From 841424463abecab129e1cf77728a49a897784246 Mon Sep 17 00:00:00 2001 From: glenn schrooyen Date: Fri, 25 Sep 2026 18:01:15 +0200 Subject: [PATCH] CI-12 review: INFRA_READ_TOKEN via an env-set header, not a remote URL The long-lived token no longer lands in $WS/goodwe/.git/config (mounted into the tests' container, left behind by a failed job) or in git's argv. A missing secret (fork PR) fails with its own message. README: addon-pin is not re-run after a bump. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01LyR88rXETvwhTgx6yHE39p --- .gitea/workflows/checks.yml | 7 +++++-- .gitea/workflows/infra-pin.yml | 8 +++++--- README.md | 2 +- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/checks.yml b/.gitea/workflows/checks.yml index 70b15f5..5db6bb5 100644 --- a/.gitea/workflows/checks.yml +++ b/.gitea/workflows/checks.yml @@ -500,10 +500,13 @@ jobs: set -eu PIN=$(grep -v '^#' "$WS/goodwe-addon/.gitea/infra-pin" | tr -d '[:space:]') echo "$PIN" | grep -Eq '^[0-9a-f]{40}$' || { echo "FAIL: .gitea/infra-pin holds '$PIN', not a full 40-hex SHA."; exit 1; } + test -n "$TOKEN" || { echo "FAIL: secret INFRA_READ_TOKEN is not available to this run (a fork PR?)."; exit 1; } rm -rf "$WS/goodwe" && mkdir -p "$WS/goodwe" && cd "$WS/goodwe" git init -q . - git remote add origin "$(echo "$URL" | sed "s#://#://x-access-token:${TOKEN}@#")" - git fetch -q origin "$PIN" || { echo "FAIL: could not fetch admin/goodwe at $PIN."; exit 1; } + # The token goes in a header via env: not in argv, and not in .git/config, + # which is mounted into the tests' container and outlives a failed job. + GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $TOKEN" \ + git fetch -q "$URL" "$PIN" || { echo "FAIL: could not fetch admin/goodwe at $PIN."; exit 1; } git -c advice.detachedHead=false checkout -qf FETCH_HEAD test "$(git rev-parse HEAD)" = "$PIN" test -f sim/hwsim.py || { echo "FAIL: admin/goodwe@$PIN has no sim/hwsim.py."; exit 1; } diff --git a/.gitea/workflows/infra-pin.yml b/.gitea/workflows/infra-pin.yml index 8c2dafb..133ef90 100644 --- a/.gitea/workflows/infra-pin.yml +++ b/.gitea/workflows/infra-pin.yml @@ -23,13 +23,15 @@ jobs: INFRA_TOKEN: ${{ secrets.INFRA_READ_TOKEN }} # admin/goodwe is private run: | set -eu - auth() { echo "$1" | sed "s#://#://x-access-token:${2:-$TOKEN}@#"; } D=$(mktemp -d) && cd "$D" - git init -q . && git remote add origin "$(auth "$SELF")" + git init -q . && git remote add origin "$(echo "$SELF" | sed "s#://#://x-access-token:${TOKEN}@#")" # The pin of the commit this event is about (the PR head, or the push). git fetch -q --depth 1 origin "$GITHUB_SHA" PIN=$(git show FETCH_HEAD:.gitea/infra-pin | grep -v '^#' | tr -d '[:space:]') - HEAD=$(git ls-remote "$(auth "$INFRA" "$INFRA_TOKEN")" refs/heads/release/1.0 | cut -f1) + test -n "$INFRA_TOKEN" || { echo "FAIL: secret INFRA_READ_TOKEN is not available to this run (a fork PR?)."; exit 1; } + # Header via env, as in checks.yml: the token stays out of argv. + HEAD=$(GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $INFRA_TOKEN" \ + git ls-remote "$INFRA" refs/heads/release/1.0 | cut -f1) cd / && rm -rf "$D" test -n "$HEAD" || { echo "FAIL: could not read admin/goodwe release/1.0."; exit 1; } if [ "$PIN" != "$HEAD" ]; then diff --git a/README.md b/README.md index 2004b50..53438fc 100644 --- a/README.md +++ b/README.md @@ -108,7 +108,7 @@ on real hardware, and the comments in `control.py` say which. ### CI and the infra pin CI (`.gitea/workflows/checks.yml`) runs every `test_*.py`, with `admin/goodwe` checked out next to this repo at the commit in `.gitea/infra-pin`, so `test_freeze.py` grades against the real `sim/hwsim.py`. If that checkout fails, the job fails. The local stub is used only in local runs, and it prints `STUB USED` when it is. -The pin tracks `admin/goodwe` **release/1.0**, not master. Two non-required checks go red when release/1.0 has moved past the pin: `infra-pin / fresh` here, on any add-on PR or push to release/1.0, and `addon-pin / fresh` in `admin/goodwe`, on every push to its release/1.0. +The pin tracks `admin/goodwe` **release/1.0**, not master. Two non-required checks go red when release/1.0 has moved past the pin: `infra-pin / fresh` here, on any add-on PR or push to release/1.0, and `addon-pin / fresh` in `admin/goodwe`, on every push to its release/1.0. Nothing re-runs `addon-pin` after a bump, so it stays red on that admin/goodwe commit; `infra-pin / fresh` green on the bump is the all-clear. **Bump the pin** whenever either is red. Set `.gitea/infra-pin` to the new release/1.0 SHA (`git ls-remote /admin/goodwe.git refs/heads/release/1.0`) in a PR, and let `checks / unit` grade the tests against it. CI reads `admin/goodwe` with the Actions secret `INFRA_READ_TOKEN`. ## Compatibility