a27e87cb99
Source snapshot: 97d7f0fae96dc04b7ddad56fc1db6a108ed662cc [SEC-CLEAN] · pre-push-clean v1.0 · 109处敏感信息已自动转乱码
199 lines
5.9 KiB
Markdown
199 lines
5.9 KiB
Markdown
---
|
||
belongs_to:
|
||
- "[[INDEX · 铸渊·协作指令｜GitHub ↔ Notion 桥接协议]]"
|
||
---
|
||
# 🌉 铸渊指令｜主仓库拉取同步 · Awen 仓库桥接修复方案
|
||
|
||
<aside>
|
||
🚨
|
||
|
||
**指令编号：ZY-BRIDGE-FIX-001**
|
||
|
||
**执行人：铸渊（GitHub 执行层）**
|
||
|
||
**签发人：冰朔（TCS-0002∞）**
|
||
|
||
**优先级：🟡 P1**
|
||
|
||
**问题：Awen 仓库 Actions 推送主仓库报 403 Permission denied**
|
||
|
||
</aside>
|
||
|
||
---
|
||
|
||
## 🔍 问题背景
|
||
|
||
Awen（DEV-012）的仓库 `WENZHUOXI/guanghu-awen` 通过 GitHub Actions 向主仓库 `qinfendebingshuo/guanghulab` 推送时，报错：
|
||
|
||
```
|
||
remote: Permission to qinfendebingshuo/guanghulab.git denied to qinfendebingshuo.
|
||
fatal: unable to access 'https://github.com/qinfendebingshuo/guanghulab.git/': The requested URL returned error: 403
|
||
```
|
||
|
||
**根因：** Classic PAT 从外部仓库的 Actions 运行环境推送到主仓库时，GitHub 拒绝了跨仓库写入。Token 本身有效且有 `repo` 权限，但 GitHub 的安全策略不允许这种跨仓库 Actions 推送。
|
||
|
||
**约束：** Token 不能换，其他开发者也在用同一个 Token。
|
||
|
||
---
|
||
|
||
## ✅ 解决方案：反转同步方向
|
||
|
||
**不让 Awen 的仓库推到主仓库，而是让主仓库主动拉取 Awen 的内容。**
|
||
|
||
推送动作发生在 `guanghulab` 自己的 Actions 里，不涉及跨仓库写入，不会触发 403。
|
||
|
||
---
|
||
|
||
## 🛠️ 执行步骤
|
||
|
||
### Step 1 · 在主仓库创建拉取工作流
|
||
|
||
在 `qinfendebingshuo/guanghulab` 仓库中创建文件：
|
||
|
||
`.github/workflows/pull-sync-awen.yml`
|
||
|
||
```yaml
|
||
# 🌉 光湖桥接拉取同步 · Awen 仓库
|
||
# 主仓库主动拉取 Awen 仓库内容到 federation/awen/
|
||
# 触发条件：定时 / 手动 / Awen 通过 repository_dispatch 触发
|
||
|
||
name: "🌉 Pull Sync from Awen"
|
||
|
||
on:
|
||
# 定时拉取：每天 09:00 和 21:00 北京时间
|
||
schedule:
|
||
- cron: "0 1 * * *" # UTC 01:00 = CST 09:00
|
||
- cron: "0 13 * * *" # UTC 13:00 = CST 21:00
|
||
# 手动触发
|
||
workflow_dispatch:
|
||
# Awen 仓库可通过 API 触发
|
||
repository_dispatch:
|
||
types: [awen-sync]
|
||
|
||
jobs:
|
||
pull-from-awen:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: "📥 Checkout GuanghuLab"
|
||
uses: actions/checkout@v4
|
||
with:
|
||
fetch-depth: 0
|
||
|
||
- name: "🌉 Pull Awen Repo Content"
|
||
env:
|
||
GH_TOKEN: $\{\{ secrets.MAIN_REPO_TOKEN \}\}
|
||
run: |
|
||
echo "🌊 光湖桥接拉取同步开始"
|
||
echo "时间: $(TZ='Asia/Shanghai' date '+%Y-%m-%d %H:%M:%S CST')"
|
||
|
||
# 克隆 Awen 仓库
|
||
git clone https://github.com/WENZHUOXI/guanghu-awen.git /tmp/awen-repo || {
|
||
echo "⚠️ Awen 仓库为 Private，尝试用 Token 克隆"
|
||
git clone https://x-access-token:${GH_TOKEN}@github.com/WENZHUOXI/guanghu-awen.git /tmp/awen-repo
|
||
}
|
||
|
||
# 创建同步目标目录
|
||
mkdir -p federation/awen/workspace
|
||
|
||
# 复制 Awen 仓库内容（排除 .git 和 .github）
|
||
rsync -av --delete --exclude='.git' --exclude='.github' /tmp/awen-repo/ federation/awen/workspace/
|
||
|
||
# 生成同步清单
|
||
cat > federation/awen/latest-sync.json << EOF
|
||
{
|
||
"source": "WENZHUOXI/guanghu-awen",
|
||
"synced_by": "guanghulab-pull-action",
|
||
"timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
|
||
"method": "pull-sync"
|
||
}
|
||
EOF
|
||
|
||
echo "✅ 拉取完成"
|
||
|
||
- name: "💾 Commit & Push"
|
||
run: |
|
||
git config user.name "guanghu-bridge-bot"
|
||
git config user.email "bridge-bot@guanghu.dev"
|
||
|
||
git add -A
|
||
git diff --cached --quiet && echo "无变更，跳过" && exit 0
|
||
git commit -m "🌉 [pull-sync] GuanghuLab ← Awen | $(TZ='Asia/Shanghai' date '+%Y-%m-%d %H:%M')"
|
||
git push origin main
|
||
|
||
echo "✅ 同步提交完成！"
|
||
|
||
- name: "📝 Sync Summary"
|
||
if: always()
|
||
run: |
|
||
echo "## 🌉 拉取同步结果" >> $GITHUB_STEP_SUMMARY
|
||
echo "- 源仓库: WENZHUOXI/guanghu-awen" >> $GITHUB_STEP_SUMMARY
|
||
echo "- 目标路径: federation/awen/" >> $GITHUB_STEP_SUMMARY
|
||
echo "- 方式: 主仓库拉取" >> $GITHUB_STEP_SUMMARY
|
||
echo "- 时间: $(TZ='Asia/Shanghai' date '+%Y-%m-%d %H:%M:%S CST')" >> $GITHUB_STEP_SUMMARY
|
||
```
|
||
|
||
### Step 2 · 简化 Awen 的仓库工作流
|
||
|
||
**Awen 仓库不再需要推送到主仓库。** 可以把原来的 `bridge-sync.yml` 简化为只发一个通知：
|
||
|
||
将 Awen 仓库的 `.github/workflows/bridge-sync.yml` 替换为：
|
||
|
||
```yaml
|
||
# 🌊 Awen 仓库变更通知
|
||
# 每次 push 后通知主仓库拉取
|
||
|
||
name: "📢 Notify GuanghuLab"
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
|
||
jobs:
|
||
notify-main-repo:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: "📢 Trigger Pull Sync"
|
||
env:
|
||
MAIN_REPO_TOKEN: $\{\{ secrets.MAIN_REPO_TOKEN \}\}
|
||
run: |
|
||
curl -X POST \
|
||
-H "Accept: application/vnd.github+json" \
|
||
-H "Authorization: Bearer ${MAIN_REPO_TOKEN}" \
|
||
https://api.github.com/repos/qinfendebingshuo/guanghulab/dispatches \
|
||
-d '{"event_type": "awen-sync"}'
|
||
|
||
echo "✅ 已通知主仓库拉取同步"
|
||
```
|
||
|
||
### Step 3 · 测试验证
|
||
|
||
1. 先在主仓库手动触发 `Pull Sync from Awen` 工作流，确认拉取成功
|
||
2. 然后让 Awen 推送一次代码，确认自动触发主仓库拉取
|
||
3. 检查主仓库 `federation/awen/workspace/` 目录是否出现文件
|
||
|
||
---
|
||
|
||
## 🔄 同步流程图
|
||
|
||
```
|
||
Awen push 代码
|
||
↓
|
||
Awen Actions: 发 repository_dispatch 事件
|
||
↓
|
||
GuanghuLab Actions: 收到事件 → 拉取 Awen 仓库 → 复制到 federation/awen/ → commit + push
|
||
↓
|
||
✅ 同步完成
|
||
```
|
||
|
||
---
|
||
|
||
<aside>
|
||
💡
|
||
|
||
**这个方案同样适用于其他开发者仓库（小兴、之之、桔子等）。**
|
||
|
||
只需在主仓库复制一份 workflow，改一下仓库地址和同步目录名即可。
|
||
|
||
后续可统一为模板。
|
||
|
||
</aside> |