FAIL lines under pipefail. A missing or comment-only .gitea/infra-pin now ends on the workflow's own FAIL line (still red), instead of git's fatal: path ... does not exist (infra run 862).
No token in remote URLs. Every x-access-token:${TOKEN}@ URL is replaced by the env-set http.extraHeader used in goodwe-addon 8414244, so no token gets into .git/config or argv.
Temp dirs. The pin workflows remove their mktemp -d dir with an EXIT trap, so it also goes when the job fails.
Workspace at job start. Unchanged. checks-<run>, addon-checks-<run> and rig-*.new were already rm -rf'd at job start. Pruning other runs' leftovers at start would delete ci/checks-145, and that needs the owner's OK.
Trello TOOL-9.
- **FAIL lines under pipefail.** A missing or comment-only `.gitea/infra-pin` now ends on the workflow's own FAIL line (still red), instead of git's `fatal: path ... does not exist` (infra run 862).
- **No token in remote URLs.** Every `x-access-token:${TOKEN}@` URL is replaced by the env-set `http.extraHeader` used in goodwe-addon 8414244, so no token gets into `.git/config` or argv.
- **Temp dirs.** The pin workflows remove their `mktemp -d` dir with an EXIT trap, so it also goes when the job fails.
- **Workspace at job start.** Unchanged. `checks-<run>`, `addon-checks-<run>` and `rig-*.new` were already `rm -rf`'d at job start. Pruning *other* runs' leftovers at start would delete `ci/checks-145`, and that needs the owner's OK.
Proof runs are listed in the PR comments.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01LyR88rXETvwhTgx6yHE39p
A missing or comment-only .gitea/infra-pin now ends on the workflow's own
FAIL line instead of git's `fatal: path ... does not exist` (still red). Every
x-access-token remote URL becomes an env-set Authorization header, so no
token lands in .git/config or argv; the pin workflows' temp dir is removed
by an EXIT trap, also on failure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
checks run 873: success, GRADED: refs/pull/126/head merged into release/1.0.
infra-pin run 874: success, OK: .gitea/infra-pin 2d026df... is admin/goodwe release/1.0 HEAD.
No x-access-token string in any of these logs. The checkout now runs git remote add origin "$URL", and the token goes in an env header.
TOOL-9 proof
- a2c571b (throwaway, pin removed):
- infra-pin run 871: red, `FAIL: .gitea/infra-pin is missing at a2c571b..., or holds only comments.`
- checks run 870: red, `FAIL: .gitea/infra-pin holds '', not a full 40-hex SHA.`
- Runs 868/869 were queued for 550bd6f but fetched refs/pull/126/head after the throwaway push. So 868 graded a2c571b.
- b963153 (pin restored; tree identical to 550bd6f):
- checks run 873: success, `GRADED: refs/pull/126/head merged into release/1.0`.
- infra-pin run 874: success, `OK: .gitea/infra-pin 2d026df... is admin/goodwe release/1.0 HEAD`.
- No `x-access-token` string in any of these logs. The checkout now runs `git remote add origin "$URL"`, and the token goes in an env header.
Review TOOL-9 (head b963153). Every point below is resolved or refuted. No changes are requested.
|| true on the pin lines.
infra-pin.yml:
The SELF fetch keeps its own FAIL line.
After that, only a missing path (git show) or an all-comment file (grep -v) can empty PIN, and either one hits the FAIL line (run 871).
A network or auth failure on ls-remote ... || true leaves HEAD empty, which hits FAIL: could not read admin/goodwe release/1.0.
A garbled PIN goes STALE.
checks.yml: a missing pin makes grep fail, PIN is empty, and the 40-hex check prints FAIL: .gitea/infra-pin holds '', not a full 40-hex SHA. (run 870). grep's own "No such file" line appears just above it.
Wording nit, refuted as non-blocking: the message does not say "missing". It is still a FAIL line and still red, and grep names the missing file. It is not worth a new head and another CI cycle.
