os
from pathlib import Path
import re
import shlex
import subprocess
import sys
import tempfile
from urllib.parse import urlsplit
SERVER = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
parsed = urlsplit(SERVER)
if (parsed.scheme not in {"http", "https"} or not parsed.netloc or
parsed.username or parsed.password or parsed.query or parsed.fragment):
sys.exit("Acquisition requires the platform-injected http(s) server")
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
GO_PREFIX = "git-ssh.u1680832.nyat.app/weichen/"
REPOS = {"Agent-System-Dev", "Logging-System", "Error-Code-System", "Agent-System-Core", "Agent-Native",
"Agent-Intent", "Agent-Command", "Agent-Squad", "Agent-System-Backend",
"Agent-System-Frontend", "Agent-System-UI", "Agent-System-RDM",
"Development-Guidelines", "Agent-System-Documents"}
LEGACY = {
"modules/core": "Agent-System-Core", "modules/backend": "Agent-System-Backend",
"modules/frontend": "Agent-System-Frontend", "modules/ui": "Agent-System-UI",
"modules/documents": "Agent-System-Documents", "deps/agent-system-core": "Agent-System-Core",
"deps/development-guidelines": "Development-Guidelines", "deps/agent-native": "Agent-Native",
"deps/agent-squad": "Agent-Squad", "deps/agent-intent": "Agent-Intent",
"deps/agent-command": "Agent-Command", "deps/error-code-system": "Error-Code-System",
"deps/logging-system": "Logging-System", "pins/agent-system-backend": "Agent-System-Backend",
"pins/agent-system-core": "Agent-System-Core", "pins/agent-system-frontend": "Agent-System-Frontend",
"pins/agent-system-ui": "Agent-System-UI",
}
GO_REPOS = REPOS - {"Agent-System-Dev", "Agent-System-UI", "Agent-System-Frontend", "Development-Guidelines", "Agent-System-Documents"}
GO_MODULES = {GO_PREFIX + repo + ".git" for repo in GO_REPOS}
GO_MODULES |= {GO_PREFIX + "Agent-Squad.git/" + suffix for suffix in
("adapters/native", "adapters/intent", "adapters/sqlite", "adapters/a2a", "cmd/agent-squad")}
root_token = os.environ.pop("TOKEN", "")
component_token = os.environ.pop("SUBMODULE_TOKEN", "")
# Go environment files and inherited Git tracing/config must not change acquisition.
clean = {k: v for k, v in os.environ.items()
if not k.startswith(("GIT_", "NPM_CONFIG_", "npm_config_")) and
not any(word in k.upper() for word in ("TOKEN", "PASSWORD", "SECRET"))}
clean.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_SYSTEM="/dev/null", GIT_CONFIG_GLOBAL="/dev/null",
GIT_TERMINAL_PROMPT="0", GOENV="off", GOTOOLCHAIN="local", GOWORK="off", GOFLAGS="-mod=readonly",
GOPRIVATE=GO_PREFIX.rstrip("/"), GONOPROXY=GO_PREFIX.rstrip("/"), GONOSUMDB=GO_PREFIX.rstrip("/"))
if os.environ.get("npm_config_cache"):
clean["npm_config_cache"] = os.environ["npm_config_cache"]
config = {"core.hooksPath": "/dev/null", "core.fsmonitor": "false", "init.templateDir": "",
"credential.helper": "", "fetch.recurseSubmodules": "false", "submodule.recurse": "false",
"http.followRedirects": "false", "protocol.allow": "never", "protocol." + parsed.scheme + ".allow": "always"}
root = Path.cwd()
mirrors = root / ".ci-mirrors"
def process_env(values):
env = clean | {"GIT_CONFIG_COUNT": str(len(values))}
for index, (key, value) in enumerate(values.items()):
env[f"GIT_CONFIG_KEY_{index}"] = key
env[f"GIT_CONFIG_VALUE_{index}"] = value
return env
def git(directory, *args, token="", repo=""):
values = config.copy()
if token:
if repo not in REPOS:
raise ValueError("Credential destination is outside the reviewed repository allowlist")
values[f"http.{SERVER}/weichen/{repo}.git.extraheader"] = "AUTHORIZATION: token " + token
result = subprocess.run(["git", "-C", str(directory), *args], env=process_env(values),
check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
return result.stdout
def fixed_sha(value):
if not isinstance(value, str) or not re.fullmatch(r"[0-9a-fA-F]{40}", value):
raise ValueError("Source acquisition requires a fixed commit SHA")
return value.lower()
def mirror(repo, sha, token):
sha = fixed_sha(sha)
destination = mirrors / (repo + ".git")
if destination.is_symlink() or mirrors.is_symlink():
raise ValueError("Mirror directory cannot be a symlink")
mirrors.mkdir(exist_ok=True)
if not destination.exists():
destination.mkdir()
git(destination, "init", "--bare", "-q")
url = f"{SERVER}/weichen/{repo}.git"
try:
git(destination, "cat-file", "-e", sha + "^{commit}")
except subprocess.CalledProcessError:
git(destination, "fetch", "--depth=200", url, sha, token=token, repo=repo)
git(destination, "update-ref", "refs/heads/main", sha)
git(destination, "symbolic-ref", "HEAD", "refs/heads/main")
git(destination, "update-ref", "refs/ci/" + sha, sha)
return destination
def mirror_env():
values = {"protocol.file.allow": "always", "core.hooksPath": "/dev/null", "credential.helper": ""}
