docs(P02): complete gitea-scrub-decisions phase (REQ-367, REQ-368, v1.28.2)

---ci--- project: acdl phase: 2 milestone: v1.29 status: complete ---/ci---
2026-08-20 05:16:53 +00:00
parent d247db3569
commit c19cc68d15
22 changed files with 125 additions and 1181 deletions
@@ -1,96 +0,0 @@
-#!/usr/bin/env python3
-"""scripts/attach_release_asset.py — upload one or more files as Gitea release
-attachments.
-
-REQ-228 (v1.18): PPTX (and any deck artifact) is attached to the phase's
-Gitea release. Uses the Gitea API:
-    POST /api/v1/repos/{owner}/{repo}/releases/{id}/assets
-multipart form: name=<filename>, attachment=<file bytes>
-
-REQ-270 (v1.23): supports dual PPTX attachment — the MARP PPTX (primary,
-attached first) and the python-pptx PPTX (comparison artifact). Multiple
-file paths are accepted; the first is the primary attachment.
-
-Usage:
-    python3 scripts/attach_release_asset.py <file-path> <release-id>
-    python3 scripts/attach_release_asset.py <file-path> <file-path-2>... <release-id>
-    python3 scripts/attach_release_asset.py docs/presentations/nova-autonomous-cloud-delivery.pptx 522
-    python3 scripts/attach_release_asset.py \
-        docs/presentations/nova-autonomous-cloud-delivery.pptx \
-        docs/presentations/nova-autonomous-cloud-delivery-python.pptx 522
-
-The last positional argument is always the release id; every preceding
-argument is an asset path (backward compatible with the single-asset call).
-
-Token resolution: reads NOVA_GITEA_TOKEN (or ACDL_GITEA_TOKEN) from .env.secrets
-/ .env, matching the ship_phase.sh pattern. Never uses shell env tokens.
-"""
-import os
-import sys
-import json
-import urllib.request
-import urllib.error
-from pathlib import Path
-
-GITEA_BASE = "https://git.cloudinit.dev"
-OWNER = "continuous-intelligence"
-REPO = "acdl"
-
-
-def resolve_token() -> str:
-    for fn in (".env.secrets", ".env"):
-        try:
-            for line in Path(fn).read_text().splitlines():
-                if line.startswith("NOVA_GITEA_TOKEN=") or line.startswith("ACDL_GITEA_TOKEN="):
-                    return line.split("=", 1)[1].strip()
-        except (FileNotFoundError, PermissionError):
-            continue
-    raise RuntimeError("No Gitea token found in .env.secrets or .env (NOVA_GITEA_TOKEN/ACDL_GITEA_TOKEN)")
-
-
-def attach_asset(file_path: str, release_id: str) -> dict:
-    token = resolve_token()
-    p = Path(file_path)
-    if not p.is_file():
-        raise FileNotFoundError(f"Asset file not found: {file_path}")
-
-    url = f"{GITEA_BASE}/api/v1/repos/{OWNER}/{REPO}/releases/{release_id}/assets"
-    filename = p.name
-
-    boundary = "----NovaBoundary7MAgYbk"
-    body = (
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="name"\r\n\r\n'
-        f"{filename}\r\n"
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="attachment"; filename="{filename}"\r\n'
-        f"Content-Type: application/octet-stream\r\n\r\n"
-    ).encode() + p.read_bytes() + f"\r\n--{boundary}--\r\n".encode()
-
-    req = urllib.request.Request(
-        url,
-        data=body,
-        headers={
-            "Authorization": f"token {token}",
-            "Content-Type": f"multipart/form-data; boundary={boundary}",
-        },
-        method="POST",
-    )
-    try:
-        resp = urllib.request.urlopen(req, timeout=60)
-        return json.loads(resp.read())
-    except urllib.error.HTTPError as e:
-        err = e.read().decode()[:300]
-        raise RuntimeError(f"HTTP {e.code} attaching {filename} to release {release_id}: {err}") from e
-
-
-if __name__ == "__main__":
-    if len(sys.argv) < 3:
-        print("Usage: attach_release_asset.py <file-path> [<file-path-2>...] <release-id>")
-        sys.exit(1)
-    asset_paths = sys.argv[1:-1]
-    release_id = sys.argv[-1]
-    for idx, path in enumerate(asset_paths):
-        result = attach_asset(path, release_id)
-        primary = " (primary)" if idx == 0 and len(asset_paths) > 1 else ""
-        print(f"Attached{primary}: {result.get('name')} → release {release_id} (asset id {result.get('id')})")
@@ -6,25 +6,19 @@
 #   1. List nova-spike-runner's access keys.
 #   2. Create a new key.
 #   3. Write the new key to gitignored .env.secrets (chmod 600).
-#   4. Upload the new key to the consumer's Actions secret store + verify
-#      (GET) that it propagated (SPEC §5.9 idempotency).
-#   5. Deactivate + delete the old key(s) ONLY after the upload is verified.
-#      If the upload/verify fails, the old key stays Active + the run exits
-#      non-zero (the consumer's deploy keeps a working credential).
+#   4. Deactivate + delete the old key(s).
 #
-# Env vars (forge coords): NOVA_FORGE_TOKEN / NOVA_FORGE_BASE_URL /
-# NOVA_FORGE_OWNER / NOVA_CONSUMER_REPO (the scheduled workflow passes these
-# forge-agnostic names, REQ-230). NOVA_GITEA_* are a backward-compat
-# fallback for ad-hoc local runs.
-#
-# Idempotent: re-running always ends with exactly 1 active key for the user
-# (once the new key has propagated to the secret store).
+# Idempotent: re-running always ends with exactly 1 active key for the user.
 # Does NOT rotate the bootstrap root key (D-034 closure = manual user step).
 #
 # Spike scope (D-039): the spike user key is per-run-rotated; real OIDC is
-# v1.2 (blocked on go-gitea/gitea#36988).
+# v1.2.
 # Nova rebrand (P4, REQ-163): IAM user renamed acdl-spike-runner →
 # nova-spike-runner.
+# D-232 (v1.29): the forge Actions secret-store upload was dev-forge-only
+# and has been removed with the forge-parity retirement. The rotated key
+# is written to .env.secrets only; the consumer's deploy reads it from
+# there.
 set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
@@ -72,10 +66,6 @@ new_id = new["AccessKeyId"]
 new_secret = new["SecretAccessKey"]
 print(f"iam: created new key {new_id} for {user}", file=sys.stderr)

-# Deactivation of the old keys is deferred to AFTER the new key propagates
-# to the Gitea Actions secret store (SPEC §5.9 idempotency — see below).
-# Writing .env.secrets first keeps the local operator's working key current.
-
 # Write the new key to gitignored .env.secrets (chmod 600).
 # Nova rebrand (P2): keys are NOVA_*; the ACDL_* legacy keys are the
 # dual-read fallback source until P5 (kept as comments in .env.secrets).
@@ -86,106 +76,15 @@ with open(env_file, "w") as fh:
 os.chmod(env_file, 0o600)
 print(f"rotated key written to {env_file} (chmod 600)", file=sys.stderr)

-# Upload the new key to the consumer's Actions secret store BEFORE
-# deactivating the old key (SPEC §5.9 — idempotency: the old key is
-# deactivated only after the new one propagates). If the upload or the
-# post-upload verification fails, the old key is left Active so the
-# consumer's deploy still has a working credential; the run exits non-zero
-# so the scheduled workflow surfaces the failure (rather than silently
-# stranding the consumer with a key that never reached the secret store).
-#
-# Forge + consumer coords come from env vars. The scheduled workflow passes
-# forge-agnostic NOVA_FORGE_* names (REQ-230 — no forge hostnames in the
-# synced workflow file); NOVA_GITEA_* are accepted as a backward-compat
-# fallback for ad-hoc local runs. Defaults keep the legacy platform-repo
-# target when nothing is set.
-# Dual-read token: NOVA_FORGE_TOKEN preferred, NOVA_GITEA_TOKEN fallback (G-106).
-gitea_token = os.environ.get("NOVA_FORGE_TOKEN") or os.environ.get("NOVA_GITEA_TOKEN")
-gitea_base = (
-    os.environ.get("NOVA_FORGE_BASE_URL")
-    or os.environ.get("NOVA_GITEA_BASE_URL")
-    or "https://git.cloudinit.dev"
-).rstrip("/")
-gitea_owner = (
-    os.environ.get("NOVA_FORGE_OWNER")
-    or os.environ.get("NOVA_GITEA_OWNER")
-    or "continuous-intelligence"
-)
-gitea_repo = (
-    os.environ.get("NOVA_CONSUMER_REPO")
-    or os.environ.get("NOVA_GITEA_REPO")
-    or "acdl"
-)
-secrets_api = f"{gitea_base}/api/v1/repos/{gitea_owner}/{gitea_repo}/actions/secrets"
-
-if gitea_token:
-    import urllib.request
-    import urllib.error
-    import time
-
-    def _put_secret(name, value):
-        req = urllib.request.Request(
-            f"{secrets_api}/{name}",
-            data=json.dumps({"value": value}).encode(),
-            method="PUT",
-            headers={"Authorization": f"token {gitea_token}",
-                     "Content-Type": "application/json"},
-        )
-        urllib.request.urlopen(req).read()
-        print(f"gitea: secret {name} uploaded to {gitea_owner}/{gitea_repo}", file=sys.stderr)
-
-    def _verify_secret(name):
-        # Gitea does not return secret *values*; a 200 confirms the secret
-        # exists with the expected name. Retry briefly so eventual
-        # consistency on the secrets API settles (observed sub-second lag).
