From ff3dd6ce12f8b0d9b86e5ad3a2fdb0cee0aabc0c Mon Sep 17 00:00:00 2001 From: zcode_mulm Date: Sat, 29 Aug 2026 21:31:41 +0800 Subject: [PATCH] templates v3: checkout back on mu-ref/actions-checkout@v4 + drop orphan reusable/checkout.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P1-10 completed the JS-action checkout migration on 2026-08-27 09:39 (est/Est-Infra@57cc9f7) after tn gained a host node runtime (v22). The 12:07 consolidation founded this repo on the P1-7 host-clone fallback lineage instead, deleting the migrated copies at 12:25 — live pipelines have run host git clone with stale 'tn does not install node' headers ever since. v3 restores the JS path in both templates, keeps the fallback's HEAD==SHA assertion as an explicit postcondition step (guard is not downgraded), and deletes reusable/checkout.yml which had zero callers (reusable workflows cannot nest; its guard now lives inline). Verified by a Seabed task-branch probe run before tagging v3 (coordination task M1-423, issue #32). --- .gitea/workflows/reusable/checkout.yml | 38 ------------------- .gitea/workflows/reusable/node-quality.yml | 28 +++++++------- .../reusable/oci-build-push-verify.yml | 19 ++++------ README.md | 4 +- 4 files changed, 23 insertions(+), 66 deletions(-) delete mode 100644 .gitea/workflows/reusable/checkout.yml diff --git a/.gitea/workflows/reusable/checkout.yml b/.gitea/workflows/reusable/checkout.yml deleted file mode 100644 index aca5575..0000000 --- a/.gitea/workflows/reusable/checkout.yml +++ /dev/null @@ -1,38 +0,0 @@ -# Unified checkout for host-mode jobs (build-docker): mu-ref/actions-checkout -# (local JS-action mirror) with the Caddy CA and a HEAD==SHA guard. -# -# Requirements (verified 2026-08-27 on Gitea 1.27.2): the runner host must -# have a node runtime for JS actions (tn does), and the action repos must be -# anonymously readable (public). NOT usable from container jobs whose image -# lacks node — those callers keep a host `git clone` step instead. -name: reusable-checkout - -on: - workflow_call: - inputs: - fetch-depth: - required: false - type: number - default: 1 - verify-sha: - required: false - type: string - default: "yes" - description: "Empty disables; otherwise fail unless HEAD equals the triggering commit (boolean inputs are NOT reliable through workflow_call with:)" - -jobs: - checkout: - runs-on: build-docker - steps: - - name: checkout (mu-ref/actions-checkout) - uses: https://git.moneywood.site/mu-ref/actions-checkout@v4 - env: - GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt - with: - fetch-depth: ${{ inputs.fetch-depth }} - - - name: verify HEAD equals triggering commit - if: inputs.verify-sha != '' - run: | - set -eu - test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" diff --git a/.gitea/workflows/reusable/node-quality.yml b/.gitea/workflows/reusable/node-quality.yml index 3ae90fc..a9b2cb2 100644 --- a/.gitea/workflows/reusable/node-quality.yml +++ b/.gitea/workflows/reusable/node-quality.yml @@ -3,12 +3,14 @@ # P1-7 verification status (2026-08-27, Gitea 1.27.2): # - reusable workflow calls verified working (1.27.2 probe + this workflow's # selftest caller: .gitea/workflows/selftest.yml) -# - checkout uses host git clone (NOT mu-ref/actions-checkout): act_runner -# runs JS actions with a host node runtime, which tn does not install — -# the JS-action path is unavailable for host jobs until node is installed -# on the runner host (coordination review fallback decision) -# - no actions/cache layer for the same reason; the persistent /data/cache/ci -# directory is the primary (and only) cache layer +# - checkout via mu-ref/actions-checkout@v4 (JS action) + explicit +# HEAD==SHA postcondition: tn has a host node runtime (v22, installed +# 2026-08-27). v3 restores the P1-10 JS path — the 2026-08-27 12:07 +# consolidation had based this repo on the P1-7 host-clone fallback +# lineage and dropped the completed migration (est/Est-Infra@57cc9f7); +# the action repo must stay PUBLIC (act clones it anonymously) +# - no actions/cache layer; the persistent /data/cache/ci