# Distinct keys use repeated .insteadOf values, represented as a sequence below.
pairs = list(values.items())
for repo in sorted(REPOS):
destination = mirrors / (repo + ".git")
if not destination.exists():
continue
key = "url." + destination.as_uri() + ".insteadOf"
pairs.extend((key, url) for url in (SSH + repo + ".git", "https://" + GO_PREFIX + repo + ".git",
SERVER + "/weichen/" + repo + ".git", "https://" + GO_PREFIX + repo))
env = clean | {"CI_DEPENDENCY_MIRRORS": str(mirrors), "GIT_CONFIG_COUNT": str(len(pairs))}
for index, (key, value) in enumerate(pairs):
env[f"GIT_CONFIG_KEY_{index}"] = key
env[f"GIT_CONFIG_VALUE_{index}"] = value
exports = {k: v for k, v in env.items() if k.startswith("GIT_CONFIG_") or k == "CI_DEPENDENCY_MIRRORS"}
(root / ".ci-mirrors.env").write_text("".join("export " + k + "=" + shlex.quote(v) + "\n" for k, v in exports.items()))
return env
def materialize_legacy(directory, depth=0):
if depth > 16:
raise ValueError("Historical submodule depth exceeds the checkout limit")
links = {}
for entry in git(directory, "ls-tree", "-rz", "HEAD").split(b"\0"):
if entry:
metadata, path = entry.split(b"\t", 1)
mode, kind, commit = metadata.decode().split()
if mode == "160000":
links[path.decode()] = commit
if not links:
return
raw = git(directory, "config", "--no-includes", "--blob", "HEAD:.gitmodules", "--null", "--list")
entries = {}
for item in raw.split(b"\0"):
if not item:
continue
key, value = item.decode().split("\n", 1)
match = re.fullmatch(r"submodule\.(.+)\.(path|url)", key)
if not match:
raise ValueError("Unsupported candidate .gitmodules setting")
name, field = match.groups()
if field in entries.setdefault(name, {}):
raise ValueError("Duplicate candidate .gitmodules setting")
entries[name][field] = value
if set(entries) != set(links):
raise ValueError("Submodule names must match fixed gitlink paths")
for name, fields in entries.items():
repo = LEGACY.get(name)
if not repo or fields.get("path") != name or fields.get("url") not in {
SSH + repo + ".git", f"{SERVER}/weichen/{repo}.git"}:
raise ValueError("Historical submodule source is outside the reviewed allowlist")
for name in entries:
repo = LEGACY[name]
sha = links[name]
url = f"{SERVER}/weichen/{repo}.git"
git(directory, "config", f"submodule.{name}.url", url)
# Trusted explicit checkout prevents candidate update commands from running.
git(directory, "submodule", "update", "--init", "--checkout", "--", name, token=component_token, repo=repo)
child = directory / name
if git(child, "rev-parse", "HEAD").decode().strip() != sha:
raise ValueError("Historical submodule does not match its fixed SHA")
mirror(repo, sha, component_token)
materialize_legacy(child, depth + 1)
def materialize_manifest(directory):
manifest = directory / "components.json"
lock = directory / "components.lock.json"
if not manifest.exists() and not lock.exists():
materialize_legacy(directory)
return
data = json.loads(manifest.read_text())
locked = json.loads(lock.read_text())
if data.get("schema") != 1 or locked.get("schema") != 1:
raise ValueError("Unsupported source manifest schema")
entries = {}
for item in data["components"]:
repo = item["id"]
path = ".workspace/" + repo
if (repo not in REPOS or repo in entries or item["path"] != path or
item["repo"] not in {SSH + repo + ".git", f"{SERVER}/weichen/{repo}.git"} or
item.get("role") not in {"go-library", "npm-library", "application", "guidelines", "documentation"}):
raise ValueError("Candidate source manifest is outside the reviewed allowlist")
for module in item.get("modules", []):
if module.get("path") not in GO_MODULES or not module["path"].startswith(GO_PREFIX + repo + ".git"):
raise ValueError("Candidate module mapping is outside the reviewed allowlist")
entries[repo] = item
selected = locked["components"]
if set(selected) - set(entries):
raise ValueError("Source lock refers to an unregistered repository")
for repo, item in entries.items():
if item["role"] in {"application", "guidelines", "documentation"} and repo not in selected:
raise ValueError("Application and documentation source needs a fixed lock")
for repo, pin in selected.items():
fixed_sha(pin["commit"])
destination = directory / entries[repo]["path"]
if destination.exists() or destination.is_symlink() or destination.parent.is_symlink():
raise ValueError("Source materialization requires a fresh destination")
