|
48620
|
27273
|
116
|
5
|
56fba13b931825fc703078204277739c2f08bc0d
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39357
|
2
|
1794245844
|
1794245848
|
1794245842
|
1794245848
|
|
0
|
|
0
|
Edit
Delete
|
|
48621
|
27274
|
116
|
5
|
4174f156301864692df3627fde0d37c2a71c6a5e
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39358
|
2
|
1794245943
|
1794245947
|
1794245942
|
1794245948
|
|
0
|
|
0
|
Edit
Delete
|
|
48622
|
27275
|
116
|
5
|
7169c9c1bfa842e6d49c844b0c4602043e445449
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39359
|
1
|
1794246171
|
1794246176
|
1794246171
|
1794246176
|
|
0
|
|
0
|
Edit
Delete
|
|
48623
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test bounded Action preparation (synthetic credentials only)
run: PYTHONDONTWRITEBYTECODE=1 python3 ci/test-prepare-actions.py
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Docker CLI for pinned-image syntax checks (runner images may ship without it)
run: command -v docker >/dev/null || { apt-get update && apt-get install -y --no-install-recommends docker.io; }
- name: Caddy and alert rule syntax (compose-pinned images; skipped fails here)
run: |
pnpm check:caddy
pnpm check:otel
env:
CHECK_SYNTAX_REQUIRED: "1"
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload package tarballs
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload public static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
39360
|
2
|
1794246407
|
1794246407
|
1794246405
|
1794246407
|
|
0
|
|
0
|
Edit
Delete
|
|
48624
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
39361
|
2
|
1794246409
|
1794246409
|
1794246405
|
1794246409
|
|
0
|
|
0
|
Edit
Delete
|
|
48625
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
39362
|
4
|
1794246411
|
1794246411
|
1794246405
|
1794246411
|
|
1
|
|
0
|
Edit
Delete
|
|
48626
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload port conformance evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
39363
|
4
|
1794246413
|
1794246413
|
1794246405
|
1794246413
|
|
1
|
|
0
|
Edit
Delete
|
|
48627
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload workbench browser diagnostics
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload runtime and UI evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
39364
|
4
|
1794246415
|
1794246415
|
1794246405
|
1794246415
|
|
1
|
|
0
|
Edit
Delete
|
|
48628
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload identity evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
39365
|
4
|
1794246417
|
1794246417
|
1794246405
|
1794246417
|
|
1
|
|
0
|
Edit
Delete
|
|
48629
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: ./.git/ci-actions/cosign-installer
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload image evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
39366
|
4
|
1794246419
|
1794246419
|
1794246405
|
1794246419
|
|
1
|
|
0
|
Edit
Delete
|
|
48630
|
27276
|
116
|
5
|
f6ffb8a8388a98cf34a543b59088bc08dcceb338
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39367
|
2
|
1794246421
|
1794246421
|
1794246405
|
1794246421
|
|
1
|
|
0
|
Edit
Delete
|
|
48631
|
27277
|
116
|
5
|
c2a050879deacf466227bf869940ddd9b5daae3a
|
0
|
validate
|
1
|
name: Refresh native memory window capacity and re name: Refresh native memory window capacity and readonly prerequisites
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Refresh native backup access HTTP and compressed geometry without maintenance
run: |
set -eu
python3 <<'PY'
import ast,hashlib,importlib.util,json,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_MEMORY_PREFLIGHT_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-window-preflight-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
sources={}
for name in frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines():
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
with open(work/'source-closure.private.json','x') as stream:json.dump(sources,stream)
for name in ['test-memory-window-capacity.py','test-memory-native-prerequisites.py']:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=60)
unit='eios-r1-memory-prerequisites-'+run
props=['User=root','UMask=0077','Nice=15','CPUQuota=150%','MemoryMax=7G','MemorySwapMax=0','OOMPolicy=kill','TasksMax=256','RuntimeMaxSec=2400','TimeoutStopSec=30','KillMode=control-group','ProtectSystem=strict','PrivateTmp=yes','ReadWritePaths=/var/lib/eios-r1-maintenance','StandardOutput=file:'+str(work/'prerequisites.stdout'),'StandardError=file:'+str(work/'prerequisites.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'memory-native-prerequisites.py')],check=True,capture_output=True,timeout=30)
spec=importlib.util.spec_from_file_location('manager',work/'run-memory-old-database-probe.py');manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,2410);output=(work/'prerequisites.stdout').read_text();marker='R1_MEMORY_PREREQUISITES_JSON '