Header auth. The token goes in GIT_CONFIG_* env vars, not -c, so it is not in argv or .git/config. The export in checks.yml only lasts until the end of that step, and the step only talks to origin. Tokens are scoped correctly: GITHUB_TOKEN for SELF (infra-pin fetch and checks checkout), INFRA_READ_TOKEN for admin/goodwe (infra-pin ls-remote and the checks pin fetch). Resolved.
EXIT trap (infra-pin). Same as goodwe#57: D is set before the trap, never reassigned, and an empty value would be safe. The trap does not change the exit status. Resolved.
test_ci_gate.py. Line 312 still has the old x-access-token sed line. That is correct: it is Part 3's reproduction of the old checkout, run with TOKEN="" against a local path. It is not a shipped line and holds no secret. The docstring change is accurate. Refuted as a leak.
Branch protection (release/1.0 and master): the only required context is still checks / unit (pull_request). Unchanged.
Card item 4 (leftover token inventory). The PR only mentions ci/checks-145, so I took the inventory myself. It records presence only; no token was printed, nothing was deleted, and the owner decides.
/home/homelab/ci: 30 .git/config files hold a credential in the remote URL.
Only one was made by a CI job (root-owned, x-access-token): ci/checks-145/goodwe.
The other 29 are homelab-owned manual or agent trees: rig-fw01docs, rig-tel06, rig-fw01p, rig-fw01b, rig-rev, and verify-cards/** (24 repos).
The current CI rigs (rig-fast/layer1/transport/winddown) are clean since run 867.
Outside /home/homelab/ci: 128 agent clones under /home/homelab/* (depth ≤2) have userinfo in their remote URL. None is in x-access-token form. They are listed for the owner and are out of this card's CI scope.
Merge order: this PR first, then goodwe#57. That way this PR's post-merge infra-pin / fresh compares 2d026df with an admin/goodwe release/1.0 that has not moved yet. goodwe#57 moves it afterwards, and its addon-pin will then be STALE by design.
**Review TOOL-9 (head b963153)**. Every point below is resolved or refuted. No changes are requested.
1. **`|| true` on the pin lines.**
- infra-pin.yml:
- The SELF fetch keeps its own FAIL line.
- After that, only a missing path (`git show`) or an all-comment file (`grep -v`) can empty PIN, and either one hits the FAIL line (run 871).
- A network or auth failure on `ls-remote ... || true` leaves HEAD empty, which hits `FAIL: could not read admin/goodwe release/1.0.`
- A garbled PIN goes STALE.
- checks.yml: a missing pin makes `grep` fail, PIN is empty, and the 40-hex check prints `FAIL: .gitea/infra-pin holds '', not a full 40-hex SHA.` (run 870). grep's own "No such file" line appears just above it.
- Wording nit, refuted as non-blocking: the message does not say "missing". It is still a FAIL line and still red, and grep names the missing file. It is not worth a new head and another CI cycle.
2. **Header auth.** The token goes in `GIT_CONFIG_*` env vars, not `-c`, so it is not in argv or `.git/config`. The `export` in checks.yml only lasts until the end of that step, and the step only talks to `origin`. Tokens are scoped correctly: `GITHUB_TOKEN` for SELF (infra-pin fetch and checks checkout), `INFRA_READ_TOKEN` for admin/goodwe (infra-pin ls-remote and the checks pin fetch). Resolved.
3. **EXIT trap (infra-pin).** Same as goodwe#57: D is set before the trap, never reassigned, and an empty value would be safe. The trap does not change the exit status. Resolved.
4. **test_ci_gate.py.** Line 312 still has the old `x-access-token` sed line. That is correct: it is Part 3's reproduction of the *old* checkout, run with `TOKEN=""` against a local path. It is not a shipped line and holds no secret. The docstring change is accurate. Refuted as a leak.
5. **Branch protection** (release/1.0 and master): the only required context is still `checks / unit (pull_request)`. Unchanged.
6. **Card item 4 (leftover token inventory).** The PR only mentions `ci/checks-145`, so I took the inventory myself. It records presence only; no token was printed, nothing was deleted, and the owner decides.
- `/home/homelab/ci`: 30 `.git/config` files hold a credential in the remote URL.
- Only one was made by a CI job (root-owned, `x-access-token`): `ci/checks-145/goodwe`.