# Validate the complete lock before any authenticated component fetch.
for repo, pin in selected.items():
sha = fixed_sha(pin["commit"])
destination = directory / entries[repo]["path"]
destination.mkdir(parents=True)
url = f"{SERVER}/weichen/{repo}.git"
git(destination, "init", "-q")
git(destination, "remote", "add", "origin", url)
git(destination, "fetch", "--depth=1", "origin", sha, token=component_token, repo=repo)
git(destination, "checkout", "-q", "--detach", "FETCH_HEAD")
if git(destination, "rev-parse", "HEAD").decode().strip() != sha:
raise ValueError("Materialized source differs from the fixed lock")
# Persist the registered identity; process config chooses the transport.
git(destination, "remote", "set-url", "origin", entries[repo]["repo"])
mirror(repo, sha, component_token)
materialize_legacy(destination)
try:
if os.environ.get("GITHUB_REPOSITORY") != "weichen/Logging-System":
raise ValueError("Checkout repository is outside the reviewed allowlist")
sha = fixed_sha(os.environ.get("GITHUB_SHA", ""))
if not root_token:
raise ValueError("Checkout requires TOKEN")
if (root / ".git").exists():
raise ValueError("Checkout requires a fresh workspace")
git(root, "init", "-q")
git(root, "remote", "add", "origin", SERVER + "/weichen/Logging-System.git")
git(root, "fetch", "--depth=1", "origin", sha, token=root_token, repo="Logging-System")
git(root, "checkout", "-q", "--detach", "FETCH_HEAD")
if git(root, "rev-parse", "HEAD").decode().strip() != sha:
raise ValueError("Checked-out commit differs from the platform commit")
if (root / ".ci-mirrors").exists() or (root / ".ci-mirrors.env").exists():
raise ValueError("Candidate cannot provide trusted prefetch state")
materialize_manifest(root)
mirror_env()
except (ValueError, KeyError, OSError, subprocess.CalledProcessError) as error:
# Do not print child stderr or environment: a failed credential fetch stays redacted.
sys.exit("Checkout refused: " + str(error))
print("Fixed source checkout complete; credentials were not persisted")
PY_TRUSTED
unset TOKEN SUBMODULE_TOKEN
- name: Install Go 1.27.1
run: |
set -euo pipefail
curl -fsSL -o "$RUNNER_TEMP/go.tgz" https://mirrors.aliyun.com/golang/go1.27.1.linux-amd64.tar.gz
tar -C /usr/local -xzf "$RUNNER_TEMP/go.tgz"
ln -sfn /usr/local/go/bin/go /usr/local/bin/go
ln -sfn /usr/local/go/bin/gofmt /usr/local/bin/gofmt
- name: Prefetch Go modules without executing candidate code
env:
SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
run: &trusted_acquisition_2 |
set -euo pipefail
python3 - <<'PY_TRUSTED'
# Trusted workflow code only: never import or execute checkout scripts here.
# Token scopes, workflow provenance and runner isolation are platform NOT_RUN.
import json
import os
from pathlib import Path
import re
import shlex
import subprocess
import sys
import tempfile
from urllib.parse import urlsplit
SERVER = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
parsed = urlsplit(SERVER)
if (parsed.scheme not in {"http", "https"} or not parsed.netloc or
parsed.username or parsed.password or parsed.query or parsed.fragment):
sys.exit("Acquisition requires the platform-injected http(s) server")
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
GO_PREFIX = "git-ssh.u1680832.nyat.app/weichen/"
REPOS = {"Agent-System-Dev", "Logging-System", "Error-Code-System", "Agent-System-Core", "Agent-Native",
"Agent-Intent", "Agent-Command", "Agent-Squad", "Agent-System-Backend",
"Agent-System-Frontend", "Agent-System-UI", "Agent-System-RDM",
"Development-Guidelines", "Agent-System-Documents"}
LEGACY = {
"modules/core": "Agent-System-Core", "modules/backend": "Agent-System-Backend",
"modules/frontend": "Agent-System-Frontend", "modules/ui": "Agent-System-UI",
"modules/documents": "Agent-System-Documents", "deps/agent-system-core": "Agent-System-Core",
"deps/development-guidelines": "Development-Guidelines", "deps/agent-native": "Agent-Native",
"deps/agent-squad": "Agent-Squad", "deps/agent-intent": "Agent-Intent",
"deps/agent-command": "Agent-Command", "deps/error-code-system": "Error-Code-System",
"deps/logging-system": "Logging-System", "pins/agent-system-backend": "Agent-System-Backend",
"pins/agent-system-core": "Agent-System-Core", "pins/agent-system-frontend": "Agent-System-Frontend",
"pins/agent-system-ui": "Agent-System-UI",
}
GO_REPOS = REPOS - {"Agent-System-Dev", "Agent-System-UI", "Agent-System-Frontend", "Development-Guidelines", "Agent-System-Documents"}
GO_MODULES = {GO_PREFIX + repo + ".git" for repo in GO_REPOS}
GO_MODULES |= {GO_PREFIX + "Agent-Squad.git/" + suffix for suffix in
("adapters/native", "adapters/intent", "adapters/sqlite", "adapters/a2a", "cmd/agent-squad")}
root_token = os.environ.pop("TOKEN", "")
component_token = os.environ.pop("SUBMODULE_TOKEN", "")
