From 52d96bd774a453cd9175f9a13f7469a1f91f2c67 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Nov 2026 03:58:53 +0000 Subject: [PATCH 1/2] Initial plan From f58af5f43282014bf7fae83defacd832cb93621a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Nov 2026 04:01:42 +0000 Subject: [PATCH 2/2] Resolve cached CLI revision through Git Co-authored-by: darrenoh <2293701+darrenoh@users.noreply.github.com> --- .github/workflows/update-devpanel-cli.yml | 23 +++++++++++++++-------- AGENTS.md | 4 ++-- README.md | 8 ++++---- TODO.md | 20 ++++++++++++++++---- 4 files changed, 37 insertions(+), 18 deletions(-) diff --git a/.github/workflows/update-devpanel-cli.yml b/.github/workflows/update-devpanel-cli.yml index 1b067831..de1ee17e 100644 --- a/.github/workflows/update-devpanel-cli.yml +++ b/.github/workflows/update-devpanel-cli.yml @@ -8,9 +8,9 @@ name: Update DevPanel CLI binaries # branch HEAD after both binaries are committed to this branch. Delete that # cache entry to rebuild the same commit. # -# The plan job queries GitLab's commits API; the build fetches the commit under RUNNER_TEMP. -# GITLAB_TOKEN needs read_api for the API and read_repository for Git fetches. -# GITLAB_USER is used to authenticate the Git fetch. +# The plan job resolves the default branch HEAD through Git; the build fetches +# that commit under RUNNER_TEMP. GITLAB_TOKEN needs read_repository access. +# GITLAB_USER and GITLAB_TOKEN authenticate Git requests. # The workflow token commits the binaries. on: @@ -36,19 +36,26 @@ jobs: id: upstream env: GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }} + GITLAB_USER: ${{ vars.GITLAB_USER }} + GIT_TERMINAL_PROMPT: "0" run: | set -euo pipefail if [[ -z "${GITLAB_TOKEN}" ]]; then echo "::error::GITLAB_TOKEN is required to read gitlab.com/devpanel-vn/cli." exit 1 fi + if [[ -z "${GITLAB_USER}" ]]; then + echo "::error::GITLAB_USER is required to authenticate to gitlab.com/devpanel-vn/cli." + exit 1 + fi - commits=$(curl --fail --silent --show-error \ - --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \ - "https://gitlab.com/api/v4/projects/devpanel-vn%2Fcli/repository/commits?per_page=1") - sha=$(jq -r '.[0].id // empty' <<< "$commits") + auth=$(printf '%s:%s' "${GITLAB_USER}" "${GITLAB_TOKEN}" | base64 -w0) + echo "::add-mask::${auth}" + head=$(git -c "http.https://gitlab.com/.extraheader=AUTHORIZATION: basic ${auth}" \ + ls-remote https://gitlab.com/devpanel-vn/cli.git HEAD) + sha=${head%%$'\t'*} if [[ ! "$sha" =~ ^[0-9a-f]{40}$ ]]; then - echo "::error::Unable to resolve the GitLab CLI default branch HEAD." + echo "::error::Unable to resolve the GitLab CLI default branch HEAD through Git." exit 1 fi echo "sha=${sha}" >> "$GITHUB_OUTPUT" diff --git a/AGENTS.md b/AGENTS.md index 76262305..4a2011be 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -129,10 +129,10 @@ Baseline JSON files in `tests/baselines/` track pre-existing lint violations per #### Workflows - **`docker-build.yml`** — triggered on pushes to `main` or `develop` and by manual `workflow_dispatch`; detects changed versions, builds images per-platform in parallel, and merges platform-specific digests into multi-arch manifests. -- **`update-devpanel-cli.yml`** — manual `workflow_dispatch` on branches only. Resolves the GitLab `devpanel-vn/cli` default branch HEAD and builds `base/bin/devpanel-amd64` and `base/bin/devpanel-arm64` in parallel on native runners from `cmd/devpanel-client` (the original binary's embedded package path; confirm against GitLab source). The Go version comes from upstream `go.mod`. A branch-specific Actions cache records the revision only after the workflow token commits both binaries. A new run cancels one already in progress. Upstream Git authentication is scoped to GitLab requests, not global configuration. +- **`update-devpanel-cli.yml`** — manual `workflow_dispatch` on branches only. Resolves the GitLab `devpanel-vn/cli` default branch HEAD through authenticated Git access and builds `base/bin/devpanel-amd64` and `base/bin/devpanel-arm64` in parallel on native runners from `cmd/devpanel-client` (the original binary's embedded package path; confirm against GitLab source). The Go version comes from upstream `go.mod`. A branch-specific Actions cache records the revision only after the workflow token commits both binaries. A new run cancels one already in progress. Upstream Git authentication is scoped to GitLab requests, not global configuration. - **`test.yml`** — runs YAML, shell, and Dockerfile linting plus build/run tests on pushes and pull requests. - Production images are tagged without suffix (e.g. `devpanel/php:8.3-base`); `develop` branch builds use the `-rc` suffix. -- Required