|
49701
|
27572
|
51
|
5
|
b791891a7343c98f0ae82a205921d170a9d2421e
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794765110
|
1794765110
|
|
0
|
|
0
|
Edit
Delete
|
|
49702
|
27573
|
51
|
5
|
b791891a7343c98f0ae82a205921d170a9d2421e
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794765110
|
1794765110
|
|
0
|
|
0
|
Edit
Delete
|
|
49703
|
27574
|
160
|
5
|
8f896214aa1760bd7bac1efde305da2cf724afe3
|
0
|
Frontend Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794765592
|
1794765441
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49704
|
27574
|
160
|
5
|
8f896214aa1760bd7bac1efde305da2cf724afe3
|
0
|
Lint & Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794765592
|
1794765441
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49705
|
27574
|
160
|
5
|
8f896214aa1760bd7bac1efde305da2cf724afe3
|
0
|
Unit Tests (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
unit-tests:
name: Unit Tests (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run unit tests
run: pnpm -C backend run test:unit
...
|
unit-tests
|
["frontend-typecheck","lint-and-typech ["frontend-typecheck","lint-and-typecheck"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794765592
|
1794765441
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49706
|
27574
|
160
|
5
|
8f896214aa1760bd7bac1efde305da2cf724afe3
|
0
|
State Machine Model-Based (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
state-machine-model:
name: State Machine Model-Based (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run state machine model-based tests
run: pnpm -C backend run test:state-machines:model
...
|
state-machine-model
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794765592
|
1794765441
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49707
|
27574
|
160
|
5
|
8f896214aa1760bd7bac1efde305da2cf724afe3
|
0
|
Governance Audit (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
governance-audit:
name: Governance Audit (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Audit 多租户隔离（HARD GATE / 红线1，不豁免）
run: pnpm -C backend run audit:tenant
- name: Audit Prisma Schema 镜像一致性（HARD GATE）
run: pnpm run audit:prisma-schema-source
- name: Audit Prisma↔Zod 契约
run: pnpm -C backend exec tsx scripts/audit-prisma-zod-contract.ts
continue-on-error: true
- name: Audit FormRules↔Zod
run: pnpm run audit:formrules-zod
continue-on-error: true
- name: Audit Response Columns
run: pnpm run audit:response-columns
continue-on-error: true
- name: Audit Field Payload
run: pnpm run audit:field-payload
continue-on-error: true
- name: Audit Enum Consistency
run: pnpm run audit:enum-consistency
continue-on-error: true
- name: Audit useListPage ↔ Router
run: pnpm run audit:list-page-routes
continue-on-error: true
- name: Audit 前端权限键 ↔ 后端真源（HARD GATE / 防按钮 fail-closed 隐藏）
run: pnpm run audit:permission-keys
- name: Audit Page AI Assist Coverage
run: pnpm run audit:ai-assist-coverage
continue-on-error: true
- name: Audit Page AI Assist Skill Binding
run: pnpm run audit:ai-assist-skill-binding
continue-on-error: true
- name: Audit Page AI Assist Context Providers
run: pnpm run audit:context-provider-redact
continue-on-error: true
- name: Audit Coach Script Library
run: pnpm run audit:coach-script-library
continue-on-error: true
- name: Audit AI Decision Quality
run: pnpm run audit:ai-decision-quality
continue-on-error: true
- name: Audit Event Publishing
run: pnpm -C backend run audit:events
continue-on-error: true
- name: Audit State Machines
run: pnpm -C backend run audit:state-machines
continue-on-error: true
- name: Audit Money Decimal Purity (CFO-P0 防御)
run: node --import tsx scripts/audit-money-decimal-purity.ts
continue-on-error: true
- name: Audit Nested Transaction (CFO-P0-1 + RO-P0-3 防御)
run: node --import tsx scripts/audit-nested-transaction.ts
continue-on-error: true
- name: Audit Test Assertion Density (QA-P0 防御)
run: node --import tsx scripts/audit-test-assertion-density.ts
continue-on-error: true
- name: Audit API Test Coverage (probe-only / read-covered / action-covered / complete-crud)
run: pnpm -C backend run audit:api-test-coverage
continue-on-error: true
