ea7c11265b
repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its own secrets_required (account platform-readonly.space:platform, a read-only Gitea deploy key), and stages the key before cloning. workflow-script/v1 no longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated: credential layers in the composite must declare write_targets: []. Bug 45a48685-23e9-4605-af1f-d93306108cef Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
40 lines
1.9 KiB
YAML
40 lines
1.9 KiB
YAML
kind: context
|
|
name: repo-readonly
|
|
version: 1
|
|
description: "Read-only project-repo clone for harness-path kind: script nodes (spec/typed-workflows.md WF-COMP-34, bug 3bee78fa). Clones AGENT_REPO_URL (the upstream project repo URL emitted by the WF-COMP-34 compiler emission as payload.agent_repo.url and propagated to the container env by the dispatcher) into /workspace/project at its default branch. No fork management, no AR-39 select-base, no scratchpad directory, no .gitignore munging, no finalize.sh push. The script node reads repo files only; it never writes back through a fork. Distinct from agent-repo/v1 (the agent-node branch-per-task fork-management context) on every one of those axes."
|
|
requires: []
|
|
provides: []
|
|
|
|
# HC-11: read-only layer. No push target; the credential below is a read-only
|
|
# deploy key (Gitea key id 20 on skynet/agent-runtimes), so a script node
|
|
# cannot write even if its code tries (bug 45a48685).
|
|
write_targets: []
|
|
|
|
# WF-COMP-34: this layer's init.sh is the read-only clone. It only runs
|
|
# when AGENT_REPO_URL is set; the unset case is a no-op (a script node
|
|
# whose template omits agent_repo keeps its pre-fix silent empty workspace
|
|
# runtime exactly, verified by
|
|
# tests/test_entrypoint.py::TestV2WorkspaceAssertions::test_v2_no_agent_repo_url_skips_workspace_check).
|
|
#
|
|
# AGENT_WORKING_DIR=/workspace/project is the env var
|
|
# entrypoint.py:_apply_working_dir reads (entrypoint/entrypoint.py:908-916),
|
|
# and the path entrypoint/runners/shell.py:67 sets as the subprocess cwd
|
|
# when context["workspace"] is unset and no clone action ran.
|
|
env:
|
|
AGENT_WORKING_DIR: /workspace/project
|
|
|
|
scripts:
|
|
init: "./init.sh"
|
|
|
|
ssh_hosts:
|
|
- alias: gitea.oreillyit.nz-ai-enablement
|
|
hostname: gitea.oreillyit.nz
|
|
user: git
|
|
identity_secret: GITEA_SSH_KEY
|
|
|
|
secrets_required:
|
|
- name: gitea-ssh-readonly
|
|
account_ref: "platform-readonly.space:platform"
|
|
mount_path: /run/agent/secrets/gitea-ssh-readonly
|
|
mode: "0400"
|