daarion-admin/microdao-daarion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Guard deploy workflow against stale origin on NODA1 #5

Merged
daarion-admin merged 1 commits from codex/deploy-origin-guard into main 2026-03-05 11:36:45 -08:00
Conversation 0 Commits 1 Files Changed 2 +4
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.gitea/workflows/deploy-node1-runtime.yml
View File

@@ -100,8 +100,11 @@ jobs:
"${SSH_USER}@${SSH_HOST}" \ "${SSH_USER}@${SSH_HOST}" \
"set -euo pipefail; \ "set -euo pipefail; \
cd /opt/microdao-daarion; \ cd /opt/microdao-daarion; \
origin_url=\$(git remote get-url origin 2>/dev/null || true); \
if [ -n \"\$(git status --porcelain)\" ]; then \ if [ -n \"\$(git status --porcelain)\" ]; then \
echo 'WARN: dirty git tree on NODA1; skip checkout/pull and continue with gate'; \ echo 'WARN: dirty git tree on NODA1; skip checkout/pull and continue with gate'; \
elif ! printf '%s' \"\$origin_url\" | grep -Eq 'daarion-admin/microdao-daarion(\\.git)?$'; then \
echo \"WARN: origin remote (\$origin_url) is not deploy-safe; skip checkout/pull and continue with gate\"; \
else \ else \
git fetch origin; \ git fetch origin; \
git checkout '${DEPLOY_REF:-main}'; \ git checkout '${DEPLOY_REF:-main}'; \

1
docs/ops/deploy_gate.md
View File

@@ -32,6 +32,7 @@ Required repo secrets:
- `redeploy_runtime=false` only syncs git on NODA1 and runs gate checks. - `redeploy_runtime=false` only syncs git on NODA1 and runs gate checks.
- `redeploy_runtime=true` recreates `gateway` and `experience-learner` containers. - `redeploy_runtime=true` recreates `gateway` and `experience-learner` containers.
- If NODA1 git tree is dirty, workflow skips checkout/pull and still enforces `phase6_gate` (safe mode for live nodes). - If NODA1 git tree is dirty, workflow skips checkout/pull and still enforces `phase6_gate` (safe mode for live nodes).
- If NODA1 `origin` remote is not the expected deploy-safe repo, workflow skips checkout/pull and still enforces `phase6_gate` (prevents accidental downgrade from a stale remote).
- Workflow uses SSH key validation and `IdentitiesOnly=yes` to avoid host key collisions. - Workflow uses SSH key validation and `IdentitiesOnly=yes` to avoid host key collisions.
## Expected PASS ## Expected PASS