[wip ai slop] Verify immutable receipts before ingest / 导入前验证不可变回执

.github/workflows/ingest-agentic-results.yml

@@ -51,6 +51,61 @@ on:
         required: false
         default: ''
         type: string
+      receipt-required:
+        description: Immutable publication transport receipt-required
+        required: false
+        type: string
+        default: 'false'
+      receipt-artifact-id:
+        description: Immutable publication transport receipt-artifact-id
+        required: false
+        type: string
+        default: ''
+      receipt-artifact-sha256:
+        description: Immutable publication transport receipt-artifact-sha256
+        required: false
+        type: string
+        default: ''
+      receipt-sha256:
+        description: Immutable publication transport receipt-sha256
+        required: false
+        type: string
+        default: ''
+      receipt-issuer-run-id:
+        description: Immutable publication transport receipt-issuer-run-id
+        required: false
+        type: string
+        default: ''
+      receipt-issuer-sha:
+        description: Immutable publication transport receipt-issuer-sha
+        required: false
+        type: string
+        default: ''
+      publication-artifact-id:
+        description: Immutable publication transport publication-artifact-id
+        required: false
+        type: string
+        default: ''
+      publication-artifact-sha256:
+        description: Immutable publication transport publication-artifact-sha256
+        required: false
+        type: string
+        default: ''
+      publication-sha256:
+        description: Immutable publication transport publication-sha256
+        required: false
+        type: string
+        default: ''
+      publication-issuer-run-id:
+        description: Immutable publication transport publication-issuer-run-id
+        required: false
+        type: string
+        default: ''
+      publication-issuer-sha:
+        description: Immutable publication transport publication-issuer-sha
+        required: false
+        type: string
+        default: ''
     secrets:
       DATABASE_WRITE_URL:
         description: Production database write connection for direct ingests
@@ -111,6 +166,62 @@ on:
         default: ''
         type: string
 
+      receipt-required:
+        description: Immutable publication transport receipt-required
+        required: false
+        type: string
+        default: 'false'
+      receipt-artifact-id:
+        description: Immutable publication transport receipt-artifact-id
+        required: false
+        type: string
+        default: ''
+      receipt-artifact-sha256:
+        description: Immutable publication transport receipt-artifact-sha256
+        required: false
+        type: string
+        default: ''
+      receipt-sha256:
+        description: Immutable publication transport receipt-sha256
+        required: false
+        type: string
+        default: ''
+      receipt-issuer-run-id:
+        description: Immutable publication transport receipt-issuer-run-id
+        required: false
+        type: string
+        default: ''
+      receipt-issuer-sha:
+        description: Immutable publication transport receipt-issuer-sha
+        required: false
+        type: string
+        default: ''
+      publication-artifact-id:
+        description: Immutable publication transport publication-artifact-id
+        required: false
+        type: string
+        default: ''
+      publication-artifact-sha256:
+        description: Immutable publication transport publication-artifact-sha256
+        required: false
+        type: string
+        default: ''
+      publication-sha256:
+        description: Immutable publication transport publication-sha256
+        required: false
+        type: string
+        default: ''
+      publication-issuer-run-id:
+        description: Immutable publication transport publication-issuer-run-id
+        required: false
+        type: string
+        default: ''
+      publication-issuer-sha:
+        description: Immutable publication transport publication-issuer-sha
+        required: false
+        type: string
+        default: ''
+
 permissions: {}
 
 concurrency:
@@ -266,6 +377,28 @@ jobs:
           echo "Selected ingest target: $REQUESTED_DATABASE_TARGET"
           echo "Cache invalidate URL: $cache_invalidate_url"
 
