Skip to content

Commit ef6925a

Browse files
seonghobaeseonghobae
committed
ci(strix): repair applicator root and finalize gateway tree
1 parent ec5c784 commit ef6925a

1 file changed

Lines changed: 247 additions & 0 deletions

File tree

‎.github/workflows/recover-strix-orchestrator-final-tree-v2.yml‎

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
name: Recover final Strix gateway tree v2
2+
3+
on:
4+
push:
5+
branches:
6+
- feat/strix-orchestrator-free-zdr
7+
8+
permissions:
9+
contents: write
10+
pull-requests: write
11+
12+
concurrency:
13+
group: apply-strix-orchestrator-free-zdr-v3
14+
cancel-in-progress: false
15+
16+
jobs:
17+
recover:
18+
if: "${{ github.event.head_commit.message == 'ci(strix): repair applicator root and finalize gateway tree' }}"
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 30
21+
env:
22+
FEATURE_BRANCH: feat/strix-orchestrator-free-zdr
23+
REPOSITORY: ContextualWisdomLab/.github
24+
GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
25+
steps:
26+
- name: Harden runner
27+
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
28+
with:
29+
egress-policy: audit
30+
disable-file-monitoring: true
31+
32+
- name: Checkout exact feature branch
33+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
34+
with:
35+
ref: feat/strix-orchestrator-free-zdr
36+
fetch-depth: 0
37+
persist-credentials: true
38+
39+
- name: Recover or verify exact production tree
40+
shell: bash
41+
run: |
42+
set -euo pipefail
43+
starting_head="$(git rev-parse HEAD)"
44+
marker='Provision contextual-orchestrator Strix sidecar'
45+
bootstrap='scripts/ci/apply_strix_orchestrator_followup.py'
46+
47+
verify_tree() {
48+
test -f tests/test_strix_contextual_orchestrator_contract.py
49+
test -f docs/adr/0004-strix-contextual-orchestrator-authority.md
50+
test -f docs/doctoring/strix-contextual-orchestrator-gateway.md
51+
python3 tests/test_strix_contextual_orchestrator_contract.py
52+
bash scripts/ci/strix_required_workflow_smoke.sh
53+
bash -n scripts/ci/contextual_orchestrator_review_sidecar.sh
54+
python3 -m py_compile tests/test_strix_contextual_orchestrator_contract.py
55+
ruby -e 'require "yaml"; YAML.load_file(ARGV[0])' .github/workflows/strix.yml
56+
git diff --check
57+
}
58+
59+
temporary_paths=(
60+
.github/workflows/apply-strix-orchestrator-followup.yml
61+
.github/workflows/apply-strix-orchestrator-followup-v2.yml
62+
.github/workflows/apply-strix-orchestrator-followup-v3.yml
63+
.github/workflows/apply-strix-orchestrator-followup-v4.yml
64+
.github/workflows/finalize-strix-orchestrator-pr.yml
65+
.github/workflows/recover-strix-orchestrator-final-tree.yml
66+
.github/workflows/recover-strix-orchestrator-final-tree-v2.yml
67+
scripts/ci/apply_strix_orchestrator_followup.py
68+
)
69+
70+
commit_cleanup_fast_forward_only() {
71+
for temporary in "${temporary_paths[@]}"; do
72+
rm -f "$temporary"
73+
done
74+
git diff --check
75+
remote_head="$(git ls-remote origin "refs/heads/${FEATURE_BRANCH}" | awk '{print $1}')"
76+
if [ "$remote_head" != "$starting_head" ]; then
77+
echo "::error::Concurrent branch advance detected: expected ${starting_head}, live ${remote_head}; refusing overwrite."
78+
exit 1
79+
fi
80+
git config user.name 'ContextualWisdomLab Automation'
81+
git config user.email 'automation@contextualwisdomlab.invalid'
82+
git add -A
83+
if git diff --cached --quiet; then
84+
return 0
85+
fi
86+
git commit -m 'fix(strix): route default scans through contextual-orchestrator'
87+
git push origin "HEAD:${FEATURE_BRANCH}"
88+
}
89+
90+
if grep -Fq "$marker" .github/workflows/strix.yml; then
91+
verify_tree