directory is +# the primary (and only) cache layer # # Conventions proven on the business-repo pipelines: # - runs-on: build-docker (host job, root) + docker run for the toolchain @@ -73,18 +75,14 @@ jobs: quality: runs-on: build-docker steps: - - name: checkout (host git; JS actions need a host node runtime) + - name: checkout (mu-ref/actions-checkout; tn host node runs JS actions) + uses: https://git.moneywood.site/mu-ref/actions-checkout@v4 env: - CI_ACTOR: ${{ github.actor }} - CI_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt + + - name: verify HEAD equals triggering commit run: | set -eu - export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt - git config --global credential.helper \ - '!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f' - git config --global --add safe.directory '*' - timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \ - "https://git.moneywood.site/${GITHUB_REPOSITORY}.git" . test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" - name: authenticate to gitea registry (private helper image pulls) diff --git a/.gitea/workflows/reusable/oci-build-push-verify.yml b/.gitea/workflows/reusable/oci-build-push-verify.yml index ce8cf37..eccb6c2 100644 --- a/.gitea/workflows/reusable/oci-build-push-verify.yml +++ b/.gitea/workflows/reusable/oci-build-push-verify.yml @@ -3,8 +3,9 @@ # P1-7 verification status (2026-08-27, Gitea 1.27.2): # - reusable workflow calls verified working (selftest caller: # .gitea/workflows/selftest.yml) -# - checkout uses host git clone (JS actions need a host node runtime that -# tn does not install — see reusable/node-quality.yml header) +# - checkout via mu-ref/actions-checkout@v4 + HEAD==SHA postcondition +# (tn host node v22; v3 restoration history in reusable/node-quality.yml +# header; the action repo must stay PUBLIC — act clones it anonymously) # - registry identity is the triggering actor (github.actor), credentials # flow exclusively through the REGISTRY_PASSWORD secret (no hardcoded # usernames — coordination review pitfall 21) @@ -106,18 +107,14 @@ jobs: build: runs-on: build-docker steps: - - name: checkout (host git; JS actions need a host node runtime) + - name: checkout (mu-ref/actions-checkout; tn host node runs JS actions) + uses: https://git.moneywood.site/mu-ref/actions-checkout@v4 env: - CI_ACTOR: ${{ github.actor }} - CI_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt + + - name: verify HEAD equals triggering commit run: | set -eu - export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt - git config --global credential.helper \ - '!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f' - git config --global --add safe.directory '*' - timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \ - "https://git.moneywood.site/${GITHUB_REPOSITORY}.git" . test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" - name: authenticate to gitea registry diff --git a/README.md b/README.md index ecd5a29..0d11d1c 100644 --- a/README.md +++ b/README.md @@ -7,8 +7,7 @@ | 路径 | 用途 | |---|---| -| `.gitea/workflows/reusable/checkout.yml` | 统一 checkout（mu-ref/actions-checkout + CA + HEAD==SHA 守卫；host job 专用） | -| `.gitea/workflows/reusable/node-quality.yml` | node 质量门（digest helper、持久缓存、rank 源序） | +| `.gitea/workflows/reusable/node-quality.yml` | node 质量门（digest helper、持久缓存、rank 源序、actions-checkout checkout） | | `.gitea/workflows/reusable/oci-build-push-verify.yml` | 镜像构建+推送+verify-command 校验链 | | `tools/ci/source-policy.sh` | 唯一选源实现（公司级 canonical） | | `tools/ci/helper/REGISTER.md` | ci-node-* helper 镜像 digest 注册 | @@ -34,4 +33,5 @@ jobs: ## 迁移与同步 - 2026-08-27 定稿：曾按初版决策试建 est/ci-workflows，因 est org 私有闸门不可跨仓调用而删除（用户改批 mu-ref 宿主）；同日自 est/Est-Infra 上移 tools/ci。 +- 2026-08-29 v3：模板 checkout 恢复 mu-ref/actions-checkout@v4（JS action）+ HEAD==SHA postcondition——P1-10 的 JS 迁移（est/Est-Infra@57cc9f7，08-27 09:39）在 08-27 12:07 上移建仓时被回退为 P1-7 host-clone fallback 血统，v3 恢复并经 Seabed 私仓探针验证；无调用方的孤儿模板 `reusable/checkout.yml` 删除（reusable 不可嵌套调用，其守卫已内联进两个模板）。 - helper Dockerfile 的可复现 bake 与 ops 巡检脚本仍属项目级（Est-Infra / gitea-host-setup）。 -- 2.54.0