- The other 29 are homelab-owned manual or agent trees: `rig-fw01docs`, `rig-tel06`, `rig-fw01p`, `rig-fw01b`, `rig-rev`, and `verify-cards/**` (24 repos).
- The current CI rigs (`rig-fast/layer1/transport/winddown`) are clean since run 867.
- Outside `/home/homelab/ci`: 128 agent clones under `/home/homelab/*` (depth ≤2) have userinfo in their remote URL. None is in `x-access-token` form. They are listed for the owner and are out of this card's CI scope.
**Merge order: this PR first, then goodwe#57.** That way this PR's post-merge `infra-pin / fresh` compares 2d026df with an admin/goodwe release/1.0 that has not moved yet. goodwe#57 moves it afterwards, and its `addon-pin` will then be STALE by design.
admin
merged commit 82f032e8cf into release/1.02026-09-25 20:39:48 +02:00
Merged in the order set out in 1732/1733, with head_commit_id pinned.
goodwe-addon#126: merge commit 82f032e8cfaa04cbecd1a8c3fc3e20138a8c7f29 (parents 6a8a5ff and b963153). Confirmed with git ls-remote. Post-merge infra-pin / fresh run 876 is success: OK: .gitea/infra-pin 2d026df... is admin/goodwe release/1.0 HEAD.
goodwe#57: merge commit a1d0618eb339b1d4841cd31d6399b67a22b9dfee (parents 2d026df and 16526f3). Confirmed with git ls-remote. Post-merge addon-pin / fresh run 877 is red, STALE by design: goodwe-addon release/1.0 pins admin/goodwe 2d026df... but release/1.0 here is a1d0618.... The addon pin now needs a bump. That is left to the manager; no PR has been opened.
Token check. Neither the 876 nor the 877 log contains a token string. Neither run left a .git/config behind: both use mktemp dirs removed by the trap, and no .git/config under /home/homelab/ci changed.
Inventory addendum (presence only, nothing deleted). The goodwe-runner container has 4 leftover /tmp/tmp.* dirs from pin runs before TOOL-9. They were left behind when the old scripts died before their rm -rf. 3 of them have a token-bearing remote URL in .git/config. All 4 are older than these merges.
Merged in the order set out in 1732/1733, with `head_commit_id` pinned.
- **goodwe-addon#126**: merge commit `82f032e8cfaa04cbecd1a8c3fc3e20138a8c7f29` (parents 6a8a5ff and b963153). Confirmed with `git ls-remote`. Post-merge `infra-pin / fresh` run 876 is **success**: `OK: .gitea/infra-pin 2d026df... is admin/goodwe release/1.0 HEAD.`
- **goodwe#57**: merge commit `a1d0618eb339b1d4841cd31d6399b67a22b9dfee` (parents 2d026df and 16526f3). Confirmed with `git ls-remote`. Post-merge `addon-pin / fresh` run 877 is **red, STALE by design**: `goodwe-addon release/1.0 pins admin/goodwe 2d026df... but release/1.0 here is a1d0618...`. The addon pin now needs a bump. That is left to the manager; no PR has been opened.
- **Token check.** Neither the 876 nor the 877 log contains a token string. Neither run left a `.git/config` behind: both use mktemp dirs removed by the trap, and no `.git/config` under `/home/homelab/ci` changed.
- **Inventory addendum** (presence only, nothing deleted). The `goodwe-runner` container has 4 leftover `/tmp/tmp.*` dirs from pin runs before TOOL-9. They were left behind when the old scripts died before their `rm -rf`. 3 of them have a token-bearing remote URL in `.git/config`. All 4 are older than these merges.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Trello TOOL-9.
.gitea/infra-pinnow ends on the workflow's own FAIL line (still red), instead of git'sfatal: path ... does not exist(infra run 862).x-access-token:${TOKEN}@URL is replaced by the env-sethttp.extraHeaderused in goodwe-addon8414244, so no token gets into.git/configor argv.mktemp -ddir with an EXIT trap, so it also goes when the job fails.checks-<run>,addon-checks-<run>andrig-*.newwere alreadyrm -rf'd at job start. Pruning other runs' leftovers at start would deleteci/checks-145, and that needs the owner's OK.Proof runs are listed in the PR comments.
