refactor: retire git mirror runtime

scripts/src/ci-plan-lib.mjs

@@ -15,7 +15,7 @@ import { parseStructuredConfig, readStructuredFileIfPresent } from "./structured
 const execFileAsync = promisify(execFile);
 
 export const CI_PLAN_VERSION = "v1";
-export const ENV_REUSE_RUNTIME_MODE = "env-reuse-git-mirror-checkout";
+export const ENV_REUSE_RUNTIME_MODE = "env-reuse-gitea-checkout";
 export const V02_ENV_REUSE_RUNTIME_MODE = ENV_REUSE_RUNTIME_MODE;
 
 export const DEFAULT_RUNTIME_DEP_PATHS = Object.freeze([

scripts/src/gitops-render/core.mjs

@@ -29,10 +29,10 @@ const defaultOutDir = "deploy/gitops/node";
 const defaultRegistryPrefix = process.env.HWLAB_NODE_REGISTRY_PREFIX || "127.0.0.1:5000/hwlab";
 const defaultSourceRepo = process.env.HWLAB_NODE_GIT_URL || "git@github.com:pikasTech/HWLAB.git";
 const defaultGitReadUrl = process.env.HWLAB_NODE_GIT_READ_URL || null;
-const defaultV02GitReadUrl = process.env.HWLAB_V02_GIT_READ_URL || "http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB.git";
-const defaultV02GitWriteUrl = process.env.HWLAB_V02_GIT_WRITE_URL || "http://git-mirror-write.devops-infra.svc.cluster.local/pikasTech/HWLAB.git";
+const defaultV02GitReadUrl = process.env.HWLAB_V02_GIT_READ_URL || "http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git";
+const defaultV02GitWriteUrl = process.env.HWLAB_V02_GIT_WRITE_URL || defaultV02GitReadUrl;
 const defaultRuntimeLaneGitReadUrl = process.env.HWLAB_RUNTIME_LANE_GIT_READ_URL || "http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git";
-const defaultRuntimeLaneGitWriteUrl = process.env.HWLAB_RUNTIME_LANE_GIT_WRITE_URL || defaultV02GitWriteUrl;
+const defaultRuntimeLaneGitWriteUrl = process.env.HWLAB_RUNTIME_LANE_GIT_WRITE_URL || defaultRuntimeLaneGitReadUrl;
 const defaultBranch = process.env.HWLAB_NODE_BRANCH || "node";
 const defaultGitopsBranch = process.env.HWLAB_NODE_GITOPS_BRANCH || "node-gitops";
 const defaultCatalogPath = process.env.HWLAB_ARTIFACT_CATALOG_PATH || "deploy/artifact-catalog.dev.json";
@@ -44,7 +44,7 @@ const defaultV02RuntimeEndpoint = process.env.HWLAB_V02_RUNTIME_ENDPOINT || "htt
 const defaultV02WebEndpoint = process.env.HWLAB_V02_WEB_ENDPOINT || "https://hwlab.74-48-78-17.nip.io";
 const defaultProxyUrl = process.env.HWLAB_NODE_PROXY_URL || "http://127.0.0.1:10808";
 const defaultAllProxyUrl = process.env.HWLAB_NODE_ALL_PROXY_URL || "socks5h://127.0.0.1:10808";
-const defaultNoProxy = process.env.HWLAB_NODE_NO_PROXY || "hyueapi.com,.hyueapi.com,127.0.0.1,localhost,::1,10.0.0.0/8,10.42.0.0/16,10.43.0.0/16,192.168.0.0/16,.svc,.cluster.local,kubernetes.default.svc,registry.hwlab-ci.svc,hwlab-registry.hwlab-ci.svc,git-mirror-http,git-mirror-http.devops-infra,git-mirror-http.devops-infra.svc,git-mirror-http.devops-infra.svc.cluster.local,git-mirror-write,git-mirror-write.devops-infra,git-mirror-write.devops-infra.svc,git-mirror-write.devops-infra.svc.cluster.local";
+const defaultNoProxy = process.env.HWLAB_NODE_NO_PROXY || "hyueapi.com,.hyueapi.com,127.0.0.1,localhost,::1,10.0.0.0/8,10.42.0.0/16,10.43.0.0/16,192.168.0.0/16,.svc,.cluster.local,kubernetes.default.svc,registry.hwlab-ci.svc,hwlab-registry.hwlab-ci.svc,gitea-http,gitea-http.devops-infra,gitea-http.devops-infra.svc,gitea-http.devops-infra.svc.cluster.local";
 const ciToolsRunnerImage = process.env.HWLAB_NODE_CI_TOOLS_IMAGE || "127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1";
 const buildkitRunnerImage = process.env.HWLAB_NODE_BUILDKIT_IMAGE || "moby/buildkit:rootless";
 const defaultDevBaseImage = process.env.HWLAB_NODE_DEV_BASE_IMAGE || "127.0.0.1:5000/hwlab/hwlab-node20-base:20-bookworm-slim";

scripts/src/gitops-render/infra-manifests.mjs

@@ -1,17 +1,3 @@
-import assert from "node:assert/strict";
-
-import {
-  ciToolsRunnerImage,
-  configObject,
-  defaultOutDir,
-  label,
-  optionalConfigString,
-  requiredConfigPositiveInteger,
-  requiredConfigString,
-  runtimeLaneMirrorSpecs
-} from "./core.mjs";
-import { renderTemplate, shellSingleQuote } from "./tekton-scripts.mjs";
-
 function registryManifest() {
   return {
     apiVersion: "v1",
@@ -55,200 +41,6 @@ function registryManifest() {
   };
 }
 
