源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

.github/workflows/dev-daytona-snapshot.yml

@@ -0,0 +1,294 @@
+# web.openworklabs.com engine channel:
+# Per-push snapshot builds from dev HEAD stay; the production pin moves only on
+# the nightly backstop, manual dispatch, or releases after the 2026-08-15
+# merge-burst update treadmill recycled every running cloud workspace 3 times.
+# DAYTONA_PIN_CHANNEL resolves pin ping-pong: release pinning defers to the dev channel.
+# Set DAYTONA_PIN_CHANNEL=release to stop this pipeline; the next release re-pins.
+# Sandboxes roll forward via the existing stopped+stale recycle.
+
+name: Dev Daytona Snapshot
+
+on:
+  push:
+    branches: ["dev"]
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+    inputs:
+      force:
+        description: "Rebuild even if the snapshot for the current dev HEAD already exists"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  # Per-push runs queue/batch naturally; in-flight snapshot publishes are never cancelled.
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  publish-daytona-snapshot:
+    name: Build and Push Dev Daytona Snapshot
+    if: github.repository == 'different-ai/openwork'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Check channel
+        id: channel
+        shell: bash
+        env:
+          DAYTONA_PIN_CHANNEL: ${{ vars.DAYTONA_PIN_CHANNEL }}
+        run: |
+          if [ "$DAYTONA_PIN_CHANNEL" != "dev" ]; then
+            echo "::notice::Dev engine channel is disabled; set repository variable DAYTONA_PIN_CHANNEL=dev to enable."
+            echo "Skipped: dev engine channel is disabled (set \`DAYTONA_PIN_CHANNEL=dev\` to enable)." >> "$GITHUB_STEP_SUMMARY"
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Immutable SHA: the pushed commit for push events, or default-branch HEAD at trigger time for schedule/dispatch.
+      # Every commit on dev has passed PR review (Warden L24-F6Z).
+      - name: Checkout dev source at the triggering commit
+        if: steps.channel.outputs.enabled == 'true'
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+
+      - name: Resolve snapshot name
+        id: resolve
+        if: steps.channel.outputs.enabled == 'true'
+        shell: bash
+        env:
+          DAYTONA_SNAPSHOT_NAME_BASE: ${{ vars.DAYTONA_SNAPSHOT_NAME_BASE }}
+          DEFAULT_SNAPSHOT_REGION: ${{ vars.DAYTONA_SNAPSHOT_REGION }}
+        run: |
+          set -euo pipefail
+
+          short_sha="$(git rev-parse --short=7 HEAD)"
+          snapshot_name="${DAYTONA_SNAPSHOT_NAME_BASE:-openwork}-dev-${short_sha}"
+          snapshot_region="${DEFAULT_SNAPSHOT_REGION:-}"
+          {
+            echo "snapshot_name=$snapshot_name"
+            echo "snapshot_region=$snapshot_region"
+            echo "short_sha=$short_sha"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Install Daytona CLI
+        # Pinned and checksum-verified because the CLI runs with DAYTONA_API_KEY.
+        # Bump the version and SHA together (Warden MZE-XC3).
