|
49301
|
27431
|
160
|
5
|
3f25b180fa3520683adf07b889ac1744dea3c790
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738288
|
1794737648
|
1794738288
|
|
0
|
|
0
|
Edit
Delete
|
|
49302
|
27432
|
83
|
5
|
73dd46f9babf070d260fb46329915b078db33cfa
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794737951
|
1794737679
|
1794737951
|
|
0
|
|
0
|
Edit
Delete
|
|
49303
|
27432
|
83
|
5
|
73dd46f9babf070d260fb46329915b078db33cfa
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794737951
|
1794737679
|
1794737951
|
|
0
|
|
0
|
Edit
Delete
|
|
49304
|
27433
|
83
|
5
|
73dd46f9babf070d260fb46329915b078db33cfa
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737679
|
1794737679
|
|
0
|
|
0
|
Edit
Delete
|
|
49305
|
27433
|
83
|
5
|
73dd46f9babf070d260fb46329915b078db33cfa
|
0
|
Platform consumer gate
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
0
|
7
|
0
|
0
|
1794737679
|
1794737679
|
|
0
|
|
0
|
Edit
Delete
|
|
49306
|
27434
|
181
|
5
|
959c4231a67e22e73ebe1e964d0c94ee109faa49
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737918
|
1794737918
|
|
0
|
|
0
|
Edit
Delete
|
|
49307
|
27435
|
83
|
5
|
23a8d5922b22edb4994b383b507579824be28355
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738321
|
1794737951
|
1794738321
|
|
0
|
|
0
|
Edit
Delete
|
|
49308
|
27435
|
83
|
5
|
23a8d5922b22edb4994b383b507579824be28355
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738321
|
1794737951
|
1794738321
|
|
0
|
|
0
|
Edit
Delete
|
|
49309
|
27436
|
83
|
5
|
23a8d5922b22edb4994b383b507579824be28355
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737951
|
1794737951
|
|
0
|
|
0
|
Edit
Delete
|
|
49310
|
27436
|
83
|
5
|
23a8d5922b22edb4994b383b507579824be28355
|
0
|
Platform consumer gate
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
0
|
7
|
0
|
0
|
1794737951
|
1794737951
|
|
0
|
|
0
|
Edit
Delete
|
|
49311
|
27437
|
51
|
5
|
77256134fac82e3f82816a5110d4c9b459a4d343
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
env:
# 无DB单测会 import config/env（zod 启动校验，仅校验格式不连库）：提供合法 DATABASE_URL/JWT_SECRET 让校验通过。
# 纯函数单测（leads.canTransition / platforms.platformConnectionTruth 等）不发查询，无需真实 DB 服务。
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
JWT_SECRET: ci-jwt-secret-not-for-prod
USE_MOCK_ADAPTERS: 'true'
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run check:enterprise
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738456
|
1794738018
|
1794738456
|
|
0
|
|
0
|
Edit
Delete
|
|
49312
|
27437
|
51
|
5
|
77256134fac82e3f82816a5110d4c9b459a4d343
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738456
|
1794738018
|
1794738456
|
|
0
|
|
0
|
Edit
Delete
|
|
49313
|
27437
|
51
|
5
|
77256134fac82e3f82816a5110d4c9b459a4d343
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738456
|
1794738018
|
1794738456
|
|
0
|
|
0
|
Edit
Delete
|
|
49314
|
27438
|
51
|
5
|
77256134fac82e3f82816a5110d4c9b459a4d343
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738018
|
1794738018
|
|
0
|
|
0
|
Edit
Delete
|
|
49315
|
27439
|
81
|
5
|
8bcce3a0c5bfaf6bc3a0af121f9bca6ab86a3c97
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
fetch-depth: "0"
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 89b2adeeda1017b1ac4f66fb1ff5f89e0a21fcef
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Configure Gitea npm read access
run: |
test -n "$JUHAI_NPM_READ_TOKEN" || { echo "JUHAI_NPM_READ_TOKEN secret is required to install @juhai/kernel and @juhai/governance-kit"; exit 1; }
echo "//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=${JUHAI_NPM_READ_TOKEN}" >> "$HOME/.npmrc"
env:
JUHAI_NPM_READ_TOKEN: ${{ secrets.JUHAI_NPM_READ_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738434
|
1794738080
|
1794738434
|
|
0
|
|
0
|
Edit
Delete
|
|
49316
|
27439
|
81
|
5
|
8bcce3a0c5bfaf6bc3a0af121f9bca6ab86a3c97
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_after_sales_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Configure Gitea npm read access
run: |
test -n "$JUHAI_NPM_READ_TOKEN" || { echo "JUHAI_NPM_READ_TOKEN secret is required to install @juhai/kernel and @juhai/governance-kit"; exit 1; }
echo "//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=${JUHAI_NPM_READ_TOKEN}" >> "$HOME/.npmrc"
env:
JUHAI_NPM_READ_TOKEN: ${{ secrets.JUHAI_NPM_READ_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Build workspace packages
run: pnpm --filter "./packages/**" build
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_after_sales_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_after_sales_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738434
|
1794738080
|
1794738434
|
|
0
|
|
0
|
Edit
Delete
|
|
49317
|
27440
|
181
|
5
|
97b01f32ebe3bd1a9263c4faef36a08ba923a83b
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738219
|
1794738219
|
|
0
|
|
0
|
Edit
Delete
|
|
49318
|
27441
|
160
|
5
|
2296607f117a251c04a920ef163306e334b29763
|
0
|
Frontend Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739405
|
1794738288
|
1794739405
|
|
0
|
|
0
|
Edit
Delete
|
|
49319
|
27441
|
160
|
5
|
2296607f117a251c04a920ef163306e334b29763
|
0
|
Lint & Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739405
|
1794738288
|
1794739405
|
|
0
|
|
0
|
Edit
Delete
|
|
49320
|
27441
|
160
|
5
|
2296607f117a251c04a920ef163306e334b29763
|
0
|
Unit Tests (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
unit-tests:
name: Unit Tests (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run unit tests
run: pnpm -C backend run test:unit
...
