Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 zcode-mulm
|
12b01c6cc5 | ||
|
zcode-mulm
|
ff3dd6ce12 |
@@ -1,38 +0,0 @@
|
||||
# Unified checkout for host-mode jobs (build-docker): mu-ref/actions-checkout
|
||||
# (local JS-action mirror) with the Caddy CA and a HEAD==SHA guard.
|
||||
#
|
||||
# Requirements (verified 2026-08-27 on Gitea 1.27.2): the runner host must
|
||||
# have a node runtime for JS actions (tn does), and the action repos must be
|
||||
# anonymously readable (public). NOT usable from container jobs whose image
|
||||
# lacks node — those callers keep a host `git clone` step instead.
|
||||
name: reusable-checkout
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
fetch-depth:
|
||||
required: false
|
||||
type: number
|
||||
default: 1
|
||||
verify-sha:
|
||||
required: false
|
||||
type: string
|
||||
default: "yes"
|
||||
description: "Empty disables; otherwise fail unless HEAD equals the triggering commit (boolean inputs are NOT reliable through workflow_call with:)"
|
||||
|
||||
jobs:
|
||||
checkout:
|
||||
runs-on: build-docker
|
||||
steps:
|
||||
- name: checkout (mu-ref/actions-checkout)
|
||||
uses: https://git.moneywood.site/mu-ref/actions-checkout@v4
|
||||
env:
|
||||
GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt
|
||||
with:
|
||||
fetch-depth: ${{ inputs.fetch-depth }}
|
||||
|
||||
- name: verify HEAD equals triggering commit
|
||||
if: inputs.verify-sha != ''
|
||||
run: |
|
||||
set -eu
|
||||
test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
|
||||
@@ -3,12 +3,14 @@
|
||||
# P1-7 verification status (2026-08-27, Gitea 1.27.2):
|
||||
# - reusable workflow calls verified working (1.27.2 probe + this workflow's
|
||||
# selftest caller: .gitea/workflows/selftest.yml)
|
||||
# - checkout uses host git clone (NOT mu-ref/actions-checkout): act_runner
|
||||
# runs JS actions with a host node runtime, which tn does not install —
|
||||
# the JS-action path is unavailable for host jobs until node is installed
|
||||
# on the runner host (coordination review fallback decision)
|
||||
# - no actions/cache layer for the same reason; the persistent /data/cache/ci
|
||||
# directory is the primary (and only) cache layer
|
||||
# - checkout via mu-ref/actions-checkout@v4 (JS action) + explicit
|
||||
# HEAD==SHA postcondition: tn has a host node runtime (v22, installed
|
||||
# 2026-08-27). v3 restores the P1-10 JS path — the 2026-08-27 12:07
|
||||
# consolidation had based this repo on the P1-7 host-clone fallback
|
||||
# lineage and dropped the completed migration (est/Est-Infra@57cc9f7);
|
||||
# the action repo must stay PUBLIC (act clones it anonymously)
|
||||
# - no actions/cache layer; the persistent /data/cache/ci directory is
|
||||
# the primary (and only) cache layer
|
||||
#
|
||||
# Conventions proven on the business-repo pipelines:
|
||||
# - runs-on: build-docker (host job, root) + docker run for the toolchain
|
||||
@@ -73,18 +75,14 @@ jobs:
|
||||
quality:
|
||||
runs-on: build-docker
|
||||
steps:
|
||||
- name: checkout (host git; JS actions need a host node runtime)
|
||||
- name: checkout (mu-ref/actions-checkout; tn host node runs JS actions)
|
||||
uses: https://git.moneywood.site/mu-ref/actions-checkout@v4
|
||||
env:
|
||||
CI_ACTOR: ${{ github.actor }}
|
||||
CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt
|
||||
|
||||
- name: verify HEAD equals triggering commit
|
||||
run: |
|
||||
set -eu
|
||||
export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt
|
||||
git config --global credential.helper \
|
||||
'!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f'
|
||||
git config --global --add safe.directory '*'
|
||||
timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
|
||||
"https://git.moneywood.site/${GITHUB_REPOSITORY}.git" .
