Mike/ralpi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

workflow: Gitea-canonical auth (Mike:<token>), PORTING_KEY everywhere, workflow_dispatch, preflight auth check
Some checks failed
port-to-omp / port (push) Failing after 5s
Details

Browse Source
This commit is contained in:
Michael Freno
2026-08-11 09:09:15 -04:00
parent 5466630dbd
commit 85438c4a3e
1 changed files with 21 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
.gitea/workflows/port-to-omp.yml
View File

@@ -1,19 +1,22 @@
name: port-to-omp name: port-to-omp
# Regenerate the omp port of ralpi from this repo and push it to Mike/omp-ralpi. # Regenerate the omp port of ralpi from this repo and push it to
# Mike/omp-ralpi.
# #
# Prerequisites on git.freno.me: # Prerequisites on git.freno.me:
# - an access token with write:repository scope, stored as the repo/org # - an access token with write:repository scope, stored as the repo secret
# secret PORTING_TOKEN (the workflow authenticates as `oauth2:<token>` over # PORTING_KEY (the workflow authenticates as https://Mike:<token>@…)
# https)
# - a registered Actions runner (act_runner) for this repo # - a registered Actions runner (act_runner) for this repo
# - the omp repo must exist (Mike/omp-ralpi)
# #
# Manual run: Actions tab → Run workflow (workflow_dispatch), or push.
# Safe by construction: the port commit lands in the omp repo, never here, so # Safe by construction: the port commit lands in the omp repo, never here, so
# this workflow cannot re-trigger itself. # this workflow cannot re-trigger itself.
on: on:
push: push:
branches: [master] branches: [master]
workflow_dispatch:
jobs: jobs:
port: port:
@@ -27,30 +30,30 @@ jobs:
- name: Port to omp - name: Port to omp
env: env:
PORTING_TOKEN: ${{ secrets.PORTING_TOKEN }} PORTING_KEY: ${{ secrets.PORTING_KEY }}
OMP_REPO: omp-ralpi OMP_REPO: omp-ralpi
run: | run: |
set -euo pipefail set -euo pipefail
# Trim the secret: a stray newline from pasting silently breaks # Trim the secret: a stray newline from pasting silently breaks
# oauth2 basic-auth. Fail loudly when it is missing entirely. # basic auth. Fail loudly when it is missing entirely.
: "${PORTING_TOKEN:?PORTING_TOKEN secret is not set}" || exit 1 PORTING_KEY="$(printf '%s' "${PORTING_KEY}" | tr -d '[:space:]')"
PORTING_TOKEN="$(printf '%s' "${PORTING_TOKEN}" | tr -d '[:space:]')" : "${PORTING_KEY:?PORTING_KEY secret is not set}" || exit 1
URL="https://oauth2:${PORTING_TOKEN}@git.freno.me/Mike/${OMP_REPO}.git" URL="https://Mike:${PORTING_KEY}@git.freno.me/Mike/${OMP_REPO}.git"
# The omp checkout lives in $RUNNER_TEMP, outside the pi checkout: # The omp checkout lives in $RUNNER_TEMP, outside the pi checkout:
# the port script refuses to write into a subdirectory of its own # the port script refuses to write into a subdirectory of its own
# source (cpSync would recurse into itself). # source (cpSync would recurse into itself).
PORT_DIR="${RUNNER_TEMP:-/tmp}/omp-port" PORT_DIR="${RUNNER_TEMP:-/tmp}/omp-port"
if git ls-remote "$URL" HEAD >/dev/null 2>&1; then # Preflight: reach the omp repo with the token. Fail with a clear
git clone --depth 1 "$URL" "$PORT_DIR" # message instead of a confusing error later at push time.
git -C "$PORT_DIR" config user.name "omp-port" if ! git ls-remote "$URL" HEAD >/dev/null 2>&1; then
git -C "$PORT_DIR" config user.email "omp-port@freno.me" echo "::error::cannot read Mike/omp-ralpi with PORTING_KEY — is the secret set on this repo, valid, and write:repository-scoped?"
else exit 1
git init -b main "$PORT_DIR"
git -C "$PORT_DIR" remote add origin "$URL"
git -C "$PORT_DIR" config user.name "omp-port"
git -C "$PORT_DIR" config user.email "omp-port@freno.me"
fi fi
git clone --depth 1 "$URL" "$PORT_DIR"
git -C "$PORT_DIR" config user.name "omp-port"
git -C "$PORT_DIR" config user.email "omp-port@freno.me"
# Regenerate the port directly into the omp checkout. The script # Regenerate the port directly into the omp checkout. The script
# preserves .git, asserts every patch rule, and runs `bun install` # preserves .git, asserts every patch rule, and runs `bun install`