- name: Audit Consumer Test Authenticity (断言剧场防御 / 假绿防御)
run: node --import tsx scripts/audit-consumer-test-authenticity.ts
continue-on-error: true
- name: Audit Consumer Idempotency (去重路径假覆盖防御)
run: node --import tsx scripts/audit-consumer-idempotency.ts
continue-on-error: true
- name: Audit State Machine Unwired Guards (死守卫 / 假保护防御)
run: node --import tsx scripts/audit-state-machine-unwired-guards.ts
continue-on-error: true
- name: Audit Migration Topology (影子迁移防御)
run: node --import tsx scripts/audit-migration-topology.ts
continue-on-error: true
- name: Audit API Test Fixed IDs (并行化降债棘轮 / write-pk)
run: pnpm -C backend run audit:api-test-fixed-ids
continue-on-error: true
- name: 30d Evidence - Launch Smoke Scope
run: pnpm run audit:launch-smoke-scope
continue-on-error: true
- name: 30d Evidence - Rollout Scope Freeze
run: pnpm run audit:rollout-scope-freeze
continue-on-error: true
- name: 30d Evidence - Production Foundation
run: pnpm run audit:production-foundation-evidence
continue-on-error: true
- name: 30d Evidence - RLS Staging Canary Plan
run: pnpm run audit:rls-staging-canary
continue-on-error: true
- name: 30d Evidence - Customer Signoff Status
run: node --import tsx scripts/harness/customer-signoff-status.ts
continue-on-error: true
- name: 30d Evidence - Production Gate Projection
run: node --import tsx scripts/production-release-gate.ts --no-fail
continue-on-error: true
- name: 30d Evidence - Gate Integrity
run: pnpm run audit:production-release-gate-integrity
continue-on-error: true
- name: Harness Report 聚合
run: pnpm harness report --save
continue-on-error: true
- name: 30d Evidence - Harness Meta Tests
run: pnpm run harness:test
- name: 30d Evidence - War Plan Markdown
run: node --import tsx scripts/governance-30d-war-plan.ts
- if: always()
name: Upload audit reports
uses: https://gitea.com/actions/upload-artifact@v3
with:
name: governance-audit-reports
path: |
reports/prisma-zod-contract-audit.latest.json
reports/formrules-zod-audit.latest.json
reports/response-columns-audit.latest.json
reports/field-payload-audit.latest.json
reports/enum-consistency-audit.latest.json
reports/list-page-routes-audit.latest.json
reports/ai-assist-coverage.latest.json
reports/ai-assist-skill-binding.latest.json
reports/ai-assist-context-providers.latest.json
reports/coach-script-library.latest.json
reports/ai-decision-quality.latest.json
reports/event-publishing-audit.latest.json
reports/state-machine-integration-audit.latest.json
reports/harness-dashboard.latest.json
reports/module-grades.latest.json
reports/money-decimal-purity-audit.latest.json
reports/nested-transaction-audit.latest.json
reports/test-assertion-density-audit.latest.json
reports/api-test-coverage.latest.json
reports/api-test-fixed-ids-audit.latest.json
reports/consumer-test-authenticity-audit.latest.json
reports/consumer-idempotency-audit.latest.json
reports/state-machine-unwired-guards-audit.latest.json
reports/migration-topology-audit.latest.json
reports/customer-signoff-status.latest.json
reports/p0-customer-input-status.latest.json
reports/rollout-scope-freeze.latest.json
reports/rollout-scope-freeze.latest.md
reports/production-foundation-evidence.latest.json
reports/production-foundation-evidence.latest.md
reports/launch-smoke-scope.latest.json
reports/launch-smoke-scope.latest.md
reports/rls-staging-canary.latest.json
reports/rls-staging-canary.latest.md
reports/production-release-gate.latest.json
reports/production-release-gate.latest.md
reports/production-release-actions.latest.json
reports/production-release-actions.latest.md
reports/production-release-gate-integrity.latest.json
reports/production-release-gate-integrity.latest.md
reports/governance-30d-war-plan.latest.md
retention-days: "14"
- if: always()
name: 输出 governance summary
run: node --import tsx scripts/ci-governance-summary.ts --title "Governance Audit Summary" --include-rules
- name: 治理硬门禁 — 豁免感知 verdict（HARD）
run: node --import tsx scripts/harness/governance-gate.ts
- name: 文档对账 — CLAUDE.md GOVERNANCE-BASELINE ↔ reports 实测（HARD）
run: node --import tsx scripts/harness/baseline-reconcile.ts
- name: Harness Gate 综合 PR 验收（HARD）
run: pnpm harness gate
...