-function uniqueStrings(values) {
-  return Array.from(new Set(values.filter((value) => typeof value === "string" && value.length > 0)));
-}
-
-function renderGitMirrorSshPrelude({ direct, proxySummary, proxyCommand, proxyUrl, proxyNoProxy }) {
-  if (direct) {
-    return renderTemplate("git-mirror-ssh-direct.sh", {
-      "__HWLAB_PROXY_SUMMARY_SHELL__": shellSingleQuote(proxySummary)
-    });
-  }
-  return renderTemplate("git-mirror-ssh-proxied.sh", {
-    "// __HWLAB_GIT_MIRROR_PROXY_CONNECT_MJS__": renderTemplate("git-mirror-proxy-connect.mjs"),
-    "__HWLAB_PROXY_SUMMARY_SHELL__": shellSingleQuote(proxySummary),
-    "__HWLAB_PROXY_COMMAND_SHELL__": shellSingleQuote(proxyCommand),
-    "__HWLAB_PROXY_URL_SHELL__": shellSingleQuote(proxyUrl),
-    "__HWLAB_PROXY_NO_PROXY_SHELL__": shellSingleQuote(proxyNoProxy)
-  });
-}
-
-function gitMirrorConfigScripts({
-  fetchConfigCommands,
-  gitMirrorSshPrelude,
-  gitopsBranchArgs,
-  gitopsBranchesJson,
-  mirrorBranchesJson,
-  requiredRefArgs,
-  sourceBranchArgs,
-  sourceBranchesJson,
-  sourceSnapshotRefPrefix
-}) {
-  const gitopsBranchesJsonShell = shellSingleQuote(gitopsBranchesJson);
-  return {
-    "sync.sh": renderTemplate("git-mirror-sync.sh", {
-      "# __HWLAB_GIT_MIRROR_SSH_PRELUDE__": gitMirrorSshPrelude,
-      "__HWLAB_SOURCE_SNAPSHOT_REF_PREFIX_SHELL__": shellSingleQuote(sourceSnapshotRefPrefix),
-      "# __HWLAB_FETCH_CONFIG_COMMANDS__": fetchConfigCommands,
-      "__HWLAB_REQUIRED_REF_ARGS__": requiredRefArgs,
-      "__HWLAB_SOURCE_BRANCH_ARGS__": sourceBranchArgs,
-      "__HWLAB_GITOPS_BRANCH_ARGS__": gitopsBranchArgs,
-      "__HWLAB_MIRROR_BRANCHES_JSON_SHELL__": shellSingleQuote(mirrorBranchesJson),
-      "__HWLAB_SOURCE_BRANCHES_JSON_SHELL__": shellSingleQuote(sourceBranchesJson),
-      "__HWLAB_GITOPS_BRANCHES_JSON_SHELL__": gitopsBranchesJsonShell
-    }),
-    "install-hooks.sh": renderTemplate("git-mirror-install-hooks.sh", {
-      "__HWLAB_GITOPS_BRANCHES_JSON_SHELL__": gitopsBranchesJsonShell
-    }),
-    "flush.sh": renderTemplate("git-mirror-flush.sh", {
-      "# __HWLAB_GIT_MIRROR_SSH_PRELUDE__": gitMirrorSshPrelude,
-      "__HWLAB_GITOPS_BRANCH_ARGS__": gitopsBranchArgs,
-      "__HWLAB_GITOPS_BRANCHES_JSON_SHELL__": gitopsBranchesJsonShell
-    }),
-    "http.mjs": renderTemplate("git-mirror-http.mjs")
-  };
-}
-
-function devopsInfraGitMirrorManifest(args, deploy) {
-  const mirrorSpecs = runtimeLaneMirrorSpecs(deploy, { defaultNodeId: args.nodeId, defaultGitopsRoot: defaultOutDir });
-  assert.ok(mirrorSpecs.length > 0, "runtime lane git mirror requires at least one deploy.lanes entry");
-  const sourceBranches = uniqueStrings(mirrorSpecs.map((spec) => spec.sourceBranch));
-  const gitopsBranches = uniqueStrings(mirrorSpecs.map((spec) => spec.gitopsBranch));
-  const mirrorBranches = uniqueStrings([...sourceBranches, ...gitopsBranches]);
-  const fetchConfigCommands = mirrorBranches
-    .map((branch) => `git -C "$repo_path" config --add remote.origin.fetch '+refs/heads/${branch}:refs/mirror-stage/heads/${branch}'`)
-    .join("\n");
-  const requiredRefArgs = mirrorBranches.map((branch) => shellSingleQuote(`refs/mirror-stage/heads/${branch}`)).join(" ");
-  const sourceBranchArgs = sourceBranches.map((branch) => shellSingleQuote(branch)).join(" ");
-  const gitopsBranchArgs = gitopsBranches.map((branch) => shellSingleQuote(branch)).join(" ");
-  const mirrorBranchesJson = JSON.stringify(mirrorBranches);
-  const sourceBranchesJson = JSON.stringify(sourceBranches);
-  const gitopsBranchesJson = JSON.stringify(gitopsBranches);
-  const sourceSnapshotRefPrefix = "refs/unidesk/snapshots/hwlab-node-runtime";
-  const laneConfig = configObject(configObject(deploy.lanes, "deploy.lanes")[args.lane], `deploy.lanes.${args.lane}`);
-  const gitMirrorConfig = configObject(laneConfig.gitMirror, `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorProxy = configObject(gitMirrorConfig.egressProxy, `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const gitMirrorProxyMode = requiredConfigString(gitMirrorProxy, "mode", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  assert.ok(gitMirrorProxyMode === "node-global" || gitMirrorProxyMode === "host-proxy-client" || gitMirrorProxyMode === "direct", `deploy.lanes.${args.lane}.gitMirror.egressProxy.mode must be node-global, host-proxy-client, or direct`);
-  const useDirectGitMirrorProxy = gitMirrorProxyMode === "direct";
-  const useHostGitMirrorProxy = gitMirrorProxyMode === "host-proxy-client";
-  const gitMirrorNamespace = requiredConfigString(gitMirrorConfig, "namespace", `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorReadName = requiredConfigString(gitMirrorConfig, "serviceReadName", `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorWriteName = requiredConfigString(gitMirrorConfig, "serviceWriteName", `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorCachePvcName = requiredConfigString(gitMirrorConfig, "cachePvcName", `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorCachePvcStorage = requiredConfigString(gitMirrorConfig, "cachePvcStorage", `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorCacheHostPath = optionalConfigString(gitMirrorConfig, "cacheHostPath", `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorServicePort = requiredConfigPositiveInteger(gitMirrorConfig, "servicePort", `deploy.lanes.${args.lane}.gitMirror`);
-  const gitMirrorConfigMapName = requiredConfigString(gitMirrorConfig, "syncConfigMapName", `deploy.lanes.${args.lane}.gitMirror`);
-  const proxyNamespace = useDirectGitMirrorProxy || useHostGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "namespace", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyServiceName = useDirectGitMirrorProxy || useHostGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "serviceName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyPort = useDirectGitMirrorProxy ? 0 : requiredConfigPositiveInteger(gitMirrorProxy, "port", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyClientName = useDirectGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "clientName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyNoProxy = !useDirectGitMirrorProxy && Array.isArray(gitMirrorProxy.noProxy) ? gitMirrorProxy.noProxy.filter((value) => typeof value === "string" && value.length > 0).join(",") : "";
-  const proxyHost = useHostGitMirrorProxy
-    ? requiredConfigString(gitMirrorProxy, "host", `deploy.lanes.${args.lane}.gitMirror.egressProxy`)
-    : `${proxyServiceName}.${proxyNamespace}.svc.cluster.local`;
-  const proxyUrl = `http://${proxyHost}:${proxyPort}`;
-  const proxySummary = useDirectGitMirrorProxy
-    ? "git-mirror-egress-proxy mode=direct required=false transport=ssh source=yaml"
-    : `git-mirror-egress-proxy client=${proxyClientName} mode=${gitMirrorProxyMode} required=true host=${proxyHost} port=${proxyPort} ssh=GIT_SSH-wrapper source=yaml`;
-  const proxyCommand = useDirectGitMirrorProxy ? "" : `ProxyCommand=node /tmp/hwlab-github-proxy-connect.mjs ${proxyHost} ${proxyPort} %h %p`;
-  const gitMirrorSshPrelude = renderGitMirrorSshPrelude({
-    direct: useDirectGitMirrorProxy,
-    proxySummary,
-    proxyCommand,
-    proxyUrl,
-    proxyNoProxy
-  });
-  const cacheVolume = gitMirrorCacheHostPath === null
-    ? { name: "cache", persistentVolumeClaim: { claimName: gitMirrorCachePvcName } }
-    : { name: "cache", hostPath: { path: gitMirrorCacheHostPath, type: "DirectoryOrCreate" } };
-  const labels = {
-    "app.kubernetes.io/part-of": "hwlab-node-control-plane",
-    "hwlab.pikastech.local/node": args.nodeId,
-    "hwlab.pikastech.local/lane": args.lane
-  };
-  const configLabels = { ...labels, "app.kubernetes.io/name": "git-mirror" };
-  const readLabels = { ...labels, "app.kubernetes.io/name": gitMirrorReadName, "hwlab.pikastech.local/git-mirror-mode": "read" };
-  const writeLabels = { ...labels, "app.kubernetes.io/name": gitMirrorWriteName, "hwlab.pikastech.local/git-mirror-mode": "write" };
-  return {
-    apiVersion: "v1",
-    kind: "List",
-    items: [
-      { apiVersion: "v1", kind: "Namespace", metadata: { name: gitMirrorNamespace } },
-      ...(gitMirrorCacheHostPath === null ? [{
-        apiVersion: "v1",
-        kind: "PersistentVolumeClaim",
-        metadata: { name: gitMirrorCachePvcName, namespace: gitMirrorNamespace, labels: configLabels },
-        spec: { accessModes: ["ReadWriteOnce"], resources: { requests: { storage: gitMirrorCachePvcStorage } } }
-      }] : []),
-      {
-        apiVersion: "v1",
-        kind: "ConfigMap",
-        metadata: { name: gitMirrorConfigMapName, namespace: gitMirrorNamespace, labels: configLabels },
-        data: gitMirrorConfigScripts({
-          fetchConfigCommands,
-          gitMirrorSshPrelude,
-          gitopsBranchArgs,
-          gitopsBranchesJson,
-          mirrorBranchesJson,
-          requiredRefArgs,
-          sourceBranchArgs,
-          sourceBranchesJson,
-          sourceSnapshotRefPrefix
-        })
-      },
-      {
-        apiVersion: "apps/v1",
-        kind: "Deployment",
-        metadata: { name: gitMirrorReadName, namespace: gitMirrorNamespace, labels: readLabels },
-        spec: {
-          replicas: 1,
-          selector: { matchLabels: { "app.kubernetes.io/name": gitMirrorReadName } },
-          template: {
-            metadata: { labels: readLabels },
-            spec: {
-              containers: [{
-                name: "git-mirror",
-                image: ciToolsRunnerImage,
-                imagePullPolicy: "IfNotPresent",
-                command: ["node"],
-                args: ["/etc/git-mirror/http.mjs"],
-                ports: [{ name: "http", containerPort: 8080 }],
-                readinessProbe: { httpGet: { path: "/pikasTech/HWLAB.git/HEAD", port: "http" }, initialDelaySeconds: 5, periodSeconds: 10 },
-                livenessProbe: { httpGet: { path: "/", port: "http" }, initialDelaySeconds: 10, periodSeconds: 30 },
-                volumeMounts: [
-                  { name: "cache", mountPath: "/cache" },
-                  { name: "config", mountPath: "/etc/git-mirror", readOnly: true }
-                ]
-              }],
-              volumes: [
-                cacheVolume,
-                { name: "config", configMap: { name: gitMirrorConfigMapName, defaultMode: 0o555 } }
-              ]
-            }
-          }
-        }
-      },
-      {
-        apiVersion: "v1",
-        kind: "Service",
-        metadata: { name: gitMirrorReadName, namespace: gitMirrorNamespace, labels: readLabels },
-        spec: { selector: { "app.kubernetes.io/name": gitMirrorReadName }, ports: [{ name: "http", port: gitMirrorServicePort, targetPort: "http" }] }
-      },
-      {
-        apiVersion: "v1",
-        kind: "Service",
-        metadata: { name: gitMirrorWriteName, namespace: gitMirrorNamespace, labels: writeLabels },
-        spec: { selector: { "app.kubernetes.io/name": gitMirrorReadName }, ports: [{ name: "http", port: gitMirrorServicePort, targetPort: "http" }] }
-      }
-    ]
-  };
-}
-
 export {
-  devopsInfraGitMirrorManifest,
-  registryManifest,
-  uniqueStrings
+  registryManifest
 };

