fix: add yaml ssh secret for d518 git mirror

2026-06-27 12:07:22 +00:00
parent 1f5eaa4ac4
commit f28019bd9b
6 changed files with 300 additions and 35 deletions
@@ -1184,7 +1184,27 @@ export function nodeRuntimeGitMirrorTarget(spec: HwlabRuntimeLaneSpec): NodeRunt

 export function nodeRuntimeGitMirrorGithubTransportSpec(raw: Record<string, unknown>, path: string): NodeRuntimeGitMirrorGithubTransportSpec {
  const mode = stringValue(raw.mode, `${path}.mode`);
-  if (mode === "ssh") return { mode };
+  if (mode === "ssh") {
+    const knownHostsSecretKey = optionalStringValue(raw.knownHostsSecretKey, `${path}.knownHostsSecretKey`);
+    const knownHostsSourceRef = optionalStringValue(raw.knownHostsSourceRef, `${path}.knownHostsSourceRef`);
+    const knownHostsSourceKey = optionalStringValue(raw.knownHostsSourceKey, `${path}.knownHostsSourceKey`);
+    const knownHostsSourceEncoding = raw.knownHostsSourceEncoding === undefined ? null : gitMirrorSecretSourceEncoding(raw.knownHostsSourceEncoding, `${path}.knownHostsSourceEncoding`);
+    const knownHostsValues = [knownHostsSecretKey, knownHostsSourceRef, knownHostsSourceKey, knownHostsSourceEncoding];
+    if (knownHostsValues.some((value) => value !== null) && knownHostsValues.some((value) => value === null)) {
+      throw new Error(`${path}.knownHostsSecretKey/sourceRef/sourceKey/sourceEncoding must be declared together`);
+    }
+    return {
+      mode,
+      privateKeySecretKey: stringValue(raw.privateKeySecretKey, `${path}.privateKeySecretKey`),
+      privateKeySourceRef: stringValue(raw.privateKeySourceRef, `${path}.privateKeySourceRef`),
+      privateKeySourceKey: stringValue(raw.privateKeySourceKey, `${path}.privateKeySourceKey`),
+      privateKeySourceEncoding: gitMirrorSecretSourceEncoding(raw.privateKeySourceEncoding, `${path}.privateKeySourceEncoding`),
+      knownHostsSecretKey,
+      knownHostsSourceRef,
+      knownHostsSourceKey,
+      knownHostsSourceEncoding,
+    };
+  }
  if (mode !== "https") throw new Error(`${path}.mode must be ssh or https`);
  return {
    mode,
@@ -1196,6 +1216,12 @@ export function nodeRuntimeGitMirrorGithubTransportSpec(raw: Record<string, unkn
  };
 }

+function gitMirrorSecretSourceEncoding(raw: unknown, path: string): "plain" | "base64" {
+  const value = stringValue(raw, path);
+  if (value !== "plain" && value !== "base64") throw new Error(`${path} must be plain or base64`);
+  return value;
+}
+
 export function nodeRuntimeGitMirrorEgressProxySpec(raw: Record<string, unknown>, path: string): NodeRuntimeGitMirrorEgressProxySpec {
  const mode = stringValue(raw.mode, `${path}.mode`);
  if (mode !== "k8s-service-cluster-ip") throw new Error(`${path}.mode must be k8s-service-cluster-ip`);