源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

.github/workflows/daytona-snapshot-drift.yml

@@ -0,0 +1,122 @@
+name: Daytona Snapshot Drift
+
+on:
+  schedule:
+    - cron: "17 9 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-snapshot-pin:
+    name: Compare production pin with latest release
+    if: github.repository == 'different-ai/openwork'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      DAYTONA_CLOUD_ENV_GROUP_ID: ${{ vars.DAYTONA_CLOUD_ENV_GROUP_ID }}
+      DAYTONA_SNAPSHOT_NAME_BASE: ${{ vars.DAYTONA_SNAPSHOT_NAME_BASE }}
+      RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
+
+    steps:
+      - name: Check drift configuration
+        id: config
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          missing=""
+          [ -z "${DAYTONA_CLOUD_ENV_GROUP_ID:-}" ] && missing="$missing DAYTONA_CLOUD_ENV_GROUP_ID"
+          [ -z "${RENDER_API_KEY:-}" ] && missing="$missing RENDER_API_KEY"
+          if [ -n "$missing" ]; then
+            echo "::notice::Skipping Daytona snapshot drift check; missing GitHub configuration:$missing."
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "enabled=true" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout
+        if: steps.config.outputs.enabled == 'true'
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+
+      - name: Read production snapshot pin
+        if: steps.config.outputs.enabled == 'true'
+        id: current
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          pin="$(node scripts/update-daytona-snapshot-pin.mjs \
+            --env-group-id "$DAYTONA_CLOUD_ENV_GROUP_ID" \
+            --read)"
+          base_name="${DAYTONA_SNAPSHOT_NAME_BASE:-openwork}"
+          echo "pin=$pin" >> "$GITHUB_OUTPUT"
+          if [[ "$pin" =~ ^${base_name}-dev-([0-9a-f]{7,})$ ]]; then
+            echo "channel=dev" >> "$GITHUB_OUTPUT"
+            echo "sha=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          else
+            echo "channel=release" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check dev channel snapshot pin
+        if: steps.config.outputs.enabled == 'true' && steps.current.outputs.channel == 'dev'
+        shell: bash
+        env:
+          CURRENT_PIN: ${{ steps.current.outputs.pin }}
+          SHORT_SHA: ${{ steps.current.outputs.sha }}
+        run: |
+          set -euo pipefail
+
+          git fetch origin dev
+          if ! full_sha="$(git rev-parse --verify "${SHORT_SHA}^{commit}" 2>/dev/null)"; then
+            echo "::error::nightly dev snapshot appears stale/broken: ${SHORT_SHA} does not resolve to a commit"
+            exit 1
+          fi
+          if ! git merge-base --is-ancestor "$full_sha" origin/dev; then
+            echo "::error::nightly dev snapshot appears stale/broken: ${full_sha} is not on origin/dev"
+            exit 1
+          fi
+
+          commit_time="$(git show -s --format=%ct "$full_sha")"
+          if [ "$(( $(date +%s) - commit_time ))" -gt 172800 ]; then
+            echo "::error::nightly dev snapshot appears stale/broken"
+            exit 1
+          fi
+          echo "Dev channel pin healthy: ${CURRENT_PIN}" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Resolve expected snapshot from latest release
+        if: steps.config.outputs.enabled == 'true' && steps.current.outputs.channel == 'release'
+        id: expected
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          release_tag="$(gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \
+            --jq 'map(select(.draft == false))[0].tag_name')"
+          if [[ ! "$release_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::Newest published GitHub release returned invalid tag: ${release_tag}"
+            exit 1
+          fi
+
+          base_name="${DAYTONA_SNAPSHOT_NAME_BASE:-openwork}"
+          snapshot_name="${base_name}-${release_tag#v}"
+          echo "release_tag=$release_tag" >> "$GITHUB_OUTPUT"
+          echo "snapshot_name=$snapshot_name" >> "$GITHUB_OUTPUT"
+          echo "Expected snapshot for ${release_tag}: ${snapshot_name}"
+
+      - name: Compare production snapshot pin
+        if: steps.config.outputs.enabled == 'true' && steps.current.outputs.channel == 'release'
+        shell: bash
+        env:
+          EXPECTED_SNAPSHOT_NAME: ${{ steps.expected.outputs.snapshot_name }}
+        run: |
+          set -euo pipefail
+
+          node scripts/update-daytona-snapshot-pin.mjs \
+            --env-group-id "$DAYTONA_CLOUD_ENV_GROUP_ID" \
+            --snapshot "$EXPECTED_SNAPSHOT_NAME" \
+            --compare