skynet/agent-runtime-framework
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(harnesses): migrate to ESO secrets_required form, mirror agent-runtimes

Browse Source 
The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.

Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).

Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Paul O'Reilly
2026-05-07 07:26:19 +12:00
parent 8bbf6cbb2f
commit 5f85d895c1
20 changed files with 288 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
harnesses/contexts/gitea-https/v1/init.sh
View File

@@ -1,8 +1,8 @@
#!/bin/bash
# Configure git to use GITEA_TOKEN for HTTPS cloning/pushing to gitea.oreillyit.nz
# Configure git to use git credential helper for gitea.oreillyit.nz via HTTPS.
#
# Uses a credential helper script that reads the token from the environment.
# This avoids embedding the token in clone URLs (which would appear in logs).
# The token is read from /run/agent/secrets/gitea-https/token at every git
# invocation (not at init time). This avoids the token appearing in logs.
set -euo pipefail
@@ -11,14 +11,16 @@ CRED_HELPER="/opt/harness/contexts/gitea-https/v1/git-credential-gitea.sh"
# Create the credential helper script
cat > "$CRED_HELPER" << 'HELPER_EOF'
#!/bin/bash
# Git credential helper that provides GITEA_TOKEN for gitea.oreillyit.nz
if [ -z "${GITEA_TOKEN:-}" ]; then
exit 1
fi
# Git credential helper that provides the token from a mounted file
# for gitea.oreillyit.nz.
# This reads the file at EVERY git invocation, not at init time.
set -euo pipefail
SECRET_FILE=/run/agent/secrets/gitea-https/token
[ -r "$SECRET_FILE" ] || exit 1
echo "protocol=https"
echo "host=gitea.oreillyit.nz"
echo "username=token"
echo "password=${GITEA_TOKEN}"
echo "password=$(cat $SECRET_FILE)"
HELPER_EOF
chmod +x "$CRED_HELPER"
@@ -26,4 +28,4 @@ chmod +x "$CRED_HELPER"
# Configure git to use this credential helper for gitea.oreillyit.nz
git config --global credential.https://gitea.oreillyit.nz.helper "$CRED_HELPER"
echo "Git HTTPS credential helper configured for gitea.oreillyit.nz"
echo "Git HTTPS credential helper configured for gitea.oreillyit.nz"