|
unit-tests
|
["frontend-typecheck","lint-and-typech ["frontend-typecheck","lint-and-typecheck"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739405
|
1794738288
|
1794739405
|
|
0
|
|
0
|
Edit
Delete
|
|
49321
|
27441
|
160
|
5
|
2296607f117a251c04a920ef163306e334b29763
|
0
|
State Machine Model-Based (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
state-machine-model:
name: State Machine Model-Based (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run state machine model-based tests
run: pnpm -C backend run test:state-machines:model
...
|
state-machine-model
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739405
|
1794738288
|
1794739405
|
|
0
|
|
0
|
Edit
Delete
|
|
49322
|
27441
|
160
|
5
|
2296607f117a251c04a920ef163306e334b29763
|
0
|
Governance Audit (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
governance-audit:
name: Governance Audit (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Audit 多租户隔离（HARD GATE / 红线1，不豁免）
run: pnpm -C backend run audit:tenant
- name: Audit Prisma Schema 镜像一致性（HARD GATE）
run: pnpm run audit:prisma-schema-source
- name: Audit Prisma↔Zod 契约
run: pnpm -C backend exec tsx scripts/audit-prisma-zod-contract.ts
continue-on-error: true
- name: Audit FormRules↔Zod
run: pnpm run audit:formrules-zod
continue-on-error: true
- name: Audit Response Columns
run: pnpm run audit:response-columns
continue-on-error: true
- name: Audit Field Payload
run: pnpm run audit:field-payload
continue-on-error: true
- name: Audit Enum Consistency
run: pnpm run audit:enum-consistency
continue-on-error: true
- name: Audit useListPage ↔ Router
run: pnpm run audit:list-page-routes
continue-on-error: true
- name: Audit 前端权限键 ↔ 后端真源（HARD GATE / 防按钮 fail-closed 隐藏）
run: pnpm run audit:permission-keys
- name: Audit Page AI Assist Coverage
run: pnpm run audit:ai-assist-coverage
continue-on-error: true
- name: Audit Page AI Assist Skill Binding
run: pnpm run audit:ai-assist-skill-binding
continue-on-error: true
- name: Audit Page AI Assist Context Providers
run: pnpm run audit:context-provider-redact
continue-on-error: true
- name: Audit Coach Script Library
run: pnpm run audit:coach-script-library
continue-on-error: true
- name: Audit AI Decision Quality
run: pnpm run audit:ai-decision-quality
continue-on-error: true
- name: Audit Event Publishing
run: pnpm -C backend run audit:events
continue-on-error: true
- name: Audit State Machines
run: pnpm -C backend run audit:state-machines
continue-on-error: true
- name: Audit Money Decimal Purity (CFO-P0 防御)
run: node --import tsx scripts/audit-money-decimal-purity.ts
continue-on-error: true
- name: Audit Nested Transaction (CFO-P0-1 + RO-P0-3 防御)
run: node --import tsx scripts/audit-nested-transaction.ts
continue-on-error: true
- name: Audit Test Assertion Density (QA-P0 防御)
run: node --import tsx scripts/audit-test-assertion-density.ts
continue-on-error: true
- name: Audit API Test Coverage (probe-only / read-covered / action-covered / complete-crud)
run: pnpm -C backend run audit:api-test-coverage
continue-on-error: true
- name: Audit Consumer Test Authenticity (断言剧场防御 / 假绿防御)
run: node --import tsx scripts/audit-consumer-test-authenticity.ts
continue-on-error: true
- name: Audit Consumer Idempotency (去重路径假覆盖防御)
run: node --import tsx scripts/audit-consumer-idempotency.ts
continue-on-error: true
- name: Audit State Machine Unwired Guards (死守卫 / 假保护防御)
run: node --import tsx scripts/audit-state-machine-unwired-guards.ts
continue-on-error: true
- name: Audit Migration Topology (影子迁移防御)
run: node --import tsx scripts/audit-migration-topology.ts
continue-on-error: true
- name: Audit API Test Fixed IDs (并行化降债棘轮 / write-pk)
run: pnpm -C backend run audit:api-test-fixed-ids
continue-on-error: true
- name: 30d Evidence - Launch Smoke Scope
run: pnpm run audit:launch-smoke-scope
continue-on-error: true
- name: 30d Evidence - Rollout Scope Freeze
run: pnpm run audit:rollout-scope-freeze
continue-on-error: true
- name: 30d Evidence - Production Foundation
run: pnpm run audit:production-foundation-evidence
continue-on-error: true
- name: 30d Evidence - RLS Staging Canary Plan
run: pnpm run audit:rls-staging-canary