scripts/src/gitops-render/runtime-manifests.mjs

@@ -1237,7 +1237,7 @@ function opencodeConfigBoolean(value, fallback, label) {
 }
 
 function opencodeEgressProxyUrlForProfile(deploy, profile) {
-  const proxy = deploy?.lanes?.[profile]?.gitMirror?.egressProxy;
+  const proxy = deploy?.lanes?.[profile]?.egressProxy;
   if (!proxy || proxy.required === false) return "";
   const proxyUrl = configString(proxy.proxyUrl);
   if (proxyUrl) return proxyUrl;
@@ -1249,7 +1249,7 @@ function opencodeEgressProxyUrlForProfile(deploy, profile) {
 }
 
 function opencodeEgressNoProxyForProfile(deploy, profile) {
-  const proxy = deploy?.lanes?.[profile]?.gitMirror?.egressProxy;
+  const proxy = deploy?.lanes?.[profile]?.egressProxy;
   const entries = Array.isArray(proxy?.noProxy) ? proxy.noProxy.map(configString).filter(Boolean) : [];
   return entries.length > 0 ? entries.join(",") : "localhost,127.0.0.1,::1,.svc,.svc.cluster.local,.cluster.local";
 }

scripts/src/gitops-render/tekton-manifests.mjs

@@ -307,7 +307,7 @@ function planArtifactsTask({ serviceIds = defaultServiceIds } = {}) {
     taskSpec: {
       params: [
         { name: "git-url" },
-        { name: "git-read-url" },
+        { name: "gitops-read-url" },
         { name: "gitops-branch" },
         { name: "lane" },
         { name: "revision" },
@@ -338,7 +338,7 @@ function planArtifactsTask({ serviceIds = defaultServiceIds } = {}) {
     },
     params: [
       { name: "git-url", value: "$(params.git-url)" },
-      { name: "git-read-url", value: "$(params.git-read-url)" },
+      { name: "gitops-read-url", value: "$(params.gitops-read-url)" },
       { name: "gitops-branch", value: "$(params.gitops-branch)" },
       { name: "lane", value: "$(params.lane)" },
       { name: "revision", value: "$(params.revision)" },
@@ -516,11 +516,11 @@ function tektonTasks(args = { lane: "node" }, deploy = null) {
     name: "prepare-source",
     taskSpec: {
       params: [
-        { name: "git-url" }, { name: "git-read-url" }, { name: "source-branch" },
+        { name: "git-url" }, { name: "git-read-url" }, { name: "gitops-read-url" }, { name: "source-branch" },
         { name: "gitops-branch" }, { name: "lane" }, { name: "catalog-path" },
         { name: "image-tag-mode" }, { name: "registry-prefix" }, { name: "services" }, { name: "revision" }
       ],
-      workspaces: [{ name: "source" }, { name: "git-ssh" }],
+      workspaces: [{ name: "source" }],
       steps: [{ name: "prepare-source", image: ciToolsRunnerImage, env: proxyEnv(), script: prepareSourceScript() }]
     }
   };
@@ -532,13 +532,13 @@ function tektonTasks(args = { lane: "node" }, deploy = null) {
       name: "gitops-promote",
       taskSpec: {
         params: [
-          { name: "git-url" }, { name: "git-read-url" }, { name: "git-write-url" },
+          { name: "git-url" }, { name: "git-read-url" }, { name: "gitops-read-url" }, { name: "git-write-url" }, { name: "gitops-username" },
           { name: "source-branch" }, { name: "gitops-branch" }, { name: "lane" },
           { name: "catalog-path" }, { name: "image-tag-mode" }, { name: "runtime-path" },
           { name: "revision" }, { name: "registry-prefix" }
         ],
         results: [{ name: "runtime-ready-required", description: "true when GitOps promotion changed runtime desired state and runtime readiness must be observed" }],
-        workspaces: [{ name: "source" }, { name: "git-ssh" }],
+        workspaces: [{ name: "source" }, { name: "gitea-auth" }],
         steps: [{ name: "promote", image: ciToolsRunnerImage, env: proxyEnv(), script: gitopsPromoteScript() }]
       }
     },
@@ -576,7 +576,9 @@ function tektonPipeline(args = { lane: "node" }, deploy = null) {
       params: [
         { name: "git-url", type: "string", default: defaultSourceRepo },
         { name: "git-read-url", type: "string", default: args.gitReadUrl },
+        { name: "gitops-read-url", type: "string", default: args.gitReadUrl },
         { name: "git-write-url", type: "string", default: args.gitWriteUrl },
+        { name: "gitops-username", type: "string", default: "unidesk-admin" },
         { name: "source-branch", type: "string", default: args.sourceBranch },
         { name: "gitops-branch", type: "string", default: args.gitopsBranch },
         { name: "lane", type: "string", default: settings.lane },
@@ -596,19 +598,19 @@ function tektonPipeline(args = { lane: "node" }, deploy = null) {
       ],
       workspaces: [
         { name: "source" },
-        { name: "git-ssh" }
+        { name: "gitea-auth" }
       ],
       tasks: [
         {
           name: "prepare-source",
           workspaces: [
-            { name: "source", workspace: "source" },
-            { name: "git-ssh", workspace: "git-ssh" }
+            { name: "source", workspace: "source" }
           ],
           taskSpec: {
             params: [
               { name: "git-url" },
               { name: "git-read-url" },
+              { name: "gitops-read-url" },
               { name: "source-branch" },
               { name: "gitops-branch" },
               { name: "lane" },
@@ -618,12 +620,13 @@ function tektonPipeline(args = { lane: "node" }, deploy = null) {
               { name: "services" },
               { name: "revision" }
             ],
-            workspaces: [{ name: "source" }, { name: "git-ssh" }],
+            workspaces: [{ name: "source" }],
             steps: [{ name: "prepare-source", image: ciToolsRunnerImage, env: proxyEnv(), script: prepareSourceScript() }]
           },
           params: [
             { name: "git-url", value: "$(params.git-url)" },
             { name: "git-read-url", value: "$(params.git-read-url)" },
+            { name: "gitops-read-url", value: "$(params.gitops-read-url)" },
             { name: "source-branch", value: "$(params.source-branch)" },
             { name: "gitops-branch", value: "$(params.gitops-branch)" },
             { name: "lane", value: "$(params.lane)" },
@@ -641,13 +644,15 @@ function tektonPipeline(args = { lane: "node" }, deploy = null) {
           runAfter: ["collect-artifacts"],
           workspaces: [
             { name: "source", workspace: "source" },
-            { name: "git-ssh", workspace: "git-ssh" }
+            { name: "gitea-auth", workspace: "gitea-auth" }
           ],
           taskSpec: {
             params: [
               { name: "git-url" },
               { name: "git-read-url" },
+              { name: "gitops-read-url" },
               { name: "git-write-url" },
+              { name: "gitops-username" },
               { name: "source-branch" },
               { name: "gitops-branch" },
               { name: "lane" },
@@ -658,13 +663,15 @@ function tektonPipeline(args = { lane: "node" }, deploy = null) {
               { name: "registry-prefix" }
             ],
             results: [{ name: "runtime-ready-required", description: "true when GitOps promotion changed runtime desired state and runtime readiness must be observed" }],
-            workspaces: [{ name: "source" }, { name: "git-ssh" }],
+            workspaces: [{ name: "source" }, { name: "gitea-auth" }],
             steps: [{ name: "promote", image: ciToolsRunnerImage, env: proxyEnv(), script: gitopsPromoteScript() }]
           },
           params: [
             { name: "git-url", value: "$(params.git-url)" },
             { name: "git-read-url", value: "$(params.git-read-url)" },
+            { name: "gitops-read-url", value: "$(params.gitops-read-url)" },
             { name: "git-write-url", value: "$(params.git-write-url)" },
+            { name: "gitops-username", value: "$(params.gitops-username)" },
             { name: "source-branch", value: "$(params.source-branch)" },
             { name: "gitops-branch", value: "$(params.gitops-branch)" },
             { name: "lane", value: "$(params.lane)" },
@@ -709,7 +716,9 @@ function tektonPipelineRunTemplate({ source, args, deploy = null }) {
       params: [
         { name: "git-url", value: args.sourceRepo },
         { name: "git-read-url", value: args.gitReadUrl },
+        { name: "gitops-read-url", value: args.gitReadUrl },
         { name: "git-write-url", value: args.gitWriteUrl },
+        { name: "gitops-username", value: "unidesk-admin" },
         { name: "source-branch", value: args.sourceBranch },
         { name: "gitops-branch", value: args.gitopsBranch },
         { name: "lane", value: settings.lane },
@@ -723,7 +732,7 @@ function tektonPipelineRunTemplate({ source, args, deploy = null }) {
       ],
       workspaces: [
         { name: "source", volumeClaimTemplate: { spec: { accessModes: ["ReadWriteOnce"], resources: { requests: { storage: "8Gi" } } } } },
-        { name: "git-ssh", secret: { secretName: "hwlab-git-ssh" } }
+        { name: "gitea-auth", secret: { secretName: "pac-gitea-hwlab", items: [{ key: "token", path: "token" }] } }
       ]
     }
   };

