From e8bd518efa49bd72f5f690aa6a3015512109159d Mon Sep 17 00:00:00 2001 From: richblack Date: Wed, 29 Jul 2026 19:33:46 +0800 Subject: [PATCH] =?UTF-8?q?D36=20=E7=AC=AC0=E6=AD=A5=EF=BC=9A=E7=AF=84?= =?UTF-8?q?=E4=BE=8B=20workflow=20=E9=87=91=E9=91=B0=E7=B5=B1=E4=B8=80?= =?UTF-8?q?=E8=B5=B0=20credential=EF=BC=88=E6=AD=A2=E8=A1=80=E2=80=94?= =?UTF-8?q?=E2=80=94=E7=AF=84=E4=BE=8B=E6=98=AF=E7=94=A8=E6=88=B6=E7=85=A7?= =?UTF-8?q?=E6=8A=84=E7=9A=84=E6=A8=A3=E6=9D=BF=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 改前四種寫法並存、沒一個是 credential，而執行端只認 {{credential.X}} （graph-executor.ts:247→resolveCredentialRefs）⇒ 用戶照抄必踩坑： {{api_key}} 13／{{gitea_token}} 2／{{secret.GITHUB_BOT_TOKEN}} 2／{{kbdb_api_key}} 1 改後（19 處統一）： {{credential.arcrun_namespace}} 15／{{credential.gitea_token}} 2／{{credential.github_bot_token}} 2 ⚠️ 中途修正一次錯誤命名：我先改成 kbdb_partner_key（照零件契約舊敘述 ak_xxx）， leo 當場指正「現在沒有 partner key，改用 namespace，沒有發 API key 的機制」—— 實際機制確為 X-Arcrun-API-Key: （實例上活的 workflow 為證）。 不動：{{secret.LEO_TELEGRAM_CHAT_ID}} 3 處——chat_id 是聊天室 ID 不是金鑰， 無腦套規則會引進「找不到 credential」的錯誤。 驗：違規寫法歸零／12 個範例 YAML 全可解析。 殘：kbdb_upsert_block 契約仍寫『KBDB partner key（ak_xxx）』＝假資訊源（我就是被它騙的）， 修它被 component-guard 擋（正確），需 leo 跑 scripts/component-arm.sh。 --- registry/examples/cron-watcher/workflow.yaml | 6 +++--- registry/examples/daily-digest/workflow.yaml | 2 +- registry/examples/github-issue-bot/workflow.yaml | 4 ++-- registry/examples/km-wiki-ingest/workflow.yaml | 8 ++++---- registry/examples/llm-classify/workflow.yaml | 2 +- registry/examples/parallel-fanout/workflow.yaml | 12 ++++++------ registry/examples/pdf-to-blocks/workflow.yaml | 2 +- registry/examples/rag-search-answer/workflow.yaml | 2 +- 8 files changed, 19 insertions(+), 19 deletions(-) diff --git a/registry/examples/cron-watcher/workflow.yaml b/registry/examples/cron-watcher/workflow.yaml index c2fcadd..25ce9b0 100644 --- a/registry/examples/cron-watcher/workflow.yaml +++ b/registry/examples/cron-watcher/workflow.yaml @@ -14,7 +14,7 @@ config: list_unprocessed: component: kbdb_get - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" type: "note" source: "user-input" limit: 20 @@ -32,7 +32,7 @@ config: trigger_processor: component: trigger_workflow workflow_name: "your_processor_workflow" # ← 改成你的處理 workflow 名 - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" input: - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" block_id: "{{item.id}}" diff --git a/registry/examples/daily-digest/workflow.yaml b/registry/examples/daily-digest/workflow.yaml index 1a69f91..504bcf2 100644 --- a/registry/examples/daily-digest/workflow.yaml +++ b/registry/examples/daily-digest/workflow.yaml @@ -17,7 +17,7 @@ config: fetch_kbdb_yesterday: component: kbdb_get - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" type: "note" source: "km-writer-direct" limit: 50 diff --git a/registry/examples/github-issue-bot/workflow.yaml b/registry/examples/github-issue-bot/workflow.yaml index 4a93567..9ac0231 100644 --- a/registry/examples/github-issue-bot/workflow.yaml +++ b/registry/examples/github-issue-bot/workflow.yaml @@ -33,7 +33,7 @@ config: url: "https://api.github.com/repos/{{input.repository.full_name}}/issues/{{input.issue.number}}/comments" method: POST headers: - Authorization: "Bearer {{secret.GITHUB_BOT_TOKEN}}" + Authorization: "Bearer {{credential.github_bot_token}}" Accept: "application/vnd.github+json" body_json: body: "{{analyze.first_response}}" @@ -43,7 +43,7 @@ config: url: "https://api.github.com/repos/{{input.repository.full_name}}/issues/{{input.issue.number}}/labels" method: POST headers: - Authorization: "Bearer {{secret.GITHUB_BOT_TOKEN}}" + Authorization: "Bearer {{credential.github_bot_token}}" body_json: labels: - "auto-triaged" diff --git a/registry/examples/km-wiki-ingest/workflow.yaml b/registry/examples/km-wiki-ingest/workflow.yaml index 0f1632d..9bbdd6c 100644 --- a/registry/examples/km-wiki-ingest/workflow.yaml +++ b/registry/examples/km-wiki-ingest/workflow.yaml @@ -36,7 +36,7 @@ config: method: GET url: "https://git.uncle6.me/api/v1/repos/{{repo}}/contents/system-dev/wiki/cards?ref={{ref}}" headers: - Authorization: "token {{gitea_token}}" + Authorization: "token {{credential.gitea_token}}" Accept: "application/json" # 下游用 filter/set 取「游標之後第一張、且 .md、且非 00-INDEX」的一張。 @@ -46,7 +46,7 @@ config: method: GET url: "{{pick_next_card.next.download_url}}" headers: - Authorization: "token {{gitea_token}}" + Authorization: "token {{credential.gitea_token}}" # 4) ★ 機械解析 —— 通用 code 零件（sandbox inline JS，無 LLM、無 fs/網路，stdin→stdout JSON）。 # Arcrun#10 裁定：一次性解析邏輯走通用逃生口，不再鑄 domain 零件 km_wiki_card_parse。 @@ -414,7 +414,7 @@ config: # metadata.embed=true → base embed 模組會補嵌 → 語意可搜。 upsert_entry: component: kbdb_upsert_block - api_key: "{{kbdb_api_key}}" + api_key: "{{credential.arcrun_namespace}}" kbdb_url: "{{kbdb_url}}" page_name: "{{parse_card.data.entry.page_name}}" type: "{{parse_card.data.entry.entry_type}}" @@ -438,7 +438,7 @@ config: url: "{{graph_url}}/triplets/ingest" headers: Content-Type: "application/json" - X-Arcrun-API-Key: "{{graph_api_key}}" + X-Arcrun-API-Key: "{{credential.arcrun_namespace}}" body_json: "{{envelope}}" # envelope 已符合 ingest-candidate.json 契約（禁止欄位已排除） # ── 執行環境變數（部署時注入；此檔不放密鑰）── diff --git a/registry/examples/llm-classify/workflow.yaml b/registry/examples/llm-classify/workflow.yaml index 7825c6e..939873f 100644 --- a/registry/examples/llm-classify/workflow.yaml +++ b/registry/examples/llm-classify/workflow.yaml @@ -24,7 +24,7 @@ config: save_with_tag: component: kbdb_create_block - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" type: "note" source: "llm-classified" user_id: "ai_classifier" diff --git a/registry/examples/parallel-fanout/workflow.yaml b/registry/examples/parallel-fanout/workflow.yaml index 369fc9a..e548917 100644 --- a/registry/examples/parallel-fanout/workflow.yaml +++ b/registry/examples/parallel-fanout/workflow.yaml @@ -12,24 +12,24 @@ config: dispatch_to_summary: component: trigger_workflow workflow_name: "llm_classify_example" # 改成你的 summary workflow - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" input: - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" text: "{{input.text}}" dispatch_to_translate: component: trigger_workflow workflow_name: "your_translate_workflow" - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" input: - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" text: "{{input.text}}" target_lang: "{{input.target_lang}}" dispatch_to_classify: component: trigger_workflow workflow_name: "llm_classify_example" - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" input: - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" text: "{{input.text}}" diff --git a/registry/examples/pdf-to-blocks/workflow.yaml b/registry/examples/pdf-to-blocks/workflow.yaml index 93036da..46779a4 100644 --- a/registry/examples/pdf-to-blocks/workflow.yaml +++ b/registry/examples/pdf-to-blocks/workflow.yaml @@ -18,7 +18,7 @@ config: # source 用 file_url 當去重 key（同 PDF 重 ingest 不會重複建） ingest_to_kbdb: component: kbdb_ingest - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" page_name: "pdf-{{input.title}}" text: "{{convert_pdf.data.text}}" source: "pdf:{{input.pdf_url}}" diff --git a/registry/examples/rag-search-answer/workflow.yaml b/registry/examples/rag-search-answer/workflow.yaml index 6e6425e..3f6b339 100644 --- a/registry/examples/rag-search-answer/workflow.yaml +++ b/registry/examples/rag-search-answer/workflow.yaml @@ -8,7 +8,7 @@ flow: config: search_kbdb: component: kbdb_search - api_key: "{{api_key}}" + api_key: "{{credential.arcrun_namespace}}" query: "{{input.question}}" topK: 5 user_id: "{{input.user_id}}" # 可選，限定某用戶 namespace