repository secrets: `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`. Optional: `GHCR_TOKEN` (falls back to `GITHUB_TOKEN` for GHCR pushes). `update-devpanel-cli.yml` requires the service account's `GITLAB_TOKEN` with both `read_api` (for the commits API) and `read_repository` (for Git fetches) scopes, plus the `GITLAB_USER` repository variable containing that account's GitLab username. A deploy token with only `read_repository` cannot authenticate the API request. +- Required repository secrets: `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`. Optional: `GHCR_TOKEN` (falls back to `GITHUB_TOKEN` for GHCR pushes). `update-devpanel-cli.yml` requires `GITLAB_TOKEN` with `read_repository` access and the `GITLAB_USER` repository variable containing that account's GitLab username. ## Environment Variables (base images) diff --git a/README.md b/README.md index 61d09f18..9c47e1c7 100644 --- a/README.md +++ b/README.md @@ -301,10 +301,10 @@ for setup instructions. and skips subsequent builds on a cache hit. Delete that cache entry to rebuild the same commit. A new run cancels one already in progress. Set the `GITLAB_TOKEN` repository secret to the service account's GitLab - token with both `read_api` (for the commits API) and `read_repository` (for - Git fetches) scopes. Set the `GITLAB_USER` repository variable to the - service account's username. A deploy token with only `read_repository` is - insufficient because the workflow also queries the GitLab API. + token with `read_repository` access. Set the `GITLAB_USER` repository + variable to the service account's username. The workflow resolves the + default-branch HEAD using authenticated Git access, so it does not require + GitLab API access. The workflow token commits the binaries. GitLab credentials are scoped to GitLab Git requests and not stored in global Git configuration. The checkout is placed outside this repository. AMD64 and ARM64 binaries build in parallel diff --git a/TODO.md b/TODO.md index b86faf92..6d1989ee 100644 --- a/TODO.md +++ b/TODO.md @@ -107,12 +107,24 @@ Use this file to track work that needs to be done. Lint scripts automatically ap ## Steps - [x] Add a manual workflow based on `main`. The workflow token commits the binaries. -- [x] Resolve and cache the upstream default branch HEAD through the authenticated GitLab commits API, and skip revisions already built for the destination branch. +- [x] Resolve and cache the upstream default branch HEAD through authenticated Git access, and skip revisions already built for the destination branch. - [x] Build linux/amd64 and linux/arm64 in parallel on native runners, then commit both binaries. -- [x] Configure GitLab API and source-fetch authentication with the service account's `GITLAB_TOKEN` (`read_api` and `read_repository`) and `GITLAB_USER`. +- [x] Configure GitLab source-fetch authentication with the service account's `GITLAB_TOKEN` (`read_repository`) and `GITLAB_USER`. - [ ] Confirm `cmd/devpanel-client`, Go setup, build dependencies and smoke checks against the actual GitLab source. - [ ] Run the workflow with GitLab credentials and verify both binaries and revision caching. ## Definition of Done -- A cache miss resolves the latest default-branch commit through the GitLab API, builds both binaries on `ubuntu-26.04` and `ubuntu-26.04-arm`, and commits `base/bin/devpanel-amd64` and `base/bin/devpanel-arm64`. -- GitLab API access uses the service account's `GITLAB_TOKEN` with `read_api` and `read_repository` scopes plus its username in `GITLAB_USER`; the built revision is cached after the binaries are committed. +- A cache miss resolves the latest default-branch commit through authenticated Git access, builds both binaries on `ubuntu-26.04` and `ubuntu-26.04-arm`, and commits `base/bin/devpanel-amd64` and `base/bin/devpanel-arm64`. +- GitLab access uses the service account's `GITLAB_TOKEN` with `read_repository` access plus its username in `GITLAB_USER`; the built revision is cached after the binaries are committed. + +# Task: Fix cached DevPanel CLI revision lookup + +## Steps +- [x] Resolve the upstream default-branch HEAD through authenticated Git access instead of the GitLab commits API. +- [x] Update the workflow documentation to describe the revised GitLab credential requirements. +- [x] Run focused workflow/shell validation, scan changed files for secrets, and review the final diff. + +## Definition of Done +- The plan job gets the upstream default-branch HEAD using the same authenticated Git access required by the build. +- Documentation no longer requires `read_api` for the updater. +- Focused validation passes and changed files contain no secrets.