if output.count(marker)==1:print(marker+output.split(marker)[1],flush=True)
else:
diagnostics={}
for name in ['prerequisites.stderr','window-preflight.py.stderr','window-receipt-preflight.py.stderr']:
p=work/name
if p.exists():
raw=p.read_text();diagnostics[name]={'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',raw),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',raw)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',raw)]}
print('R1_MEMORY_PREREQUISITES_FAILURE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'diagnostics':diagnostics,'liveHealthAfter':manager.health(),'productionServicesChanged':False,'windowAdmissionGranted':False}),flush=True);raise RuntimeError('FRESH_MEMORY_NATIVE_PREREQUISITES_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "45"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39368
|
2
|
1794246679
|
1794246681
|
1794246679
|
1794246681
|
|
0
|
|
0
|
Edit
Delete
|
|
48632
|
27278
|
116
|
5
|
35aa2c339ecb5960584d33165c130d03c38926ac
|
0
|
validate
|
1
|
name: Refresh native memory window capacity and re name: Refresh native memory window capacity and readonly prerequisites
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Refresh native backup access HTTP and compressed geometry without maintenance
run: |
set -eu
python3 <<'PY'
import ast,hashlib,importlib.util,json,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_MEMORY_PREFLIGHT_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-window-preflight-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
sources={}
for name in frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines():
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
with open(work/'source-closure.private.json','x') as stream:json.dump(sources,stream)
for name in ['test-memory-window-capacity.py','test-memory-native-prerequisites.py']:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=60)
roots=next(ast.literal_eval(n.value) for n in ast.parse((work/'window-support.py').read_bytes()).body if isinstance(n,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='ROOTS' for t in n.targets))
if hashlib.sha256(json.dumps(list(roots),separators=(',',':')).encode()).hexdigest()!='be95219bdb15adaf0b7b4ba28d1227bee48688a17865575c5fe473377c47e89c':raise RuntimeError('FIXED_EIGHT_READONLY_ROOTS_REQUIRED')
unit='eios-r1-memory-prerequisites-'+run
props=['User=root','UMask=0077','Nice=15','CPUQuota=150%','MemoryMax=7G','MemorySwapMax=0','OOMPolicy=kill','TasksMax=256','RuntimeMaxSec=2400','TimeoutStopSec=30','KillMode=control-group','ProtectSystem=strict','PrivateMounts=yes','PrivateTmp=yes','BindReadOnlyPaths='+' '.join('/'+name for name in roots),'ReadWritePaths=/var/lib/eios-r1-maintenance','StandardOutput=file:'+str(work/'prerequisites.stdout'),'StandardError=file:'+str(work/'prerequisites.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'memory-native-prerequisites.py')],check=True,capture_output=True,timeout=30)
spec=importlib.util.spec_from_file_location('manager',work/'run-memory-old-database-probe.py');manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,2410);output=(work/'prerequisites.stdout').read_text();marker='R1_MEMORY_PREREQUISITES_JSON '
if output.count(marker)==1:print(marker+output.split(marker)[1],flush=True)
else:
diagnostics={}
for name in ['prerequisites.stderr','window-preflight.py.stderr','window-receipt-preflight.py.stderr']:
p=work/name
if p.exists():
raw=p.read_text();diagnostics[name]={'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',raw),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',raw)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',raw)]}
print('R1_MEMORY_PREREQUISITES_FAILURE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'diagnostics':diagnostics,'liveHealthAfter':manager.health(),'productionServicesChanged':False,'windowAdmissionGranted':False}),flush=True);raise RuntimeError('FRESH_MEMORY_NATIVE_PREREQUISITES_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "45"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39369
|
1
|
1794246825
|
1794247168
|
1794246824
|
1794247168
|
|
0
|
|
0
|
Edit
Delete
|
|
48633
|
27279
|
116
|
5
|
6f5712eeb23c7a420a105d5ce4c4a6795643d018
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39370
|
1
|
1794247487
|
1794247491
|
1794247485
|
1794247491
|
|
0
|
|
0
|
Edit
Delete
|
|
48634
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test bounded Action preparation (synthetic credentials only)
run: PYTHONDONTWRITEBYTECODE=1 python3 ci/test-prepare-actions.py
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Docker CLI for pinned-image syntax checks (runner images may ship without it)
run: command -v docker >/dev/null || { apt-get update && apt-get install -y --no-install-recommends docker.io; }
- name: Caddy and alert rule syntax (compose-pinned images; skipped fails here)
run: |
pnpm check:caddy
pnpm check:otel
env:
CHECK_SYNTAX_REQUIRED: "1"
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload package tarballs
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload public static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
39371
|
2
|
1794247805
|
1794247805
|
1794247805
|
1794247805
|
|
0
|
|
0
|
Edit
Delete
|
|
48635
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
39372
|
2
|
1794247807
|
1794247807
|
1794247805
|
1794247807
|
|
0
|
|
0
|
Edit
Delete
|
|
48636
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
39373
|
4
|
1794247809
|
1794247809
|
1794247805
|
1794247809
|
|
1
|
|
0
|
Edit
Delete
|
|
48637
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload port conformance evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
39374
|
4
|
1794247811
|
1794247811
|
1794247805
|
1794247811
|
|
1
|
|
0
|
Edit
Delete
|
|
48638
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload workbench browser diagnostics
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload runtime and UI evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
39375
|
4
|
1794247813
|
1794247813
|
1794247805
|
1794247813
|
|
1
|
|
0
|
Edit
Delete
|
|
48639
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload identity evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
39376
|
4
|
1794247815
|
1794247815
|
1794247805
|
1794247815
|
|
1
|
|
0
|
Edit
Delete
|
|
48640
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: ./.git/ci-actions/cosign-installer
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload image evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
39377
|
4
|
1794247817
|
1794247817
|
1794247805
|
1794247817
|
|
1
|
|
0
|
Edit
Delete
|
|
48641
|
27280
|
116
|
5
|
8b6a3353b349dac24024c1ba5bb4b3ca2e3999de
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39378
|
2
|
1794247819
|
1794247819
|
1794247805
|
1794247819
|
|
1
|
|
0
|
Edit
Delete
|
|
48642
|
27281
|
116
|
5
|
22308a7c690e7aa1bd27938ad7b2658bf76b174c
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39379
|
1
|
1794248167
|
1794248172
|
1794248166
|
1794248172
|
|
0
|
|
0
|
Edit
Delete
|
|
48643
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test bounded Action preparation (synthetic credentials only)
run: PYTHONDONTWRITEBYTECODE=1 python3 ci/test-prepare-actions.py
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Docker CLI for pinned-image syntax checks (runner images may ship without it)
run: command -v docker >/dev/null || { apt-get update && apt-get install -y --no-install-recommends docker.io; }
- name: Caddy and alert rule syntax (compose-pinned images; skipped fails here)
run: |
pnpm check:caddy
pnpm check:otel
env:
CHECK_SYNTAX_REQUIRED: "1"
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload package tarballs
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload public static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
39380
|
2
|
1794248414
|
1794248414
|
1794248413
|
1794248415
|
|
0
|
|
0
|
Edit
Delete
|
|
48644
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
39381
|
2
|
1794248416
|
1794248416
|
1794248413
|
1794248417
|
|
0
|
|
0
|
Edit
Delete
|
|
48645
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
39382
|
4
|
1794248418
|
1794248418
|
1794248413
|
1794248419
|
|
1
|
|
0
|
Edit
Delete
|
|
48646
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload port conformance evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
39383
|
4
|
1794248420
|
1794248420
|
1794248413
|
1794248421
|
|
1
|
|
0
|
Edit
Delete
|
|
48647
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload workbench browser diagnostics
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload runtime and UI evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
39384
|
4
|
1794248422
|
1794248422
|
1794248413
|
1794248423
|
|
1
|
|
0
|
Edit
Delete
|
|
48648
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload identity evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
39385
|
4
|
1794248424
|
1794248424
|
1794248413
|
1794248425
|
|
1
|
|
0
|
Edit
Delete
|
|
48649
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: ./.git/ci-actions/cosign-installer
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload image evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
39386
|
4
|
1794248426
|
1794248426
|
1794248413
|
1794248427
|
|
1
|
|
0
|
Edit
Delete
|
|
48650
|
27282
|
116
|
5
|
948d4917ced87a20fff6c561f69c4229923c3aab
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102':raise RuntimeError('BOOTSTRAP_d1a743408b27459c015d90fa6035952cf6f26f43899ee8a7cd24df39c2af0102_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39387
