From a87cdaf435eb888ef5197f939d144c65ae7895d0 Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Tue, 20 Oct 2026 02:39:47 +0800 Subject: [PATCH] fix: use standard checkout and verify the pinned engine in Lyra CI --- .gitea/README.md | 26 +++++++++-------- .gitea/workflows/README.md | 2 +- .gitea/workflows/ci.yml | 57 +++++++++++++++++++------------------- README.md | 2 +- scripts/README.md | 2 +- scripts/check.sh | 4 +++ vendor/README.md | 2 +- vendor/aster | 2 +- 8 files changed, 52 insertions(+), 45 deletions(-) diff --git a/.gitea/README.md b/.gitea/README.md index 91118b6..cbd1775 100644 --- a/.gitea/README.md +++ b/.gitea/README.md @@ -2,20 +2,24 @@ [workflows](workflows/README.md) contains repository workflows. -## CI checkout prerequisites +## CI source checkout All workflows use `runs-on: ces-control`; no shared Runner configuration is changed. -Configure repository or organization secrets `CODEX_BOT_SSH_KEY` (the dedicated -codex-bot private SSH key) and `GITEA_SSH_KNOWN_HOSTS` (the independently verified -known_hosts entry for `[gitea.entroia.com]:22222`). The bot needs read access to the -repository and its Aster submodule. Workflows use an isolated SSH command with -`-F /dev/null`, `IdentitiesOnly=yes`, an explicit key and port, strict host-key -checking, and temporary credential files removed after checkout. Keys are never -written into tracked files. Missing secrets fail checkout explicitly. +`actions/checkout@v4` reads source over HTTPS using Gitea's automatically supplied +`GITEA_TOKEN`. No additional SSH key or known_hosts secrets are required, and +`persist-credentials: false` prevents credentials from being retained for later +build steps. -The SSH submodule URL's repository owner is separate from the authenticated bot. -Local Git operations must use the same dedicated bot identity; configure the -checkout's isolated command in `GIT_SSH_COMMAND` for submodule initialization. +Consumer workflows read the exact Aster commit from the checked-out project's +`vendor/aster` gitlink, then use another standard checkout into that directory and +verify the resulting HEAD. They do not follow Aster main automatically. Aster is +currently a public repository, so reading it does not require private cross-repo +authorization. If that visibility changes, diagnose the job token's read access +instead of assuming an SSH key must be distributed. + +The SSH URL in `.gitmodules` is retained for developer Git operations, which +continue to use the dedicated codex-bot identity. CI's built-in job token is +separate from local developer credentials. Workflow definitions do not prove CI passed. CI/deployment state is not queried automatically. Local runtime checks are not performed for Aster, Lyra or Hestia; diff --git a/.gitea/workflows/README.md b/.gitea/workflows/README.md index e4f9da0..c1e0556 100644 --- a/.gitea/workflows/README.md +++ b/.gitea/workflows/README.md @@ -1,5 +1,5 @@ # Lyra CLI workflows -[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. Checkout and secret requirements are in [the parent README](../README.md). +[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md). There is no production service deployment in this workflow. diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 115ef23..343b155 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -13,44 +13,43 @@ jobs: env: DOCKER_BUILDKIT: "0" steps: - - name: Checkout with codex-bot - env: - CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }} - GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }} - SOURCE_SHA: ${{ gitea.sha }} - SOURCE_REPOSITORY: ${{ gitea.repository }} + - name: Checkout project + id: checkout_project + uses: actions/checkout@v4 + with: + github-server-url: ${{ gitea.server_url }} + persist-credentials: false + - name: Read pinned Aster revision + id: aster_revision run: | set -eu - test -n "$CODEX_BOT_SSH_KEY" - test -n "$GITEA_SSH_KNOWN_HOSTS" - case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac - test "${#SOURCE_SHA}" -eq 40 - umask 077 - checkout_keys=$(mktemp -d) - trap 'rm -rf "$checkout_keys"' EXIT - printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key" - printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts" - unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS - export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts" - git init . - source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git" - if git remote get-url origin >/dev/null 2>&1; then - git remote set-url origin "$source_url" - else - git remote add origin "$source_url" - fi - git fetch --no-tags --depth=1 origin "$SOURCE_SHA" - git checkout --detach --force FETCH_HEAD - git submodule update --init --recursive + aster_sha=$(git ls-tree HEAD -- vendor/aster | awk '$1 == "160000" && $2 == "commit" && $4 == "vendor/aster" { print $3 }') + case "$aster_sha" in *[!0-9a-f]*|'') echo "Invalid Aster gitlink" >&2; exit 1;; esac + test "${#aster_sha}" -eq 40 + printf 'sha=%s\n' "$aster_sha" >> "$GITHUB_OUTPUT" + - name: Checkout pinned Aster + id: checkout_aster + uses: actions/checkout@v4 + with: + github-server-url: ${{ gitea.server_url }} + repository: Zayden-Jung/endorphin-aster-vm + ref: ${{ steps.aster_revision.outputs.sha }} + path: vendor/aster + persist-credentials: false + - name: Verify Aster revision + env: + EXPECTED_ASTER_SHA: ${{ steps.aster_revision.outputs.sha }} + run: test "$(git -C vendor/aster rev-parse HEAD)" = "$EXPECTED_ASTER_SHA" + - name: Verify CLI and record Endor output env: LYRA_RELEASE_SHA: ${{ gitea.sha }} run: sh scripts/ci-ces-control.sh - name: Show Endor output - if: always() + if: ${{ always() && steps.checkout_aster.outcome == 'success' }} run: cat ci-output/endor-examples.md - name: Upload Endor output - if: always() + if: ${{ always() && steps.checkout_aster.outcome == 'success' }} uses: actions/upload-artifact@v3 with: name: endor-execution-output-${{ gitea.sha }} diff --git a/README.md b/README.md index b8cc63c..514c058 100644 --- a/README.md +++ b/README.md @@ -24,4 +24,4 @@ lyra bootstrap run 默认调用无参数 main，可用 --entry 指定入口；run／eval／parse 支持 - 读取 UTF-8 stdin。语言能力与所有权见固定 Aster 版本文档。Lyra 不提供宿主 metadata 管理，相关命令已归 Hestia 的兼容管理程序 cli。 -本地不构建、运行测试／冒烟或下载 Cargo 依赖。远端 CI 在 ces-control 检查格式、进程测试、Clippy，并执行固定 Aster 的五个样例；Markdown／JSON 报告保存真实 stdout／stderr、退出码、源码和预期值，失败也保留。成功后上传 Linux lyra 二进制。CI 凭据要求见 [.gitea](.gitea/README.md)，不自动查询运行状态。 +本地不构建、运行测试／冒烟或下载 Cargo 依赖。远端 CI 在 ces-control 显式运行固定 Aster 的引擎检查，再检查本项目格式、进程测试、Clippy，并执行固定 Aster 的五个样例；Markdown／JSON 报告保存真实 stdout／stderr、退出码、源码和预期值，失败也保留。成功后上传 Linux lyra 二进制。CI 内置任务凭据与源码检出说明见 [.gitea](.gitea/README.md)，不自动查询运行状态。 diff --git a/scripts/README.md b/scripts/README.md index 51647cf..85a81b8 100644 --- a/scripts/README.md +++ b/scripts/README.md @@ -2,7 +2,7 @@ | 文件 | 职责 | | --- | --- | -| check.sh | 远端格式、CLI 进程测试、Clippy 和报告脚本回归 | +| check.sh | 显式验证固定 Aster 引擎，再验证远端格式、CLI 进程测试、Clippy 和报告脚本回归 | | endor_examples.py | 构建真实 lyra，执行固定 Aster 的 cases.json，保存实际输出 | | test_endor_examples.py | 远端报告失败／超时／输出不匹配检查 | | ci-ces-control.sh | 专用检查容器，复制报告和 Linux 二进制，清理容器 | diff --git a/scripts/check.sh b/scripts/check.sh index 60f7ef0..571f6da 100644 --- a/scripts/check.sh +++ b/scripts/check.sh @@ -1,6 +1,10 @@ #!/bin/sh # Run only in the designated remote validation environment. set -eu +( + cd vendor/aster + sh scripts/check.sh +) cargo fmt --all --check cargo test --workspace --locked cargo clippy --workspace --all-targets --locked -- -D warnings diff --git a/vendor/README.md b/vendor/README.md index 27a5052..fe531b4 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -8,4 +8,4 @@ git submodule update --init --recursive 根 Cargo.toml 通过子模块路径链接库；子模块保留自己的 Cargo workspace。父仓库 Cargo.lock 负责宿主依赖图。构建宿主会自动编译所需引擎库，无需启动 Aster 服务。更新时先取得明确的已发布 Aster commit，再 checkout --detach 并提交父仓库 gitlink；不要提交指向未发布引擎提交的宿主版本。 -CI 获取私有子模块的 bot SSH secrets 要求见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。 +CI 通过 HTTPS 获取固定 Aster 提交，使用内置任务凭据；说明见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。 diff --git a/vendor/aster b/vendor/aster index 55475a9..6281e58 160000 --- a/vendor/aster +++ b/vendor/aster @@ -1 +1 @@ -Subproject commit 55475a9d4b3948a569bf76c84041ad9cea0ec6ea +Subproject commit 6281e5864783ed23d8959425e7c8b519b61b2105