# Go environment files and inherited Git tracing/config must not change acquisition.
clean = {k: v for k, v in os.environ.items()
if not k.startswith(("GIT_", "NPM_CONFIG_", "npm_config_")) and
not any(word in k.upper() for word in ("TOKEN", "PASSWORD", "SECRET"))}
clean.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_SYSTEM="/dev/null", GIT_CONFIG_GLOBAL="/dev/null",
GIT_TERMINAL_PROMPT="0", GOENV="off", GOTOOLCHAIN="local", GOWORK="off", GOFLAGS="-mod=readonly",
GOPRIVATE=GO_PREFIX.rstrip("/"), GONOPROXY=GO_PREFIX.rstrip("/"), GONOSUMDB=GO_PREFIX.rstrip("/"))
if os.environ.get("npm_config_cache"):
clean["npm_config_cache"] = os.environ["npm_config_cache"]
config = {"core.hooksPath": "/dev/null", "core.fsmonitor": "false", "init.templateDir": "",
"credential.helper": "", "fetch.recurseSubmodules": "false", "submodule.recurse": "false",
"http.followRedirects": "false", "protocol.allow": "never", "protocol." + parsed.scheme + ".allow": "always"}
root = Path.cwd()
mirrors = root / ".ci-mirrors"
def process_env(values):
env = clean | {"GIT_CONFIG_COUNT": str(len(values))}
for index, (key, value) in enumerate(values.items()):
env[f"GIT_CONFIG_KEY_{index}"] = key
env[f"GIT_CONFIG_VALUE_{index}"] = value
return env
def git(directory, *args, token="", repo=""):
values = config.copy()
if token:
if repo not in REPOS:
raise ValueError("Credential destination is outside the reviewed repository allowlist")
values[f"http.{SERVER}/weichen/{repo}.git.extraheader"] = "AUTHORIZATION: token " + token
result = subprocess.run(["git", "-C", str(directory), *args], env=process_env(values),
check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
return result.stdout
def fixed_sha(value):
if not isinstance(value, str) or not re.fullmatch(r"[0-9a-fA-F]{40}", value):
raise ValueError("Source acquisition requires a fixed commit SHA")
return value.lower()
def mirror(repo, sha, token):
sha = fixed_sha(sha)
destination = mirrors / (repo + ".git")
if destination.is_symlink() or mirrors.is_symlink():
raise ValueError("Mirror directory cannot be a symlink")
mirrors.mkdir(exist_ok=True)
if not destination.exists():
destination.mkdir()
git(destination, "init", "--bare", "-q")
url = f"{SERVER}/weichen/{repo}.git"
try:
git(destination, "cat-file", "-e", sha + "^{commit}")
except subprocess.CalledProcessError:
git(destination, "fetch", "--depth=200", url, sha, token=token, repo=repo)
git(destination, "update-ref", "refs/heads/main", sha)
git(destination, "symbolic-ref", "HEAD", "refs/heads/main")
git(destination, "update-ref", "refs/ci/" + sha, sha)
return destination
def mirror_env():
values = {"protocol.file.allow": "always", "core.hooksPath": "/dev/null", "credential.helper": ""}
