ea7c11265b
repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its own secrets_required (account platform-readonly.space:platform, a read-only Gitea deploy key), and stages the key before cloning. workflow-script/v1 no longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated: credential layers in the composite must declare write_targets: []. Bug 45a48685-23e9-4605-af1f-d93306108cef Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
36 lines
2.6 KiB
YAML
36 lines
2.6 KiB
YAML
kind: composite
|
|
name: workflow-script
|
|
version: 1
|
|
description: "Internal composite for the flag-on kind: script path (typed-workflows WF-COMP-31 / workflow-variables WV-19). Brings the shared-variables filesystem context AND the AU-51 CP write credential (cp-service-token/v1 sets CP_SERVICE_TOKEN_FILE in the entrypoint process env before shell_runner runs). NOT a model-bearing composite — the kind: script compiled shape is cli=\"shell\", params.cmd=<cmd>; this composite provides the harness layers that path needs and nothing else."
|
|
|
|
# Order matters only for HC-6 env last-writer-wins / HC-8 git identity. The two
|
|
# layers here have disjoint env vars (shared-variables sets WORKFLOW_VARIABLES_*
|
|
# paths, cp-service-token sets CP_SERVICE_TOKEN_FILE) and no overlapping git
|
|
# identity, so the listed order has no observable merge effect — both layers
|
|
# reach the script-node container either way.
|
|
layers:
|
|
# spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — agent-facing
|
|
# /variables/ context (CLAUDE.md mounted at /opt/harness/context/shared-variables/CLAUDE.md)
|
|
# plus WORKFLOW_VARIABLES_ROOT=/variables and templated WORKFLOW_VARIABLES_SELF=<step_path>.
|
|
# Provides the [shared-variables] tag used by the dispatcher's extra_layers injection.
|
|
- context: shared-variables/v1
|
|
# spec/typed-workflows.md WF-COMP-31 "AU-51 credential env seam" — this layer's
|
|
# init.sh restages the ESO-mounted CP-service-token secret (root-owned mode 0400)
|
|
# to an agent-owned 0600 copy at /run/agent/cp-service-token/token and exports
|
|
# CP_SERVICE_TOKEN_FILE pointing at it. Verified: env.CP_SERVICE_TOKEN_FILE is set
|
|
# on the entrypoint process environment before shell_runner runs (entrypoint reads
|
|
# os.environ via env=os.environ.copy() in subprocess.run at entrypoint/runners/shell.py:73,
|
|
# so the same credential channel an agent node gets reaches a script node unchanged).
|
|
- context: cp-service-token/v1
|
|
# spec/typed-workflows.md WF-COMP-34 (bug 3bee78fa, 2026-10-02) — read-only
|
|
# project-repo clone for harness-path kind: script nodes. Layered LAST so
|
|
# its clone runs after the two AU-51 wiring layers and before the script
|
|
# starts (init.sh order: shared-variables -> cp-service-token -> repo-readonly).
|
|
# When AGENT_REPO_URL is unset (the pre-fix runtime, or any template that
|
|
# does not declare agent_repo) this layer is a no-op; the V2 guard
|
|
# (entrypoint/entrypoint.py:901-906) does NOT trip because the unset case
|
|
# is a no-op there too. Layered-in instead of layering agent-repo/v1
|
|
# because that context's fork management and push side effects are wrong
|
|
# for a read-only script node (see bug item body).
|
|
- context: repo-readonly/v1
|