+      - name: Verify immutable receipt transport
+        env:
+          GH_TOKEN: ${{ secrets.INFX_MAIN_PAT }}
+          INGEST_REPO: SemiAnalysisAI/InferenceX
+          SOURCE_RUN_ID: ${{ github.event.client_payload.source-run-id || github.event.client_payload.run-id || inputs.run-id }}
+          RECEIPT_TRANSPORT_PATH: ${{ github.workspace }}/receipt-transport
+          ALLOWED_RECEIPT_ISSUER_SHAS: ${{ vars.INFX_RECEIPT_ISSUER_SHAS }}
+          ALLOWED_RECEIPT_ISSUER_WORKFLOW: ${{ vars.INFX_RECEIPT_ISSUER_WORKFLOW }}
+          RECEIPT_REQUIRED: ${{ github.event.client_payload.receipt-required || inputs.receipt-required || 'false' }}
+          PUBLICATION_REQUIRED: ${{ env.REQUESTED_DATABASE_TARGET == 'production' && 'true' || 'false' }}
+          RECEIPT_ARTIFACT_ID: ${{ github.event.client_payload.receipt-artifact-id || inputs.receipt-artifact-id }}
+          RECEIPT_ARTIFACT_SHA256: ${{ github.event.client_payload.receipt-artifact-sha256 || inputs.receipt-artifact-sha256 }}
+          RECEIPT_SHA256: ${{ github.event.client_payload.receipt-sha256 || inputs.receipt-sha256 }}
+          RECEIPT_ISSUER_RUN_ID: ${{ github.event.client_payload.receipt-issuer-run-id || inputs.receipt-issuer-run-id }}
+          RECEIPT_ISSUER_SHA: ${{ github.event.client_payload.receipt-issuer-sha || inputs.receipt-issuer-sha }}
+          PUBLICATION_ARTIFACT_ID: ${{ github.event.client_payload.publication-artifact-id || inputs.publication-artifact-id }}
+          PUBLICATION_ARTIFACT_SHA256: ${{ github.event.client_payload.publication-artifact-sha256 || inputs.publication-artifact-sha256 }}
+          PUBLICATION_SHA256: ${{ github.event.client_payload.publication-sha256 || inputs.publication-sha256 }}
+          PUBLICATION_ISSUER_RUN_ID: ${{ github.event.client_payload.publication-issuer-run-id || inputs.publication-issuer-run-id }}
+          PUBLICATION_ISSUER_SHA: ${{ github.event.client_payload.publication-issuer-sha || inputs.publication-issuer-sha }}
+        run: bun packages/db/src/prepare-receipt-transport.ts
+
       - name: Prepare artifacts from InferenceX
         id: artifacts
         env:
@@ -317,6 +450,20 @@ jobs:
       - name: Verify PowerX source, database and public API
         run: bun packages/db/src/verify-power-publication.ts power-publication.json "${CACHE_INVALIDATE_URL%/api/v1/invalidate}"
 
+      - name: Verify accepted measurement publication
+        if: env.INGEST_RECEIPT_REQUIRED == '1'
+        env:
+          INGEST_ARTIFACTS_PATH: ${{ github.workspace }}/artifacts
+        run: bun packages/db/src/verify-measurement-publication.ts "${CACHE_INVALIDATE_URL%/api/v1/invalidate}" measurement-publication.json
+
+      - name: Retain measurement publication verification
+        if: always() && env.INGEST_RECEIPT_REQUIRED == '1'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: measurement-publication-${{ steps.artifacts.outputs.source-run-id }}
+          path: measurement-publication.json
+          if-no-files-found: warn
+
       - name: Retain PowerX publication receipt
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/workflows/ingest-results.yml

@@ -50,6 +50,29 @@ jobs:
         env:
           CYPRESS_INSTALL_BINARY: '0'
 
+      - name: Verify immutable receipt transport
+        env:
+          # Existing cross-repository credential reads pinned issuer metadata and receipt artifacts.
+          GH_TOKEN: ${{ secrets.INFX_MAIN_PAT }}
+          INGEST_REPO: SemiAnalysisAI/InferenceX
+          SOURCE_RUN_ID: ${{ github.event.client_payload.source-run-id || github.event.client_payload.run-id }}
+          RECEIPT_TRANSPORT_PATH: ${{ github.workspace }}/receipt-transport
+          ALLOWED_RECEIPT_ISSUER_SHAS: ${{ vars.INFX_RECEIPT_ISSUER_SHAS }}
+          ALLOWED_RECEIPT_ISSUER_WORKFLOW: ${{ vars.INFX_RECEIPT_ISSUER_WORKFLOW }}
+          RECEIPT_REQUIRED: ${{ github.event.client_payload.receipt-required || 'false' }}
+          PUBLICATION_REQUIRED: 'true'
+          RECEIPT_ARTIFACT_ID: ${{ github.event.client_payload.receipt-artifact-id }}
+          RECEIPT_ARTIFACT_SHA256: ${{ github.event.client_payload.receipt-artifact-sha256 }}
+          RECEIPT_SHA256: ${{ github.event.client_payload.receipt-sha256 }}
+          RECEIPT_ISSUER_RUN_ID: ${{ github.event.client_payload.receipt-issuer-run-id }}
+          RECEIPT_ISSUER_SHA: ${{ github.event.client_payload.receipt-issuer-sha }}
+          PUBLICATION_ARTIFACT_ID: ${{ github.event.client_payload.publication-artifact-id }}
+          PUBLICATION_ARTIFACT_SHA256: ${{ github.event.client_payload.publication-artifact-sha256 }}
+          PUBLICATION_SHA256: ${{ github.event.client_payload.publication-sha256 }}
+          PUBLICATION_ISSUER_RUN_ID: ${{ github.event.client_payload.publication-issuer-run-id }}
+          PUBLICATION_ISSUER_SHA: ${{ github.event.client_payload.publication-issuer-sha }}
+        run: bun packages/db/src/prepare-receipt-transport.ts
+
       - name: Prepare artifacts from InferenceX
         id: artifacts
         env:
@@ -102,6 +125,20 @@ jobs:
           DATABASE_WRITE_URL: ${{ secrets.DATABASE_WRITE_URL }}
         run: bun packages/db/src/verify-power-publication.ts power-publication.json
 
+      - name: Verify accepted measurement publication
+        if: env.INGEST_RECEIPT_REQUIRED == '1'
+        env:
+          INGEST_ARTIFACTS_PATH: ${{ github.workspace }}/artifacts
+        run: bun packages/db/src/verify-measurement-publication.ts "https://inferencex.semianalysis.com" measurement-publication.json
+
+      - name: Retain measurement publication verification
+        if: always() && env.INGEST_RECEIPT_REQUIRED == '1'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: measurement-publication-${{ steps.artifacts.outputs.source-run-id }}
+          path: measurement-publication.json
+          if-no-files-found: warn
+
       - name: Retain PowerX publication receipt
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/workflows/migrate-database.yml

@@ -0,0 +1,82 @@
+name: Migrate Database
+
+on:
+  workflow_dispatch:
+    inputs:
+      database-target:
+        description: Explicit database target; existing measurements are preserved
+        required: true
+        type: choice
+        options: [staging, production]
+      expected-sha:
+        description: Exact reviewed 40-character app commit to migrate and verify
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: database-migrations-${{ inputs.database-target }}
+  cancel-in-progress: false
+
+jobs:
+  migrate:
+    name: Migrate and verify selected database
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    env:
+      MIGRATION_DATABASE_TARGET: ${{ inputs.database-target }}
+      MIGRATION_EXPECTED_SHA: ${{ inputs.expected-sha }}
+    steps:
+      - name: Validate exact migration request
+        shell: python
+        run: |
+          import os
+          import re
+
+          if os.environ['GITHUB_REF'] != 'refs/heads/master':
+              raise ValueError('Database migrations must execute the reviewed master branch')
+          if os.environ['MIGRATION_DATABASE_TARGET'] not in {'staging', 'production'}:
+              raise ValueError('An explicit staging or production database target is required')
+          expected = os.environ['MIGRATION_EXPECTED_SHA']
+          if not re.fullmatch(r'[0-9a-f]{40}', expected) or expected != os.environ['GITHUB_SHA']:
+              raise ValueError('The workflow commit must equal the exact reviewed expected-sha')
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: package.json
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        env:
+          CYPRESS_INSTALL_BINARY: '0'
+
+      - name: Apply staging migrations and verify receipt schema
+        if: inputs.database-target == 'staging'
+        env:
+          DATABASE_WRITE_URL: ${{ secrets.DATABASE_STAGING_WRITE_URL }}
+        run: |
+          bun run admin:db:migrate --yes
+          bun packages/db/src/verify-measurement-schema.ts migration-report.json
+
+      - name: Apply production migrations and verify receipt schema
+        if: inputs.database-target == 'production'
+        env:
+          DATABASE_WRITE_URL: ${{ secrets.DATABASE_WRITE_URL }}
+        run: |
+          bun run admin:db:migrate --yes
+          bun packages/db/src/verify-measurement-schema.ts migration-report.json
+
+      - name: Retain migration verification
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: measurement-schema-${{ inputs.database-target }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: migration-report.json
+          if-no-files-found: ignore