From d41a1d37fe8faf8119f2b7808246bc5a1269afa7 Mon Sep 17 00:00:00 2001 From: ogt Date: Sat, 11 Jul 2026 00:35:10 +0800 Subject: [PATCH] fix(ci): keep workflows on Gitea supply chain --- .gitea/workflows/agent-market-watch.yaml | 11 +++++- .../agent-version-lifecycle-watch.yaml | 11 +++++- .gitea/workflows/ai-technology-watch.yaml | 11 +++++- .gitea/workflows/ansible-lint.yml | 11 +++++- .../awoooi-onboarding-warning-step.yaml | 11 +++++- .gitea/workflows/cd-dev.yaml | 11 +++++- .gitea/workflows/cd.yaml | 35 ++++++++++++++++--- .gitea/workflows/code-review.yaml | 13 +++++-- .gitea/workflows/deploy-alerts.yaml | 11 +++++- .gitea/workflows/e2e-health.yaml | 11 +++++- .gitea/workflows/harbor-110-local-repair.yaml | 11 +++++- .gitea/workflows/run-migration.yml | 14 +++++--- .gitea/workflows/type-sync-check.yaml | 33 +++++++++++------ ...ding_warning_step_template_copy_receipt.py | 2 +- ...t_p0_cicd_baseline_source_readiness_api.py | 4 +-- ..._signal_worker_ansible_executor_binding.py | 23 ++++++++++-- ...g-step-template-copy-receipt.snapshot.json | 6 ++-- ...itea-onboarding-warning-step.workflow.yaml | 11 +++++- k8s/awoooi-prod/06-deployment-api.yaml | 4 --- 19 files changed, 200 insertions(+), 44 deletions(-) diff --git a/.gitea/workflows/agent-market-watch.yaml b/.gitea/workflows/agent-market-watch.yaml index e989a0b44..3430b73dd 100644 --- a/.gitea/workflows/agent-market-watch.yaml +++ b/.gitea/workflows/agent-market-watch.yaml @@ -21,7 +21,16 @@ jobs: runs-on: awoooi-non110-ubuntu timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Run read-only market watch id: watch diff --git a/.gitea/workflows/agent-version-lifecycle-watch.yaml b/.gitea/workflows/agent-version-lifecycle-watch.yaml index 90b51a952..70da51958 100644 --- a/.gitea/workflows/agent-version-lifecycle-watch.yaml +++ b/.gitea/workflows/agent-version-lifecycle-watch.yaml @@ -18,7 +18,16 @@ jobs: runs-on: awoooi-non110-ubuntu timeout-minutes: 5 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Validate no-write version lifecycle proposal id: lifecycle diff --git a/.gitea/workflows/ai-technology-watch.yaml b/.gitea/workflows/ai-technology-watch.yaml index 89de19222..f3238c8b5 100644 --- a/.gitea/workflows/ai-technology-watch.yaml +++ b/.gitea/workflows/ai-technology-watch.yaml @@ -17,7 +17,16 @@ jobs: runs-on: awoooi-non110-ubuntu timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: 執行只讀 AI 技術雷達監控 id: watch diff --git a/.gitea/workflows/ansible-lint.yml b/.gitea/workflows/ansible-lint.yml index a744b36e9..64d3e06c5 100644 --- a/.gitea/workflows/ansible-lint.yml +++ b/.gitea/workflows/ansible-lint.yml @@ -15,7 +15,16 @@ jobs: runs-on: awoooi-non110-ubuntu timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Bootstrap Ansible validation env run: bash scripts/ops/bootstrap-ansible-validation-env.sh diff --git a/.gitea/workflows/awoooi-onboarding-warning-step.yaml b/.gitea/workflows/awoooi-onboarding-warning-step.yaml index 3b805808b..48d5d7b5a 100644 --- a/.gitea/workflows/awoooi-onboarding-warning-step.yaml +++ b/.gitea/workflows/awoooi-onboarding-warning-step.yaml @@ -30,7 +30,16 @@ jobs: runs-on: awoooi-non110-host timeout-minutes: 3 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Validate warning-step boundaries run: | diff --git a/.gitea/workflows/cd-dev.yaml b/.gitea/workflows/cd-dev.yaml index 22885f376..4ed76b4e6 100644 --- a/.gitea/workflows/cd-dev.yaml +++ b/.gitea/workflows/cd-dev.yaml @@ -28,7 +28,16 @@ jobs: build-and-deploy-dev: runs-on: awoooi-non110-ubuntu steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Get Commit Info id: commit diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml index 2ec74d0e1..92e2e6dee 100644 --- a/.gitea/workflows/cd.yaml +++ b/.gitea/workflows/cd.yaml @@ -108,7 +108,16 @@ jobs: apk add --no-cache nodejs npm git curl bash coreutils python3 openssh-client docker-cli docker-cli-buildx fi - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Wait for Host Web Build Pressure # 2026-06-28 Codex: 110 runner pressure remains incident-grade and @@ -1293,7 +1302,16 @@ jobs: apk add --no-cache nodejs npm git curl bash coreutils python3 openssh-client docker-cli docker-cli-buildx fi - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Wait for Host Web Build Pressure # 2026-06-27 Codex: post-deploy smoke is also browser-heavy. Refuse to @@ -2161,7 +2179,7 @@ jobs: # ─── Step 2: 更新 kustomization.yaml image tag ─── # kustomize is an immutable dependency of the internal runner image. - # GitHub is frozen, so CD must never download tools from github.com. + # GitHub is frozen, so CD must never download tools from public GitHub. export PATH="${HOME}/.local/bin:${PATH}" command -v kustomize >/dev/null 2>&1 || { echo "❌ internal runner image is missing required kustomize" @@ -2690,7 +2708,16 @@ jobs: apk add --no-cache nodejs npm git curl bash coreutils python3 openssh-client docker-cli docker-cli-buildx fi - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Wait for Host Web Build Pressure # 2026-06-28 Codex: post-deploy is browser-heavy; fail closed on host diff --git a/.gitea/workflows/code-review.yaml b/.gitea/workflows/code-review.yaml index 08f77fcfc..43be1c441 100644 --- a/.gitea/workflows/code-review.yaml +++ b/.gitea/workflows/code-review.yaml @@ -24,9 +24,16 @@ jobs: runs-on: awoooi-non110-ubuntu timeout-minutes: 8 steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 50 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=50 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Guard Workflow Secret Surfaces run: node scripts/ci/check-gitea-step-env-secrets.js diff --git a/.gitea/workflows/deploy-alerts.yaml b/.gitea/workflows/deploy-alerts.yaml index b64f7fb82..a9904cfe9 100644 --- a/.gitea/workflows/deploy-alerts.yaml +++ b/.gitea/workflows/deploy-alerts.yaml @@ -21,7 +21,16 @@ jobs: runs-on: awoooi-non110-ubuntu timeout-minutes: 5 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Validate alerts YAML # 2026-04-08 Claude Sonnet 4.6: pip install pyyaml 確保 runner 有此依賴 diff --git a/.gitea/workflows/e2e-health.yaml b/.gitea/workflows/e2e-health.yaml index 92f0263a8..abb8d101a 100644 --- a/.gitea/workflows/e2e-health.yaml +++ b/.gitea/workflows/e2e-health.yaml @@ -25,7 +25,16 @@ jobs: e2e-health: runs-on: awoooi-non110-ubuntu steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Check API Health id: health_check diff --git a/.gitea/workflows/harbor-110-local-repair.yaml b/.gitea/workflows/harbor-110-local-repair.yaml index 8afcd56fa..785469043 100644 --- a/.gitea/workflows/harbor-110-local-repair.yaml +++ b/.gitea/workflows/harbor-110-local-repair.yaml @@ -38,7 +38,16 @@ jobs: runs-on: awoooi-non110-host timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Validate repair workflow boundaries run: | diff --git a/.gitea/workflows/run-migration.yml b/.gitea/workflows/run-migration.yml index 3f00ce789..872bffc53 100644 --- a/.gitea/workflows/run-migration.yml +++ b/.gitea/workflows/run-migration.yml @@ -25,10 +25,16 @@ jobs: runs-on: awoooi-non110-ubuntu steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 2 # 需比對上一個 commit + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=2 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Install migration tools run: | diff --git a/.gitea/workflows/type-sync-check.yaml