|
2
|
1794248428
|
1794248428
|
1794248413
|
1794248429
|
|
1
|
|
0
|
Edit
Delete
|
|
48651
|
27283
|
116
|
5
|
0dcbc46424391ac6cb50f950f3913f802035d4df
|
0
|
validate
|
1
|
name: Refresh native memory window capacity and re name: Refresh native memory window capacity and readonly prerequisites
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Refresh native backup access HTTP and compressed geometry without maintenance
run: |
set -eu
python3 <<'PY'
import ast,hashlib,importlib.util,json,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_MEMORY_PREFLIGHT_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-window-preflight-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
sources={}
for name in frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines():
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
with open(work/'source-closure.private.json','x') as stream:json.dump(sources,stream)
for name in ['prerequisites-native-27278.json','parent-child-native-27281.json']:
data=frozen('show',sha+':docs/evidence/r1-memory-restore-2026-11-09/'+name);json.loads(data);(work/name).write_bytes(data)
suites=[]
for name,count in [('test-memory-window-capacity.py',12),('test-memory-native-prerequisites.py',4),('test-memory-window-integration.py',15),('test-launch-memory-window.py',5)]:
result=subprocess.run(['/usr/bin/python3','-B',str(work/name)],capture_output=True,text=True,timeout=60)
(work/(name+'.stdout')).write_text(result.stdout);(work/(name+'.stderr')).write_text(result.stderr)
observed=re.findall(r'Ran ([0-9]+) tests?',result.stderr)
if result.returncode or observed!=[str(count)] or 'OK' not in result.stderr:raise RuntimeError('FIXED_MEMORY_PREREQUISITE_UNIT_TEST_FAILED')
suites.append({'file':name,'tests':count,'exitCode':0})
with open(work/'native-unit-tests.private.json','x') as stream:json.dump({'ci':{'runId':run,'sourceSha':sha},'suites':suites},stream)
(work/'native-unit-tests.private.json').chmod(0o600)
roots=next(ast.literal_eval(n.value) for n in ast.parse((work/'window-support.py').read_bytes()).body if isinstance(n,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='ROOTS' for t in n.targets))
if hashlib.sha256(json.dumps(list(roots),separators=(',',':')).encode()).hexdigest()!='be95219bdb15adaf0b7b4ba28d1227bee48688a17865575c5fe473377c47e89c':raise RuntimeError('FIXED_EIGHT_READONLY_ROOTS_REQUIRED')
unit='eios-r1-memory-prerequisites-'+run
props=['User=root','UMask=0077','Nice=15','CPUQuota=150%','MemoryMax=7G','MemorySwapMax=0','OOMPolicy=kill','TasksMax=256','RuntimeMaxSec=2400','TimeoutStopSec=30','KillMode=control-group','ProtectSystem=strict','PrivateMounts=yes','PrivateTmp=yes','BindReadOnlyPaths='+' '.join('/'+name for name in roots),'ReadWritePaths=/var/lib/eios-r1-maintenance','StandardOutput=file:'+str(work/'prerequisites.stdout'),'StandardError=file:'+str(work/'prerequisites.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'memory-native-prerequisites.py')],check=True,capture_output=True,timeout=30)
spec=importlib.util.spec_from_file_location('manager',work/'run-memory-old-database-probe.py');manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,2410);output=(work/'prerequisites.stdout').read_text();marker='R1_MEMORY_PREREQUISITES_JSON '
if output.count(marker)==1:print(marker+output.split(marker)[1],flush=True)
else:
diagnostics={}
for name in ['prerequisites.stderr','window-preflight.py.stderr','window-receipt-preflight.py.stderr','controller-envelope.stderr']:
p=work/name
if p.exists():
raw=p.read_text();diagnostics[name]={'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',raw),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',raw)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',raw)]}
print('R1_MEMORY_PREREQUISITES_FAILURE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'diagnostics':diagnostics,'liveHealthAfter':manager.health(),'productionServicesChanged':False,'windowAdmissionGranted':False}),flush=True);raise RuntimeError('FRESH_MEMORY_NATIVE_PREREQUISITES_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "45"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39388
|
2
|
1794250821
|
1794250840
|
1794250821
|
1794250840
|
|
0
|
|
0
|
Edit
Delete
|
|
48652
|
27284
|
116
|
5
|
13ed622cddaf0f03151f974e4a2570ed72552f45
|
0
|
validate
|
1
|
name: Refresh native memory window capacity and re name: Refresh native memory window capacity and readonly prerequisites
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Refresh native backup access HTTP and compressed geometry without maintenance
run: |
set -eu
python3 <<'PY'