|
governance-audit
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794765592
|
1794765441
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49708
|
27574
|
160
|
5
|
8f896214aa1760bd7bac1efde305da2cf724afe3
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794765592
|
1794765441
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49709
|
27575
|
160
|
5
|
ffa148adcca22ba61c7359a6961d8d8fb1e9a703
|
0
|
Frontend Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: 22.23.2
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794765592
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49710
|
27575
|
160
|
5
|
ffa148adcca22ba61c7359a6961d8d8fb1e9a703
|
0
|
Lint & Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: 22.23.2
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794765592
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49711
|
27575
|
160
|
5
|
ffa148adcca22ba61c7359a6961d8d8fb1e9a703
|
0
|
Unit Tests (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: 22.23.2
jobs:
unit-tests:
name: Unit Tests (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run unit tests
run: pnpm -C backend run test:unit
...
|
unit-tests
|
["frontend-typecheck","lint-and-typech ["frontend-typecheck","lint-and-typecheck"]...
|
["ubuntu-latest"]
|
0
|
7
|
0
|
0
|
1794765592
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49712
|
27575
|
160
|
5
|
ffa148adcca22ba61c7359a6961d8d8fb1e9a703
|
0
|
State Machine Model-Based (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: 22.23.2
jobs:
state-machine-model:
name: State Machine Model-Based (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run state machine model-based tests
run: pnpm -C backend run test:state-machines:model
...
|
state-machine-model
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
0
|
7
|
0
|
0
|
1794765592
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49713
|
27575
|
160
|
5
|
ffa148adcca22ba61c7359a6961d8d8fb1e9a703
|
0
|
Governance Audit (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: 22.23.2
jobs:
governance-audit:
name: Governance Audit (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Audit 多租户隔离（HARD GATE / 红线1，不豁免）
run: pnpm -C backend run audit:tenant
- name: Audit Prisma Schema 镜像一致性（HARD GATE）
run: pnpm run audit:prisma-schema-source
- name: Audit Prisma↔Zod 契约
run: pnpm -C backend exec tsx scripts/audit-prisma-zod-contract.ts
continue-on-error: true
- name: Audit FormRules↔Zod
run: pnpm run audit:formrules-zod
continue-on-error: true
- name: Audit Response Columns
run: pnpm run audit:response-columns
continue-on-error: true
- name: Audit Field Payload
run: pnpm run audit:field-payload
continue-on-error: true
- name: Audit Enum Consistency
run: pnpm run audit:enum-consistency
continue-on-error: true
- name: Audit useListPage ↔ Router
run: pnpm run audit:list-page-routes
continue-on-error: true
- name: Audit 前端权限键 ↔ 后端真源（HARD GATE / 防按钮 fail-closed 隐藏）
run: pnpm run audit:permission-keys
- name: Audit Page AI Assist Coverage
run: pnpm run audit:ai-assist-coverage
continue-on-error: true
- name: Audit Page AI Assist Skill Binding
run: pnpm run audit:ai-assist-skill-binding
continue-on-error: true
- name: Audit Page AI Assist Context Providers
run: pnpm run audit:context-provider-redact
continue-on-error: true
- name: Audit Coach Script Library
run: pnpm run audit:coach-script-library
continue-on-error: true
- name: Audit AI Decision Quality
run: pnpm run audit:ai-decision-quality
continue-on-error: true
- name: Audit Event Publishing
run: pnpm -C backend run audit:events
continue-on-error: true
- name: Audit State Machines
run: pnpm -C backend run audit:state-machines
continue-on-error: true
- name: Audit Money Decimal Purity (CFO-P0 防御)
run: node --import tsx scripts/audit-money-decimal-purity.ts
continue-on-error: true
- name: Audit Nested Transaction (CFO-P0-1 + RO-P0-3 防御)
run: node --import tsx scripts/audit-nested-transaction.ts
continue-on-error: true
- name: Audit Test Assertion Density (QA-P0 防御)
run: node --import tsx scripts/audit-test-assertion-density.ts
continue-on-error: true
- name: Audit API Test Coverage (probe-only / read-covered / action-covered / complete-crud)
run: pnpm -C backend run audit:api-test-coverage
continue-on-error: true
- name: Audit Consumer Test Authenticity (断言剧场防御 / 假绿防御)
run: node --import tsx scripts/audit-consumer-test-authenticity.ts
continue-on-error: true
