5f85d895c1
The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.
Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).
Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
20 lines
721 B
Bash
Executable File
20 lines
721 B
Bash
Executable File
#!/bin/bash
|
|
# init.sh for gitea-admin harness (M22 Phase 9)
|
|
# Sets up non-secret env vars and configures git credential helper.
|
|
# Credential token is NOT exported here — only read at exec time by the wrapper.
|
|
|
|
set -euo pipefail
|
|
|
|
# Non-secret configuration
|
|
export GITEA_BASE_URL="${GITEA_BASE_URL:-https://gitea.oreillyit.nz}"
|
|
|
|
# Ensure SSH directory exists with correct permissions
|
|
mkdir -p /home/agent/.ssh
|
|
chmod 700 /home/agent/.ssh
|
|
|
|
# Configure git to use the gitea-admin credential helper wrapper
|
|
# The wrapper reads the ESO-mounted token at exec time
|
|
git config --global credential.helper "!/opt/harness/contexts/gitea-admin/v1/bin/gitea-admin-wrapper.sh git-credential-helper"
|
|
|
|
echo "[gitea-admin] init complete"
|