|
||||
test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
|
||||
|
||||
- name: authenticate to gitea registry (private helper image pulls)
|
||||
|
||||
@@ -3,8 +3,9 @@
|
||||
# P1-7 verification status (2026-08-27, Gitea 1.27.2):
|
||||
# - reusable workflow calls verified working (selftest caller:
|
||||
# .gitea/workflows/selftest.yml)
|
||||
# - checkout uses host git clone (JS actions need a host node runtime that
|
||||
# tn does not install — see reusable/node-quality.yml header)
|
||||
# - checkout via mu-ref/actions-checkout@v4 + HEAD==SHA postcondition
|
||||
# (tn host node v22; v3 restoration history in reusable/node-quality.yml
|
||||
# header; the action repo must stay PUBLIC — act clones it anonymously)
|
||||
# - registry identity is the triggering actor (github.actor), credentials
|
||||
# flow exclusively through the REGISTRY_PASSWORD secret (no hardcoded
|
||||
# usernames — coordination review pitfall 21)
|
||||
@@ -106,18 +107,14 @@ jobs:
|
||||
build:
|
||||
runs-on: build-docker
|
||||
steps:
|
||||
- name: checkout (host git; JS actions need a host node runtime)
|
||||
- name: checkout (mu-ref/actions-checkout; tn host node runs JS actions)
|
||||
uses: https://git.moneywood.site/mu-ref/actions-checkout@v4
|
||||
env:
|
||||
CI_ACTOR: ${{ github.actor }}
|
||||
CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt
|
||||
|
||||
- name: verify HEAD equals triggering commit
|
||||
run: |
|
||||
set -eu
|
||||
export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt
|
||||
git config --global credential.helper \
|
||||
'!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f'
|
||||
git config --global --add safe.directory '*'
|
||||
timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
|
||||
"https://git.moneywood.site/${GITHUB_REPOSITORY}.git" .
|
||||
test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
|
||||
|
||||
- name: authenticate to gitea registry
|
||||
|
||||
@@ -7,8 +7,7 @@
|
||||
|
||||
| 路径 | 用途 |
|
||||
|---|---|
|
||||
| `.gitea/workflows/reusable/checkout.yml` | 统一 checkout（mu-ref/actions-checkout + CA + HEAD==SHA 守卫；host job 专用） |
|
||||
| `.gitea/workflows/reusable/node-quality.yml` | node 质量门（digest helper、持久缓存、rank 源序） |
|
||||
| `.gitea/workflows/reusable/node-quality.yml` | node 质量门（digest helper、持久缓存、rank 源序、actions-checkout checkout） |
|
||||
| `.gitea/workflows/reusable/oci-build-push-verify.yml` | 镜像构建+推送+verify-command 校验链 |
|
||||
| `tools/ci/source-policy.sh` | 唯一选源实现（公司级 canonical） |
|
||||
| `tools/ci/helper/REGISTER.md` | ci-node-* helper 镜像 digest 注册 |
|
||||
@@ -34,4 +33,5 @@ jobs:
|
||||
## 迁移与同步
|
||||
|
||||
- 2026-08-27 定稿：曾按初版决策试建 est/ci-workflows，因 est org 私有闸门不可跨仓调用而删除（用户改批 mu-ref 宿主）；同日自 est/Est-Infra 上移 tools/ci。
|
||||
- 2026-08-29 v3：模板 checkout 恢复 mu-ref/actions-checkout@v4（JS action）+ HEAD==SHA postcondition——P1-10 的 JS 迁移（est/Est-Infra@57cc9f7，08-27 09:39）在 08-27 12:07 上移建仓时被回退为 P1-7 host-clone fallback 血统，v3 恢复并经 Seabed 私仓探针验证；无调用方的孤儿模板 `reusable/checkout.yml` 删除（reusable 不可嵌套调用，其守卫已内联进两个模板）。
|
||||
- helper Dockerfile 的可复现 bake 与 ops 巡检脚本仍属项目级（Est-Infra / gitea-host-setup）。
|
||||
|
||||
Reference in New Issue
Block a user