scripts/src/gitops-render/tekton-scripts.mjs

@@ -63,7 +63,6 @@ function gitSshShellFunction() {
 function prepareSourceScript() {
   return renderTemplate("prepare-source.sh", {
     "# __HWLAB_CI_TIMING_SHELL__\n": ciTimingShellFunction(),
-    "# __HWLAB_GIT_SSH_SHELL__\n": gitSshShellFunction(),
     "__HWLAB_CI_TOOLS_IMAGE__": ciToolsRunnerImage,
     "__HWLAB_V02_RUNTIME_ENDPOINT__": JSON.stringify(defaultV02RuntimeEndpoint).slice(1, -1),
     "__HWLAB_VALIDATION_TASK_COUNT__": primitiveValidationTasks.length
@@ -140,7 +139,6 @@ function collectArtifactsScript() {
 function gitopsPromoteScript() {
   return renderTemplate("gitops-promote.sh", {
     "# __HWLAB_CI_TIMING_SHELL__\n": ciTimingShellFunction(),
-    "# __HWLAB_GIT_SSH_SHELL__\n": gitSshShellFunction(),
     "__HWLAB_CI_TOOLS_IMAGE__": ciToolsRunnerImage
   });
 }

scripts/src/gitops-render/templates/git-mirror-flush.sh

@@ -1,76 +0,0 @@
-#!/bin/sh
-set -eu
-repo_url="ssh://git@ssh.github.com:443/pikasTech/HWLAB.git"
-repo_path="/cache/pikasTech/HWLAB.git"
-lock_dir="/cache/.hwlab-flush.lock"
-started_ms=$(node -e 'console.log(Date.now())')
-now_ms() { node -e 'console.log(Date.now())'; }
-emit_timing() {
-  phase="$1"
-  status="$2"
-  started="$3"
-  finished=$(now_ms)
-  duration=$((finished - started))
-  printf '{"event":"git-mirror-flush-timing","phase":"%s","status":"%s","durationMs":%s,"repository":"pikasTech/HWLAB"}
-' "$phase" "$status" "$duration"
-}
-if ! mkdir "$lock_dir" 2>/dev/null; then
-  echo "git mirror flush already running"
-  exit 0
-fi
-trap 'rmdir "$lock_dir" 2>/dev/null || true' EXIT INT TERM
-mkdir -p /root/.ssh
-cp /git-ssh/ssh-privatekey /root/.ssh/id_rsa
-chmod 0400 /root/.ssh/id_rsa
-# __HWLAB_GIT_MIRROR_SSH_PRELUDE__
-/script/install-hooks.sh
-for gitops_branch in __HWLAB_GITOPS_BRANCH_ARGS__; do
-  local_head=$(git -C "$repo_path" show-ref --verify --hash "refs/heads/$gitops_branch" 2>/dev/null || true)
-  if [ -z "$local_head" ]; then
-    echo "git mirror flush skips missing local refs/heads/$gitops_branch"
-    continue
-  fi
-  fetch_started=$(now_ms)
-  timeout 90 git -C "$repo_path" fetch --quiet "$repo_url" "refs/heads/$gitops_branch:refs/mirror-stage/heads/$gitops_branch"
-  emit_timing "fetch-$gitops_branch" succeeded "$fetch_started"
-  github_head=$(git -C "$repo_path" show-ref --verify --hash "refs/mirror-stage/heads/$gitops_branch" 2>/dev/null || true)
-  if [ -n "$github_head" ] && [ "$github_head" != "$local_head" ] && ! git -C "$repo_path" merge-base --is-ancestor "$github_head" "$local_head"; then
-    echo "git mirror flush rejected divergent $gitops_branch local=$local_head github=$github_head" >&2
-    exit 52
-  fi
-  if [ "$local_head" != "$github_head" ]; then
-    push_started=$(now_ms)
-    timeout 120 git -C "$repo_path" push "$repo_url" "$local_head:refs/heads/$gitops_branch"
-    emit_timing "push-$gitops_branch" succeeded "$push_started"
-  else
-    echo "git mirror flush $gitops_branch already matches GitHub"
-  fi
-  git -C "$repo_path" update-ref "refs/mirror-stage/heads/$gitops_branch" "$local_head"
-done
-git -C "$repo_path" update-server-info
-flushed_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-export flushed_at
-export gitops_branches_json=__HWLAB_GITOPS_BRANCHES_JSON_SHELL__
-node - <<'NODE' | tee /cache/HWLAB.last-flush.json
-const { execFileSync } = require("node:child_process");
-const repo = "/cache/pikasTech/HWLAB.git";
-const gitopsBranches = JSON.parse(process.env.gitops_branches_json || "[]");
-function rev(ref) {
-  try { return execFileSync("git", ["-C", repo, "rev-parse", ref], { encoding: "utf8" }).trim() || null; } catch { return null; }
-}
-const refs = {};
-for (const branch of gitopsBranches) {
-  refs["refs/heads/" + branch] = rev("refs/heads/" + branch);
-  refs["refs/mirror-stage/heads/" + branch] = rev("refs/mirror-stage/heads/" + branch);
-}
-const pendingFlush = gitopsBranches.some((branch) => refs["refs/heads/" + branch] && refs["refs/mirror-stage/heads/" + branch] && refs["refs/heads/" + branch] !== refs["refs/mirror-stage/heads/" + branch]);
-console.log(JSON.stringify({
-  event: "git-mirror-flush",
-  status: "flushed",
-  repository: "pikasTech/HWLAB",
-  flushedAt: process.env.flushed_at,
-  pendingFlush,
-  refs
-}));
-NODE
-emit_timing total succeeded "$started_ms"

