From 0c115ea714bf5b4014751878906259a5c398b9d7 Mon Sep 17 00:00:00 2001 From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone> Date: Mon, 14 Sep 2026 16:54:55 +0000 Subject: [PATCH] cctest-recipe-upstream: support non-sandboxed execution (anonymous git/API access) --- .../skills/cctest-recipe-upstream/SKILL.md | 29 +++++++++++++++ scripts/gen-cctest-skills.py | 36 ++++++++++++++++++- 2 files changed, 64 insertions(+), 1 deletion(-) diff --git a/.opencode/skills/cctest-recipe-upstream/SKILL.md b/.opencode/skills/cctest-recipe-upstream/SKILL.md index 992364b..61c55c4 100644 --- a/.opencode/skills/cctest-recipe-upstream/SKILL.md +++ b/.opencode/skills/cctest-recipe-upstream/SKILL.md @@ -24,3 +24,32 @@ run `/cctest-intro` / `/cctest-setup-sandbox` first. timers) from an ARM skill — cc-ci work goes through the cc-ci skills. - The submodule is **pinned**: don't commit into it from here; upstream ARM changes arrive via a deliberate submodule bump + `scripts/gen-cctest-skills.py` regeneration. + +**Sandboxed vs non-sandboxed mode.** This skill needs only git + (optionally) the Gitea API — +not the test server — so it can run either way. Probe, then follow that branch: + +- **Sandboxed** (ARM env configured: `test-ssh/.testenv` with `GITEA_USERNAME`/`GITEA_PASSWORD`/ + `GITEA_URL`, sandbox/test instances): the canonical `recipe-upstream` script in + `references/recipe-maintainer/.claude/commands/recipe-upstream.md` runs as written. Note its + WORKSPACE probing expects `/workspace` or `~/Documents/recipe-maintainer`; on a bare host pass + the submodule dir explicitly instead. +- **Non-sandboxed** (no ARM env on the host — e.g. the orchestrator, where the recipe-maintainer + checkout is only a pinned submodule): no sandbox/test instances are needed and NONE of the + setup skills are. Recipe-maintainer mirrors on `git.autonomic.zone` are publicly readable, so: + 1. Check out the recipe if missing: `abra recipe fetch ` (lands in `~/.abra/recipes/`) + — or a plain anonymous `git clone https://git.autonomic.zone/recipe-maintainers/.git` + if abra is unavailable. + 2. Fetch the PR head branch from the mirror **anonymously** — no credentials in the remote URL: + `git remote add gitea https://git.autonomic.zone/recipe-maintainers/.git` + (remote update rather than re-add if it exists), then + `git fetch gitea +refs/pull//head:refs/heads/`. + 3. Fetch PR metadata (head/base refs, merged flag, release bump line) from + `https://git.autonomic.zone/api/v1/repos/recipe-maintainers//pulls/` — + unauthenticated; use bot creds only if the repo turns out to be private (orchestrator hosts + can read them from `/srv/cc-ci-orch/.testenv` — never written anywhere else). + 4. Everything else in the canonical script (origin/dev remote setup, release recommendation, + emitted next-steps) is identical. + +In both modes the final output is a set of commands for the operator to run on a machine **with +push access to `git.coopcloud.tech`** — always print them, even when everything local is +already prepared. diff --git a/scripts/gen-cctest-skills.py b/scripts/gen-cctest-skills.py index a01d3e7..4a1caa0 100644 --- a/scripts/gen-cctest-skills.py +++ b/scripts/gen-cctest-skills.py @@ -50,6 +50,40 @@ run `/cctest-intro` / `/cctest-setup-sandbox` first. a deliberate submodule bump + `scripts/gen-cctest-skills.py` regeneration. """ +# Per-skill extra body sections appended after BODY_TEMPLATE (survive regeneration). +PER_SKILL_NOTES: dict[str, str] = { + "recipe-upstream": """ +**Sandboxed vs non-sandboxed mode.** This skill needs only git + (optionally) the Gitea API — +not the test server — so it can run either way. Probe, then follow that branch: + +- **Sandboxed** (ARM env configured: `test-ssh/.testenv` with `GITEA_USERNAME`/`GITEA_PASSWORD`/ + `GITEA_URL`, sandbox/test instances): the canonical `recipe-upstream` script in + `references/recipe-maintainer/.claude/commands/recipe-upstream.md` runs as written. Note its + WORKSPACE probing expects `/workspace` or `~/Documents/recipe-maintainer`; on a bare host pass + the submodule dir explicitly instead. +- **Non-sandboxed** (no ARM env on the host — e.g. the orchestrator, where the recipe-maintainer + checkout is only a pinned submodule): no sandbox/test instances are needed and NONE of the + setup skills are. Recipe-maintainer mirrors on `git.autonomic.zone` are publicly readable, so: + 1. Check out the recipe if missing: `abra recipe fetch ` (lands in `~/.abra/recipes/`) + — or a plain anonymous `git clone https://git.autonomic.zone/recipe-maintainers/.git` + if abra is unavailable. + 2. Fetch the PR head branch from the mirror **anonymously** — no credentials in the remote URL: + `git remote add gitea https://git.autonomic.zone/recipe-maintainers/.git` + (remote update rather than re-add if it exists), then + `git fetch gitea +refs/pull//head:refs/heads/`. + 3. Fetch PR metadata (head/base refs, merged flag, release bump line) from + `https://git.autonomic.zone/api/v1/repos/recipe-maintainers//pulls/` — + unauthenticated; use bot creds only if the repo turns out to be private (orchestrator hosts + can read them from `/srv/cc-ci-orch/.testenv` — never written anywhere else). + 4. Everything else in the canonical script (origin/dev remote setup, release recommendation, + emitted next-steps) is identical. + +In both modes the final output is a set of commands for the operator to run on a machine **with +push access to `git.coopcloud.tech`** — always print them, even when everything local is +already prepared. +""", +} + WRAPPER_TEMPLATE = """# {wrapped} (thin wrapper) The canonical definition of this skill lives in the **opencode** position: @@ -99,7 +133,7 @@ def main() -> int: ) canon = ROOT / ".opencode/skills" / wrapped / "SKILL.md" canon.parent.mkdir(parents=True, exist_ok=True) - canon.write_text(frontmatter + BODY_TEMPLATE.format(name=name, wrapped=wrapped)) + canon.write_text(frontmatter + BODY_TEMPLATE.format(name=name, wrapped=wrapped) + PER_SKILL_NOTES.get(name, "")) thin = ROOT / ".claude/skills" / wrapped / "SKILL.md" thin.parent.mkdir(parents=True, exist_ok=True) thin.write_text(frontmatter + WRAPPER_TEMPLATE.format(name=name, wrapped=wrapped)) -- 2.54.0