From 8b1fd453bbc03ff7d5186a6a868082913bda679f Mon Sep 17 00:00:00 2001 From: Amperstrand Date: Tue, 22 Sep 2026 17:52:51 +0200 Subject: [PATCH 1/2] ci(repro): resolve SOURCE_DATE_EPOCH before the SDK Go audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The audit step sources packaging/build-env.sh, which requires SOURCE_DATE_EPOCH and cannot derive it inside an act checkout (no usable .git) — the lane has failed on every main push since #448 landed the audit: build-env: ERROR: SOURCE_DATE_EPOCH not set and no git history available to derive it; export it explicitly Hoist the epoch derivation (the same chain the repro-build step already uses) into a step before the audit and export it via GITHUB_ENV; the repro-build step's own fallback chain now finds it set. The GitHub twin is unaffected: its runners have git metadata, so build-env derives the epoch there. --- .ngit/act/workflows/repro-check.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.ngit/act/workflows/repro-check.yml b/.ngit/act/workflows/repro-check.yml index bb868a679..f12c4b8a6 100644 --- a/.ngit/act/workflows/repro-check.yml +++ b/.ngit/act/workflows/repro-check.yml @@ -91,6 +91,23 @@ jobs: exit 1 fi echo "go $have matches packaging/build-inputs.json" + - name: Resolve SOURCE_DATE_EPOCH from the commit + # The audit step below sources packaging/build-env.sh, which requires + # SOURCE_DATE_EPOCH and cannot derive it from git history in an act + # checkout (no usable .git). Without this step the audit — and with + # it the whole lane — fails on every run. + run: | + set -euo pipefail + SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -C "$GITHUB_WORKSPACE" log -1 --format=%ct HEAD 2>/dev/null || true)}" + if [ -z "$SOURCE_DATE_EPOCH" ] && [ -n "${{ github.event.head_commit.timestamp }}" ]; then + SOURCE_DATE_EPOCH="$(date -u -d "${{ github.event.head_commit.timestamp }}" +%s)" + fi + if [ -z "$SOURCE_DATE_EPOCH" ]; then + echo "NOTE: no commit timestamp available in this environment; pinning the epoch to job start (within-run determinism only)." >&2 + SOURCE_DATE_EPOCH="$(date +%s)" + fi + echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> "${GITHUB_ENV}" + echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" - name: Audit the SDK Go pins against the live OpenWrt feeds # The pin's authority is the SDK's own packages feed: this fails when # .go.version stops matching the pinned release's feed, or when the From 8262f00f7e8a55037bd00d1efccd321fa1a737ba Mon Sep 17 00:00:00 2001 From: Amperstrand Date: Thu, 24 Sep 2026 07:44:16 +0200 Subject: [PATCH 2/2] ci(repro): resolve the epoch via ngit-commit-epoch.sh; rebase changelog --- .ngit/act/workflows/repro-check.yml | 18 ++++++------------ CHANGELOG.md | 10 ++++++++++ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/.ngit/act/workflows/repro-check.yml b/.ngit/act/workflows/repro-check.yml index f12c4b8a6..633e9814a 100644 --- a/.ngit/act/workflows/repro-check.yml +++ b/.ngit/act/workflows/repro-check.yml @@ -94,20 +94,14 @@ jobs: - name: Resolve SOURCE_DATE_EPOCH from the commit # The audit step below sources packaging/build-env.sh, which requires # SOURCE_DATE_EPOCH and cannot derive it from git history in an act - # checkout (no usable .git). Without this step the audit — and with - # it the whole lane — fails on every run. + # checkout (no usable .git). Resolve it the way this repo + # standardized in stage 1: the fail-closed commit-epoch resolver. run: | set -euo pipefail - SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -C "$GITHUB_WORKSPACE" log -1 --format=%ct HEAD 2>/dev/null || true)}" - if [ -z "$SOURCE_DATE_EPOCH" ] && [ -n "${{ github.event.head_commit.timestamp }}" ]; then - SOURCE_DATE_EPOCH="$(date -u -d "${{ github.event.head_commit.timestamp }}" +%s)" - fi - if [ -z "$SOURCE_DATE_EPOCH" ]; then - echo "NOTE: no commit timestamp available in this environment; pinning the epoch to job start (within-run determinism only)." >&2 - SOURCE_DATE_EPOCH="$(date +%s)" - fi - echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> "${GITHUB_ENV}" - echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" + EPOCH=$(bash scripts/ngit-commit-epoch.sh "$GITHUB_SHA") + case "$EPOCH" in ''|*[!0-9]*) echo "ERROR: not an epoch: '$EPOCH'" >&2; exit 1 ;; esac + echo "SOURCE_DATE_EPOCH=$EPOCH" >> "${GITHUB_ENV}" + echo "SOURCE_DATE_EPOCH=$EPOCH ($(date -u -d "@$EPOCH" '+%Y-%m-%d %H:%M:%S UTC'))" - name: Audit the SDK Go pins against the live OpenWrt feeds # The pin's authority is the SDK's own packages feed: this fails when # .go.version stops matching the pinned release's feed, or when the diff --git a/CHANGELOG.md b/CHANGELOG.md index 573ab05c5..a5b530b26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,16 @@ and [Semantic Versioning](https://semver.org/). ## [Unreleased] +### Changed / Internal + +- **The repro lane's SDK Go audit runs again.** Since #448 landed the + audit, `repro-check` failed on every push: the audit sources + `packaging/build-env.sh`, which needs a `SOURCE_DATE_EPOCH` that an act + checkout cannot derive. The lane now resolves the epoch through the + repo-standard fail-closed resolver (`scripts/ngit-commit-epoch.sh`) + before the audit. + ([#519](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/519)) + ### Added - **`GET /session-state?mac=…` reports a machine-readable session state per