scripts/src/gitops-render/templates/git-mirror-http.mjs

@@ -1,196 +0,0 @@
-import { createServer } from "node:http";
-import { spawn } from "node:child_process";
-import { createReadStream, statSync } from "node:fs";
-import path from "node:path";
-import { createGunzip, createInflate } from "node:zlib";
-
-const cacheRoot = process.env.GIT_MIRROR_CACHE_ROOT || "/cache";
-const port = Number(process.env.PORT || 8080);
-
-createServer((req, res) => {
-  handle(req, res).catch((error) => {
-    if (!res.headersSent) res.writeHead(500, { "content-type": "application/json" });
-    res.end(JSON.stringify({ ok: false, error: error.message }));
-  });
-}).listen(port, "0.0.0.0", () => {
-  console.log(JSON.stringify({ event: "git-mirror-smart-http-listening", port, cacheRoot }));
-});
-
-async function handle(req, res) {
-  const url = new URL(req.url || "/", "http://git-mirror-http");
-  const writeHost = isWriteHost(req.headers.host || "");
-  if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/health")) {
-    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-cache" });
-    res.end(JSON.stringify({ ok: true, service: "git-mirror-smart-http", writeHost }));
-    return;
-  }
-  if (req.method === "GET" && url.pathname.endsWith("/info/refs") && url.searchParams.get("service") === "git-upload-pack") {
-    await runUploadPackAdvertisement(repoPathFromGitServicePath(url.pathname, "/info/refs"), res);
-    return;
-  }
-  if (req.method === "POST" && url.pathname.endsWith("/git-upload-pack")) {
-    await runUploadPackRpc(repoPathFromGitServicePath(url.pathname, "/git-upload-pack"), req, res);
-    return;
-  }
-  if (req.method === "GET" && url.pathname.endsWith("/info/refs") && url.searchParams.get("service") === "git-receive-pack") {
-    if (!writeHost) return rejectReadOnly(res);
-    await runReceivePackAdvertisement(repoPathFromGitServicePath(url.pathname, "/info/refs"), res);
-    return;
-  }
-  if (req.method === "POST" && url.pathname.endsWith("/git-receive-pack")) {
-    if (!writeHost) return rejectReadOnly(res);
-    await runReceivePackRpc(repoPathFromGitServicePath(url.pathname, "/git-receive-pack"), req, res);
-    return;
-  }
-  if (req.method === "GET" || req.method === "HEAD") {
-    serveStaticFile(url.pathname, req, res);
-    return;
-  }
-  res.writeHead(405, { "content-type": "text/plain" });
-  res.end("method not allowed\n");
-}
-
-function isWriteHost(hostHeader) {
-  const host = String(hostHeader || "").split(":", 1)[0].toLowerCase();
-  return host === "git-mirror-write" || host.startsWith("git-mirror-write.");
-}
-
-function rejectReadOnly(res) {
-  res.writeHead(403, { "content-type": "application/json", "cache-control": "no-cache" });
-  res.end(JSON.stringify({ ok: false, error: "git mirror receive-pack is only available through git-mirror-write" }));
-}
-
-function repoPathFromGitServicePath(urlPath, suffix) {
-  const repoUrlPath = urlPath.slice(0, -suffix.length);
-  if (!repoUrlPath.endsWith(".git")) throw new Error(`unsupported git repo path: ${urlPath}`);
-  return safePath(repoUrlPath);
-}
-
-function safePath(urlPath) {
-  const decoded = decodeURIComponent(urlPath.replace(/^[/]+/u, ""));
-  const fullPath = path.resolve(cacheRoot, decoded);
-  const normalizedRoot = path.resolve(cacheRoot);
-  if (fullPath !== normalizedRoot && !fullPath.startsWith(`${normalizedRoot}${path.sep}`)) throw new Error("path escapes cache root");
-  return fullPath;
-}
-
-function smartHeaders(contentType) {
-  return {
-    "content-type": contentType,
-    "cache-control": "no-cache, max-age=0, must-revalidate",
-    expires: "Fri, 01 Jan 1980 00:00:00 GMT",
-    pragma: "no-cache"
-  };
-}
-
-function pktLine(text) {
-  const length = Buffer.byteLength(text) + 4;
-  return `${length.toString(16).padStart(4, "0")}${text}`;
-}
-
-function requestBodyStream(req) {
-  const encoding = String(req.headers["content-encoding"] || "identity").toLowerCase();
-  if (encoding === "identity" || encoding === "") return req;
-  if (encoding === "gzip" || encoding === "x-gzip") return req.pipe(createGunzip());
-  if (encoding === "deflate") return req.pipe(createInflate());
-  throw new Error(`unsupported git upload-pack content-encoding: ${encoding}`);
-}
-
-function runUploadPackAdvertisement(repoPath, res) {
-  return new Promise((resolve, reject) => {
-    const child = spawn("git-upload-pack", ["--stateless-rpc", "--advertise-refs", repoPath], { stdio: ["ignore", "pipe", "pipe"] });
-    let stderr = "";
-    child.stderr.on("data", (chunk) => { stderr += chunk; process.stderr.write(chunk); });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code !== 0 && !res.headersSent) reject(new Error(`git-upload-pack advertise failed: ${stderr.trim()}`));
-      else resolve();
-    });
-    res.writeHead(200, smartHeaders("application/x-git-upload-pack-advertisement"));
-    res.write(pktLine("# service=git-upload-pack\n"));
-    res.write("0000");
-    child.stdout.pipe(res, { end: false });
-    child.stdout.on("end", () => res.end());
-  });
-}
-
-function runUploadPackRpc(repoPath, req, res) {
-  return new Promise((resolve, reject) => {
-    const child = spawn("git-upload-pack", ["--stateless-rpc", repoPath], { stdio: ["pipe", "pipe", "pipe"] });
-    let stderr = "";
-    child.stderr.on("data", (chunk) => { stderr += chunk; process.stderr.write(chunk); });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code !== 0 && !res.headersSent) reject(new Error(`git-upload-pack rpc failed: ${stderr.trim()}`));
-      else resolve();
-    });
-    res.writeHead(200, smartHeaders("application/x-git-upload-pack-result"));
-    const body = requestBodyStream(req);
-    body.on("error", (error) => child.stdin.destroy(error));
-    body.pipe(child.stdin);
-    child.stdout.pipe(res);
-  });
-}
-
-function runReceivePackAdvertisement(repoPath, res) {
-  return new Promise((resolve, reject) => {
-    const child = spawn("git-receive-pack", ["--stateless-rpc", "--advertise-refs", repoPath], { stdio: ["ignore", "pipe", "pipe"] });
-    let stderr = "";
-    child.stderr.on("data", (chunk) => { stderr += chunk; process.stderr.write(chunk); });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code !== 0 && !res.headersSent) reject(new Error(`git-receive-pack advertise failed: ${stderr.trim()}`));
-      else resolve();
-    });
-    res.writeHead(200, smartHeaders("application/x-git-receive-pack-advertisement"));
-    res.write(pktLine("# service=git-receive-pack\n"));
-    res.write("0000");
-    child.stdout.pipe(res, { end: false });
-    child.stdout.on("end", () => res.end());
-  });
-}
-
-function runReceivePackRpc(repoPath, req, res) {
-  return new Promise((resolve, reject) => {
-    const child = spawn("git-receive-pack", ["--stateless-rpc", repoPath], { stdio: ["pipe", "pipe", "pipe"] });
-    let stderr = "";
-    child.stderr.on("data", (chunk) => { stderr += chunk; process.stderr.write(chunk); });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code !== 0 && !res.headersSent) reject(new Error(`git-receive-pack rpc failed: ${stderr.trim()}`));
-      else resolve();
-    });
-    res.writeHead(200, smartHeaders("application/x-git-receive-pack-result"));
-    const body = requestBodyStream(req);
-    body.on("error", (error) => child.stdin.destroy(error));
-    body.pipe(child.stdin);
-    child.stdout.pipe(res);
-  });
-}
-
-function serveStaticFile(urlPath, req, res) {
-  const fullPath = safePath(urlPath);
-  let stat;
-  try { stat = statSync(fullPath); } catch {
-    res.writeHead(404, { "content-type": "text/plain" });
-    res.end("not found\n");
-    return;
-  }
-  if (!stat.isFile()) {
-    res.writeHead(404, { "content-type": "text/plain" });
-    res.end("not found\n");
-    return;
-  }
-  res.writeHead(200, { "content-length": stat.size, "content-type": contentType(fullPath), "cache-control": "no-cache" });
-  if (req.method === "HEAD") {
-    res.end();
-    return;
-  }
-  createReadStream(fullPath).pipe(res);
-}
-
-function contentType(filePath) {
-  if (filePath.endsWith(".pack")) return "application/x-git-packed-objects";
-  if (filePath.endsWith(".idx")) return "application/x-git-packed-objects-toc";
-  return "text/plain";
-}

scripts/src/gitops-render/templates/git-mirror-install-hooks.sh

@@ -1,65 +0,0 @@
-#!/bin/sh
-set -eu
-repo_path="/cache/pikasTech/HWLAB.git"
-mkdir -p "$repo_path/hooks"
-cat > "$repo_path/hooks/pre-receive" <<'HOOK'
-#!/bin/sh
-set -eu
-zero="0000000000000000000000000000000000000000"
-status=0
-while read -r old new ref; do
-  if [ "$new" = "$zero" ]; then
-    echo "git mirror write rejected: deleting $ref is forbidden" >&2
-    status=1
-    continue
-  fi
-  git cat-file -e "$new^{commit}" || status=1
-  git cat-file -e "$new^{tree}" || status=1
-  if git rev-list --objects --missing=print "$new" | grep -q '^?'; then
-    echo "git mirror write rejected: missing objects for $new" >&2
-    status=1
-    continue
-  fi
-  if [ "$old" != "$zero" ] && ! git merge-base --is-ancestor "$old" "$new"; then
-    echo "git mirror write rejected: non-fast-forward $ref" >&2
-    status=1
-    continue
-  fi
-done
-exit "$status"
-HOOK
-cat > "$repo_path/hooks/post-receive" <<'HOOK'
-#!/bin/sh
-set -eu
-repo_path=$(git rev-parse --git-dir)
-git -C "$repo_path" update-server-info
-written_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-export repo_path written_at
-export gitops_branches_json=__HWLAB_GITOPS_BRANCHES_JSON_SHELL__
-node - <<'NODE' > /cache/HWLAB.last-write.json
-const { execFileSync } = require("node:child_process");
-const repo = process.env.repo_path || "/cache/pikasTech/HWLAB.git";
-const gitopsBranches = JSON.parse(process.env.gitops_branches_json || "[]");
-function rev(ref) {
-  try { return execFileSync("git", ["-C", repo, "rev-parse", ref], { encoding: "utf8" }).trim() || null; } catch { return null; }
-}
-const refs = {};
-for (const branch of gitopsBranches) {
-  refs["refs/heads/" + branch] = rev("refs/heads/" + branch);
-  refs["refs/mirror-stage/heads/" + branch] = rev("refs/mirror-stage/heads/" + branch);
-}
-const pendingFlush = gitopsBranches.some((branch) => refs["refs/heads/" + branch] && refs["refs/heads/" + branch] !== refs["refs/mirror-stage/heads/" + branch]);
-console.log(JSON.stringify({
-  event: "git-mirror-write",
-  status: "received",
-  repository: "pikasTech/HWLAB",
-  writtenAt: process.env.written_at,
-  pendingFlush,
-  refs
-}));
-NODE
-HOOK
-chmod 0755 "$repo_path/hooks/pre-receive" "$repo_path/hooks/post-receive"
-git -C "$repo_path" config http.receivepack true
-git -C "$repo_path" config receive.denyDeletes true
-git -C "$repo_path" config receive.denyNonFastForwards true

