From ba8957cdd61b561bf9964b85829f93410688867f Mon Sep 17 00:00:00 2001
From: eezd <eezd@outlook.com>
Date: Fri, 30 Oct 2026 11:34:43 +0800
Subject: [PATCH] Retire legacy AlphaPulse mirror authentication

---
 .gitea/workflows/retire-legacy.yml | 21 +++++++++++++++++++++
 scripts/retire_legacy_auth.py      | 23 +++++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 .gitea/workflows/retire-legacy.yml
 create mode 100644 scripts/retire_legacy_auth.py

diff --git a/.gitea/workflows/retire-legacy.yml b/.gitea/workflows/retire-legacy.yml
new file mode 100644
index 0000000..6b47931
--- /dev/null
+++ b/.gitea/workflows/retire-legacy.yml
@@ -0,0 +1,21 @@
+name: Retire AlphaPulse legacy authentication
+on:
+  push:
+    branches: [maintenance/retire-legacy-auth]
+jobs:
+  retire:
+    runs-on: docker
+    container:
+      image: docker:29-cli
+      volumes:
+        - /docker/gitea/mirrors/AlphaPulse:/docker/gitea/mirrors/AlphaPulse
+    steps:
+      - run: apk add --no-cache python3 nodejs git git-lfs
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - name: Verify account credential and retire project SSH authentication
+        env:
+          ALL_GITHUB_TOKEN: ${{ secrets.ALL_GITHUB_TOKEN }}
+          ALPHAPULSE_GITEA_TOKEN: ${{ secrets.ALPHAPULSE_GITEA_TOKEN }}
+        run: python3 scripts/retire_legacy_auth.py
diff --git a/scripts/retire_legacy_auth.py b/scripts/retire_legacy_auth.py
new file mode 100644
index 0000000..58034ba
--- /dev/null
+++ b/scripts/retire_legacy_auth.py
@@ -0,0 +1,23 @@
+import json,os,urllib.request
+from ci import request_json,require
+from mirror import main
+main()
+token=os.environ['ALL_GITHUB_TOKEN']
+repo=request_json('https://api.github.com/repos/eezd/AlphaPulse',token=token)
+require(repo.get('permissions',{}).get('admin'),'Repository admin permission required to retire deploy key')
+keys=[]
+for page in range(1,100):
+    batch=request_json(f'https://api.github.com/repos/eezd/AlphaPulse/keys?per_page=100&page={page}',token=token)
+    keys.extend(batch)
+    if len(batch)<100:break
+else:raise RuntimeError('Incomplete deploy key listing')
+if any(key['id']==168084240 for key in keys):
+    request=urllib.request.Request('https://api.github.com/repos/eezd/AlphaPulse/keys/168084240',method='DELETE',headers={'Authorization':'token '+token,'User-Agent':'AlphaPulse-CI'})
+    with urllib.request.urlopen(request,timeout=30) as response:require(response.status==204,'Deploy key retirement failed')
+headers={'Authorization':'token '+os.environ['ALPHAPULSE_GITEA_TOKEN'],'User-Agent':'AlphaPulse-CI'}
+url='https://git.134333.xyz/api/v1/repos/eezd/AlphaPulse/actions/secrets'
+with urllib.request.urlopen(urllib.request.Request(url,headers=headers),timeout=30) as response:secrets=json.load(response)
+require(not any(secret['name']=='ALL_GITHUB_TOKEN' for secret in secrets),'Repository Secret overrides the account-level token')
+if any(secret['name']=='ALPHAPULSE_GITHUB_SSH_KEY' for secret in secrets):
+    with urllib.request.urlopen(urllib.request.Request(url+'/ALPHAPULSE_GITHUB_SSH_KEY',method='DELETE',headers=headers),timeout=30) as response:require(response.status==204,'Legacy Secret retirement failed')
+print('Account-level GitHub credential verified; project legacy SSH key and Secret retired')