feat: stronghold-seed 工作流（迁移批次一） - #508
Merged
Merged
Conversation
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
There was a problem hiding this comment.
🟡 Changes recommended
The workflow currently has confirmed path/verification issues that will break execution and/or allow a mismatch to pass without failing the job.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR adds a manually triggered GitHub Actions workflow to perform “stronghold-seed” migration batch #1: fetch 10 holdout archive entries + index snapshot, generate a genesis ledger record (hash-chain), push the seeded content into CNB stronghold, and then verify the pushed archive via sha256.
Changes:
- Introduces a new
workflow_dispatchworkflow to assemble holdout archives and an index snapshot into a staged directory. - Generates a genesis ledger entry (
ledger/stronghold.jsonl) and seeds the target CNB repo by cloning/committing/pushing. - Performs a post-push content readback and sha256 comparison (verification step).
File summaries
| File | Description |
|---|---|
| .github/workflows/stronghold-seed.yml | New workflow to seed CNB stronghold with holdout archive + ledger genesis and verify the result. |
Review details
Suppressed comments (1)
.github/workflows/stronghold-seed.yml:84
- The post-push verification reads the local file from
../stage/...(wrong relative path aftercd repo) and printsMISMATCHwithout failing the job. This makes verification non-enforcing and can allow a bad seed to pass green.
req = urllib.request.Request('https://api.cnb.cool/Cloudbird-Software/stronghold/-/git/raw/main/answers/holdout-full-archive.jsonl',
headers={'User-Agent': 'seed', 'Authorization': 'Bearer ' + os.environ['CNB_TOKEN']})
with urllib.request.urlopen(req, timeout=60) as r:
remote = r.read()
local = open('../stage/answers/holdout-full-archive.jsonl', 'rb').read()
print('VERIFY', 'OK' if hashlib.sha256(remote).hexdigest() == hashlib.sha256(local).hexdigest() else 'MISMATCH')
print('remote entries:', len(remote.decode('utf-8').strip().splitlines()))
- Files reviewed: 1/1 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+63
to
+65
| cd repo | ||
| git config user.email randypanding@users.noreply.github.com && git config user.name randypanding | ||
| cp -r ../stage/answers ../stage/ledger ../stage/README.md . |
| cd repo | ||
| git config user.email randypanding@users.noreply.github.com && git config user.name randypanding | ||
| cp -r ../stage/answers ../stage/ledger ../stage/README.md . | ||
| git add -A && git commit -qm 'seed: holdout 全量档案+台账 genesis（迁移批次一，ADR-0108/S-7，EX-SEED）' |
Comment on lines
+67
to
+74
| CH='!f(){ echo username=oauth2; echo password="$CNB_TOKEN"; };f' | ||
| if ! git -c credential.helper="$CH" push -q -u origin HEAD:main --force 2>/dev/null; then | ||
| CH='!f(){ echo username=P11; echo password="$CNB_TOKEN"; };f' | ||
| if ! git -c credential.helper="$CH" push -q -u origin HEAD:main --force 2>/dev/null; then | ||
| CH='!f(){ echo username="$CNB_TOKEN"; echo password=x-oauth-basic; };f' | ||
| git -c credential.helper="$CH" push -q -u origin HEAD:main --force | ||
| fi | ||
| fi |
| CNB_TOKEN: ${{ secrets.CNB_TOKEN_P11 }} | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| set -eu |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR-0108/S-7 已落地（stronghold 建仓 201，P11）。本工作流=迁移批次一：holdout 十条全量档案+索引快照入 stronghold（真值区），台账 genesis（hash 链同 fractures/LEDGER 公式），推送后回读 sha256 对账。凭据经 credential helper（INV-04 零明文）。批次二（GitHub 侧字段级剥离+sealed 指针+unseal 重定向）另行执行。