From 60198a6aca83e0d5ead5d44bcd7af985449cfe8f Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Tue, 20 Oct 2026 02:39:47 +0800 Subject: [PATCH] fix: fetch Hestia sources without custom SSH secrets --- .gitea/README.md | 26 +++++++++-------- .gitea/workflows/README.md | 2 +- .gitea/workflows/ci.yml | 53 +++++++++++++++++------------------ .gitea/workflows/deploy.yml | 53 +++++++++++++++++------------------ README.md | 2 +- docs/operations/validation.md | 2 +- vendor/README.md | 2 +- vendor/aster | 2 +- 8 files changed, 72 insertions(+), 70 deletions(-) diff --git a/.gitea/README.md b/.gitea/README.md index a68a774..8ac0424 100644 --- a/.gitea/README.md +++ b/.gitea/README.md @@ -2,20 +2,24 @@ [workflows](workflows/README.md) contains repository workflows. -## CI checkout prerequisites +## CI source checkout All workflows use `runs-on: ces-control`; no shared Runner configuration is changed. -Configure repository or organization secrets `CODEX_BOT_SSH_KEY` (the dedicated -codex-bot private SSH key) and `GITEA_SSH_KNOWN_HOSTS` (the independently verified -known_hosts entry for `[gitea.entroia.com]:22222`). The bot needs read access to the -repository and its Aster submodule. Workflows use an isolated SSH command with -`-F /dev/null`, `IdentitiesOnly=yes`, an explicit key and port, strict host-key -checking, and temporary credential files removed after checkout. Keys are never -written into tracked files. Missing secrets fail checkout explicitly. +`actions/checkout@v4` reads source over HTTPS using Gitea's automatically supplied +`GITEA_TOKEN`. No additional SSH key or known_hosts secrets are required, and +`persist-credentials: false` prevents credentials from being retained for later +build steps. -The SSH submodule URL's repository owner is separate from the authenticated bot. -Local Git operations must use the same dedicated bot identity; configure the -checkout's isolated command in `GIT_SSH_COMMAND` for submodule initialization. +Consumer workflows read the exact Aster commit from the checked-out project's +`vendor/aster` gitlink, then use another standard checkout into that directory and +verify the resulting HEAD. They do not follow Aster main automatically. Aster is +currently a public repository, so reading it does not require private cross-repo +authorization. If that visibility changes, diagnose the job token's read access +instead of assuming an SSH key must be distributed. + +The SSH URL in `.gitmodules` is retained for developer Git operations, which +continue to use the dedicated codex-bot identity. CI's built-in job token is +separate from local developer credentials. Workflow definitions do not prove CI passed. CI/deployment state is not queried automatically. Local runtime checks are not performed for Aster, Lyra or Hestia; diff --git a/.gitea/workflows/README.md b/.gitea/workflows/README.md index 15df70f..d22d007 100644 --- a/.gitea/workflows/README.md +++ b/.gitea/workflows/README.md @@ -1,5 +1,5 @@ # Hestia Server workflows -[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. Checkout and secret requirements are in [the parent README](../README.md). +[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md). [deploy.yml](deploy.yml) is main-only and manual-only. It repeats verification, builds the runtime image, then runs the existing deployment script. Production resource names, paths, lock and database mounts remain