glenn schrooyenandClaude Opus 5.5
550bd6fa52
A missing or comment-only .gitea/infra-pin now ends on the workflow's own FAIL line instead of git's `fatal: path ... does not exist` (still red). Every x-access-token remote URL becomes an env-set Authorization header, so no token lands in .git/config or argv; the pin workflows' temp dir is removed by an EXIT trap, also on failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
47 lines
2.6 KiB
YAML
47 lines
2.6 KiB
YAML
# CI-12: goes red when admin/goodwe release/1.0 has moved past .gitea/infra-pin.
|
|
# It runs on add-on activity only; admin/goodwe's own `addon-pin` workflow
|
|
# covers a move of release/1.0 there. Deliberately NOT a required check: it
|
|
# reports; `checks / unit` stays the only gate. How to bump: README.md,
|
|
# "CI and the infra pin".
|
|
name: infra-pin
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [release/1.0]
|
|
|
|
jobs:
|
|
fresh:
|
|
runs-on: [self-hosted, goodwe-rig]
|
|
timeout-minutes: 30 # seconds of work; the rest is queueing for the shared slot
|
|
steps:
|
|
- name: compare .gitea/infra-pin with admin/goodwe release/1.0
|
|
env:
|
|
SELF: ${{ github.server_url }}/${{ github.repository }}.git
|
|
INFRA: ${{ github.server_url }}/admin/goodwe.git
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
INFRA_TOKEN: ${{ secrets.INFRA_READ_TOKEN }} # admin/goodwe is private
|
|
run: |
|
|
set -eu
|
|
D=$(mktemp -d) && trap 'cd / && rm -rf "$D"' EXIT && cd "$D"
|
|
git init -q .
|
|
# The pin of the commit this event is about (the PR head, or the push).
|
|
# Token as an env-set header: not in argv or .git/config (TOOL-9).
|
|
GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $TOKEN" \
|
|
git fetch -q --depth 1 "$SELF" "$GITHUB_SHA" || { echo "FAIL: could not fetch $GITHUB_SHA here."; exit 1; }
|
|
# `|| true`: under the runner's pipefail a missing or comment-only pin
|
|
# would stop here on git's error instead of the FAIL line below (TOOL-9).
|
|
PIN=$(git show FETCH_HEAD:.gitea/infra-pin | grep -v '^#' | tr -d '[:space:]') || true
|
|
test -n "$PIN" || { echo "FAIL: .gitea/infra-pin is missing at $GITHUB_SHA, or holds only comments."; exit 1; }
|
|
test -n "$INFRA_TOKEN" || { echo "FAIL: secret INFRA_READ_TOKEN is not available to this run (a fork PR?)."; exit 1; }
|
|
# Header via env, as in checks.yml: the token stays out of argv.
|
|
HEAD=$(GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $INFRA_TOKEN" \
|
|
git ls-remote "$INFRA" refs/heads/release/1.0 | cut -f1) || true
|
|
test -n "$HEAD" || { echo "FAIL: could not read admin/goodwe release/1.0."; exit 1; }
|
|
if [ "$PIN" != "$HEAD" ]; then
|
|
echo "STALE: .gitea/infra-pin is $PIN but admin/goodwe release/1.0 is $HEAD."
|
|
echo " Test against $HEAD and bump the pin (README.md, \"CI and the infra pin\")."
|
|
exit 1
|
|
fi
|
|
echo "OK: .gitea/infra-pin $PIN is admin/goodwe release/1.0 HEAD."
|