-        for attempt in range(5):
-            req = urllib.request.Request(
-                f"{secrets_api}/{name}",
-                method="GET",
-                headers={"Authorization": f"token {gitea_token}"},
-            )
-            try:
-                with urllib.request.urlopen(req) as resp:
-                    if resp.status == 200:
-                        print(f"gitea: secret {name} verified present", file=sys.stderr)
-                        return True
-            except urllib.error.HTTPError as e:
-                if e.code == 404:
-                    time.sleep(0.5)
-                    continue
-                raise
-        return False
-
-    try:
-        _put_secret("NOVA_AWS_ACCESS_KEY_ID", new_id)
-        _put_secret("NOVA_AWS_SECRET_ACCESS_KEY", new_secret)
-        ok = _verify_secret("NOVA_AWS_ACCESS_KEY_ID") and \
-            _verify_secret("NOVA_AWS_SECRET_ACCESS_KEY")
-        if not ok:
-            raise RuntimeError("gitea secret verification failed (404 after PUT)")
-    except Exception as e:
-        # Upload/verify failed: leave the old key Active so the consumer's
-        # deploy still works. Surface non-zero so the schedule is noisy.
-        print(f"gitea: secret upload/verify FAILED ({e}); old key left Active", file=sys.stderr)
-        sys.exit(2)
-else:
-    print("gitea: NOVA_FORGE_TOKEN/NOVA_GITEA_TOKEN not set; secret upload skipped (v1.2 hardening)", file=sys.stderr)
-    # No forge target → the new key is already in .env.secrets, so the
-    # operator's local env works. The old key is deactivated below so the
-    # user ends with exactly 1 active key (D-039 local-rotation contract).
-
-# Deactivate + delete the old keys. When a forge token was set, this runs
-# ONLY after the new key propagated to the consumer's secret store (the
-# sys.exit(2) above prevents reaching here on upload/verify failure). When
-# no token was set, the new key is already in .env.secrets so deactivating
-# is safe (D-039 local-rotation contract).
+# Deactivate + delete the old keys. The new key is already in .env.secrets
+# so deactivating is safe (D-039 local-rotation contract).
 for k in active:
    old_id = k["AccessKeyId"]
    if old_id == new_id:
        continue
    iam.update_access_key(UserName=user, AccessKeyId=old_id, Status="Inactive")
    iam.delete_access_key(UserName=user, AccessKeyId=old_id)
-    print(f"iam: deactivated+deleted old key {old_id} (after propagation)", file=sys.stderr)
+    print(f"iam: deactivated+deleted old key {old_id}", file=sys.stderr)

 print(f"OK: {user} now has exactly 1 active key: {new_id}")
 PY
@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# scripts/ship_phase.sh — internal CIAgent per-phase ship helper (v1.16)
-# Usage: bash scripts/ship_phase.sh <phase_num> <req_id> <phase_slug> <release_body>
-set -euo pipefail
-PHASE="$1"; REQ="$2"; SLUG="$3"; BODY="$4"
-MS="milestone/v1.16-nova-simplification"
-BR="phase/$(printf '%02d' "$PHASE")-${SLUG}"
-cd "$(git rev-parse --show-toplevel)"
-git checkout "$MS" 2>/dev/null
-git merge --squash "$BR" 2>&1 | tail -2
-MSG="verify(P${PHASE}): ${SLUG} — 4-layer verify PASS + ship
-
-${BODY}
-
---ci---
-project: acdl
-phase: ${PHASE}
-milestone: v1.16
-status: complete
-phase_role: execution
-requirements:
-  covered: [${REQ}]
-  partial: []
---/ci---"
-git commit -q -m "$MSG"
-PREV=$(git tag -l "v1.15.*" --sort=-version:refname | head -1)
-PATCH=$(($(echo "$PREV" | sed 's/v1.15.//')))
-NEWPATCH=$((PATCH + 1))
-TAG="v1.15.${NEWPATCH}"
-git tag -a "$TAG" -m "${TAG}: v1.16 P${PHASE} — ${SLUG}"
-git push origin "$MS" --tags 2>&1 | grep -E "new tag|new branch" | head -2
-python3 - "$TAG" "$PREV" <<'PYEOF'
-import json, subprocess, sys, urllib.request, urllib.error
-tag, prev = sys.argv[1], sys.argv[2]
-tok = [l.split("=",1)[1].strip() for l in open(".env.secrets") if l.startswith("NOVA_GITEA_TOKEN=")][0]
-body = subprocess.check_output(["git","log",f"{prev}..{tag}","--oneline"]).decode()
-payload = {"tag_name":tag,"name":f"Nova {tag} — v1.16 P{tag.split('.')[-1]}","body":body}