+        if: steps.channel.outputs.enabled == 'true'
+        shell: bash
+        env:
+          DAYTONA_CLI_VERSION: v0.190.0
+          DAYTONA_CLI_SHA256: 1d3591a1ea61d801696110e1b5f3381f223a56a623a882940d0d85742862fd44
+        run: |
+          set -euo pipefail
+
+          mkdir -p "$HOME/.local/bin"
+          curl -fL "https://github.com/daytonaio/daytona/releases/download/${DAYTONA_CLI_VERSION}/daytona-linux-amd64" \
+            -o "$HOME/.local/bin/daytona"
+          printf '%s  %s\n' "$DAYTONA_CLI_SHA256" "$HOME/.local/bin/daytona" | sha256sum -c -
+          chmod +x "$HOME/.local/bin/daytona"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          export PATH="$HOME/.local/bin:$PATH"
+
+          daytona version
+
+      - name: Check whether snapshot already exists
+        id: existing
+        if: steps.channel.outputs.enabled == 'true'
+        shell: bash
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          DAYTONA_API_URL: ${{ vars.DAYTONA_API_URL }}
+          DAYTONA_TARGET: ${{ vars.DAYTONA_TARGET }}
+          DAYTONA_SNAPSHOT_NAME: ${{ steps.resolve.outputs.snapshot_name }}
+          FORCE_REBUILD: ${{ inputs.force }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DAYTONA_API_KEY:-}" ]; then
+            echo "Missing required secret: DAYTONA_API_KEY" >&2
+            exit 1
+          fi
+
+          export DAYTONA_CONFIG_DIR="$RUNNER_TEMP/daytona"
+          mkdir -p "$DAYTONA_CONFIG_DIR"
+          daytona login --api-key "$DAYTONA_API_KEY"
+
+          snapshot_list="$(daytona snapshot list)"
+          if grep -Fq -- "$DAYTONA_SNAPSHOT_NAME" <<<"$snapshot_list"; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            if [ "${FORCE_REBUILD:-false}" != "true" ]; then
+              echo "Snapshot already exists; skipping rebuild: ${DAYTONA_SNAPSHOT_NAME}" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Docker Buildx
+        if: steps.channel.outputs.enabled == 'true' && (steps.existing.outputs.exists != 'true' || inputs.force == true)
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.9.0
+
+      - name: Build and push snapshot
+        id: publish
+        if: steps.channel.outputs.enabled == 'true' && (steps.existing.outputs.exists != 'true' || inputs.force == true)
+        shell: bash
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          DAYTONA_API_URL: ${{ vars.DAYTONA_API_URL }}
+          DAYTONA_TARGET: ${{ vars.DAYTONA_TARGET }}
+          DAYTONA_SNAPSHOT_REGION: ${{ steps.resolve.outputs.snapshot_region }}
+          DAYTONA_SNAPSHOT_NAME: ${{ steps.resolve.outputs.snapshot_name }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DAYTONA_API_KEY:-}" ]; then
+            echo "Missing required secret: DAYTONA_API_KEY" >&2
+            exit 1
+          fi
+
+          export DAYTONA_CONFIG_DIR="$RUNNER_TEMP/daytona"
+          mkdir -p "$DAYTONA_CONFIG_DIR"
+          daytona login --api-key "$DAYTONA_API_KEY"
+
+          echo "Publishing Daytona snapshot: ${DAYTONA_SNAPSHOT_NAME}"
+          ./scripts/create-daytona-openwork-snapshot.sh "${DAYTONA_SNAPSHOT_NAME}"
+
+      - name: Checkout snapshot pin automation
+        if: steps.channel.outputs.enabled == 'true' && vars.DAYTONA_CLOUD_ENV_GROUP_ID != ''
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          ref: ${{ github.sha }}
+          path: .snapshot-pin-automation
+          sparse-checkout: scripts/update-daytona-snapshot-pin.mjs
+          sparse-checkout-cone-mode: false
+
+      - name: Update production snapshot pin
+        id: pin
+        if: steps.channel.outputs.enabled == 'true' && github.event_name != 'push'
+        shell: bash
+        env:
+          DAYTONA_CLOUD_ENV_GROUP_ID: ${{ vars.DAYTONA_CLOUD_ENV_GROUP_ID }}
+          DAYTONA_SNAPSHOT_NAME: ${{ steps.resolve.outputs.snapshot_name }}
+          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DAYTONA_CLOUD_ENV_GROUP_ID:-}" ]; then
+            echo "::notice::DAYTONA_CLOUD_ENV_GROUP_ID is not configured; skipping production snapshot pin update."
+            {
+              echo "### Daytona snapshot pin"
+              echo
+              echo "Skipped: repository variable \`DAYTONA_CLOUD_ENV_GROUP_ID\` is not configured."
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          if [ -z "${RENDER_API_KEY:-}" ]; then
+            echo "::error::Missing required secret: RENDER_API_KEY"
+            exit 1
+          fi
+
+          result="$(node .snapshot-pin-automation/scripts/update-daytona-snapshot-pin.mjs \
+            --env-group-id "$DAYTONA_CLOUD_ENV_GROUP_ID" \
+            --snapshot "$DAYTONA_SNAPSHOT_NAME")"
+          echo "$result"
+          {
+            echo "### Daytona snapshot pin"
+            echo
+            echo "$result"
+          } >> "$GITHUB_STEP_SUMMARY"
+          changed=false
+          case "$result" in
+            updated:*) changed=true ;;
+          esac
+          echo "changed=$changed" >> "$GITHUB_OUTPUT"
+
+      - name: Redeploy den-api so the new pin takes effect
+        # Render does not redeploy services when an env group value changes, so
+        # den-api keeps serving the previous DAYTONA_SNAPSHOT until it redeploys.
