vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(soong-lab-ci): webhook auto-deploy real root cause = gitea ALLOWED_HOST_LIST + add listener logging

Browse Source 
The ufw fix (prior commit) was necessary but insufficient. The DECISIVE blocker
was gitea webhook.ALLOWED_HOST_LIST = 'external, 10.100.0.0/16' (NH3 only) —
corviduo-dev is 10.250.50.152 (Anaheim), so gitea refused to deliver ('deny
10.250.50.152') and never opened the TCP connection. Fixed to 'external,
10.0.0.0/8' (whole fleet, matches the ufw choice) + gitea restart.

Listener now logs every delivery (source-IP/hmac_ok/ref/action) — the old
log_message=pass silence hid the whole failure. Proven end-to-end: real gitea
delivery -> hmac_ok=True, ref=main, 202 deploying -> green deploy.
This commit is contained in:
vh
2026-07-14 09:19:38 -07:00
parent 4fc0c27485
commit 462d528bef
2 changed files with 64 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/soong-lab-ci/soong-webhook.py
+39 -8
View File
@@ -1,27 +1,58 @@
#!/usr/bin/env python3
"""Gitea push-webhook listener for soong-lab: on a verified push to main, run
~/soong-lab-deploy.sh. HMAC-SHA256 (X-Gitea-Signature) vs ~/.config/soong/webhook-secret."""
import hashlib, hmac, json, os, subprocess, threading
~/soong-lab-deploy.sh. HMAC-SHA256 (X-Gitea-Signature) vs ~/.config/soong/webhook-secret.
Logs each delivery (source IP / event / HMAC result / ref / action) to journald.
Added 2026-07-14 to diagnose the gitea->:9010 REAL-delivery path after the ufw fix
alone didn't restore auto-deploy (the prior `log_message = pass` made the listener
silent, so we couldn't see whether gitea was delivering / authenticating / ref-matching)."""
import hashlib, hmac, json, os, subprocess, sys, threading
from http.server import BaseHTTPRequestHandler, HTTPServer
SECRET = open(os.path.expanduser("~/.config/soong/webhook-secret"), "rb").read().strip()
DEPLOY = os.path.expanduser("~/soong-lab-deploy.sh")
STATUS = os.path.expanduser("~/.config/soong/last-deploy.json")
def _log(msg):
print(f"[webhook] {msg}", file=sys.stderr, flush=True)
class H(BaseHTTPRequestHandler):
def do_POST(self):
body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
recv = self.headers.get("X-Gitea-Signature", "")
mac = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
if not hmac.compare_digest(mac, self.headers.get("X-Gitea-Signature", "")):
ok = hmac.compare_digest(mac, recv)
event = self.headers.get("X-Gitea-Event", "?")
_log(f"POST from {self.client_address[0]} event={event} clen={len(body)} "
f"sig_recv={recv[:12]!r} sig_exp={mac[:12]!r} hmac_ok={ok}")
if not ok:
_log("-> 401 bad signature (gitea-hook secret != listener secret)")
self.send_response(401); self.end_headers(); self.wfile.write(b"bad signature\n"); return
try: ref = json.loads(body).get("ref", "")
except Exception: self.send_response(400); self.end_headers(); return
try:
ref = json.loads(body).get("ref", "")
except Exception:
_log("-> 400 bad json")
self.send_response(400); self.end_headers(); return
_log(f"ref={ref!r}")
if ref != "refs/heads/main":
_log("-> 200 ignored (ref != refs/heads/main)")
self.send_response(200); self.end_headers(); self.wfile.write(b"ignored " + ref.encode() + b"\n"); return
_log("-> 202 deploying")
self.send_response(202); self.end_headers(); self.wfile.write(b"deploying\n")
threading.Thread(target=lambda: subprocess.run(["bash", DEPLOY]), daemon=True).start()
def do_GET(self):
self.send_response(200); self.end_headers()
try: st = open(STATUS).read().strip()
except Exception: st = "no deploy yet"
try:
st = open(STATUS).read().strip()
except Exception:
st = "no deploy yet"
self.wfile.write(b"soong-webhook ok | last: " + st.encode())
def log_message(self, *a): pass
def log_message(self, *a):
pass
HTTPServer(("0.0.0.0", 9010), H).serve_forever()