Retire legacy AlphaPulse mirror authentication

.gitea/workflows/retire-legacy.yml

@@ -0,0 +1,21 @@
+name: Retire AlphaPulse legacy authentication
+on:
+  push:
+    branches: [maintenance/retire-legacy-auth]
+jobs:
+  retire:
+    runs-on: docker
+    container:
+      image: docker:29-cli
+      volumes:
+        - /docker/gitea/mirrors/AlphaPulse:/docker/gitea/mirrors/AlphaPulse
+    steps:
+      - run: apk add --no-cache python3 nodejs git git-lfs
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - name: Verify account credential and retire project SSH authentication
+        env:
+          ALL_GITHUB_TOKEN: ${{ secrets.ALL_GITHUB_TOKEN }}
+          ALPHAPULSE_GITEA_TOKEN: ${{ secrets.ALPHAPULSE_GITEA_TOKEN }}
+        run: python3 scripts/retire_legacy_auth.py

scripts/retire_legacy_auth.py

@@ -0,0 +1,23 @@
+import json,os,urllib.request
+from ci import request_json,require
+from mirror import main
+main()
+token=os.environ['ALL_GITHUB_TOKEN']
+repo=request_json('https://api.github.com/repos/eezd/AlphaPulse',token=token)
+require(repo.get('permissions',{}).get('admin'),'Repository admin permission required to retire deploy key')
+keys=[]
+for page in range(1,100):
+    batch=request_json(f'https://api.github.com/repos/eezd/AlphaPulse/keys?per_page=100&page={page}',token=token)
+    keys.extend(batch)
+    if len(batch)<100:break
+else:raise RuntimeError('Incomplete deploy key listing')
+if any(key['id']==168084240 for key in keys):
+    request=urllib.request.Request('https://api.github.com/repos/eezd/AlphaPulse/keys/168084240',method='DELETE',headers={'Authorization':'token '+token,'User-Agent':'AlphaPulse-CI'})
+    with urllib.request.urlopen(request,timeout=30) as response:require(response.status==204,'Deploy key retirement failed')
+headers={'Authorization':'token '+os.environ['ALPHAPULSE_GITEA_TOKEN'],'User-Agent':'AlphaPulse-CI'}
+url='https://git.134333.xyz/api/v1/repos/eezd/AlphaPulse/actions/secrets'
+with urllib.request.urlopen(urllib.request.Request(url,headers=headers),timeout=30) as response:secrets=json.load(response)
+require(not any(secret['name']=='ALL_GITHUB_TOKEN' for secret in secrets),'Repository Secret overrides the account-level token')
+if any(secret['name']=='ALPHAPULSE_GITHUB_SSH_KEY' for secret in secrets):
+    with urllib.request.urlopen(urllib.request.Request(url+'/ALPHAPULSE_GITHUB_SSH_KEY',method='DELETE',headers=headers),timeout=30) as response:require(response.status==204,'Legacy Secret retirement failed')
+print('Account-level GitHub credential verified; project legacy SSH key and Secret retired')