| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"8a95879f7501b2874d73cf1f36f07f7673695db3","after":"f0956259a231da48063f98a22ad35b52a3699916","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/8a95879f7501b2874d73cf1f36f07f7673695db3...f0956259a231da48063f98a22ad35b52a3699916","commits":[{"id":"f0956259a231da48063f98a22ad35b52a3699916","message":"feat(image): Dockerfile 改 pnpm fetch 分层（网络层只随 lockfile 失效）+ CI image job（构建 / SBOM / 有密钥才签；D-1 / D-2）\n\n- runtime/Dockerfile：先拷 pnpm-lock.yaml / pnpm-workspace.yaml / .npmrc 做 pnpm fetch，再 COPY 源码后 --prefer-offline 安装与 deploy；secret 挂载不变\n- .github/workflows/platform.yml：新增 image job（needs static；private-npm 认证后在 RUNNER_TEMP 写已解析 npmrc 只作 --secret 源；build-image --context head；syft v1.20.0 → SBOM；cosign-installer v2.4.1，COSIGN_PRIVATE_KEY 为空或镜像未推送时明确跳过；产物 platform-image-\u003ctag\u003e artifact，不推 registry）；governance 测试 106/106\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/f0956259a231da48063f98a22ad35b52a3699916","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-12T03:30:52-07:00","added":[],"removed":[],"modified":[".github/workflows/platform.yml","runtime/Dockerfile"]},{"id":"adce2faa641ce031f52acbd29e231bb241c13186","message":"feat(image): D-1 runtime 镜像 + D-2 SBOM / 签名接线——Dockerfile、build-image / sbom / sign-image / smoke-image 脚本、compose 候选块（开发计划 §3A D-1 / D-2；设计 §12 / §14）\n\n- runtime/Dockerfile（多阶段）：node:20-bookworm-slim 按 digest 锁定；--frozen-lockfile；私有 registry token 只经 BuildKit secret（--secret id=npmrc）进入安装层；prisma generate；pnpm --filter \"api-nestjs...\" build；pnpm deploy --prod 剪枝到 api-nestjs + 七模块 + kit + @repo/contracts，显式补拷 dist、去掉 src / test；运行阶段非 root、HEALTHCHECK 打 /api/health；入口 apps/api-nestjs/dist/src/main.js，profile 装载器向上找到 /srv/runtime/modules.json\n- governance/build-image.mjs：默认 --context head = git archive HEAD:runtime（本机 WIP 不进镜像），写 reports/image-digest.json（image id + digestKind 说明、sourceSha、worktreeDirty、dockerfileTracked、平台、大小、基础镜像）\n- governance/sbom.mjs（syft / docker sbom → reports/sbom.spdx.json + sbom.latest.json；无工具退出 3）、governance/sign-image.mjs（cosign + COSIGN_KEY 只签 registry 引用；未推送 / 无密钥 / 无 cosign 明确跳过）、governance/smoke-image.mjs（起容器 → /api/health 200 → 模块视图 → 首模块 /health → 决策端点无凭证 401 → HEALTHCHECK healthy → reports/image-smoke.latest.json）\n- 根脚本 image:build / image:smoke / image:sbom / image:sign；compose 增 runtime 候选注释块（含生产守卫所需 env：ALERT_CHANNEL、AUTH_MODE=jwt + 密钥源、APP_ID、TENANT_RLS_MODE=enforce + DATABASE_RUNTIME_URL）；runbook §2 容器方式 + env 表；stack / governance README 登记\n- 证据（试建 enterprise-platform/runtime:trial，linux/arm64，142 MB）：冒烟六项全过——scope profile 装载 fail-closed、/api/health database / redis up、模块健康 200、无凭证 401、Docker HEALTHCHECK healthy；四份 compose config 通过；governance 测试 106/106。正式 digest 报告在本提交之后按 HEAD 重建\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/adce2faa641ce031f52acbd29e231bb241c13186","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-12T03:29:53-07:00","added":["governance/build-image.mjs","governance/sbom.mjs","governance/sign-image.mjs","governance/smoke-image.mjs","runtime/.dockerignore","runtime/Dockerfile"],"removed":[],"modified":["docs/runbook.md","governance/README.md","package.json","stack/README.md","stack/compose.yaml"]}],"total_commits":0,"head_commit":{"id":"f0956259a231da48063f98a22ad35b52a3699916","message":"feat(image): Dockerfile 改 pnpm fetch 分层（网络层只随 lockfile 失效）+ CI image job（构建 / SBOM / 有密钥才签；D-1 / D-2）\n\n- runtime/Dockerfile：先拷 pnpm-lock.yaml / pnpm-workspace.yaml / .npmrc 做 pnpm fetch，再 COPY 源码后 --prefer-offline 安装与 deploy；secret 挂载不变\n- .github/workflows/platform.yml：新增 image job（needs static；private-npm 认证后在 RUNNER_TEMP 写已解析 npmrc 只作 --secret 源；build-image --context head；syft v1.20.0 → SBOM；cosign-installer v2.4.1，COSIGN_PRIVATE_KEY 为空或镜像未推送时明确跳过；产物 platform-image-\u003ctag\u003e artifact，不推 registry）；governance 测试 106/106\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/f0956259a231da48063f98a22ad35b52a3699916","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-12T03:30:52-07:00","added":[],"removed":[],"modified":[".github/workflows/platform.yml","runtime/Dockerfile"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":3453,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":4,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-12T18:21:10+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |