From 574d1de23bb3754bced729edf34d1b4e7ecae142 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Wed, 29 Jul 2026 23:55:21 +0800
Subject: [PATCH] fix(jd): reconcile code-channel push permissions

---
 server-tools/lake-lamp-authz/README.md         |  6 ++++++
 .../hooks/guanghu-ice-heart-post-receive       | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100755 server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive

diff --git a/server-tools/lake-lamp-authz/README.md b/server-tools/lake-lamp-authz/README.md
index decda92..b7d3d26 100644
--- a/server-tools/lake-lamp-authz/README.md
+++ b/server-tools/lake-lamp-authz/README.md
@@ -87,6 +87,12 @@ node server-tools/lake-lamp-authz/authorize-repo-push.js \
 - 当裸仓库归属代码频道服务账户时，在系统 Git 配置中把该精确路径登记为
   `safe.directory`，不得使用通配符。
 
+光湖代码频道本身保留 `UMask=0077`，以免放宽数据库和其他状态目录。仅在
+`guanghu-ice-heart.git/hooks/post-receive` 安装仓库随附的
+`hooks/guanghu-ice-heart-post-receive`，让成功的公共 Git 推送完成后校正
+`objects` 与 `refs` 的共享组权限。不要为了共享一个裸仓库而修改整个代码频道服务的
+UMask。
+
 部署后用当前主分支生成无变化验收 bundle，经 `receiveBundle` 完整执行一次；验收前后
 主分支 SHA 必须一致，并且代码频道账户与授权服务账户执行 `git fsck` 均通过。
 
diff --git a/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
new file mode 100755
index 0000000..cca5de8
--- /dev/null
+++ b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+# The code-channel service runs with UMask=0077. Keep that isolation for its
+# database and other state, but make Git objects and refs readable/writable by
+# the repository's dedicated shared group after an accepted public push.
+repo_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd -P)
+cd "$repo_dir"
+owner_uid=$(id -u)
+
+find "$repo_dir/objects" "$repo_dir/refs" -user "$owner_uid" -type d -exec chmod g+rwx {} +
+find "$repo_dir/objects" "$repo_dir/refs" -user "$owner_uid" -type f -exec chmod g+rw {} +
+
+for shared_file in HEAD packed-refs; do
+  if [ -f "$repo_dir/$shared_file" ]; then
+    find "$repo_dir/$shared_file" -user "$owner_uid" -exec chmod g+rw {} +
+  fi
+done