scripts/src/gitops-render/templates/git-mirror-proxy-connect.mjs

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-import net from "node:net";
-const [proxyHost, proxyPortRaw, targetHost, targetPortRaw] = process.argv.slice(2);
-const proxyPort = Number.parseInt(proxyPortRaw || "", 10);
-const targetPort = Number.parseInt(targetPortRaw || "", 10);
-if (!proxyHost || !Number.isInteger(proxyPort) || !targetHost || !Number.isInteger(targetPort)) {
-  console.error("hwlab git-mirror proxy-connect: invalid ProxyCommand arguments");
-  process.exit(64);
-}
-let settled = false;
-let tunnelEstablished = false;
-function finish(code, message) {
-  if (settled) return;
-  settled = true;
-  if (message) console.error("hwlab git-mirror proxy-connect: " + message);
-  process.exit(code);
-}
-const socket = net.createConnection({ host: proxyHost, port: proxyPort });
-let buffer = Buffer.alloc(0);
-socket.setTimeout(15000, () => { socket.destroy(); finish(65, "timeout connecting via " + proxyHost + ":" + proxyPort + " to " + targetHost + ":" + targetPort); });
-socket.on("connect", () => socket.write("CONNECT " + targetHost + ":" + targetPort + " HTTP/1.1\r\nHost: " + targetHost + ":" + targetPort + "\r\nProxy-Connection: Keep-Alive\r\n\r\n"));
-socket.on("error", (error) => finish(tunnelEstablished ? 69 : 66, (tunnelEstablished ? "tunnel socket error: " : "tcp error connecting to proxy: ") + (error && error.message ? error.message : String(error))));
-socket.on("close", () => { if (!tunnelEstablished) finish(68, "proxy closed before CONNECT completed via " + proxyHost + ":" + proxyPort + " to " + targetHost + ":" + targetPort); else finish(0); });
-function onData(chunk) {
-  buffer = Buffer.concat([buffer, chunk]);
-  const headerEnd = buffer.indexOf("\r\n\r\n");
-  if (headerEnd === -1 && buffer.length < 8192) return;
-  if (headerEnd === -1) { socket.destroy(); finish(68, "proxy response header exceeded 8192 bytes before CONNECT status via " + proxyHost + ":" + proxyPort + " to " + targetHost + ":" + targetPort); return; }
-  const head = buffer.slice(0, headerEnd + 4).toString("latin1");
-  const statusLine = head.split("\r\n", 1)[0] || "";
-  const statusCode = Number.parseInt(statusLine.split(" ")[1] || "", 10);
-  if (!statusLine.startsWith("HTTP/1.") || !Number.isInteger(statusCode) || statusCode < 200 || statusCode > 299) {
-    const safeStatus = statusLine.replace(/[^\x20-\x7e]/g, "?").slice(0, 160);
-    socket.destroy();
-    finish(67, "proxy CONNECT failed via " + proxyHost + ":" + proxyPort + " to " + targetHost + ":" + targetPort + ": " + safeStatus);
-    return;
-  }
-  socket.off("data", onData);
-  socket.setTimeout(0);
-  tunnelEstablished = true;
-  const rest = buffer.slice(headerEnd + 4);
-  if (rest.length) process.stdout.write(rest);
-  process.stdin.on("error", () => {});
-  process.stdout.on("error", () => {});
-  process.stdin.pipe(socket);
-  socket.pipe(process.stdout);
-}
-socket.on("data", onData);

scripts/src/gitops-render/templates/git-mirror-ssh-direct.sh

@@ -1,11 +0,0 @@
-printf '%s\n' __HWLAB_PROXY_SUMMARY_SHELL__ >&2
-cat > /tmp/hwlab-git-ssh-proxy.sh <<'SH_PROXY'
-#!/bin/sh
-exec ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 "$@"
-SH_PROXY
-chmod 0700 /tmp/hwlab-git-ssh-proxy.sh
-unset HTTP_PROXY HTTPS_PROXY ALL_PROXY http_proxy https_proxy all_proxy
-export NO_PROXY='*'
-export no_proxy='*'
-export GIT_SSH=/tmp/hwlab-git-ssh-proxy.sh
-unset GIT_SSH_COMMAND

scripts/src/gitops-render/templates/git-mirror-ssh-proxied.sh

@@ -1,20 +0,0 @@
-printf '%s\n' __HWLAB_PROXY_SUMMARY_SHELL__ >&2
-cat > /tmp/hwlab-github-proxy-connect.mjs <<'NODE_PROXY'
-// __HWLAB_GIT_MIRROR_PROXY_CONNECT_MJS__
-NODE_PROXY
-chmod 0700 /tmp/hwlab-github-proxy-connect.mjs
-cat > /tmp/hwlab-git-ssh-proxy.sh <<'SH_PROXY'
-#!/bin/sh
-exec ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 -o __HWLAB_PROXY_COMMAND_SHELL__ "$@"
-SH_PROXY
-chmod 0700 /tmp/hwlab-git-ssh-proxy.sh
-export HTTP_PROXY=__HWLAB_PROXY_URL_SHELL__
-export HTTPS_PROXY=__HWLAB_PROXY_URL_SHELL__
-export ALL_PROXY=__HWLAB_PROXY_URL_SHELL__
-export http_proxy=__HWLAB_PROXY_URL_SHELL__
-export https_proxy=__HWLAB_PROXY_URL_SHELL__
-export all_proxy=__HWLAB_PROXY_URL_SHELL__
-export NO_PROXY=__HWLAB_PROXY_NO_PROXY_SHELL__
-export no_proxy=__HWLAB_PROXY_NO_PROXY_SHELL__
-export GIT_SSH=/tmp/hwlab-git-ssh-proxy.sh
-unset GIT_SSH_COMMAND