# Distinct keys use repeated .insteadOf values, represented as a sequence below.
pairs = list(values.items())
for repo in sorted(REPOS):
destination = mirrors / (repo + ".git")
if not destination.exists():
continue
key = "url." + destination.as_uri() + ".insteadOf"
pairs.extend((key, url) for url in (SSH + repo + ".git", "https://" + GO_PREFIX + repo + ".git",
SERVER + "/weichen/" + repo + ".git", "https://" + GO_PREFIX + repo))
env = clean | {"CI_DEPENDENCY_MIRRORS": str(mirrors), "GIT_CONFIG_COUNT": str(len(pairs))}
for index, (key, value) in enumerate(pairs):
env[f"GIT_CONFIG_KEY_{index}"] = key
env[f"GIT_CONFIG_VALUE_{index}"] = value
exports = {k: v for k, v in env.items() if k.startswith("GIT_CONFIG_") or k == "CI_DEPENDENCY_MIRRORS"}
(root / ".ci-mirrors.env").write_text("".join("export " + k + "=" + shlex.quote(v) + "\n" for k, v in exports.items()))
return env
def source_roots():
bases = [root]
composition = root / ".ci-composition-dev"
if composition.is_dir() and not composition.is_symlink():
bases.append(composition)
paths = []
for base in bases:
paths += [base, base / "rdm"] + [base / path for path in LEGACY] + [base / ".workspace" / repo for repo in sorted(REPOS)]
return [path for path in paths if path.is_dir() and not path.is_symlink()]
try:
targets = []
for source in source_roots():
for suffix in (".", "examples/trace", "adapters/native", "adapters/intent", "adapters/sqlite", "adapters/a2a", "cmd/agent-squad"):
directory = source / suffix
if (directory / "go.mod").is_file() and directory.resolve() not in targets:
targets.append(directory.resolve())
# Parse using the installed local Go tool without credentials or candidate execution.
original_files = {}
for directory in targets:
parsed_mod = json.loads(subprocess.check_output(["go", "mod", "edit", "-json"], cwd=directory, env=clean))
canonical = parsed_mod["Module"]["Path"].startswith(GO_PREFIX)
for name in ("go.mod", "go.sum"):
dependency_file = directory / name
if dependency_file.is_file():
original_files[(directory, name)] = dependency_file.read_bytes()
elif canonical and name == "go.sum":
original_files[(directory, name)] = None
for dep in (parsed_mod.get("Require") or []):
path = dep["Path"]
if path.startswith(GO_PREFIX) and path not in GO_MODULES:
raise ValueError("Go dependency is outside the reviewed module mapping")
for replacement in (parsed_mod.get("Replace") or []):
path = replacement["New"]["Path"]
if canonical and not replacement["New"].get("Version"):
raise ValueError("Canonical module cannot acquire a local path replacement")
if path.startswith(GO_PREFIX) and path not in GO_MODULES:
raise ValueError("Go replacement is outside the reviewed module mapping")
auth = config.copy()
for repo in sorted(GO_REPOS):
url = f"{SERVER}/weichen/{repo}.git"
auth[f"url.{url}.insteadOf"] = "https://" + GO_PREFIX + repo
auth[f"http.{url}.extraheader"] = "AUTHORIZATION: token " + component_token
def objects(output):
decoder = json.JSONDecoder()
remaining = output.strip()
while remaining:
item, end = decoder.raw_decode(remaining)
remaining = remaining[end:].lstrip()
yield item
def unchanged():
for (owner, name), contents in original_files.items():
dependency_file = owner / name
current = dependency_file.read_bytes() if dependency_file.exists() else None
if current != contents:
raise ValueError("Go acquisition modified a committed Go dependency file: " + str(dependency_file))
for directory in targets:
# Resolve private go.mod metadata only through exact repository headers;
# validate the complete selected graph before acquiring module zip files.
graph = subprocess.run(["go", "list", "-mod=readonly", "-m", "-json", "all"], cwd=directory,
env=process_env(auth), capture_output=True, text=True)
if graph.returncode:
raise ValueError("Go selected graph resolution failed: " + graph.stderr.strip())
for item in objects(graph.stdout):
if item.get("Main"):
continue
selected = item.get("Replace") or item
for path in (item.get("Path", ""), selected.get("Path", "")):
if path.startswith(GO_PREFIX) and path not in GO_MODULES:
raise ValueError("Selected Go module is outside the reviewed mapping")
unchanged()
# Go 1.27 can prune go.sum even under -mod=readonly for this
# metadata-only command. Use a disposable copy, then validate actual
# package loading against the unchanged committed source locks.
local_replacements = json.loads(subprocess.check_output(
["go", "mod", "edit", "-json"], cwd=directory, env=clean)).get("Replace") or []
downloaded = ""
if not any(not item["New"].get("Version") for item in local_replacements):
with tempfile.TemporaryDirectory(prefix="ci-go-prefetch-") as temporary:
download_root = Path(temporary)
for name in ("go.mod", "go.sum"):
if (directory / name).is_file():
(download_root / name).write_bytes((directory / name).read_bytes())
result = subprocess.run(["go", "mod", "download", "-json"], cwd=download_root,
env=process_env(auth), capture_output=True, text=True)
if result.returncode:
raise ValueError("Go module acquisition failed: " + result.stderr.strip())
downloaded = result.stdout
unchanged()
for item in objects(downloaded):
path = item.get("Path", "")
if path.startswith(GO_PREFIX):
if path not in GO_MODULES:
raise ValueError("Resolved Go module is outside the reviewed mapping")
repo = path[len(GO_PREFIX):].split(".git", 1)[0]
origin = item.get("Origin") or json.loads(Path(item["Info"]).read_text()).get("Origin") or {}
mirror(repo, fixed_sha(origin.get("Hash")), component_token)
