way/pigway-frame-flow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 29 Wiki Activity

Use pinned official Actions without a public Tea mirror

Browse Source
This commit is contained in:
Pigway
2026-10-11 07:45:43 +08:00
parent d109ad6ff1
commit b682bdd5b0
3 changed files with 38 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/verify.yml
+4 -4
View File
@@ -22,8 +22,8 @@ jobs:
DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }} DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }} DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
steps: steps:
- uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4 - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5 - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with: with:
python-version: '3.14' python-version: '3.14'
- name: Install CI dependencies with index diagnostics and fallback - name: Install CI dependencies with index diagnostics and fallback
@@ -75,8 +75,8 @@ jobs:
DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }} DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }} DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
steps: steps:
- uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4 - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5 - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with: with:
python-version: '3.14' python-version: '3.14'
- name: Install deploy tooling - name: Install deploy tooling
docs/deployment/GITEA_CD.md
+21 -18
View File
@@ -279,28 +279,31 @@ real host mounts and restart, remains the required live acceptance.
## Actions download transport ## Actions download transport
Verify and deploy fetch commit-pinned Actions from the supporting repository Verify and deploy reference official GitHub Actions directly, pinned to immutable
`https://tea.pigway.com/way/frame-flow-ci-actions`, subdirectories `checkout` commits rather than moving tags:
and `setup-python`, at commit `bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46`.
This avoids unstable NAS downloads from GitHub (EOF/timeouts in runs 27/28)
and slow external Gitea Action preparation (run 29, superseded).
The cache contains unmodified official upstream source, including MIT licenses: | Action | Official upstream commit |
| --- | --- |
| actions/checkout v4 | 11d5960a326750d5838078e36cf38b85af677262 |
| actions/setup-python v5 | a26af69be951a213d495a4c3e4e4022e16d87065 |
| Action | Official upstream commit | Identical Git tree | The workflow uses explicit `https://github.com/actions/...` URLs so Gitea's
| --- | --- | --- | configured default Actions host cannot redirect downloads to the project owner's
| actions/checkout v4 | 11d5960a326750d5838078e36cf38b85af677262 | f8a7b72dc00648d050099727d25ca92a43ad1162 | server. Forks download Actions through their own Runner/network; no public action
| actions/setup-python v5 | a26af69be951a213d495a4c3e4e4022e16d87065 | 568c6310706725a8b725497dbe6b3b909cbcf6cd | mirror is served by this project. The former Tea auxiliary repository is private
and is no longer required by current workflows.
`UPSTREAM.json` records provenance. Upstream tag SHAs were checked using the official Keep the NAS act_runner's existing action cache and Python toolcache persistent.
GitHub API; each cached subtree hash was compared to the upstream commit tree. A new action URL or commit may require an initial download; an old mirror cache
No application secrets are stored in this public upstream-source cache; its own is not automatically interchangeable with an upstream Git repository. Do not
Actions are disabled. Intentional action updates must repeat tree verification prune Runner caches between jobs. Python toolcache misses still download Python
and change the workflow pin. All validation steps remain unchanged. from its upstream release source. Network failures remain failures, never reasons
to skip validation or silently fall back to the owner's Tea server.
Python toolcache misses may still require setup-python to download Python from Administrators needing a mainland-specific download route can configure their
its upstream release source. This removes Action source download dependence, own Runner/network cache privately. Such settings must not introduce public
not every possible external download. No Runner or NAS network configuration is changed. workflow references to a personal mirror. This change does not modify NAS VPN,
proxy, firewall or other applications. All validation and deploy gates remain.
### Synology Photos dependencies ### Synology Photos dependencies
tests/test_publication_security.py
+13
View File
@@ -21,3 +21,16 @@ def test_private_production_configuration_uses_secrets():
): ):
assert "${{ secrets." + key + " }}" in workflow assert "${{ secrets." + key + " }}" in workflow
assert "${{ vars." + key + " }}" not in workflow assert "${{ vars." + key + " }}" not in workflow
def test_actions_downloads_do_not_depend_on_personal_server():
import re
workflow = Path(".github/workflows/verify.yml").read_text()
actions = re.findall(r"uses:\s*(\S+)", workflow)
assert len(actions) == 4
for action in actions:
assert re.fullmatch(
r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",
action,
)