wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(ci): make MCP audit writeback repeatable

Browse Source
This commit is contained in:
ogt
2026-07-15 11:27:36 +08:00
parent 5eb46f9421
commit dd32cbf9cd
8 changed files with 539 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
.gitea/workflows/mcp-external-artifact-mirror.yaml
View File

@@ -22,6 +22,8 @@ on:
- scripts/security/verify_external_mcp_artifact_receipt.py
- scripts/security/tests/test_external_mcp_artifact_controller.py
- scripts/security/tests/test_verify_external_mcp_artifact_receipt.py
- scripts/ci/write-gitea-audit-receipts.sh
- scripts/ci/tests/test_write_gitea_audit_receipts.py
- .gitea/workflows/mcp-external-artifact-mirror.yaml
concurrency:
@@ -68,9 +70,11 @@ jobs:
scripts/security/external_mcp_artifact_controller.py \
scripts/security/verify_external_mcp_artifact_receipt.py \
scripts/security/tests/test_external_mcp_artifact_controller.py \
scripts/security/tests/test_verify_external_mcp_artifact_receipt.py
scripts/security/tests/test_verify_external_mcp_artifact_receipt.py \
scripts/ci/tests/test_write_gitea_audit_receipts.py
python3 scripts/security/tests/test_external_mcp_artifact_controller.py
python3 scripts/security/tests/test_verify_external_mcp_artifact_receipt.py
python3 scripts/ci/tests/test_write_gitea_audit_receipts.py
python3 - <<'PY'
import json
from pathlib import Path
@@ -194,14 +198,11 @@ jobs:
set +x
test -s "${CONTROLLER_RECEIPT_PATH}"
test -s "${VERIFIER_RECEIPT_PATH}"
WRITEBACK_DIR="$(mktemp -d)"
cp "${CONTROLLER_RECEIPT_PATH}" "${WRITEBACK_DIR}/controller.json"
cp "${VERIFIER_RECEIPT_PATH}" "${WRITEBACK_DIR}/verifier.json"
git config user.email "mcp-artifact-controller@awoooi.internal"
git config user.name "AWOOOI MCP Artifact Controller"
git add "${CONTROLLER_RECEIPT_PATH}" "${VERIFIER_RECEIPT_PATH}"
git diff --cached --quiet && {
echo "receipt_writeback=no_change"
exit 0
}
git commit -m "chore(mcp): record verified Playwright artifact mirror [skip ci] [metadata-only]"
ASKPASS_PATH="$(mktemp)"
export ASKPASS_PATH
@@ -223,31 +224,16 @@ jobs:
PY
cleanup_push_auth() {
rm -f "${ASKPASS_PATH}"
rm -rf "${WRITEBACK_DIR}"
}
trap cleanup_push_auth EXIT
export GIT_ASKPASS="${ASKPASS_PATH}"
export GIT_TERMINAL_PROMPT=0
git remote remove gitea 2>/dev/null || true
git remote add gitea "${GITEA_SOURCE_URL}"
for attempt in 1 2 3; do
if git ls-remote --exit-code --heads gitea \
"refs/heads/${RECEIPT_BRANCH}" >/dev/null 2>&1; then
git fetch --no-tags --depth=100 gitea "${RECEIPT_BRANCH}"
if ! git merge --no-edit FETCH_HEAD; then
git merge --abort || true
echo "BLOCKER receipt_writeback_merge_conflict"
exit 1
fi
fi
if git push gitea "HEAD:refs/heads/${RECEIPT_BRANCH}"; then
echo "receipt_writeback=verified_audit_branch_normal_push"
echo "receipt_branch=${RECEIPT_BRANCH}"
echo "receipt_commit_sha=$(git rev-parse HEAD)"
exit 0
fi
echo "receipt_writeback_retry=${attempt}"
sleep 5
done
echo "BLOCKER receipt_writeback_non_fast_forward_after_bounded_retry"
exit 1
export GITEA_AUDIT_REMOTE_URL="${GITEA_SOURCE_URL}"
export GITEA_AUDIT_BRANCH="${RECEIPT_BRANCH}"
export GITEA_AUDIT_CONTROLLER_SOURCE="${WRITEBACK_DIR}/controller.json"
export GITEA_AUDIT_VERIFIER_SOURCE="${WRITEBACK_DIR}/verifier.json"
export GITEA_AUDIT_CONTROLLER_TARGET="${CONTROLLER_RECEIPT_PATH}"
export GITEA_AUDIT_VERIFIER_TARGET="${VERIFIER_RECEIPT_PATH}"
export GITEA_AUDIT_COMMIT_MESSAGE="chore(mcp): record verified Playwright artifact mirror [skip ci] [metadata-only]"
bash scripts/ci/write-gitea-audit-receipts.sh