# Package metadata loads actual test/build dependencies without running
# vet, compilers, package init functions or candidate tests. No CGO tools.
packages = subprocess.run(["go", "list", "-mod=readonly", "-deps", "-test", "./..."], cwd=directory,
env=process_env(auth) | {"CGO_ENABLED": "0"}, capture_output=True, text=True)
if packages.returncode:
raise ValueError("Go test/build dependency acquisition failed: " + packages.stderr.strip())
unchanged()
mirror_env()
except (ValueError, OSError, subprocess.CalledProcessError) as error:
sys.exit("Go prefetch refused: " + str(error))
print("Go modules cached with GOTOOLCHAIN=local; no candidate code executed")
PY_TRUSTED
unset TOKEN SUBMODULE_TOKEN
- run: |
set -euo pipefail
source .ci-mirrors.env
for module in . examples/trace; do
test -f "$module/go.mod"
(cd "$module" && go vet -mod=readonly ./... && go test -mod=readonly -count=1 ./...)
done
docker-checkout-hostgateway:
runs-on: ubuntu-latest
options: --add-host gitea:host-gateway
env:
GITHUB_SERVER_URL: http://gitea:3000
steps:
- uses: actions/checkout@v4
- name: Checkout
env:
TOKEN: ${{ secrets.GITHUB_TOKEN }}
SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
run: *trusted_acquisition_1
- run: test -f go.mod && echo "docker-mode checkout via host-gateway OK"
.gitmodules
-3
View File
@@ -1,3 +0,0 @@
[submodule "deps/development-guidelines"]
path = deps/development-guidelines
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git
AGENTS.md
+2 -2
View File
@@ -1,6 +1,6 @@
# Agent 工作说明（Logging-System）
本仓开发遵循 Development-Guidelines（Dev 仓 `deps/development-guidelines`，gitlink 固定版本）：
本仓开发遵循 Development-Guidelines（由 Dev 固定规范来源；新布局见 Dev components.lock.json，规则目录 .workspace/Development-Guidelines；历史布局仍读原 gitlink）：
核心规则见其 `core/`，按任务触发阅读 `standards/` 专题；日常交付走 `workflows/delivery.md`。
## 任务启动门禁
@@ -15,7 +15,7 @@
## 仓内规则
- 模块边界、公开契约与隔离档位见 `policy/modules/`（如有）与 PROJECT.md。
- 跨仓 gitlink 变更须经组合验证后在 Dev 仓推进；受保护分支经 PR 合入。
- 跨仓语言依赖/应用源码锁变更须经固定组合验证后在消费方推进；源码提交到所属仓；受保护分支经 PR 合入。
- 验证命令见 PROJECT.md「验证」节；完成声明须附实际命令输出证据。
## Gitea 与 Git 访问事实（2026-09-30 实测）
PROJECT.md
+8 -14
View File
@@ -5,9 +5,9 @@
## 仓库与操作
- 目标/产品边界：结构化日志库与可独立部署的采集服务。把一次请求的日志和错误码对齐到同一个 `trace_id`。不导入错误码模块。
- 源码、资产、文档、机器契约位置：模块路径 `logging-system`。包为 `logsys`、`sink`、`redact`、`config`、`slogadapter`、`server`、`cli`、`conformance`、`examples/trace`。配置示例在 `docs/example.json`。
- 源码、资产、文档、机器契约位置：模块路径 `git-ssh.u1680832.nyat.app/weichen/Logging-System.git`。包为 `logsys`、`sink`、`redact`、`config`、`slogadapter`、`server`、`cli`、`conformance`、`examples/trace`。配置示例在 `docs/example.json`。
- 权威远端、集成基线、受保护分支：`ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Logging-System.git`，基线 `main`。
- 并行共同基线记录位置、合入通知/主动检查方式：Gitea Issue/PR。消费方用自己的 gitlink 固定版本。
- 并行共同基线记录位置、合入通知/主动检查方式：Gitea Issue/PR。消费方用自己的 go.mod/go.sum 固定实际版本。
- 发布线与批准版本/实际制品查询入口：无独立制品库。`go build -o bin/logctl .` 从当前提交构建。
- 提交/审核/合并/发布身份与权限：仓库所有者 weichen。
- 任务唯一来源：Gitea `weichen/Logging-System` 的 Issue 与 Pull Request。
@@ -20,22 +20,16 @@
| 逻辑 ID | 路径 | 角色 |
|---|---|---|
| development-guidelines | `deps/development-guidelines` | development-only |
| development-guidelines | Dev `.workspace/Development-Guidelines`（源码锁固定） | development-only |
本库 Go 依赖只有标准库。`examples/trace` 是独立模块，用相对路径引用本库与同级检出的 Error-Code-System，不把错误码库变成主模块依赖。
被消费时：
```
require logging-system v0.0.0
replace logging-system => ./deps/logging-system
```
主库只依赖标准库。消费方通过 `go get git-ssh.u1680832.nyat.app/weichen/Logging-System.git@<已审核提交>`
生成真实提交版本，go.mod/go.sum 是消费权威，正式测试关闭本地 Go 覆盖。
私有传输由 Dev 固定入口配置；旧提交保留自己的历史依赖方式。
克隆：
```bash
git clone --recurse-submodules ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Logging-System.git
git clone ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Logging-System.git
```