+        # Without this the pin moves but `latestVersion` stays stale and no
+        # sandbox ever recycles - observed for real on v0.18.11.
+        # Gated on the pin actually moving, so unchanged re-runs and the
+        # nightly backstop no longer redeploy production for a no-op.
+        if: steps.channel.outputs.enabled == 'true' && github.event_name != 'push' && steps.pin.outcome == 'success' && steps.pin.outputs.changed == 'true'
+        shell: bash
+        env:
+          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
+          RENDER_DEN_SERVICE_ID: ${{ secrets.RENDER_DEN_CONTROL_PLANE_SERVICE_ID }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${RENDER_DEN_SERVICE_ID:-}" ] || [ -z "${RENDER_API_KEY:-}" ]; then
+            echo "::notice::Render den-api credentials unavailable; skipping redeploy. The pin will take effect on the next den-api deploy."
+            exit 0
+          fi
+
+          response="$(curl -s -w '\n%{http_code}' -X POST \
+            "https://api.render.com/v1/services/${RENDER_DEN_SERVICE_ID}/deploys" \
+            -H "Authorization: Bearer $RENDER_API_KEY" \
+            -H "Content-Type: application/json" \
+            -d '{}')"
+          code="$(printf '%s' "$response" | tail -1)"
+          body="$(printf '%s' "$response" | sed '$d')"
+          if [ "$code" -ge 400 ]; then
+            echo "::error::POST /deploys returned HTTP $code: $body"
+            exit 1
+          fi
+
+          {
+            echo
+            echo "Triggered a den-api deploy so the new pin takes effect."
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      # Per-push dev snapshots accumulate forever. Keep the pinned snapshot plus
+      # the 5 newest and skip snapshots referenced by active sandboxes. Old
+      # stopped/archived sandboxes do not block pruning because they keep their own disks.
+      # This also runs nightly as a pruning backstop when the snapshot already exists.
+      - name: Prune old dev snapshots
+        if: steps.channel.outputs.enabled == 'true' && steps.resolve.outcome == 'success'
+        shell: bash
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          DAYTONA_API_URL: ${{ vars.DAYTONA_API_URL }}
+          DAYTONA_CLOUD_ENV_GROUP_ID: ${{ vars.DAYTONA_CLOUD_ENV_GROUP_ID }}
+          DAYTONA_SNAPSHOT_NAME_BASE: ${{ vars.DAYTONA_SNAPSHOT_NAME_BASE }}
+          DAYTONA_SNAPSHOT_NAME: ${{ steps.resolve.outputs.snapshot_name }}
+          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DAYTONA_CLOUD_ENV_GROUP_ID:-}" ] || [ -z "${RENDER_API_KEY:-}" ]; then
+            echo "::notice::prune skipped: current pin unknown"
+            echo "prune skipped: current pin unknown" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          if ! current_pin="$(node .snapshot-pin-automation/scripts/update-daytona-snapshot-pin.mjs --env-group-id "$DAYTONA_CLOUD_ENV_GROUP_ID" --read)"; then
+            echo "::notice::prune skipped: current pin unknown"
+            echo "prune skipped: current pin unknown" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          if [ -z "$current_pin" ]; then
+            echo "::notice::prune skipped: current pin unknown"
+            echo "prune skipped: current pin unknown" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          result="$(node scripts/prune-daytona-dev-snapshots.mjs \
+            ${DAYTONA_API_URL:+--api-url "$DAYTONA_API_URL"} \
+            --name-base "${DAYTONA_SNAPSHOT_NAME_BASE:-openwork}" \
+            --keep "$DAYTONA_SNAPSHOT_NAME" \
+            --keep "$current_pin" \
+            --keep-count 5)"
+          echo "$result"
+          {
+            echo "### Daytona dev snapshot prune"
+            echo
+            echo '```'
+            echo "$result"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"