92+
commit_cleanup_fast_forward_only
93+
exit 0
94+
fi
95+
96+
predecessor='2e1db527405f4ec10c9276d95aa85c80b568c62a'
97+
git cat-file -e "${predecessor}^{commit}"
98+
mkdir -p scripts/ci
99+
git show "${predecessor}:scripts/ci/apply_strix_orchestrator_followup.py" > "$bootstrap"
100+
101+
python3 - "$bootstrap" <<'PY'
102+
from pathlib import Path
103+
import re
104+
import sys
105+
106+
path = Path(sys.argv[1])
107+
text = path.read_text(encoding='utf-8')
108+
109+
function_pattern = re.compile(
110+
r"def replace_once\(path: Path, old: str, new: str\) -> None:\n"
111+
r".*?"
112+
r"(?=\n\ndef regex_once)",
113+
re.DOTALL,
114+
)
115+
replacement = '''def replace_once(path: Path, old: str, new: str) -> None:
116+
"""Replace every exact occurrence of one bootstrap-only tracked fragment."""
117+
118+
text = path.read_text(encoding="utf-8")
119+
count = text.count(old)
120+
if count < 1:
121+
raise SystemExit(
122+
f"{path.relative_to(ROOT)}: replacement anchor is absent: {old[:120]!r}"
123+
)
124+
path.write_text(text.replace(old, new), encoding="utf-8")'''
125+
text, count = function_pattern.subn(replacement, text, count=1)
126+
if count != 1:
127+
raise SystemExit(f'could not replace replace_once implementation: matches={count}')
128+
129+
cleanup_pattern = re.compile(
130+
r"def commit_verified_patch\(\) -> None:\n"
131+
r".*?"
132+
r"(?=\n\ndef main)",
133+
re.DOTALL,
134+
)
135+
cleanup_replacement = '''def commit_verified_patch() -> None:
136+
"""Delete temporary applicators and push one verified fast-forward commit."""
137+
138+
for temporary in (
139+
ROOT / ".github/workflows/apply-strix-orchestrator-followup.yml",
140+
ROOT / ".github/workflows/apply-strix-orchestrator-followup-v2.yml",
141+
ROOT / ".github/workflows/apply-strix-orchestrator-followup-v3.yml",
142+
ROOT / ".github/workflows/apply-strix-orchestrator-followup-v4.yml",
143+
ROOT / ".github/workflows/finalize-strix-orchestrator-pr.yml",
144+
ROOT / ".github/workflows/recover-strix-orchestrator-final-tree.yml",
145+
ROOT / ".github/workflows/recover-strix-orchestrator-final-tree-v2.yml",
146+
ROOT / "scripts/ci/apply_strix_orchestrator_followup.py",
147+
):
148+
if temporary.exists():
149+
temporary.unlink()
150+
run("git", "config", "user.name", "ContextualWisdomLab Automation")
151+
run("git", "config", "user.email", "automation@contextualwisdomlab.invalid")
152+
run("git", "add", "-A")
153+
run("git", "commit", "-m", "fix(strix): route default scans through contextual-orchestrator")
154+
run("git", "push", "origin", "HEAD:feat/strix-orchestrator-free-zdr")'''
155+
text, cleanup_count = cleanup_pattern.subn(cleanup_replacement, text, count=1)
156+
if cleanup_count != 1:
157+
raise SystemExit(f'could not replace cleanup implementation: matches={cleanup_count}')
158+
159+
path.write_text(text, encoding='utf-8')
160+
PY
161+
162+
python3 -m py_compile "$bootstrap"
163+
python3 "$bootstrap"
164+
165+
- name: Confirm remote final tree and prepare protected integration
166+
shell: bash
167+
run: |
168+
set -euo pipefail
169+
git fetch --no-tags origin "${FEATURE_BRANCH}"
170+
final_head="$(git rev-parse "origin/${FEATURE_BRANCH}")"
171+
git show "${final_head}:.github/workflows/strix.yml" | grep -Fq 'Provision contextual-orchestrator Strix sidecar'
172+
git show "${final_head}:tests/test_strix_contextual_orchestrator_contract.py" >/dev/null
173+
git show "${final_head}:docs/adr/0004-strix-contextual-orchestrator-authority.md" >/dev/null
174+
git show "${final_head}:docs/doctoring/strix-contextual-orchestrator-gateway.md" >/dev/null
175+
176+
for retired in \
177+