## 验证命令
@@ -45,7 +39,7 @@ git clone --recurse-submodules ssh://git@git-ssh.u1680832.nyat.app:31411/weichen
| 文档 | 核对 `docs/integration.md` 与示例 | 不证明消费方已接线 |
| 模块/接口 | 仓库根：`go vet ./... && go test -count=1 ./...` | 不含 `examples/trace`（独立模块） |
| 数据/权限/恢复 | 文件滚动与采集 JSONL 由 sink/server 测试覆盖 | 无共享数据库 |
| 跨库追溯示例 | 在 `examples/trace`：`go test ./...` | 需要同级目录 `../../../Error-Code-System` 或该 go.mod 的 replace 目标存在 |
| 跨库追溯示例 | 在 `examples/trace`：`go test ./...` | 独立模块通过 go.mod 固定远端两库版本 |
## 环境与数据
README.md
+7 -8
View File
@@ -2,7 +2,7 @@
跨系统共用的结构化日志库，以及可独立部署的采集服务。目标是把一次请求的运行日志和错误码对齐到同一个 `trace_id` 上，方便事后追溯。
本仓库是该模块的源码位置。Go 模块路径为 `logging-system`。只依赖标准库，不依赖错误码模块：只要错误实现了 `ErrorCode()` 和 `ErrorFields()`，错误日志会自动带上码和字段。
本仓库是该模块的源码位置。Go 模块路径为 `git-ssh.u1680832.nyat.app/weichen/Logging-System.git`。只依赖标准库，不依赖错误码模块：只要错误实现了 `ErrorCode()` 和 `ErrorFields()`，错误日志会自动带上码和字段。
## 分层
@@ -74,16 +74,15 @@ go test -count=1 ./...
## 依赖本仓库
消费方把本库固定为 submodule，推荐路径 `deps/logging-system`。版本以消费方 gitlink 为准，不执行 `submodule update --remote`。
消费方使用模块 `git-ssh.u1680832.nyat.app/weichen/Logging-System.git`，由 Go 生成可获取的提交版本：
```
require logging-system v0.0.0
replace logging-system => ./deps/logging-system
```bash
go get git-ssh.u1680832.nyat.app/weichen/Logging-System.git@<已审核提交>
GOWORK=off go test -mod=readonly ./...
```
并列检出、还没放进 `deps/` 时，也可以暂时写 `replace logging-system => ../Logging-System`。本库不导入错误码模块。若消费方同时依赖 Agent-Native，而 Agent-Native 的 `deps/` 里还有一份本库，编译时只认消费方自己的 `replace`；两份 gitlink 必须相同。
go.mod 决定实际版本，go.sum 校验内容。私有获取通过 Dev 登记的进程级传输配置，不修改全局 Git 配置。源码联调用本地工作区覆盖，正式消费没有源码目录 replace；旧提交继续按其原固定组合构建。
远程：`ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Logging-System.git`
与错误码系统的追溯闭环见 [docs/integration.md](docs/integration.md)。可运行示例：`go test ./examples/trace`（两个仓库需为同级目录）。
与错误码系统的追溯闭环见 [docs/integration.md](docs/integration.md)。可运行示例：`cd examples/trace && GOWORK=off go test -mod=readonly ./...`（独立模块，远端版本消费）。
cli/cli.go
+1 -1
View File
@@ -13,7 +13,7 @@ import (
"os"
"strings"
"logging-system/server"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/server"
)
// Main 执行命令行并返回退出码。
cli/cli_test.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"strings"
"testing"
"logging-system/server"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/server"
)
func TestQueryCommand(t *testing.T) {
config/config.go
+3 -3
View File
@@ -8,9 +8,9 @@ import (
"strings"
"time"
"logging-system/logsys"
"logging-system/redact"
"logging-system/sink"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/redact"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/sink"
)
// Config 是日志系统的全部可配置项。
config/config_test.go
+2 -2
View File
@@ -6,8 +6,8 @@ import (
"strings"
"testing"
"logging-system/logsys"
"logging-system/sink"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/sink"
)
func TestLoadEnvOverridesFile(t *testing.T) {
conformance/conformance_test.go
+3 -3
View File
@@ -6,9 +6,9 @@ import (
"testing"
"time"
"logging-system/logsys"
"logging-system/redact"
"logging-system/sink"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/redact"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/sink"
)
func TestSyncConcurrentNoLoss(t *testing.T) {
deps/development-guidelines
Vendored
-1
Submodule deps/development-guidelines deleted from 26b562d2e3
examples/trace/go.mod
+3 -7
View File
@@ -1,12 +1,8 @@
module logging-system/examples/trace
module git-ssh.u1680832.nyat.app/weichen/Logging-System.git/examples/trace
go 1.27
require (
error-code-system v0.0.0
logging-system v0.0.0
git-ssh.u1680832.nyat.app/weichen/Error-Code-System.git v0.0.0-20261013150648-28d2d5074347
git-ssh.u1680832.nyat.app/weichen/Logging-System.git v0.0.0-20261013150647-9c5442f06d05
)
replace error-code-system => ../../../Error-Code-System
replace logging-system => ../..