🤖 Generated with Claude Code
https://claude.ai/code/session_01LyR88rXETvwhTgx6yHE39p
TOOL-9 proof
a2c571b(throwaway, pin removed):FAIL: .gitea/infra-pin is missing at a2c571b..., or holds only comments.FAIL: .gitea/infra-pin holds '', not a full 40-hex SHA.550bd6fbut fetched refs/pull/126/head after the throwaway push. So 868 gradeda2c571b.b963153(pin restored; tree identical to550bd6f):GRADED: refs/pull/126/head merged into release/1.0.OK: .gitea/infra-pin 2d026df... is admin/goodwe release/1.0 HEAD.x-access-tokenstring in any of these logs. The checkout now runsgit remote add origin "$URL", and the token goes in an env header.Review TOOL-9 (head
b963153). Every point below is resolved or refuted. No changes are requested.|| trueon the pin lines.git show) or an all-comment file (grep -v) can empty PIN, and either one hits the FAIL line (run 871).ls-remote ... || trueleaves HEAD empty, which hitsFAIL: could not read admin/goodwe release/1.0.grepfail, PIN is empty, and the 40-hex check printsFAIL: .gitea/infra-pin holds '', not a full 40-hex SHA.(run 870). grep's own "No such file" line appears just above it.GIT_CONFIG_*env vars, not-c, so it is not in argv or.git/config. Theexportin checks.yml only lasts until the end of that step, and the step only talks toorigin. Tokens are scoped correctly:GITHUB_TOKENfor SELF (infra-pin fetch and checks checkout),INFRA_READ_TOKENfor admin/goodwe (infra-pin ls-remote and the checks pin fetch). Resolved.x-access-tokensed line. That is correct: it is Part 3's reproduction of the old checkout, run withTOKEN=""against a local path. It is not a shipped line and holds no secret. The docstring change is accurate. Refuted as a leak.checks / unit (pull_request). Unchanged.ci/checks-145, so I took the inventory myself. It records presence only; no token was printed, nothing was deleted, and the owner decides./home/homelab/ci: 30.git/configfiles hold a credential in the remote URL.x-access-token):ci/checks-145/goodwe.rig-fw01docs,rig-tel06,rig-fw01p,rig-fw01b,rig-rev, andverify-cards/**(24 repos).rig-fast/layer1/transport/winddown) are clean since run 867./home/homelab/ci: 128 agent clones under/home/homelab/*(depth ≤2) have userinfo in their remote URL. None is inx-access-tokenform. They are listed for the owner and are out of this card's CI scope.Merge order: this PR first, then goodwe#57. That way this PR's post-merge
infra-pin / freshcompares 2d026df with an admin/goodwe release/1.0 that has not moved yet. goodwe#57 moves it afterwards, and itsaddon-pinwill then be STALE by design.Merged in the order set out in 1732/1733, with
head_commit_idpinned.82f032e8cfaa04cbecd1a8c3fc3e20138a8c7f29(parents6a8a5ffandb963153). Confirmed withgit ls-remote. Post-mergeinfra-pin / freshrun 876 is success:OK: .gitea/infra-pin 2d026df... is admin/goodwe release/1.0 HEAD.a1d0618eb339b1d4841cd31d6399b67a22b9dfee(parents 2d026df and 16526f3). Confirmed withgit ls-remote. Post-mergeaddon-pin / freshrun 877 is red, STALE by design:goodwe-addon release/1.0 pins admin/goodwe 2d026df... but release/1.0 here is a1d0618.... The addon pin now needs a bump. That is left to the manager; no PR has been opened..git/configbehind: both use mktemp dirs removed by the trap, and no.git/configunder/home/homelab/cichanged.goodwe-runnercontainer has 4 leftover/tmp/tmp.*dirs from pin runs before TOOL-9. They were left behind when the old scripts died before theirrm -rf. 3 of them have a token-bearing remote URL in.git/config. All 4 are older than these merges.