50
.gitea/workflows/mcp-external-replay.yaml
View File

@@ -22,6 +22,8 @@ on:
- scripts/security/verify_external_mcp_replay_receipt.py
- scripts/security/tests/test_external_mcp_replay_controller.py
- scripts/security/tests/test_verify_external_mcp_replay_receipt.py
- scripts/ci/write-gitea-audit-receipts.sh
- scripts/ci/tests/test_write_gitea_audit_receipts.py
- .gitea/workflows/mcp-external-replay.yaml
concurrency:
@@ -76,9 +78,11 @@ jobs:
scripts/security/external_mcp_replay_controller.py \
scripts/security/verify_external_mcp_replay_receipt.py \
scripts/security/tests/test_external_mcp_replay_controller.py \
scripts/security/tests/test_verify_external_mcp_replay_receipt.py
scripts/security/tests/test_verify_external_mcp_replay_receipt.py \
scripts/ci/tests/test_write_gitea_audit_receipts.py
python3 scripts/security/tests/test_external_mcp_replay_controller.py
python3 scripts/security/tests/test_verify_external_mcp_replay_receipt.py
python3 scripts/ci/tests/test_write_gitea_audit_receipts.py
python3 - <<'PY'
import json
from pathlib import Path
@@ -267,16 +271,11 @@ jobs:
set +x
test -s "${REPLAY_CONTROLLER_RECEIPT_PATH}"
test -s "${REPLAY_VERIFIER_RECEIPT_PATH}"
WRITEBACK_DIR="$(mktemp -d)"
cp "${REPLAY_CONTROLLER_RECEIPT_PATH}" "${WRITEBACK_DIR}/controller.json"
cp "${REPLAY_VERIFIER_RECEIPT_PATH}" "${WRITEBACK_DIR}/verifier.json"
git config user.email "mcp-replay-controller@awoooi.internal"
git config user.name "AWOOOI MCP Replay Controller"
git add \
"${REPLAY_CONTROLLER_RECEIPT_PATH}" \
"${REPLAY_VERIFIER_RECEIPT_PATH}"
git diff --cached --quiet && {
echo "receipt_writeback=no_change"
exit 0
}
git commit -m "chore(mcp): record verified Playwright protocol replay [skip ci] [metadata-only]"
ASKPASS_PATH="$(mktemp)"
export ASKPASS_PATH
@@ -298,31 +297,16 @@ jobs:
PY
cleanup_push_auth() {
rm -f "${ASKPASS_PATH}"
rm -rf "${WRITEBACK_DIR}"
}
trap cleanup_push_auth EXIT
export GIT_ASKPASS="${ASKPASS_PATH}"
export GIT_TERMINAL_PROMPT=0
git remote remove gitea 2>/dev/null || true
git remote add gitea "${GITEA_SOURCE_URL}"
for attempt in 1 2 3; do
if git ls-remote --exit-code --heads gitea \
"refs/heads/${REPLAY_RECEIPT_BRANCH}" >/dev/null 2>&1; then
git fetch --no-tags --depth=100 gitea "${REPLAY_RECEIPT_BRANCH}"
if ! git merge --no-edit FETCH_HEAD; then
git merge --abort || true
echo "BLOCKER receipt_writeback_merge_conflict"
exit 1
fi
fi
if git push gitea "HEAD:refs/heads/${REPLAY_RECEIPT_BRANCH}"; then
echo "receipt_writeback=verified_audit_branch_normal_push"
echo "receipt_branch=${REPLAY_RECEIPT_BRANCH}"
echo "receipt_commit_sha=$(git rev-parse HEAD)"
exit 0
fi
echo "receipt_writeback_retry=${attempt}"
sleep 5
done
echo "BLOCKER receipt_writeback_non_fast_forward_after_bounded_retry"
exit 1
export GITEA_AUDIT_REMOTE_URL="${GITEA_SOURCE_URL}"
export GITEA_AUDIT_BRANCH="${REPLAY_RECEIPT_BRANCH}"
export GITEA_AUDIT_CONTROLLER_SOURCE="${WRITEBACK_DIR}/controller.json"
export GITEA_AUDIT_VERIFIER_SOURCE="${WRITEBACK_DIR}/verifier.json"
export GITEA_AUDIT_CONTROLLER_TARGET="${REPLAY_CONTROLLER_RECEIPT_PATH}"
export GITEA_AUDIT_VERIFIER_TARGET="${REPLAY_VERIFIER_RECEIPT_PATH}"
export GITEA_AUDIT_COMMIT_MESSAGE="chore(mcp): record verified Playwright protocol replay [skip ci] [metadata-only]"
bash scripts/ci/write-gitea-audit-receipts.sh