fix(morph): publish opengauss alias from tracked template source

.github/morph/opengauss-template.yaml

@@ -0,0 +1,92 @@
+name: Open Gauss Batteries Included Devbox
+description: Installer-driven Open Gauss template that uses the current checkout when run locally and otherwise clones math-inc/OpenGauss, runs the internal installer, exposes the local guide, and opens a ready Gauss session.
+steps:
+  - id: bootstrap-installer-runtime
+    title: Prepare Open Gauss Installer Runtime
+    type: command
+    run: |
+      set -euo pipefail
+      if command -v apt-get >/dev/null 2>&1 && [ "$(id -u)" = "0" ]; then
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update -y
+        apt-get install -y --no-install-recommends git curl ca-certificates tmux
+      else
+        command -v git >/dev/null 2>&1 || { printf '%s\n' 'git is required.' >&2; exit 1; }
+        command -v curl >/dev/null 2>&1 || { printf '%s\n' 'curl is required.' >&2; exit 1; }
+      fi
+      mkdir -p "$HOME/.opengauss-template"
+  - id: resolve-open-gauss-repository
+    title: Prepare Open Gauss Repository
+    type: command
+    run: |
+      set -euo pipefail
+      state_dir="$HOME/.opengauss-template"
+      state_env="$state_dir/runtime.env"
+      mkdir -p "$state_dir"
+
+      repo_root=""
+      if [ -x "./scripts/install-internal.sh" ] && [ -f "./pyproject.toml" ] && [ -f "./README.md" ]; then
+        repo_root="$(pwd)"
+      else
+        repo_root="$HOME/OpenGauss"
+        if [ -d "$repo_root/.git" ]; then
+          git -C "$repo_root" fetch origin --prune
+        else
+          rm -rf "$repo_root"
+          git clone https://github.com/math-inc/OpenGauss.git "$repo_root"
+        fi
+        git -C "$repo_root" fetch origin --prune
+        git -C "$repo_root" reset --hard origin/main
+      fi
+
+      gauss_home="${GAUSS_HOME:-$HOME/.gauss}"
+      workspace_dir="${GAUSS_WORKSPACE_DIR:-$HOME/GaussWorkspace}"
+
+      cat > "$state_env" <<EOF
+      export OPEN_GAUSS_REPO_ROOT="$repo_root"
+      export GAUSS_HOME="$gauss_home"
+      export GAUSS_INSTALL_ROOT="$repo_root"
+      export GAUSS_WORKSPACE_DIR="$workspace_dir"
+      export PATH="$HOME/.local/bin:$repo_root/venv/bin:$HOME/.elan/bin:$PATH"
+      export PROMPT_TOOLKIT_NO_CPR=1
+      EOF
+
+      printf 'Using Open Gauss repository at %s\n' "$repo_root"
+      git -C "$repo_root" rev-parse --short=12 HEAD || true
+  - id: install-open-gauss
+    title: Run Open Gauss Installer
+    type: command
+    run: |
+      set -euo pipefail
+      . "$HOME/.opengauss-template/runtime.env"
+      cd "$OPEN_GAUSS_REPO_ROOT"
+      ./scripts/install-internal.sh --with-workspace --noninteractive
+      . "$HOME/.opengauss-template/runtime.env"
+      "$HOME/.local/bin/gauss-launch-session" --print-summary || true
+  - id: start-guide-server
+    title: Start Guide Iframe Server
+    type: command
+    run: |
+      set -euo pipefail
+      . "$HOME/.opengauss-template/runtime.env"
+      nohup python3 -m http.server 4310 --directory "$GAUSS_HOME/guide" >/tmp/opengauss-guide.log 2>&1 &
+      sleep 1
+  - id: expose-guide
+    title: Expose Guide Iframe
+    type: exposeHttpService
+    name: guide
+    port: 4310
+    autoOpenIframe: true
+  - id: open-gauss-session
+    title: Open Gauss tmux Session
+    type: tmuxSession
+    name: gauss
+    command: |
+      set -euo pipefail
+      . "$HOME/.opengauss-template/runtime.env"
+      if [ -f "$GAUSS_HOME/.env" ]; then
+        set -a
+        . "$GAUSS_HOME/.env"
+        set +a
+      fi
+      exec "$HOME/.local/bin/gauss-launch-session"