.github/workflows/apply-strix-orchestrator-followup.yml \
178+
.github/workflows/apply-strix-orchestrator-followup-v2.yml \
179+
.github/workflows/apply-strix-orchestrator-followup-v3.yml \
180+
.github/workflows/apply-strix-orchestrator-followup-v4.yml \
181+
.github/workflows/finalize-strix-orchestrator-pr.yml \
182+
.github/workflows/recover-strix-orchestrator-final-tree.yml \
183+
.github/workflows/recover-strix-orchestrator-final-tree-v2.yml \
184+
scripts/ci/apply_strix_orchestrator_followup.py; do
185+
if git cat-file -e "${final_head}:${retired}" 2>/dev/null; then
186+
echo "::error::Temporary applicator remains in final tree: ${retired}"
187+
exit 1
188+
fi
189+
done
190+
191+
body_file="$RUNNER_TEMP/pr-body.md"
192+
cat > "$body_file" <<EOF
193+
## Summary
194+
195+
Route normal required Strix scans through the pinned vendored
196+
\`contextual-orchestrator\` sidecar and its fail-closed
197+
\`orchestrator/free\` ZDR-first zero-cost pool.
198+
199+
- Provider credentials remain in the sidecar process-local KV.
200+
- Strix receives only a short-lived masked token and exact IPv4-loopback
201+
OpenAI-compatible endpoint.
202+
- Provider/model discovery and fallback have one authority: the gateway.
203+
- Direct NVIDIA NIM, OpenRouter, GitHub Models, OpenAI, and Vertex paths
204+
remain explicit \`repository_dispatch.strix_llm\` diagnostics.
205+
- Missing credentials, discovery failure, provider exhaustion, and
206+
incomplete reports remain non-passing.
207+
208+
## Exact-head evidence
209+
210+
- Head: \`${final_head}\`
211+
- RED contract observed against the predecessor direct-provider default.
212+
- GREEN workflow contract, bounded smoke, Bash syntax, Python compile,
213+
YAML parse, and diff hygiene passed before publication.
214+
- Every self-modifying bootstrap workflow and applicator is absent from
215+
the final tree.
216+
- No force push, self-approval, protection bypass, or provider-failure
217+
neutralization is used.
218+
219+
## Traceability
220+
221+
- \`docs/adr/0004-strix-contextual-orchestrator-authority.md\`
222+
- \`docs/doctoring/strix-contextual-orchestrator-gateway.md\`
223+
- \`docs/product-technical-gap-baseline.md\`
224+
- \`CHANGELOG.md\`
225+
- Figma File ID: N/A — central control-plane workflow, no UI.
226+
227+
Merge only after this unchanged head has terminal required Checks, no
228+
valid unresolved findings, and qualifying independent approval.
229+
EOF
230+
231+
pr_number="$(gh pr list --repo "$REPOSITORY" --state open --head "$FEATURE_BRANCH" --json number --jq '.[0].number // empty')"
232+
if [ -z "$pr_number" ]; then
233+
gh pr create --repo "$REPOSITORY" --base main --head "$FEATURE_BRANCH" \
234+
--title 'fix(strix): route default scans through contextual-orchestrator' \
235+
--body-file "$body_file" --draft
236+
pr_number="$(gh pr list --repo "$REPOSITORY" --state open --head "$FEATURE_BRANCH" --json number --jq '.[0].number // empty')"
237+
fi
238+
test -n "$pr_number"
239+
gh pr edit "$pr_number" --repo "$REPOSITORY" \
240+
--title 'fix(strix): route default scans through contextual-orchestrator' \
241+
--body-file "$body_file"
242+
if [ "$(gh pr view "$pr_number" --repo "$REPOSITORY" --json isDraft --jq '.isDraft')" = 'true' ]; then
243+
gh pr ready "$pr_number" --repo "$REPOSITORY"
244+
fi
245+
gh pr merge "$pr_number" --repo "$REPOSITORY" --auto --squash || \
246+
echo '::notice::Protected auto-merge was not enabled; live Checks and independent review remain authoritative.'
247+
echo "Prepared ${REPOSITORY}#${pr_number} at exact head ${final_head}."

0 commit comments

Comments
 (0)