examples/trace/go.sum
+4
View File
@@ -0,0 +1,4 @@
git-ssh.u1680832.nyat.app/weichen/Error-Code-System.git v0.0.0-20261013150648-28d2d5074347 h1:mESnwe9ZpZqpLoGPzLyCWEmXDHKm7ouKC8qpF8EztEQ=
git-ssh.u1680832.nyat.app/weichen/Error-Code-System.git v0.0.0-20261013150648-28d2d5074347/go.mod h1:b8CDy31Xo3uRzAhA3HldwcgNnk0x5Lb02osIb9ewJ3A=
git-ssh.u1680832.nyat.app/weichen/Logging-System.git v0.0.0-20261013150647-9c5442f06d05 h1:gtFuWlGr7GlpEkuoIfIw6f/uXHUlYXlHU2qgLWAV46Y=
git-ssh.u1680832.nyat.app/weichen/Logging-System.git v0.0.0-20261013150647-9c5442f06d05/go.mod h1:Jg/bDRsd1/g5YjIoEUYkCsTgJOrTolYccfyb/tc57Dk=
examples/trace/trace_test.go
+5 -5
View File
@@ -7,11 +7,11 @@ import (
"net/http/httptest"
"testing"
"error-code-system/domains"
"error-code-system/errcode"
"error-code-system/httpx"
"logging-system/logsys"
"logging-system/sink"
"git-ssh.u1680832.nyat.app/weichen/Error-Code-System.git/domains"
"git-ssh.u1680832.nyat.app/weichen/Error-Code-System.git/errcode"
"git-ssh.u1680832.nyat.app/weichen/Error-Code-System.git/httpx"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/sink"
)
func TestErrorCodeReachesLogAndHTTP(t *testing.T) {
go.mod
+1 -1
View File
@@ -1,3 +1,3 @@
module logging-system
module git-ssh.u1680832.nyat.app/weichen/Logging-System.git
go 1.27
main.go
+1 -1
View File
@@ -3,7 +3,7 @@ package main
import (
"os"
"logging-system/cli"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/cli"
)
func main() {
server/server.go
+2 -2
View File
@@ -9,8 +9,8 @@ import (
"strconv"
"strings"
"logging-system/logsys"
"logging-system/redact"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/redact"
)
// DefaultAddr 是 logcollector 的默认监听地址。
server/store.go
+2 -2
View File
@@ -6,8 +6,8 @@ import (
"os"
"sync"
"logging-system/logsys"
"logging-system/redact"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/redact"
)
// Record 是带序号的日志，序号即查询游标。
sink/async.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"sync/atomic"
"time"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
// ErrClosed 表示出口已经关闭。
sink/console.go
+1 -1
View File
@@ -5,7 +5,7 @@ import (
"os"
"sync"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
// Console 把日志写到 io.Writer。Format 为 human 或 json，空值按 human。
sink/fanout.go
+1 -1
View File
@@ -3,7 +3,7 @@ package sink
import (
"errors"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
// Fanout 把同一条日志写到多个出口。单个出口失败不影响其他出口。
sink/file.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"path/filepath"
"sync"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
// File 以互斥锁保护的方式追加日志，可选按大小滚动。
sink/httpbatch.go
+1 -1
View File
@@ -9,7 +9,7 @@ import (
"sync/atomic"
"time"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
// HTTPBatch 把日志攒批 POST 到采集器。Async 为 false 时在 Write 里同步发送。
sink/memory.go
+1 -1
View File
@@ -3,7 +3,7 @@ package sink
import (
"sync"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
// Memory 把日志留在内存里，供测试和进程内订阅前的缓冲。
sink/sink_test.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
"testing"
"time"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
func entry(i int) logsys.Entry {
slogadapter/slogadapter.go
+1 -1
View File
@@ -5,7 +5,7 @@ import (
"context"
"log/slog"
"logging-system/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
)
// Handler 把 slog 记录写入 logsys。
slogadapter/slogadapter_test.go
+2 -2
View File
@@ -6,8 +6,8 @@ import (
"strings"
"testing"
"logging-system/logsys"
"logging-system/sink"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/logsys"
"git-ssh.u1680832.nyat.app/weichen/Logging-System.git/sink"
)
func TestSlogToLogsys(t *testing.T) {