b/.gitea/workflows/type-sync-check.yaml index cdcd274c3..e80bae741 100644 --- a/.gitea/workflows/type-sync-check.yaml +++ b/.gitea/workflows/type-sync-check.yaml @@ -18,7 +18,16 @@ jobs: check-type-sync: runs-on: awoooi-non110-ubuntu steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Setup Python # 2026-04-05 Claude Code: 改用 apt 安裝，避免 setup-python toolcache glibc 版本不符 @@ -26,15 +35,19 @@ jobs: python3 --version pip3 install -q uv 2>/dev/null || (apt-get update -q && apt-get install -y -q python3-pip && pip3 install -q uv) - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - - - name: Setup pnpm - uses: pnpm/action-setup@v3 - with: - version: 9 + - name: Verify internal Node.js and pnpm toolchain + run: | + set -euo pipefail + NODE_MAJOR=$(node --version | sed 's/^v//' | cut -d. -f1) + test "$NODE_MAJOR" -ge 20 || { + echo "internal runner requires Node.js 20 or newer" + exit 1 + } + if ! command -v pnpm >/dev/null 2>&1; then + corepack enable 2>/dev/null || npm install -g pnpm@9 -q + fi + node --version + pnpm --version - name: Install Python Dependencies run: | diff --git a/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py b/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py index f08df995f..bcdda7e20 100644 --- a/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py +++ b/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py @@ -17,7 +17,7 @@ _SCHEMA_VERSION = "awoooi_gitea_onboarding_warning_step_template_copy_receipt_v1 _RECEIPT_SCHEMA_VERSION = ( "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1" ) -_EXPECTED_WORKFLOW_SHA256_12 = "980ff5452f59" +_EXPECTED_WORKFLOW_SHA256_12 = "6a6710f37fd1" _TEMPLATE_RELATIVE_PATH = ( "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml" ) diff --git a/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py b/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py index 2cc739945..cb8f2f06b 100644 --- a/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py +++ b/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py @@ -377,7 +377,7 @@ def _assert_template_copy_receipt(payload: dict): assert payload["status"] == "controlled_template_copy_receipt_ready" assert payload["active_blockers"] == [] assert payload["readback"]["template_copy_performed"] is True - assert payload["readback"]["workflow_content_sha256_12"] == "980ff5452f59" + assert payload["readback"]["workflow_content_sha256_12"] == "6a6710f37fd1" assert payload["target_selector"]["active_workflow_file_created"] is True assert payload["rollups"]["template_file_present"] is True assert payload["rollups"]["receipt_snapshot_present"] is True @@ -385,7 +385,7 @@ def _assert_template_copy_receipt(payload: dict): assert payload["rollups"]["workflow_matches_template"] is True assert payload["rollups"]["auto_branch_event_count"] == 0 assert payload["rollups"]["generic_runner_label_count"] == 0 - assert payload["rollups"]["expected_workflow_sha256_12"] == "980ff5452f59" + assert payload["rollups"]["expected_workflow_sha256_12"] == "6a6710f37fd1" assert payload["rollups"]["fail_closed_execution_switch_present"] is False assert payload["rollups"]["runtime_execution_switch_controlled"] is True assert payload["rollups"]["runtime_execution_switch_value"] == "1" diff --git a/apps/api/tests/test_signal_worker_ansible_executor_binding.py b/apps/api/tests/test_signal_worker_ansible_executor_binding.py index 6f05e2fdb..415a53f07 100644 --- a/apps/api/tests/test_signal_worker_ansible_executor_binding.py +++ b/apps/api/tests/test_signal_worker_ansible_executor_binding.py @@ -107,9 +107,9 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None: ) workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text() - assert deployment["metadata"]["annotations"][ - "argocd.argoproj.io/sync-options" - ] == "Replace=true" + assert "argocd.argoproj.io/sync-options" not in deployment["metadata"].get( + "annotations", {} + ) assert "AIA-P0-011 API/executor production boundary verified" in workflow assert "patch deployments.apps --all-namespaces" in workflow assert "delete pods --all-namespaces" in workflow @@ -117,6 +117,23 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None: assert "github.com/kubernetes-sigs/kustomize" not in workflow +def test_gitea_workflows_never_download_github_actions() -> None: + repo_root = Path(__file__).resolve().parents[3] + workflow_root = repo_root / ".gitea/workflows" + + for path in sorted(workflow_root.glob("*.y*ml")): + source = path.read_text() + assert "uses: actions/" not in source, path + for forbidden_domain in ( + "github.com/", + "api.github.com/", + "raw.githubusercontent.com/", + "codeload.github.com/", + "ghcr.io/", + ): + assert forbidden_domain not in source, path + + def test_api_log_does_not_claim_skipped_executor_was_scheduled() -> None: repo_root = Path(__file__).resolve().parents[3] main_source = (repo_root / "apps/api/src/main.py").read_text() diff --git a/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json b/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json index 874e5ed62..cf47ca104 100644 --- a/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json +++ b/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json @@ -1,11 +1,11 @@ { "schema_version": "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1", - "generated_at": "2026-06-30T01:35:00+08:00", + "generated_at": "2026-07-11T00:32:00+08:00", "workplan_id": "P0-004-TEMPLATE-COPY-CONTROLLED-APPLY", "source_template_path": "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml", "destination_workflow_path": ".gitea/workflows/awoooi-onboarding-warning-step.yaml", - "source_template_content_sha256_12": "980ff5452f59", - "destination_workflow_content_sha256_12": "980ff5452f59", + "source_template_content_sha256_12": "6a6710f37fd1", + "destination_workflow_content_sha256_12": "6a6710f37fd1", "template_copy_recorded": true, "destination_workflow_runtime_visible_required": false, "runtime_image_excludes_dot_gitea": true, diff --git a/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml b/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml index 3b805808b..48d5d7b5a 100644 --- a/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml +++ b/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml @@ -30,7 +30,16 @@ jobs: runs-on: awoooi-non110-host timeout-minutes: 3 steps: - - uses: actions/checkout@v4 + - name: Checkout source from Gitea + env: + GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git + run: | + set -euo pipefail + git init . + git remote remove origin 2>/dev/null || true + git remote add origin "$GITEA_SOURCE_URL" + git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA" + git checkout --force --detach FETCH_HEAD - name: Validate warning-step boundaries run: | diff --git a/k8s/awoooi-prod/06-deployment-api.yaml b/k8s/awoooi-prod/06-deployment-api.yaml index e4db9aa80..8160d47b3 100644 --- a/k8s/awoooi-prod/06-deployment-api.yaml +++ b/k8s/awoooi-prod/06-deployment-api.yaml @@ -9,10 +9,6 @@ kind: Deployment metadata: name: awoooi-api namespace: awoooi-prod - annotations: - # One controlled replace prunes legacy SSH mounts that were not owned by - # Argo CD's server-side apply field manager. Remove after prod verification. - argocd.argoproj.io/sync-options: Replace=true labels: app: awoooi-api system: awoooi