-req = urllib.request.Request("https://git.cloudinit.dev/api/v1/repos/continuous-intelligence/acdl/releases", data=json.dumps(payload).encode(), headers={"Authorization":f"token {tok}","Content-Type":"application/json"}, method="POST")
-try:
-    r = urllib.request.urlopen(req, timeout=30); d = json.loads(r.read()); print(f"release_id: {d.get('id')}  tag: {tag}")
-except urllib.error.HTTPError as e:
-    if e.code == 409: print(f"release exists for {tag}")
-    else: print(f"HTTP {e.code}: {e.read().decode()[:120]}")
-except Exception as e: print(f"ERROR: {e}")
-PYEOF
-echo "SHIPPED ${TAG}"
@@ -102,7 +102,6 @@ DOMAINS=(
 EXCLUDE_SCRIPTS=(
  sync_to_gl.sh
  sync_to_nova.sh
-  ship_phase.sh
  update_atelier_vendor.sh
  post_stage_comment.sh
  rotate_spike_key.sh
@@ -114,8 +113,6 @@ EXCLUDE_SCRIPTS=(
  untag_acdl_keys.py
  seed_uptime_monitors.py
  push_consumer_image.py
-  sync_workflows.py
-  attach_release_asset.py
  check_north_star_diff.sh
  render_slides.sh
 )
@@ -198,7 +195,6 @@ echo ""
 # Hidden dirs/files in SRC that are NOT consumer-facing. .github is kept.
 EXCLUDES=(
  --exclude=/.ciagent
-  --exclude=/.gitea
  --exclude=/.env
  --exclude=/.env.secrets
  --exclude=/.coverage
@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-"""Sync byte-identical workflows from workflows-src/ to .gitea/ + .github/ (P8, REQ-172).
-
-Three workflow pairs are byte-identical Gitea + GitHub mirrors:
-  ci.yml, deploy.yml, modules-lifecycle.yml, rotate-aws-key.yml.
-
-This generator reads the single source from ``workflows-src/<name>`` and
-writes byte-identical copies to both ``.gitea/workflows/<name>`` and
-``.github/workflows/<name>``. Use ``--check`` to verify the committed
-files match the generated output (CI gate); use ``--write`` to regenerate
-the committed files from the sources.
-
-The 4 GitHub-only workflows (platform-test.yml, primitives-plan.yml,
-patterns-plan.yml, release.yml) have no Gitea mirror (act_runner feature
-gaps) and are NOT touched by this generator.
-"""
-from __future__ import annotations
-
-import argparse
-import filecmp
-import sys
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parent.parent
-SRC_DIR = ROOT / "workflows-src"
-GITEA_DIR = ROOT / ".gitea" / "workflows"
-GITHUB_DIR = ROOT / ".github" / "workflows"
-
-PAIRS = ["ci.yml", "deploy.yml", "modules-lifecycle.yml", "rotate-aws-key.yml"]
-
-
-def _read_source(name: str) -> str:
-    src = SRC_DIR / name
-    if not src.is_file():
-        raise FileNotFoundError(f"source {src} missing")
-    return src.read_text()
-
-
-def check() -> int:
-    """Verify committed files match the sources. Exit 0 if clean, 1 if drift."""
-    drift = []
-    for name in PAIRS:
-        content = _read_source(name)
-        for dest_dir in (GITEA_DIR, GITHUB_DIR):
-            dest = dest_dir / name
-            if not dest.is_file():
-                drift.append(f"{dest} MISSING (expected from workflows-src/{name})")
-                continue
-            if dest.read_text() != content:
-                drift.append(f"{dest} DRIFTED from workflows-src/{name}")
-    if drift:
-        for d in drift:
-            print(f"DRIFT: {d}", file=sys.stderr)
-        print("\nRun: python3 scripts/sync_workflows.py --write", file=sys.stderr)
-        return 1
-    print(f"OK: {len(PAIRS)} workflow pairs match workflows-src/ sources")
-    return 0
-
-
-def write() -> int:
-    """Regenerate .gitea/ + .github/ from workflows-src/ sources."""
-    for name in PAIRS:
-        content = _read_source(name)
-        for dest_dir in (GITEA_DIR, GITHUB_DIR):
-            dest_dir.mkdir(parents=True, exist_ok=True)
-            (dest_dir / name).write_text(content)
-        print(f"wrote: .gitea/workflows/{name} + .github/workflows/{name}")
-    return 0
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(description="Sync byte-identical workflow pairs.")
-    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument("--check", action="store_true", help="verify committed files match sources (CI gate)")
-    group.add_argument("--write", action="store_true", help="regenerate committed files from sources")
-    args = parser.parse_args(argv)
-    if args.check:
-        return check()
-    return write()
-
-
-if __name__ == "__main__":
-    sys.exit(main())