Files
orca/cloud/dev/scripts/relay-repository.mjs
T
Jinwoo Hong 0746d82c01 chore(cloud): close the Workload Identity cutover onto stablyai/orca (#18509)
Mirrors stablyai/orca-cloud#470. The private relay workflows are retired, so
the dual accept has one live arm left. Add `github_workflow_file_prefix` for
the primary repository's workflow filenames, point `github_repo`/
`github_repo_id` at `stablyai/orca` (`1183888342`), and empty
`github_accepted_repositories` in both environments. Every relay provider goes
back to a single arm naming `cloud-` prefixed workflow refs.

`cloud/infra/terraform` stays byte-identical to the private branch. The two
identity tests diverge here as they already did, so they take the same change
rather than the same bytes: both now render the trusted ref head from the
Terraform variable instead of this checkout's own workflow filenames, which is
what lets the length pin be the same 791 characters in either repository.
2026-09-03 15:57:00 -04:00

37 lines
1.6 KiB
JavaScript

import { readFileSync } from 'node:fs'
// Single place naming the repository the Relay workflows live in and where their files sit. The
// public-repo copy moves this tree under cloud/, prefixes every workflow filename, and changes the
// owning repository, so only this module changes: nothing else may restate any of the three.
export const RELAY_GITHUB_REPOSITORY = 'stablyai/orca'
export const RELAY_WORKFLOW_FILE_PREFIX = 'cloud-'
// Where .github/workflows sits relative to this file. Workflows stay at the repository root while
// this tree moves under cloud/, so the depth changes at the copy even though the layout does not.
export const RELAY_WORKFLOW_DIRECTORY = new URL('../../../.github/workflows/', import.meta.url)
export function relayWorkflowFile(name) {
return `${RELAY_WORKFLOW_FILE_PREFIX}${name}`
}
// Repository-relative path for a repository that renames its copies with `prefix`. Terraform's
// trusted prefix is a variable and need not be this checkout's, so callers rendering a
// workflow_ref from Terraform pass it in rather than assuming the local one.
export function prefixedRelayWorkflowPath(prefix, name) {
return `.github/workflows/${prefix}${name}`
}
// Repository-relative path, the shape GitHub reports in workflow_ref and evidence payloads.
export function relayWorkflowPath(name) {
return prefixedRelayWorkflowPath(RELAY_WORKFLOW_FILE_PREFIX, name)
}
export function relayWorkflowUrl(name) {
return new URL(relayWorkflowFile(name), RELAY_WORKFLOW_DIRECTORY)
}
export function readRelayWorkflow(name) {
return readFileSync(relayWorkflowUrl(name), 'utf8')
}