.github/workflows/refresh-shared-template.yml

@@ -1,4 +1,4 @@
-name: Refresh Shared Template
+name: Publish Shared Template
 
 on:
   push:
@@ -10,88 +10,29 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  refresh-opengauss-template:
+  publish-opengauss-template:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     env:
       DEVBOX_TEMPLATE_BASE_URL: https://devbox.svc.cloud.morph.so
       TEMPLATE_ALIAS: opengauss
+      TEMPLATE_FILE: .github/morph/opengauss-template.yaml
+      PYTHONUNBUFFERED: "1"
       MORPH_API_KEY: ${{ secrets.MORPH_API_KEY }}
     steps:
+      - uses: actions/checkout@v4
+
       - name: Validate refresh credentials
         run: |
           if [ -z "${MORPH_API_KEY}" ]; then
-            echo "GitHub secret MORPH_API_KEY is required to refresh the shared template alias." >&2
+            echo "GitHub secret MORPH_API_KEY is required to publish the shared template alias." >&2
+            exit 1
+          fi
+          if [ ! -f "${TEMPLATE_FILE}" ]; then
+            echo "Tracked Morph template file is missing: ${TEMPLATE_FILE}" >&2
             exit 1
           fi
 
-      - name: Refresh shared template alias
-        run: |
-          python3 - <<'PY'
-          import json
-          import os
-          import sys
-          import urllib.request
-
-          base = os.environ["DEVBOX_TEMPLATE_BASE_URL"].rstrip("/")
-          key = os.environ["MORPH_API_KEY"]
-          alias = os.environ["TEMPLATE_ALIAS"]
-
-          body = {
-              "description": f"Automatic refresh from {os.environ.get('GITHUB_REPOSITORY', 'repo')}@{os.environ.get('GITHUB_SHA', '')[:12]}"
-          }
-
-          req = urllib.request.Request(
-              f"{base}/api/templates/aliases/{alias}/refresh",
-              data=json.dumps(body).encode("utf-8"),
-              headers={
-                  "Authorization": f"Bearer {key}",
-                  "Content-Type": "application/json",
-              },
-              method="POST",
-          )
-
-          with urllib.request.urlopen(req, timeout=120) as resp:
-              started = json.load(resp)
-
-          print("refresh_started", json.dumps(started))
-
-          events_path = started.get("events_path")
-          if not events_path:
-              sys.exit("refresh response did not include events_path")
-
-          events_req = urllib.request.Request(
-              f"{base}{events_path}",
-              headers={"Authorization": f"Bearer {key}"},
-              method="GET",
-          )
-
-          completed = None
-          saw_force_rebuild = False
-          with urllib.request.urlopen(events_req, timeout=3600) as resp:
-              for raw in resp:
-                  line = raw.decode("utf-8", errors="replace").strip()
-                  if not line.startswith("data: "):
-                      continue
-                  event = json.loads(line[6:])
-                  print(json.dumps(event))
-                  if event.get("type") == "force_rebuild":
-                      saw_force_rebuild = True
-                  if event.get("type") in {"completed", "error", "cancelled"}:
-                      completed = event
-                      break
-
-          if not completed:
-              sys.exit("refresh events stream ended without a terminal event")
-          if completed.get("type") != "completed":
-              sys.exit(f"refresh failed: {completed}")
-          if not saw_force_rebuild:
-              sys.exit("refresh completed without force_rebuild event")
-
-          alias_publish = completed.get("aliasPublish") or {}
-          if not alias_publish.get("published"):
-              sys.exit(f"alias was not promoted: {alias_publish}")
-
-          print("alias_promoted_to", alias_publish.get("templateId"))
-          PY
+      - name: Publish shared template alias
+        run: python3 scripts/publish_shared_template.py