scripts/src/gitops-render/templates/git-mirror-sync.sh

@@ -1,181 +0,0 @@
-#!/bin/sh
-set -eu
-repo_url="ssh://git@ssh.github.com:443/pikasTech/HWLAB.git"
-repo_path="/cache/pikasTech/HWLAB.git"
-source_snapshot_ref_prefix=__HWLAB_SOURCE_SNAPSHOT_REF_PREFIX_SHELL__
-lock_dir="/cache/.hwlab-sync.lock"
-sync_started_ms=$(node -e 'console.log(Date.now())')
-now_ms() { node -e 'console.log(Date.now())'; }
-emit_timing() {
-  phase="$1"
-  status="$2"
-  started_ms="$3"
-  finished_ms=$(now_ms)
-  duration_ms=$((finished_ms - started_ms))
-  printf '{"event":"git-mirror-sync-timing","phase":"%s","status":"%s","durationMs":%s,"repository":"pikasTech/HWLAB"}
-' "$phase" "$status" "$duration_ms"
-}
-mkdir -p /cache/pikasTech /root/.ssh
-if ! mkdir "$lock_dir" 2>/dev/null; then
-  echo "git mirror sync already running"
-  exit 0
-fi
-trap 'rmdir "$lock_dir" 2>/dev/null || true' EXIT INT TERM
-cp /git-ssh/ssh-privatekey /root/.ssh/id_rsa
-chmod 0400 /root/.ssh/id_rsa
-# __HWLAB_GIT_MIRROR_SSH_PRELUDE__
-if [ -d "$repo_path/objects" ] && [ -f "$repo_path/HEAD" ]; then
-  git -C "$repo_path" remote set-url origin "$repo_url" || git -C "$repo_path" remote add origin "$repo_url"
-else
-  rm -rf "$repo_path"
-  git init --bare "$repo_path"
-  git -C "$repo_path" remote add origin "$repo_url"
-fi
-/script/install-hooks.sh
-git -C "$repo_path" config uploadpack.hideRefs refs/mirror-stage
-git -C "$repo_path" config uploadpack.allowReachableSHA1InWant true
-git -C "$repo_path" config uploadpack.allowAnySHA1InWant true
-git -C "$repo_path" config --unset-all remote.origin.fetch 2>/dev/null || true
-# __HWLAB_FETCH_CONFIG_COMMANDS__
-fetch_started_ms=$(now_ms)
-timeout 180 git -C "$repo_path" fetch --quiet --prune origin
-emit_timing fetch succeeded "$fetch_started_ms"
-git -C "$repo_path" for-each-ref --format='%(objectname) %(refname)' refs/mirror-stage/heads > /tmp/hwlab-stage-heads
-git -C "$repo_path" for-each-ref --format='%(refname)' refs/mirror-stage/heads > /tmp/hwlab-stage-head-refs
-git -C "$repo_path" for-each-ref --format='%(objectname) %(refname)' refs/mirror-stage/tags > /tmp/hwlab-stage-tags
-git -C "$repo_path" for-each-ref --format='%(refname)' refs/mirror-stage/tags > /tmp/hwlab-stage-tag-refs
-if [ ! -s /tmp/hwlab-stage-heads ]; then
-  echo "git mirror sync fetched no branch refs" >&2
-  exit 41
-fi
-for required_ref in __HWLAB_REQUIRED_REF_ARGS__; do
-  git -C "$repo_path" show-ref --verify --quiet "$required_ref" || { echo "git mirror sync missing required ref $required_ref" >&2; exit 43; }
-done
-validate_started_ms=$(now_ms)
-while read -r sha ref; do
-  [ -n "$sha" ] || continue
-  git -C "$repo_path" cat-file -e "$sha^{commit}"
-  git -C "$repo_path" cat-file -e "$sha^{tree}"
-  if git -C "$repo_path" rev-list --objects --missing=print "$sha" | grep -q '^?'; then
-    echo "git mirror sync found missing objects for $ref $sha" >&2
-    exit 42
-  fi
-done < /tmp/hwlab-stage-heads
-emit_timing validate succeeded "$validate_started_ms"
-publish_started_ms=$(now_ms)
-while read -r sha ref; do
-  [ -n "$sha" ] || continue
-  name=$(printf '%s
-' "$ref" | sed 's#^refs/mirror-stage/heads/##')
-  is_gitops_branch=false
-  for gitops_branch in __HWLAB_GITOPS_BRANCH_ARGS__; do
-    if [ "$name" = "$gitops_branch" ]; then is_gitops_branch=true; break; fi
-  done
-  if [ "$is_gitops_branch" = true ]; then
-    local_sha=$(git -C "$repo_path" show-ref --verify --hash "refs/heads/$name" 2>/dev/null || true)
-    if [ -n "$local_sha" ] && [ "$local_sha" != "$sha" ]; then
-      if git -C "$repo_path" merge-base --is-ancestor "$sha" "$local_sha"; then
-        echo "git mirror sync keeps local $name ahead of GitHub"
-        continue
-      fi
-      if ! git -C "$repo_path" merge-base --is-ancestor "$local_sha" "$sha"; then
-        echo "git mirror sync found divergent $name local=$local_sha github=$sha" >&2
-        exit 44
-      fi
-    fi
-  fi
-  git -C "$repo_path" update-ref "refs/heads/$name" "$sha"
-done < /tmp/hwlab-stage-heads
-for source_branch in __HWLAB_SOURCE_BRANCH_ARGS__; do
-  source_sha=$(git -C "$repo_path" show-ref --verify --hash "refs/heads/$source_branch" 2>/dev/null || true)
-  if [ -n "$source_sha" ]; then
-    source_stage_ref="${source_snapshot_ref_prefix%/}/$source_branch/$source_sha"
-    git -C "$repo_path" update-ref "$source_stage_ref" "$source_sha"
-  fi
-done
-while read -r sha ref; do
-  [ -n "$sha" ] || continue
-  name=$(printf '%s
-' "$ref" | sed 's#^refs/mirror-stage/tags/##')
-  git -C "$repo_path" update-ref "refs/tags/$name" "$sha"
-done < /tmp/hwlab-stage-tags
-git -C "$repo_path" for-each-ref --format='%(refname)' refs/heads > /tmp/hwlab-public-heads
-while read -r ref; do
-  [ -n "$ref" ] || continue
-  name=$(printf '%s
-' "$ref" | sed 's#^refs/heads/##')
-  if ! grep -Fxq "refs/mirror-stage/heads/$name" /tmp/hwlab-stage-head-refs; then
-    git -C "$repo_path" update-ref -d "$ref"
-  fi
-done < /tmp/hwlab-public-heads
-git -C "$repo_path" for-each-ref --format='%(refname)' refs/tags > /tmp/hwlab-public-tags
-while read -r ref; do
-  [ -n "$ref" ] || continue
-  name=$(printf '%s
-' "$ref" | sed 's#^refs/tags/##')
-  if ! grep -Fxq "refs/mirror-stage/tags/$name" /tmp/hwlab-stage-tag-refs; then
-    git -C "$repo_path" update-ref -d "$ref"
-  fi
-done < /tmp/hwlab-public-tags
-emit_timing publish succeeded "$publish_started_ms"
-for head_branch in __HWLAB_SOURCE_BRANCH_ARGS__; do
-  if git -C "$repo_path" show-ref --verify --quiet "refs/heads/$head_branch"; then
-    git -C "$repo_path" symbolic-ref HEAD "refs/heads/$head_branch"
-    break
-  fi
-done
-fsck_started_ms=$(now_ms)
-git -C "$repo_path" fsck --connectivity-only --no-dangling >/tmp/hwlab-git-fsck.out
-emit_timing fsck succeeded "$fsck_started_ms"
-git -C "$repo_path" update-server-info
-published_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-for source_branch in __HWLAB_SOURCE_BRANCH_ARGS__; do
-  git -C "$repo_path" rev-parse "refs/heads/$source_branch" 2>/dev/null | tee "/cache/HWLAB-$source_branch.head" >/dev/null || true
-done
-printf '%s
-' "$published_at" > /cache/HWLAB.last-sync
-export published_at
-export source_snapshot_ref_prefix
-export mirror_branches_json=__HWLAB_MIRROR_BRANCHES_JSON_SHELL__
-export source_branches_json=__HWLAB_SOURCE_BRANCHES_JSON_SHELL__
-export gitops_branches_json=__HWLAB_GITOPS_BRANCHES_JSON_SHELL__
-node - <<'NODE' | tee /cache/HWLAB.last-sync.json
-const { execFileSync } = require("node:child_process");
-const repo = "/cache/pikasTech/HWLAB.git";
-const mirrorBranches = JSON.parse(process.env.mirror_branches_json || "[]");
-const sourceBranches = JSON.parse(process.env.source_branches_json || "[]");
-const gitopsBranches = JSON.parse(process.env.gitops_branches_json || "[]");
-const sourceSnapshotRefPrefix = (process.env.source_snapshot_ref_prefix || "refs/unidesk/snapshots/hwlab-node-runtime").replace(//+$/u, "");
-function rev(ref) {
-  try { return execFileSync("git", ["-C", repo, "rev-parse", ref], { encoding: "utf8" }).trim() || null; } catch { return null; }
-}
-const refs = {};
-for (const branch of mirrorBranches) {
-  refs["refs/heads/" + branch] = rev("refs/heads/" + branch);
-  refs["refs/mirror-stage/heads/" + branch] = rev("refs/mirror-stage/heads/" + branch);
-}
-const sourceSnapshots = {};
-for (const branch of sourceBranches) {
-  const source = refs["refs/heads/" + branch] || null;
-  const stageRef = source ? sourceSnapshotRefPrefix + "/" + branch + "/" + source : null;
-  const sourceSnapshot = stageRef ? rev(stageRef) : null;
-  if (stageRef) refs[stageRef] = sourceSnapshot;
-  sourceSnapshots[branch] = { stageRef, sourceSnapshot };
-}
-const sourceInSync = sourceBranches.every((branch) => refs["refs/heads/" + branch] && refs["refs/heads/" + branch] === refs["refs/mirror-stage/heads/" + branch] && sourceSnapshots[branch]?.sourceSnapshot === refs["refs/mirror-stage/heads/" + branch]);
-const gitopsInSync = gitopsBranches.every((branch) => refs["refs/heads/" + branch] && refs["refs/heads/" + branch] === refs["refs/mirror-stage/heads/" + branch]);
-const pendingFlush = gitopsBranches.some((branch) => refs["refs/heads/" + branch] && refs["refs/mirror-stage/heads/" + branch] && refs["refs/heads/" + branch] !== refs["refs/mirror-stage/heads/" + branch]);
-const payload = {
-  event: "git-mirror-sync",
-  status: "published",
-  repository: "pikasTech/HWLAB",
-  publishedAt: process.env.published_at,
-  pendingFlush,
-  sourceInSync,
-  gitopsInSync,
-  sourceSnapshots,
-  refs
-};
-console.log(JSON.stringify(payload));
-NODE
-emit_timing total succeeded "$sync_started_ms"

scripts/src/gitops-render/templates/gitops-promote.sh

@@ -8,9 +8,6 @@ export HWLAB_TEKTON_TASK="gitops-promote"
 export HWLAB_SOURCE_REVISION="$(params.revision)"
 echo '{"event":"ci-base-image","phase":"gitops-promote","image":"__HWLAB_CI_TOOLS_IMAGE__","policy":"no-runtime-apt"}'
 for tool in node git timeout; do command -v "$tool" >/dev/null 2>&1 || { echo '{"event":"ci-base-image","phase":"gitops-promote","ok":false,"reason":"missing-tool","tool":"'"$tool"'"}'; exit 31; }; done
-# __HWLAB_GIT_SSH_SHELL__
-
-git_url_requires_ssh() { case "$1" in git@*|ssh://*) return 0 ;; *) return 1 ;; esac; }
 lane="$(params.lane)"
 case "$lane" in
   node) runtime_lane=false ;;
@@ -21,29 +18,27 @@ if [ "$runtime_lane" = "true" ]; then
 else
   printf 'true' > /tekton/results/runtime-ready-required
 fi
-source_head_url_for_setup="$(params.git-url)"
-gitops_read_url_for_setup="$(params.git-url)"
-if [ "$runtime_lane" = "true" ]; then
-  source_head_url_for_setup="$(params.git-read-url)"
-  gitops_read_url_for_setup="$(params.git-read-url)"
-fi
-gitops_write_url_for_setup="$(params.git-write-url)"
-if git_url_requires_ssh "$source_head_url_for_setup" || git_url_requires_ssh "$gitops_read_url_for_setup" || git_url_requires_ssh "$gitops_write_url_for_setup"; then
-  for tool in ssh ssh-keyscan; do command -v "$tool" >/dev/null 2>&1 || { echo '{"event":"ci-base-image","phase":"gitops-promote","ok":false,"reason":"missing-tool","tool":"'"$tool"'"}'; exit 31; }; done
-  git_ssh_setup
-else
-  echo '{"event":"git-ssh-setup","phase":"gitops-promote","status":"skipped","reason":"non-ssh-git-url"}'
-fi
+test -s /workspace/gitea-auth/token || { echo '{"event":"gitea-auth","phase":"gitops-promote","status":"failed","reason":"token-missing"}'; exit 31; }
+askpass_dir="$(mktemp -d)"
+cat > "$askpass_dir/askpass.sh" <<'SH'
+#!/bin/sh
+case "$1" in
+  *sername*) printf '%s\n' "$GITEA_USERNAME" ;;
+  *) cat /workspace/gitea-auth/token ;;
+esac
+SH
+chmod 0700 "$askpass_dir/askpass.sh"
+export GITEA_USERNAME="$(params.gitops-username)"
+export GIT_ASKPASS="$askpass_dir/askpass.sh"
+export GIT_ASKPASS_REQUIRE=force
+export GIT_TERMINAL_PROMPT=0
 cd /workspace/source/repo
 test "$(git rev-parse HEAD)" = "$(params.revision)"
 
