335e6f5b34
Removes harnesses/contexts/z-ai/v1/. Mirrors the agent-runtimes
companion PR — the z-ai harness was never cut over to ESO and
there's no active subscription. Revival path documented in
agent-runtimes planning/future/providers F49.
Removed:
- harnesses/contexts/z-ai/v1/{harness.yaml, init.sh}
Updated:
- CLAUDE.md — drops z-ai from the 'no secrets in this repo'
context list. Retirement note added.
- gitea-admin/v1/init.sh — comment ref to z-ai removed.
- gitea-https/v1/init.sh — comment ref to z-ai removed.
No composites layer z-ai (verified via grep across composites/);
no model registry entries reference it.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
70 lines
2.8 KiB
Bash
Executable File
70 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# gitea-https init — stage the token for the agent user and configure the
|
|
# git credential helper to read from the staged copy.
|
|
#
|
|
# Threat model: keep the ESO mount root-only (mode 0400). init.sh runs as
|
|
# root and `install`s a per-secret 0600 agent-owned copy at
|
|
# $AGENT_HOME/.config/git/gitea-https-token. The git credential helper
|
|
# reads from the staged copy at every git invocation; the ESO mount path
|
|
# is never accessed by the agent.
|
|
#
|
|
# This was previously a `cat /run/agent/secrets/gitea-https/token` from
|
|
# inside an init.sh-generated helper script, which silently failed because
|
|
# the helper runs as agent and the ESO file is root:root mode 0400. The
|
|
# stage-and-helper-points-at-stage pattern matches gitea-ssh / minimax /
|
|
# anthropic-cloud-paul-oauth.
|
|
#
|
|
# Rotation handling: per-container init. Ephemeral container agents
|
|
# always pick up the latest mounted token. Long-running sessions need a
|
|
# future scripts.control_loop hook to re-stage between git invocations.
|
|
|
|
set -euo pipefail
|
|
|
|
ESO_TOKEN="/run/agent/secrets/gitea-https/token"
|
|
|
|
if [ ! -r "$ESO_TOKEN" ]; then
|
|
echo "ERROR: $ESO_TOKEN not readable. Check ESO ExternalSecret acct-<gitea-https-id>." >&2
|
|
exit 1
|
|
fi
|
|
|
|
AGENT_USER="${AGENT_USER:-agent}"
|
|
AGENT_HOME=$(getent passwd "$AGENT_USER" | cut -d: -f6)
|
|
if [ -z "$AGENT_HOME" ] || [ ! -d "$AGENT_HOME" ]; then
|
|
AGENT_HOME="/home/$AGENT_USER"
|
|
fi
|
|
|
|
# Stage the token into a per-secret path owned by agent, mode 0600.
|
|
STAGED_DIR="$AGENT_HOME/.config/git"
|
|
STAGED_TOKEN="$STAGED_DIR/gitea-https-token"
|
|
mkdir -p "$STAGED_DIR"
|
|
chown "$AGENT_USER:" "$STAGED_DIR" 2>/dev/null || true
|
|
chmod 0700 "$STAGED_DIR"
|
|
install -m 0600 -o "$AGENT_USER" -g "$AGENT_USER" "$ESO_TOKEN" "$STAGED_TOKEN"
|
|
|
|
# Generate the credential helper. It reads from the STAGED copy, not the
|
|
# ESO mount, so it works under the agent's UID.
|
|
CRED_HELPER="/opt/harness/contexts/gitea-https/v1/git-credential-gitea.sh"
|
|
cat > "$CRED_HELPER" <<HELPER_EOF
|
|
#!/bin/bash
|
|
# Git credential helper for gitea.oreillyit.nz — reads the agent-staged
|
|
# token. The ESO mount itself is root-only (0400); this helper would fail
|
|
# if pointed at it directly.
|
|
set -euo pipefail
|
|
TOKEN_FILE=$STAGED_TOKEN
|
|
[ -r "\$TOKEN_FILE" ] || exit 1
|
|
echo "protocol=https"
|
|
echo "host=gitea.oreillyit.nz"
|
|
echo "username=token"
|
|
echo "password=\$(cat "\$TOKEN_FILE")"
|
|
HELPER_EOF
|
|
|
|
chmod +x "$CRED_HELPER"
|
|
|
|
# Configure git globally (per-host) to use the helper for gitea.oreillyit.nz.
|
|
# Run as agent so ~/.gitconfig is owned correctly; otherwise root would
|
|
# write into /root/.gitconfig and the agent's git wouldn't see it.
|
|
su - "$AGENT_USER" -c "git config --global credential.https://gitea.oreillyit.nz.helper '$CRED_HELPER'"
|
|
|
|
echo "gitea-https: token staged at $STAGED_TOKEN (0600 $AGENT_USER:$AGENT_USER)"
|
|
echo "gitea-https: credential helper configured for gitea.oreillyit.nz"
|