import ast,hashlib,importlib.util,json,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_MEMORY_PREFLIGHT_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-window-preflight-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
sources={}
for name in frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines():
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
with open(work/'source-closure.private.json','x') as stream:json.dump(sources,stream)
for name in ['prerequisites-native-27278.json','parent-child-native-27281.json']:
data=frozen('show',sha+':docs/evidence/r1-memory-restore-2026-11-09/'+name);json.loads(data);(work/name).write_bytes(data)
suites=[]
for name,count in [('test-memory-window-capacity.py',12),('test-memory-native-prerequisites.py',5),('test-memory-window-integration.py',15),('test-launch-memory-window.py',5)]:
result=subprocess.run(['/usr/bin/python3','-B',str(work/name)],capture_output=True,text=True,timeout=60)
(work/(name+'.stdout')).write_text(result.stdout);(work/(name+'.stderr')).write_text(result.stderr)
observed=re.findall(r'Ran ([0-9]+) tests?',result.stderr)
if result.returncode or observed!=[str(count)] or 'OK' not in result.stderr:raise RuntimeError('FIXED_MEMORY_PREREQUISITE_UNIT_TEST_FAILED')
suites.append({'file':name,'tests':count,'exitCode':0})
with open(work/'native-unit-tests.private.json','x') as stream:json.dump({'ci':{'runId':run,'sourceSha':sha},'suites':suites},stream)
(work/'native-unit-tests.private.json').chmod(0o600)
roots=next(ast.literal_eval(n.value) for n in ast.parse((work/'window-support.py').read_bytes()).body if isinstance(n,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='ROOTS' for t in n.targets))
if hashlib.sha256(json.dumps(list(roots),separators=(',',':')).encode()).hexdigest()!='be95219bdb15adaf0b7b4ba28d1227bee48688a17865575c5fe473377c47e89c':raise RuntimeError('FIXED_EIGHT_READONLY_ROOTS_REQUIRED')
unit='eios-r1-memory-prerequisites-'+run
props=['User=root','UMask=0077','Nice=15','CPUQuota=150%','MemoryMax=7G','MemorySwapMax=0','OOMPolicy=kill','TasksMax=256','RuntimeMaxSec=2400','TimeoutStopSec=30','KillMode=control-group','ProtectSystem=strict','PrivateMounts=yes','PrivateTmp=yes','BindReadOnlyPaths='+' '.join('/'+name for name in roots),'ReadWritePaths=/var/lib/eios-r1-maintenance','StandardOutput=file:'+str(work/'prerequisites.stdout'),'StandardError=file:'+str(work/'prerequisites.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'memory-native-prerequisites.py')],check=True,capture_output=True,timeout=30)
spec=importlib.util.spec_from_file_location('manager',work/'run-memory-old-database-probe.py');manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,2410);output=(work/'prerequisites.stdout').read_text();marker='R1_MEMORY_PREREQUISITES_JSON '
if output.count(marker)==1:print(marker+output.split(marker)[1],flush=True)
else:
diagnostics={}
for name in ['prerequisites.stderr','window-preflight.py.stderr','window-receipt-preflight.py.stderr','controller-envelope.stderr']:
p=work/name
if p.exists():
raw=p.read_text();diagnostics[name]={'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',raw),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',raw)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',raw)]}
print('R1_MEMORY_PREREQUISITES_FAILURE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'diagnostics':diagnostics,'liveHealthAfter':manager.health(),'productionServicesChanged':False,'windowAdmissionGranted':False}),flush=True);raise RuntimeError('FRESH_MEMORY_NATIVE_PREREQUISITES_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "45"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39389
|
1
|
1794251221
|
1794251597
|
1794251220
|
1794251597
|
|
0
|
|
0
|
Edit
Delete
|
|
48653
|
27285
|
116
|
5
|
34998162c98b7ba2104b27d3d7c5f11fc8d0602e
|
0
|
produce
|
1
|
name: Verify fixed Gitea v4 cross-job artifacts
&# name: Verify fixed Gitea v4 cross-job artifacts
"on":
workflow_dispatch:
jobs:
produce:
name: produce
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- name: Write public identity fixture without overriding runtime context
run: |
python3 <<'PYTHON'
import json,os,pathlib,re
sha=os.environ['GITHUB_SHA'];run=os.environ['GITHUB_RUN_ID']
if not re.fullmatch('[0-9a-f]{40}',sha) or not re.fullmatch('[1-9][0-9]*',run):raise RuntimeError('GENUINE_WORKFLOW_IDENTITY_REQUIRED')
p=pathlib.Path('artifact-public-fixture');p.mkdir()
(p/'receipt.json').write_text(json.dumps({'kind':'R1PublicArtifactV4Fixture','ci':{'sourceSha':sha,'runId':run},'nativeAttempt':os.environ.get('GITHUB_RUN_ATTEMPT'),'productionDataIncluded':False,'releaseEligible':False},sort_keys=True)+'\n')
PYTHON
shell: bash
- uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: r1-v4-public-fixture-${{ github.run_id }}
path: artifact-public-fixture/receipt.json
retention-days: "2"
timeout-minutes: "12"
permissions:
contents: read
...
|
produce
|
null
|
["ubuntu-latest"]
|
39390
|
1
|
1794251709
|
1794251719
|
1794251708
|
1794251720
|
|
0
|
|
0
|
Edit
Delete
|
|
48654
|
27285
|
116
|
5
|
34998162c98b7ba2104b27d3d7c5f11fc8d0602e
|
0
|
consume
|
1
|
name: Verify fixed Gitea v4 cross-job artifacts
&# name: Verify fixed Gitea v4 cross-job artifacts
"on":
workflow_dispatch:
jobs:
consume:
name: consume
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/download-artifact
with:
name: r1-v4-public-fixture-${{ github.run_id }}
path: artifact-consumer
- name: Verify exact cross-job public fixture
run: |
python3 <<'PYTHON'
import json,os,pathlib
p=pathlib.Path('artifact-consumer/receipt.json');r=json.loads(p.read_text());ci={'sourceSha':os.environ['GITHUB_SHA'],'runId':os.environ['GITHUB_RUN_ID']}
if r.get('kind')!='R1PublicArtifactV4Fixture' or r.get('ci')!=ci or r.get('nativeAttempt')!=os.environ.get('GITHUB_RUN_ATTEMPT') or r.get('productionDataIncluded') is not False or r.get('releaseEligible') is not False:raise RuntimeError('EXACT_CROSS_JOB_ARTIFACT_REQUIRED')
print('R1_ARTIFACT_V4_CROSS_JOB_JSON '+json.dumps({'kind':'R1ArtifactV4CrossJobVerification','ci':ci,'nativeAttempt':os.environ.get('GITHUB_RUN_ATTEMPT'),'status':'PUBLIC_FIXTURE_UPLOADED_AND_DOWNLOADED','fixtureBytes':p.stat().st_size,'releaseEligible':False}))
PYTHON
shell: bash
timeout-minutes: "12"
permissions:
contents: read
...
|
consume
|
["produce"]
|
["ubuntu-latest"]
|
39391
|
1
|
1794251722
|
1794251731
|
1794251708
|
1794251731
|
|
1
|
|
0
|
Edit
Delete
|
|
48655
|
27286
|
117
|
5
|
f69259adcb93550cf914baa561bd6a2700b5094a
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
39392
|
1
|
1794252089
|
1794252107
|
1794252088
|
1794252107
|
|
0
|
|
0
|
Edit
Delete
|
|
48656
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test bounded Action preparation (synthetic credentials only)
run: PYTHONDONTWRITEBYTECODE=1 python3 ci/test-prepare-actions.py
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Docker CLI for pinned-image syntax checks (runner images may ship without it)
run: command -v docker >/dev/null || { apt-get update && apt-get install -y --no-install-recommends docker.io; }
- name: Caddy and alert rule syntax (compose-pinned images; skipped fails here)
run: |
pnpm check:caddy
pnpm check:otel
env:
CHECK_SYNTAX_REQUIRED: "1"
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload package tarballs
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload public static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
39393
|
2
|
1794252148
|
1794252148
|
1794252148
|
1794252148
|
|
0
|
|
0
|
Edit
Delete
|
|
48657
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
39394
|
2
|
1794252150
|
1794252150
|
1794252148
|
1794252150
|
|
0
|
|
0
|
Edit
Delete
|
|
48658
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
39395
|
4
|
1794252152
|
1794252152
|
1794252148
|
1794252152
|
|
1
|
|
0
|
Edit
Delete
|
|
48659
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload port conformance evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
39396
|
4
|
1794252154
|
1794252154
|
1794252148
|
1794252154
|
|
1
|
|
0
|
Edit
Delete
|
|
48660
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload workbench browser diagnostics
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload runtime and UI evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
39397
|
4
|
1794252156
|
1794252156
|
1794252148
|
1794252156
|
|
1
|
|
0
|
Edit
Delete
|
|
48661
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload identity evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
39398
|
4
|
1794252158
|
1794252158
|
1794252148
|
1794252158
|
|
1
|
|
0
|
Edit
Delete
|
|
48662
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: ./.git/ci-actions/cosign-installer
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload image evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
39399
|
4
|
1794252160
|
1794252160
|
1794252148
|
1794252160
|
|
1
|
|
0
|
Edit
Delete
|
|
48663
|
27287
|
116
|
5
|
0dc09855e7e47ec27f2dd62de257330a0f3a8a62
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "20"
- name: Download static evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: ./.git/ci-actions/download-artifact
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: ./.git/ci-actions/download-artifact
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload candidate evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
39400
|
2
|
1794252162
|
1794252162
|
1794252148
|
1794252162
|
|
1
|
|
0
|
Edit
Delete
|
|
48664
|
27288
|
116
|
5
|
3a6381854c56c3f371f4fcffe18048518f63d1c5
|
0
|
launch
|
1
|
name: Launch reviewed bounded R1 memory maintenanc name: Launch reviewed bounded R1 memory maintenance window
"on":
workflow_dispatch:
jobs:
launch:
name: launch
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform' && github.ref == 'refs/heads/codex/r1-memory-restore-20261109'
steps:
- name: Start only the frozen reviewed independent controller
run: |
set -eu
python3 <<'PY'
import ast,os,pathlib,re,subprocess
sha=os.environ['GITHUB_SHA'];run=os.environ['GITHUB_RUN_ID']
if not re.fullmatch('[0-9a-f]{40}',sha) or not re.fullmatch('[1-9][0-9]*',run):raise RuntimeError('FIXED_MEMORY_WINDOW_JOB_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
data=subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-c','protocol.allow=never','-C',repo,'show',sha+':ops/gitea-r1/launch-memory-window.py'],capture_output=True,check=True,timeout=30).stdout
ast.parse(data);work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-window-launcher-'+run);work.mkdir(mode=0o700)
path=work/'launch-memory-window.py';path.write_bytes(data)
subprocess.run(['/usr/bin/python3','-B',str(path)],check=True,timeout=600)
PY
shell: bash
timeout-minutes: "12"
permissions:
contents: read
...
|
launch
|
null
|
["ubuntu-latest"]
|
39401
|
1
|
1794252200
|
1794252224
|
1794252198
|
1794252224
|
|
0
|
|
0
|
Edit
Delete
|
|
48665
|
27289
|
116
|
5
|
01339deefdf91902d1c0ae3cdb7ee16e4086c9fe
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py','test-controller-database-lifetime.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
import importlib.util
def reviewed_module(name):
spec=importlib.util.spec_from_file_location(name,work/(name+'.py'));module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module);return module
restored=reviewed_module('memory-native-prerequisites').recovered_window_27288(reviewed_module('run-memory-old-database-probe'),reviewed_module('window-support'))
if restored['liveHealth']!=200:raise RuntimeError('ORIGINAL_RECOVERED_SERVICE_HEALTH_REQUIRED')
print('R1_FAILED_WINDOW_RECOVERY_JSON '+json.dumps(restored),flush=True)
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39402
|
2
|
1794252568
|
1794252571
|
1794252567
|
1794252571
|
|
0
|
|
0
|
Edit
Delete
|
|
48666
|
27290
|
116
|
5
|
f95737b67e2dbb53b6e3c33b662c9e8014dac1a7
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py','test-controller-database-lifetime.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
import importlib.util
def reviewed_module(name):
spec=importlib.util.spec_from_file_location(name,work/(name+'.py'));module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module);return module
restored=reviewed_module('memory-native-prerequisites').recovered_window_27288(reviewed_module('run-memory-old-database-probe'),reviewed_module('window-support'))
if restored['liveHealth']!=200:raise RuntimeError('ORIGINAL_RECOVERED_SERVICE_HEALTH_REQUIRED')
print('R1_FAILED_WINDOW_RECOVERY_JSON '+json.dumps(restored),flush=True)
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39403
|
2
|
1794253621
|
1794253624
|
1794253621
|
1794253625
|
|
0
|
|
0
|
Edit
Delete
|
|
48667
|
27291
|
116
|
5
|
7790844da72b5255e02df46f742810d449a83f64
|
0
|
validate
|
1
|
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py','test-controller-database-lifetime.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
import importlib.util
def reviewed_module(name):
spec=importlib.util.spec_from_file_location(name,work/(name+'.py'));module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module);return module
restored=reviewed_module('memory-native-prerequisites').recovered_window_27288(reviewed_module('run-memory-old-database-probe'),reviewed_module('window-support'))
if restored['liveHealth']!=200:raise RuntimeError('ORIGINAL_RECOVERED_SERVICE_HEALTH_REQUIRED')
print('R1_FAILED_WINDOW_RECOVERY_JSON '+json.dumps(restored),flush=True)
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39404
|
1
|
1794255228
|
1794255233
|
1794255226
|
1794255234
|
|
0
|
|
0
|
Edit
Delete
|
|
48668
|
27292
|
116
|
5
|
50d99350e1dac11ea3b1efbb0e757ad37dd32a4b
|
0
|
validate
|
1
|
name: Refresh native memory window capacity and re name: Refresh native memory window capacity and readonly prerequisites
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Refresh native backup access HTTP and compressed geometry without maintenance
run: |
set -eu
python3 <<'PY'
import ast,hashlib,importlib.util,json,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_MEMORY_PREFLIGHT_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-window-preflight-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
sources={}
for name in frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines():
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
with open(work/'source-closure.private.json','x') as stream:json.dump(sources,stream)
for name in ['prerequisites-native-27278.json','parent-child-native-27281.json']:
data=frozen('show',sha+':docs/evidence/r1-memory-restore-2026-11-09/'+name);json.loads(data);(work/name).write_bytes(data)
suites=[]
for name,count in [('test-memory-window-capacity.py',12),('test-memory-native-prerequisites.py',6),('test-memory-window-integration.py',15),('test-launch-memory-window.py',5),('test-controller-database-lifetime.py',3),('test-memory-migration.py',3)]:
result=subprocess.run(['/usr/bin/python3','-B',str(work/name)],capture_output=True,text=True,timeout=60)
(work/(name+'.stdout')).write_text(result.stdout);(work/(name+'.stderr')).write_text(result.stderr)
observed=re.findall(r'Ran ([0-9]+) tests?',result.stderr)
if result.returncode or observed!=[str(count)] or 'OK' not in result.stderr:raise RuntimeError('FIXED_MEMORY_PREREQUISITE_UNIT_TEST_FAILED')
suites.append({'file':name,'tests':count,'exitCode':0})
with open(work/'native-unit-tests.private.json','x') as stream:json.dump({'ci':{'runId':run,'sourceSha':sha},'suites':suites},stream)
(work/'native-unit-tests.private.json').chmod(0o600)
roots=next(ast.literal_eval(n.value) for n in ast.parse((work/'window-support.py').read_bytes()).body if isinstance(n,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='ROOTS' for t in n.targets))
if hashlib.sha256(json.dumps(list(roots),separators=(',',':')).encode()).hexdigest()!='be95219bdb15adaf0b7b4ba28d1227bee48688a17865575c5fe473377c47e89c':raise RuntimeError('FIXED_EIGHT_READONLY_ROOTS_REQUIRED')
unit='eios-r1-memory-prerequisites-'+run
props=['User=root','UMask=0077','Nice=15','CPUQuota=150%','MemoryMax=7G','MemorySwapMax=0','OOMPolicy=kill','TasksMax=256','RuntimeMaxSec=2400','TimeoutStopSec=30','KillMode=control-group','ProtectSystem=strict','PrivateMounts=yes','PrivateTmp=yes','BindReadOnlyPaths='+' '.join('/'+name for name in roots),'ReadWritePaths=/var/lib/eios-r1-maintenance','StandardOutput=file:'+str(work/'prerequisites.stdout'),'StandardError=file:'+str(work/'prerequisites.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'memory-native-prerequisites.py')],check=True,capture_output=True,timeout=30)
spec=importlib.util.spec_from_file_location('manager',work/'run-memory-old-database-probe.py');manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,2410);output=(work/'prerequisites.stdout').read_text();marker='R1_MEMORY_PREREQUISITES_JSON '
if output.count(marker)==1:print(marker+output.split(marker)[1],flush=True)
else:
diagnostics={}
for name in ['prerequisites.stderr','window-preflight.py.stderr','window-receipt-preflight.py.stderr','controller-envelope.stderr']:
p=work/name
if p.exists():
raw=p.read_text();diagnostics[name]={'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',raw),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',raw)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',raw)]}
print('R1_MEMORY_PREREQUISITES_FAILURE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'diagnostics':diagnostics,'liveHealthAfter':manager.health(),'productionServicesChanged':False,'windowAdmissionGranted':False}),flush=True);raise RuntimeError('FRESH_MEMORY_NATIVE_PREREQUISITES_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "45"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
39405
|
1
|
1794255573
|
1794255992
|
1794255572
|
1794255992
|
|
0
|
|
0
|
Edit
Delete
|
|
48669
|
27293
|
116
|
5
|
38a4ca00530190a3ace9286e74382b39db9a6b71
|
0
|
Static checks (locked engineering dependency)
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test bounded Action preparation (synthetic credentials only)
run: PYTHONDONTWRITEBYTECODE=1 python3 ci/test-prepare-actions.py
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Docker CLI for pinned-image syntax checks (runner images may ship without it)
run: command -v docker >/dev/null || { apt-get update && apt-get install -y --no-install-recommends docker.io; }
- name: Caddy and alert rule syntax (compose-pinned images; skipped fails here)
run: |
pnpm check:caddy
pnpm check:otel
env:
CHECK_SYNTAX_REQUIRED: "1"
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload package tarballs
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload public static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794255967
|
1794255751
|
1794255967
|
|
0
|
|
0
|
Edit
Delete
|