feat-task-plane-add-Codex-worker-artifact-and-canary

2026-07-25 00:36:45 +08:00
parent 3d7ee3f5dc
commit 4a280bd64a
1 changed files with 114 additions and 0 deletions
@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""Build a no-.git, exact-commit Codex review worker artifact."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import shutil
+import subprocess
+import tarfile
+from pathlib import Path
+
+OID_RE = re.compile(r"^[0-9a-f]{40}$")
+SECRET_PATTERNS = (
+    re.compile(rb"Authorization:\s*Bearer\s+[A-Za-z0-9._~+/=-]{16,}", re.I),
+    re.compile(rb"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
+    re.compile(rb"(?:ghp|glpat)_[A-Za-z0-9_-]{20,}", re.I),
+)
+
+
+def sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as stream:
+        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def atomic_json(path: Path, payload: object) -> None:
+    temporary = path.with_suffix(path.suffix + ".tmp")
+    with temporary.open("w", encoding="utf-8", newline="\n") as stream:
+        json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
+        stream.write("\n")
+        stream.flush()
+        os.fsync(stream.fileno())
+    os.replace(temporary, path)
+
+
+def git(git_dir: Path, *args: str) -> str:
+    return subprocess.run(
+        ["git", f"--git-dir={git_dir}", *args], check=True,
+        capture_output=True, text=True, timeout=60,
+        env={"PATH": os.environ.get("PATH", "")},
+    ).stdout.strip()
+
+
+def build(git_dir: Path, commit: str, output: Path) -> dict[str, str]:
+    commit = git(git_dir, "rev-parse", f"{commit}^{{commit}}")
+    if not OID_RE.fullmatch(commit):
+        raise ValueError("exact commit OID required")
+    tree_oid = git(git_dir, "rev-parse", f"{commit}^{{tree}}")
+    if output.exists():
+        raise FileExistsError("output already exists")
+    output.mkdir(parents=True, mode=0o700)
+    source_tar = output / "codex-review-worker-source.tar"
+    subprocess.run(
+        ["git", f"--git-dir={git_dir}", "archive", "--format=tar", f"--output={source_tar}", commit],
+        check=True, timeout=120, env={"PATH": os.environ.get("PATH", "")},
+    )
+    source = output / "source"
+    source.mkdir(mode=0o700)
+    with tarfile.open(source_tar, "r") as archive:
+        archive.extractall(source, filter="data")
+    if any(item.name == ".git" for item in source.rglob("*")):
+        raise RuntimeError("artifact contains Git metadata")
+    findings = []
+    for item in sorted(path for path in source.rglob("*") if path.is_file() and path.stat().st_size < 5_000_000):
+        data = item.read_bytes()
+        if any(pattern.search(data) for pattern in SECRET_PATTERNS):
+            findings.append(item.relative_to(source).as_posix())
+    if findings:
+        raise RuntimeError("secret scan failed")
+    tracked = git(git_dir, "ls-tree", "-r", "--name-only", commit).splitlines()
+    files = [
+        {"path": name, "sha256": sha256(source / name), "size": (source / name).stat().st_size}
+        for name in tracked if (source / name).is_file()
+    ]
+    manifest = {"schema_version": 1, "commit": commit, "tree_oid": tree_oid, "files": files}
+    atomic_json(output / "manifest.json", manifest)
+    shutil.copyfile(source_tar, output / "rollback-source.tar")
+    unit = source / "deploy/systemd/aios-codex-review-test-worker.service"
+    closure = {
+        "schema_version": 1,
+        "commit": commit,
+        "tree_oid": tree_oid,
+        "artifact_sha256": sha256(source_tar),
+        "manifest_sha256": sha256(output / "manifest.json"),
+        "rollback_artifact_sha256": sha256(output / "rollback-source.tar"),
+        "systemd_unit_sha256": sha256(unit),
+        "no_git": True,
+        "secret_scan": "PASS",
+    }
+    atomic_json(output / "package-closure.json", closure)
+    closure["package_closure_sha256"] = sha256(output / "package-closure.json")
+    with (output / "checksums.sha256").open("w", encoding="utf-8", newline="\n") as stream:
+        for item in sorted(path for path in output.iterdir() if path.is_file() and path.name != "checksums.sha256"):
+            stream.write(f"{sha256(item)}  {item.name}\n")
+    return closure
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--git-dir", required=True, type=Path)
+    parser.add_argument("--commit", required=True)
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args()
+    print(json.dumps(build(args.git_dir.resolve(), args.commit, args.output.resolve()), sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())