 check_source_head() {
   phase="$1"
   expected="${2:-$(params.revision)}"
-  source_head_url="$(params.git-url)"
-  if [ "$runtime_lane" = "true" ]; then
-    source_head_url="$(params.git-read-url)"
-  fi
+  source_head_url="$(params.git-read-url)"
   latest_file="$(mktemp)"
   if ! git_timed "source-head-$phase" 45 git ls-remote "$source_head_url" "refs/heads/$(params.source-branch)" > "$latest_file"; then
     echo '{"status":"failed","reason":"source-head-check-failed","phase":"'"$phase"'","sourceBranch":"'"$(params.source-branch)"'","sourceRevision":"'"$(params.revision)"'"}'
@@ -182,11 +177,8 @@ node scripts/run-bun.mjs scripts/gitops-render.mjs --lane "$lane" --catalog-path
 ci_timing_emit gitops-render succeeded "$gitops_render_started_ms"
 check_source_head before-push
 workdir="$(mktemp -d)"
-gitops_read_url="$(params.git-url)"
+gitops_read_url="$(params.gitops-read-url)"
 gitops_write_url="$(params.git-write-url)"
-if [ "$runtime_lane" = "true" ]; then
-  gitops_read_url="$(params.git-read-url)"
-fi
 gitops_clone_started_ms="$(ci_now_ms)"
 git_timed gitops-clone 180 git clone --no-checkout "$gitops_read_url" "$workdir/gitops"
 cd "$workdir/gitops"

scripts/src/gitops-render/templates/per-service-publish.sh

@@ -28,7 +28,7 @@ const catalog = JSON.parse(fs.readFileSync(process.env.HWLAB_ARTIFACT_CATALOG_PA
 const plan = fs.existsSync("/workspace/source/affected-services.json") ? JSON.parse(fs.readFileSync("/workspace/source/affected-services.json", "utf8")) : {};
 const service = (catalog.services || []).find((item) => item.serviceId === serviceId) || {};
 const planned = (plan.services || []).find((item) => item.serviceId === serviceId) || {};
-const envReuse = planned.runtimeMode === "env-reuse-git-mirror-checkout" || service.runtimeMode === "env-reuse-git-mirror-checkout" || planned.envReuse === true || service.envReuse === true;
+const envReuse = planned.runtimeMode === "env-reuse-gitea-checkout" || service.runtimeMode === "env-reuse-gitea-checkout" || planned.envReuse === true || service.envReuse === true;
 const image = envReuse ? (service.environmentImage || service.image || "") : (service.image || "");
 const digest = envReuse ? (service.environmentDigest || service.digest || "not_published") : (service.digest || "not_published");
 const imageTag = service.imageTag || (image.includes(":") ? image.slice(image.lastIndexOf(":") + 1) : "");
@@ -48,7 +48,7 @@ const values = {
   "component-input-hash": componentInputHash,
   "environment-input-hash": environmentInputHash,
   "code-input-hash": codeInputHash,
-  "runtime-mode": envReuse ? "env-reuse-git-mirror-checkout" : "service-image",
+  "runtime-mode": envReuse ? "env-reuse-gitea-checkout" : "service-image",
   "boot-repo": planned.bootRepo || service.bootRepo || "",
   "boot-commit": envReuse ? revision : (service.bootCommit || ""),
   "boot-sh": planned.bootSh || service.bootSh || "",

scripts/src/gitops-render/templates/plan-artifacts.sh

@@ -9,7 +9,7 @@ if [ -d "$ci_node_deps/yaml" ] && [ ! -e node_modules/yaml ]; then
   ln -s "$ci_node_deps/yaml" node_modules/yaml
 fi
 test "$(git rev-parse HEAD)" = "$(params.revision)"
-HWLAB_CATALOG_PATH="$(params.catalog-path)" HWLAB_GIT_URL="$(params.git-url)" HWLAB_GIT_READ_URL="$(params.git-read-url)" HWLAB_GITOPS_BRANCH="$(params.gitops-branch)" HWLAB_SERVICES="$(params.services)" node scripts/ci/restore-artifact-catalog.mjs
+HWLAB_CATALOG_PATH="$(params.catalog-path)" HWLAB_GIT_URL="$(params.git-url)" HWLAB_GIT_READ_URL="$(params.gitops-read-url)" HWLAB_GITOPS_BRANCH="$(params.gitops-branch)" HWLAB_SERVICES="$(params.services)" node scripts/ci/restore-artifact-catalog.mjs
 node scripts/ci-plan.mjs --lane "$(params.lane)" --base-ref "$(params.release-base-commit)" --target-ref HEAD --deploy-config deploy/deploy.yaml --artifact-catalog "$(params.catalog-path)" --registry-prefix "$(params.registry-prefix)" --services "$(params.services)" --release-target "$(params.release-target)" --release-consumer "$(params.release-consumer)" --verify-reuse-registry > /workspace/source/ci-plan.json
 node scripts/ci/verify-reviewed-plan.mjs --actual-plan /workspace/source/ci-plan.json --reviewed-plan "$(params.reviewed-plan)"
 node - <<'NODE'
@@ -25,7 +25,7 @@ const entries = allServices.map((serviceId) => {
   const service = byService.get(serviceId) || {};
   const serviceSelected = selectedSet.has(serviceId);
   const rolloutAffected = serviceSelected && affected.has(serviceId);
-  const envReuse = service.runtimeMode === "env-reuse-git-mirror-checkout" || service.envReuse === true;
+  const envReuse = service.runtimeMode === "env-reuse-gitea-checkout" || service.envReuse === true;
   const buildRequired = serviceSelected && (plannedBuildServices ? plannedBuildServices.has(serviceId) : (envReuse ? service.envChanged === true : rolloutAffected));
   return {
     serviceId,

scripts/src/gitops-render/templates/prepare-source.sh

@@ -9,16 +9,8 @@ export HWLAB_SOURCE_REVISION="$(params.revision)"
 echo '{"event":"ci-base-image","phase":"prepare-source","image":"__HWLAB_CI_TOOLS_IMAGE__","policy":"no-runtime-apk"}'
 for tool in node git timeout; do command -v "$tool" >/dev/null 2>&1 || { echo '{"event":"ci-base-image","ok":false,"reason":"missing-tool","tool":"'"$tool"'"}'; exit 31; }; done
 node -e 'console.log(JSON.stringify({event:"ci-base-image",phase:"prepare-source",ok:true,node:process.version}))'
-# __HWLAB_GIT_SSH_SHELL__
-
-git_url_requires_ssh() { case "$1" in git@*|ssh://*) return 0 ;; *) return 1 ;; esac; }
 git_read_url="$(params.git-read-url)"
-if git_url_requires_ssh "$git_read_url"; then
-  for tool in ssh ssh-keyscan; do command -v "$tool" >/dev/null 2>&1 || { echo '{"event":"ci-base-image","ok":false,"reason":"missing-tool","tool":"'"$tool"'"}'; exit 31; }; done
-  git_ssh_setup
-else
-  echo '{"event":"git-ssh-setup","phase":"prepare-source","status":"skipped","reason":"non-ssh-git-read-url"}'
-fi
+gitops_read_url="$(params.gitops-read-url)"
 rm -rf /workspace/source/repo
 source_clone_started_ms="$(ci_now_ms)"
 git_timed source-clone 180 git clone --branch "$(params.source-branch)" "$git_read_url" /workspace/source/repo
@@ -35,8 +27,8 @@ ci_timing_emit prepare-source-dependencies succeeded "$prepare_source_dependenci
 catalog_path="$(params.catalog-path)"
 mkdir -p "$(dirname "$catalog_path")"
 catalog_fetch_started_ms="$(ci_now_ms)"
-if git_timed catalog-ls-remote 45 git ls-remote --exit-code --heads "$git_read_url" "$(params.gitops-branch)" >/dev/null; then
-  git remote set-url gitops-catalog "$git_read_url" 2>/dev/null || git remote add gitops-catalog "$git_read_url"
+if git_timed catalog-ls-remote 45 git ls-remote --exit-code --heads "$gitops_read_url" "$(params.gitops-branch)" >/dev/null; then
+  git remote set-url gitops-catalog "$gitops_read_url" 2>/dev/null || git remote add gitops-catalog "$gitops_read_url"
   git_timed catalog-fetch 90 git fetch --depth 1 gitops-catalog "$(params.gitops-branch)" >/dev/null || true
   if git cat-file -e FETCH_HEAD:"$catalog_path" 2>/dev/null; then
     git show FETCH_HEAD:"$catalog_path" > /tmp/hwlab-gitops-artifact-catalog.json