- name: Audit Consumer Idempotency (去重路径假覆盖防御)
run: node --import tsx scripts/audit-consumer-idempotency.ts
continue-on-error: true
- name: Audit State Machine Unwired Guards (死守卫 / 假保护防御)
run: node --import tsx scripts/audit-state-machine-unwired-guards.ts
continue-on-error: true
- name: Audit Migration Topology (影子迁移防御)
run: node --import tsx scripts/audit-migration-topology.ts
continue-on-error: true
- name: Audit API Test Fixed IDs (并行化降债棘轮 / write-pk)
run: pnpm -C backend run audit:api-test-fixed-ids
continue-on-error: true
- name: 30d Evidence - Launch Smoke Scope
run: pnpm run audit:launch-smoke-scope
continue-on-error: true
- name: 30d Evidence - Rollout Scope Freeze
run: pnpm run audit:rollout-scope-freeze
continue-on-error: true
- name: 30d Evidence - Production Foundation
run: pnpm run audit:production-foundation-evidence
continue-on-error: true
- name: 30d Evidence - RLS Staging Canary Plan
run: pnpm run audit:rls-staging-canary
continue-on-error: true
- name: 30d Evidence - Customer Signoff Status
run: node --import tsx scripts/harness/customer-signoff-status.ts
continue-on-error: true
- name: 30d Evidence - Production Gate Projection
run: node --import tsx scripts/production-release-gate.ts --no-fail
continue-on-error: true
- name: 30d Evidence - Gate Integrity
run: pnpm run audit:production-release-gate-integrity
continue-on-error: true
- name: Harness Report 聚合
run: pnpm harness report --save
continue-on-error: true
- name: 30d Evidence - Harness Meta Tests
run: pnpm run harness:test
- name: 30d Evidence - War Plan Markdown
run: node --import tsx scripts/governance-30d-war-plan.ts
- if: always()
name: Upload audit reports
uses: https://gitea.com/actions/upload-artifact@v3
with:
name: governance-audit-reports
path: |
reports/prisma-zod-contract-audit.latest.json
reports/formrules-zod-audit.latest.json
reports/response-columns-audit.latest.json
reports/field-payload-audit.latest.json
reports/enum-consistency-audit.latest.json
reports/list-page-routes-audit.latest.json
reports/ai-assist-coverage.latest.json
reports/ai-assist-skill-binding.latest.json
reports/ai-assist-context-providers.latest.json
reports/coach-script-library.latest.json
reports/ai-decision-quality.latest.json
reports/event-publishing-audit.latest.json
reports/state-machine-integration-audit.latest.json
reports/harness-dashboard.latest.json
reports/module-grades.latest.json
reports/money-decimal-purity-audit.latest.json
reports/nested-transaction-audit.latest.json
reports/test-assertion-density-audit.latest.json
reports/api-test-coverage.latest.json
reports/api-test-fixed-ids-audit.latest.json
reports/consumer-test-authenticity-audit.latest.json
reports/consumer-idempotency-audit.latest.json
reports/state-machine-unwired-guards-audit.latest.json
reports/migration-topology-audit.latest.json
reports/customer-signoff-status.latest.json
reports/p0-customer-input-status.latest.json
reports/rollout-scope-freeze.latest.json
reports/rollout-scope-freeze.latest.md
reports/production-foundation-evidence.latest.json
reports/production-foundation-evidence.latest.md
reports/launch-smoke-scope.latest.json
reports/launch-smoke-scope.latest.md
reports/rls-staging-canary.latest.json
reports/rls-staging-canary.latest.md
reports/production-release-gate.latest.json
reports/production-release-gate.latest.md
reports/production-release-actions.latest.json
reports/production-release-actions.latest.md
reports/production-release-gate-integrity.latest.json
reports/production-release-gate-integrity.latest.md
reports/governance-30d-war-plan.latest.md
retention-days: "14"
- if: always()
name: 输出 governance summary
run: node --import tsx scripts/ci-governance-summary.ts --title "Governance Audit Summary" --include-rules
- name: 治理硬门禁 — 豁免感知 verdict（HARD）
run: node --import tsx scripts/harness/governance-gate.ts
- name: 文档对账 — CLAUDE.md GOVERNANCE-BASELINE ↔ reports 实测（HARD）
run: node --import tsx scripts/harness/baseline-reconcile.ts
- name: Harness Gate 综合 PR 验收（HARD）
run: pnpm harness gate
...
|
governance-audit
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
0
|
7
|
0
|
0
|
1794765592
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|
|
49714
|
27575
|
160
|
5
|
ffa148adcca22ba61c7359a6961d8d8fb1e9a703
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: 22.23.2
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794765592
|
1794765592
|
|
0
|
|
0
|
Edit
Delete
|