fix: use standard checkout and verify the pinned engine in Lyra CI

.gitea/README.md

@@ -2,20 +2,24 @@
 
 [workflows](workflows/README.md) contains repository workflows.
 
-## CI checkout prerequisites
+## CI source checkout
 
 All workflows use `runs-on: ces-control`; no shared Runner configuration is changed.
-Configure repository or organization secrets `CODEX_BOT_SSH_KEY` (the dedicated
-codex-bot private SSH key) and `GITEA_SSH_KNOWN_HOSTS` (the independently verified
-known_hosts entry for `[gitea.entroia.com]:22222`). The bot needs read access to the
-repository and its Aster submodule. Workflows use an isolated SSH command with
-`-F /dev/null`, `IdentitiesOnly=yes`, an explicit key and port, strict host-key
-checking, and temporary credential files removed after checkout. Keys are never
-written into tracked files. Missing secrets fail checkout explicitly.
+`actions/checkout@v4` reads source over HTTPS using Gitea's automatically supplied
+`GITEA_TOKEN`. No additional SSH key or known_hosts secrets are required, and
+`persist-credentials: false` prevents credentials from being retained for later
+build steps.
 
-The SSH submodule URL's repository owner is separate from the authenticated bot.
-Local Git operations must use the same dedicated bot identity; configure the
-checkout's isolated command in `GIT_SSH_COMMAND` for submodule initialization.
+Consumer workflows read the exact Aster commit from the checked-out project's
+`vendor/aster` gitlink, then use another standard checkout into that directory and
+verify the resulting HEAD. They do not follow Aster main automatically. Aster is
+currently a public repository, so reading it does not require private cross-repo
+authorization. If that visibility changes, diagnose the job token's read access
+instead of assuming an SSH key must be distributed.
+
+The SSH URL in `.gitmodules` is retained for developer Git operations, which
+continue to use the dedicated codex-bot identity. CI's built-in job token is
+separate from local developer credentials.
 
 Workflow definitions do not prove CI passed. CI/deployment state is not queried
 automatically. Local runtime checks are not performed for Aster, Lyra or Hestia;

.gitea/workflows/README.md

@@ -1,5 +1,5 @@
 # Lyra CLI workflows
 
-[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. Checkout and secret requirements are in [the parent README](../README.md).
+[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
 
 There is no production service deployment in this workflow.

.gitea/workflows/ci.yml

@@ -13,44 +13,43 @@ jobs:
     env:
       DOCKER_BUILDKIT: "0"
     steps:
-      - name: Checkout with codex-bot
-        env:
-          CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }}
-          GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }}
-          SOURCE_SHA: ${{ gitea.sha }}
-          SOURCE_REPOSITORY: ${{ gitea.repository }}
+      - name: Checkout project
+        id: checkout_project
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          persist-credentials: false
+      - name: Read pinned Aster revision
+        id: aster_revision
         run: |
           set -eu
-          test -n "$CODEX_BOT_SSH_KEY"
-          test -n "$GITEA_SSH_KNOWN_HOSTS"
-          case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac
-          test "${#SOURCE_SHA}" -eq 40
-          umask 077
-          checkout_keys=$(mktemp -d)
-          trap 'rm -rf "$checkout_keys"' EXIT
-          printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key"
-          printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts"
-          unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS
-          export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts"
-          git init .
-          source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git"
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "$source_url"
-          else
-            git remote add origin "$source_url"
-          fi
-          git fetch --no-tags --depth=1 origin "$SOURCE_SHA"
-          git checkout --detach --force FETCH_HEAD
-          git submodule update --init --recursive
+          aster_sha=$(git ls-tree HEAD -- vendor/aster | awk '$1 == "160000" && $2 == "commit" && $4 == "vendor/aster" { print $3 }')
+          case "$aster_sha" in *[!0-9a-f]*|'') echo "Invalid Aster gitlink" >&2; exit 1;; esac
+          test "${#aster_sha}" -eq 40
+          printf 'sha=%s\n' "$aster_sha" >> "$GITHUB_OUTPUT"
+      - name: Checkout pinned Aster
+        id: checkout_aster
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          repository: Zayden-Jung/endorphin-aster-vm
+          ref: ${{ steps.aster_revision.outputs.sha }}
+          path: vendor/aster
+          persist-credentials: false
+      - name: Verify Aster revision
+        env:
+          EXPECTED_ASTER_SHA: ${{ steps.aster_revision.outputs.sha }}
+        run: test "$(git -C vendor/aster rev-parse HEAD)" = "$EXPECTED_ASTER_SHA"
+
       - name: Verify CLI and record Endor output
         env:
           LYRA_RELEASE_SHA: ${{ gitea.sha }}
         run: sh scripts/ci-ces-control.sh
       - name: Show Endor output
-        if: always()
+        if: ${{ always() && steps.checkout_aster.outcome == 'success' }}
         run: cat ci-output/endor-examples.md
       - name: Upload Endor output
-        if: always()
+        if: ${{ always() && steps.checkout_aster.outcome == 'success' }}
         uses: actions/upload-artifact@v3
         with:
           name: endor-execution-output-${{ gitea.sha }}

README.md

@@ -24,4 +24,4 @@ lyra bootstrap
 
 run 默认调用无参数 main，可用 --entry 指定入口；run／eval／parse 支持 - 读取 UTF-8 stdin。语言能力与所有权见固定 Aster 版本文档。Lyra 不提供宿主 metadata 管理，相关命令已归 Hestia 的兼容管理程序 cli。
 
-本地不构建、运行测试／冒烟或下载 Cargo 依赖。远端 CI 在 ces-control 检查格式、进程测试、Clippy，并执行固定 Aster 的五个样例；Markdown／JSON 报告保存真实 stdout／stderr、退出码、源码和预期值，失败也保留。成功后上传 Linux lyra 二进制。CI 凭据要求见 [.gitea](.gitea/README.md)，不自动查询运行状态。
+本地不构建、运行测试／冒烟或下载 Cargo 依赖。远端 CI 在 ces-control 显式运行固定 Aster 的引擎检查，再检查本项目格式、进程测试、Clippy，并执行固定 Aster 的五个样例；Markdown／JSON 报告保存真实 stdout／stderr、退出码、源码和预期值，失败也保留。成功后上传 Linux lyra 二进制。CI 内置任务凭据与源码检出说明见 [.gitea](.gitea/README.md)，不自动查询运行状态。

scripts/README.md

@@ -2,7 +2,7 @@
 
 | 文件 | 职责 |
 | --- | --- |
-| check.sh | 远端格式、CLI 进程测试、Clippy 和报告脚本回归 |
+| check.sh | 显式验证固定 Aster 引擎，再验证远端格式、CLI 进程测试、Clippy 和报告脚本回归 |
 | endor_examples.py | 构建真实 lyra，执行固定 Aster 的 cases.json，保存实际输出 |
 | test_endor_examples.py | 远端报告失败／超时／输出不匹配检查 |
 | ci-ces-control.sh | 专用检查容器，复制报告和 Linux 二进制，清理容器 |

scripts/check.sh

@@ -1,6 +1,10 @@
 #!/bin/sh
 # Run only in the designated remote validation environment.
 set -eu
+(
+    cd vendor/aster
+    sh scripts/check.sh
+)
 cargo fmt --all --check
 cargo test --workspace --locked
 cargo clippy --workspace --all-targets --locked -- -D warnings

vendor/README.md

@@ -8,4 +8,4 @@ git submodule update --init --recursive
 
 根 Cargo.toml 通过子模块路径链接库；子模块保留自己的 Cargo workspace。父仓库 Cargo.lock 负责宿主依赖图。构建宿主会自动编译所需引擎库，无需启动 Aster 服务。更新时先取得明确的已发布 Aster commit，再 checkout --detach 并提交父仓库 gitlink；不要提交指向未发布引擎提交的宿主版本。
 
-CI 获取私有子模块的 bot SSH secrets 要求见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。
+CI 通过 HTTPS 获取固定 Aster 提交，使用内置任务凭据；说明见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。