unchanged. diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index f2d5133..5f151d3 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -13,35 +13,34 @@ jobs: env: DOCKER_BUILDKIT: "0" steps: - - name: Checkout with codex-bot - env: - CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }} - GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }} - SOURCE_SHA: ${{ gitea.sha }} - SOURCE_REPOSITORY: ${{ gitea.repository }} + - name: Checkout project + id: checkout_project + uses: actions/checkout@v4 + with: + github-server-url: ${{ gitea.server_url }} + persist-credentials: false + - name: Read pinned Aster revision + id: aster_revision run: | set -eu - test -n "$CODEX_BOT_SSH_KEY" - test -n "$GITEA_SSH_KNOWN_HOSTS" - case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac - test "${#SOURCE_SHA}" -eq 40 - umask 077 - checkout_keys=$(mktemp -d) - trap 'rm -rf "$checkout_keys"' EXIT - printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key" - printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts" - unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS - export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts" - git init . - source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git" - if git remote get-url origin >/dev/null 2>&1; then - git remote set-url origin "$source_url" - else - git remote add origin "$source_url" - fi - git fetch --no-tags --depth=1 origin "$SOURCE_SHA" - git checkout --detach --force FETCH_HEAD - git submodule update --init --recursive + aster_sha=$(git ls-tree HEAD -- vendor/aster | awk '$1 == "160000" && $2 == "commit" && $4 == "vendor/aster" { print $3 }') + case "$aster_sha" in *[!0-9a-f]*|'') echo "Invalid Aster gitlink" >&2; exit 1;; esac + test "${#aster_sha}" -eq 40 + printf 'sha=%s\n' "$aster_sha" >> "$GITHUB_OUTPUT" + - name: Checkout pinned Aster + id: checkout_aster + uses: actions/checkout@v4 + with: + github-server-url: ${{ gitea.server_url }} + repository: Zayden-Jung/endorphin-aster-vm + ref: ${{ steps.aster_revision.outputs.sha }} + path: vendor/aster + persist-credentials: false + - name: Verify Aster revision + env: + EXPECTED_ASTER_SHA: ${{ steps.aster_revision.outputs.sha }} + run: test "$(git -C vendor/aster rev-parse HEAD)" = "$EXPECTED_ASTER_SHA" + - name: Verify SQLite, PostgreSQL and HTTP host env: ASTER_RELEASE_SHA: ${{ gitea.sha }} diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index e4d4eae..b11c069 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -16,35 +16,34 @@ jobs: DOCKER_BUILDKIT: "0" ASTER_RELEASE_SHA: ${{ gitea.sha }} steps: - - name: Checkout with codex-bot - env: - CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }} - GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }} - SOURCE_SHA: ${{ gitea.sha }} - SOURCE_REPOSITORY: ${{ gitea.repository }} + - name: Checkout project + id: checkout_project + uses: actions/checkout@v4 + with: + github-server-url: ${{ gitea.server_url }} + persist-credentials: false + - name: Read pinned Aster revision + id: aster_revision run: | set -eu - test -n "$CODEX_BOT_SSH_KEY" - test -n "$GITEA_SSH_KNOWN_HOSTS" - case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac - test "${#SOURCE_SHA}" -eq 40 - umask 077 - checkout_keys=$(mktemp -d) - trap 'rm -rf "$checkout_keys"' EXIT - printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key" - printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts" - unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS - export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts" - git init . - source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git" - if git remote get-url origin >/dev/null 2>&1; then - git remote set-url origin "$source_url" - else - git remote add origin "$source_url" - fi - git fetch --no-tags --depth=1 origin "$SOURCE_SHA" - git checkout --detach --force FETCH_HEAD - git submodule update --init --recursive + aster_sha=$(git ls-tree HEAD -- vendor/aster | awk '$1 == "160000" && $2 == "commit" && $4 == "vendor/aster" { print $3 }') + case "$aster_sha" in *[!0-9a-f]*|'') echo "Invalid Aster gitlink" >&2; exit 1;; esac + test "${#aster_sha}" -eq 40 + printf 'sha=%s\n' "$aster_sha" >> "$GITHUB_OUTPUT" + - name: Checkout pinned Aster + id: checkout_aster + uses: actions/checkout@v4 + with: + github-server-url: ${{ gitea.server_url }} + repository: Zayden-Jung/endorphin-aster-vm + ref: ${{ steps.aster_revision.outputs.sha }} + path: vendor/aster + persist-credentials: false + - name: Verify Aster revision + env: + EXPECTED_ASTER_SHA: ${{ steps.aster_revision.outputs.sha }} + run: test "$(git -C vendor/aster rev-parse HEAD)" = "$EXPECTED_ASTER_SHA" + - name: Verify SQLite, PostgreSQL and HTTP host env: ASTER_RELEASE_SHA: ${{ gitea.sha }} diff --git a/README.md b/README.md index ac9f610..9340c47 100644 --- a/README.md +++ b/README.md @@ -19,4 +19,4 @@ Server 默认监听 127.0.0.1:8080，可由 ASTER_LISTEN 调整；宿主 JSON Host 和 Server 不连接数据库。Storage 仅在显式 DatabaseConfig 下连接，不创建应用表；真实 PostgreSQL 与 SQLite 测试均由 Hestia CI 承担。生产既有数据库、卷和目录完整保留。 -main 推送和 PR 只验证；生产部署须显式手动触发 deploy.yml，且再次验证成功后才构建并发布。保留旧 ASTER_* 变量、Compose 项目／服务、镜像名和生产路径，不把拆仓当成数据迁移。见 [部署](docs/operations/deployment.md)。本地不构建／测试或运行 Docker，不主动查询 CI／部署。CI 所需 bot SSH secrets 见 [.gitea](.gitea/README.md)。 +main 推送和 PR 只验证；生产部署须显式手动触发 deploy.yml，且再次验证成功后才构建并发布。保留旧 ASTER_* 变量、Compose 项目／服务、镜像名和生产路径，不把拆仓当成数据迁移。见 [部署](docs/operations/deployment.md)。本地不构建／测试或运行 Docker，不主动查询 CI／部署。CI 使用内置任务凭据检出源码，说明见 [.gitea](.gitea/README.md)。 diff --git a/docs/operations/validation.md b/docs/operations/validation.md index d24be8a..d7f6c7d 100644 --- a/docs/operations/validation.md +++ b/docs/operations/validation.md @@ -6,4 +6,4 @@ ci.yml 在 main push、PR 和手动触发时运行 scripts/ci-ces-control.sh。 smoke.py 验证管理 cli 的对象释放、JSON 跨进程读写／缺失导入、Server 的健康／只读对象信息和 SIGTERM 退出，并检查失效数据库变量不导致隐式连接或创建 SQLite。Endor 五段样例的真实 run／eval 报告属于 Lyra CI，不由 Hestia 执行。 -生产部署位于单独手动工作流，必须重复通过以上验证。SSH 凭据要求见 ../../.gitea/README.md。工作流定义不代表实际通过，未查询结果如实注明。返回 [运维](README.md)。 +生产部署位于单独手动工作流，必须重复通过以上验证。HTTPS checkout 与内置任务凭据说明见 [.gitea](../../.gitea/README.md)。工作流定义不代表实际通过，未查询结果如实注明。返回 [运维](README.md)。 diff --git a/vendor/README.md b/vendor/README.md index 27a5052..fe531b4 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -8,4 +8,4 @@ git submodule update --init --recursive 根 Cargo.toml 通过子模块路径链接库；子模块保留自己的 Cargo workspace。父仓库 Cargo.lock 负责宿主依赖图。构建宿主会自动编译所需引擎库，无需启动 Aster 服务。更新时先取得明确的已发布 Aster commit，再 checkout --detach 并提交父仓库 gitlink；不要提交指向未发布引擎提交的宿主版本。 -CI 获取私有子模块的 bot SSH secrets 要求见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。 +CI 通过 HTTPS 获取固定 Aster 提交，使用内置任务凭据；说明见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。 diff --git a/vendor/aster b/vendor/aster index 55475a9..6281e58 160000 --- a/vendor/aster +++ b/vendor/aster @@ -1 +1 @@ -Subproject commit 55475a9d4b3948a569bf76c84041ad9cea0ec6ea +Subproject commit 6281e5864783ed23d8959425e7c8b519b61b2105