From b682bdd5b09e671caa60f46a054f663e34550a6b Mon Sep 17 00:00:00 2001 From: Pigway Date: Sun, 11 Oct 2026 07:45:43 +0800 Subject: [PATCH] Use pinned official Actions without a public Tea mirror --- .github/workflows/verify.yml | 8 +++--- docs/deployment/GITEA_CD.md | 39 ++++++++++++++++-------------- tests/test_publication_security.py | 13 ++++++++++ 3 files changed, 38 insertions(+), 22 deletions(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index a0a48b7..b1c9560 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -22,8 +22,8 @@ jobs: DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }} DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }} steps: - - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4 - - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5 + - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.14' - name: Install CI dependencies with index diagnostics and fallback @@ -75,8 +75,8 @@ jobs: DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }} DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }} steps: - - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4 - - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5 + - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: python-version: '3.14' - name: Install deploy tooling diff --git a/docs/deployment/GITEA_CD.md b/docs/deployment/GITEA_CD.md index 41a16a5..e9f89d0 100644 --- a/docs/deployment/GITEA_CD.md +++ b/docs/deployment/GITEA_CD.md @@ -279,28 +279,31 @@ real host mounts and restart, remains the required live acceptance. ## Actions download transport -Verify and deploy fetch commit-pinned Actions from the supporting repository -`https://tea.pigway.com/way/frame-flow-ci-actions`, subdirectories `checkout` -and `setup-python`, at commit `bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46`. -This avoids unstable NAS downloads from GitHub (EOF/timeouts in runs 27/28) -and slow external Gitea Action preparation (run 29, superseded). +Verify and deploy reference official GitHub Actions directly, pinned to immutable +commits rather than moving tags: -The cache contains unmodified official upstream source, including MIT licenses: +| Action | Official upstream commit | +| --- | --- | +| actions/checkout v4 | 11d5960a326750d5838078e36cf38b85af677262 | +| actions/setup-python v5 | a26af69be951a213d495a4c3e4e4022e16d87065 | -| Action | Official upstream commit | Identical Git tree | -| --- | --- | --- | -| actions/checkout v4 | 11d5960a326750d5838078e36cf38b85af677262 | f8a7b72dc00648d050099727d25ca92a43ad1162 | -| actions/setup-python v5 | a26af69be951a213d495a4c3e4e4022e16d87065 | 568c6310706725a8b725497dbe6b3b909cbcf6cd | +The workflow uses explicit `https://github.com/actions/...` URLs so Gitea's +configured default Actions host cannot redirect downloads to the project owner's +server. Forks download Actions through their own Runner/network; no public action +mirror is served by this project. The former Tea auxiliary repository is private +and is no longer required by current workflows. -`UPSTREAM.json` records provenance. Upstream tag SHAs were checked using the official -GitHub API; each cached subtree hash was compared to the upstream commit tree. -No application secrets are stored in this public upstream-source cache; its own -Actions are disabled. Intentional action updates must repeat tree verification -and change the workflow pin. All validation steps remain unchanged. +Keep the NAS act_runner's existing action cache and Python toolcache persistent. +A new action URL or commit may require an initial download; an old mirror cache +is not automatically interchangeable with an upstream Git repository. Do not +prune Runner caches between jobs. Python toolcache misses still download Python +from its upstream release source. Network failures remain failures, never reasons +to skip validation or silently fall back to the owner's Tea server. -Python toolcache misses may still require setup-python to download Python from -its upstream release source. This removes Action source download dependence, -not every possible external download. No Runner or NAS network configuration is changed. +Administrators needing a mainland-specific download route can configure their +own Runner/network cache privately. Such settings must not introduce public +workflow references to a personal mirror. This change does not modify NAS VPN, +proxy, firewall or other applications. All validation and deploy gates remain. ### Synology Photos dependencies diff --git a/tests/test_publication_security.py b/tests/test_publication_security.py index fc7099e..01fd088 100644 --- a/tests/test_publication_security.py +++ b/tests/test_publication_security.py @@ -21,3 +21,16 @@ def test_private_production_configuration_uses_secrets(): ): assert "${{ secrets." + key + " }}" in workflow assert "${{ vars." + key + " }}" not in workflow + + +def test_actions_downloads_do_not_depend_on_personal_server(): + import re + + workflow = Path(".github/workflows/verify.yml").read_text() + actions = re.findall(r"uses:\s*(\S+)", workflow) + assert len(actions) == 4 + for action in actions: + assert re.fullmatch( + r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}", + action, + )