continue-on-error: true
- name: 30d Evidence - Customer Signoff Status
run: node --import tsx scripts/harness/customer-signoff-status.ts
continue-on-error: true
- name: 30d Evidence - Production Gate Projection
run: node --import tsx scripts/production-release-gate.ts --no-fail
continue-on-error: true
- name: 30d Evidence - Gate Integrity
run: pnpm run audit:production-release-gate-integrity
continue-on-error: true
- name: Harness Report 聚合
run: pnpm harness report --save
continue-on-error: true
- name: 30d Evidence - Harness Meta Tests
run: pnpm run harness:test
- name: 30d Evidence - War Plan Markdown
run: node --import tsx scripts/governance-30d-war-plan.ts
- if: always()
name: Upload audit reports
uses: https://gitea.com/actions/upload-artifact@v3
with:
name: governance-audit-reports
path: |
reports/prisma-zod-contract-audit.latest.json
reports/formrules-zod-audit.latest.json
reports/response-columns-audit.latest.json
reports/field-payload-audit.latest.json
reports/enum-consistency-audit.latest.json
reports/list-page-routes-audit.latest.json
reports/ai-assist-coverage.latest.json
reports/ai-assist-skill-binding.latest.json
reports/ai-assist-context-providers.latest.json
reports/coach-script-library.latest.json
reports/ai-decision-quality.latest.json
reports/event-publishing-audit.latest.json
reports/state-machine-integration-audit.latest.json
reports/harness-dashboard.latest.json
reports/module-grades.latest.json
reports/money-decimal-purity-audit.latest.json
reports/nested-transaction-audit.latest.json
reports/test-assertion-density-audit.latest.json
reports/api-test-coverage.latest.json
reports/api-test-fixed-ids-audit.latest.json
reports/consumer-test-authenticity-audit.latest.json
reports/consumer-idempotency-audit.latest.json
reports/state-machine-unwired-guards-audit.latest.json
reports/migration-topology-audit.latest.json
reports/customer-signoff-status.latest.json
reports/p0-customer-input-status.latest.json
reports/rollout-scope-freeze.latest.json
reports/rollout-scope-freeze.latest.md
reports/production-foundation-evidence.latest.json
reports/production-foundation-evidence.latest.md
reports/launch-smoke-scope.latest.json
reports/launch-smoke-scope.latest.md
reports/rls-staging-canary.latest.json
reports/rls-staging-canary.latest.md
reports/production-release-gate.latest.json
reports/production-release-gate.latest.md
reports/production-release-actions.latest.json
reports/production-release-actions.latest.md
reports/production-release-gate-integrity.latest.json
reports/production-release-gate-integrity.latest.md
reports/governance-30d-war-plan.latest.md
retention-days: "14"
- if: always()
name: 输出 governance summary
run: node --import tsx scripts/ci-governance-summary.ts --title "Governance Audit Summary" --include-rules
- name: 治理硬门禁 — 豁免感知 verdict（HARD）
run: node --import tsx scripts/harness/governance-gate.ts
- name: 文档对账 — CLAUDE.md GOVERNANCE-BASELINE ↔ reports 实测（HARD）
run: node --import tsx scripts/harness/baseline-reconcile.ts
- name: Harness Gate 综合 PR 验收（HARD）
run: pnpm harness gate
...
|
governance-audit
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739405
|
1794738288
|
1794739405
|
|
0
|
|
0
|
Edit
Delete
|
|
49323
|
27441
|
160
|
5
|
2296607f117a251c04a920ef163306e334b29763
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739405
|
1794738288
|
1794739405
|
|
0
|
|
0
|
Edit
Delete
|
|
49324
|
27442
|
83
|
5
|
301f1bc87d8dc8b342d3b871076a1bcdfab5f150
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794741858
|
1794738321
|
1794741858
|
|
0
|
|
0
|
Edit
Delete
|
|
49325
|
27442
|
83
|
5
|
301f1bc87d8dc8b342d3b871076a1bcdfab5f150
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794741858
|
1794738321
|
1794741858
|
|
0
|
|
0
|
Edit
Delete
|
|
49326
|
27443
|
83
|
5
|
301f1bc87d8dc8b342d3b871076a1bcdfab5f150
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738321
|
1794738321
|
|
0
|
|
0
|
Edit
Delete
|
|
49327
|
27443
|
83
|
5
|
301f1bc87d8dc8b342d3b871076a1bcdfab5f150
|
0
|
Platform consumer gate
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
0
|
7
|
0
|
0
|
1794738321
|
1794738321
|
|
0
|
|
0
|
Edit
Delete
|
|
49328
|
27444
|
84
|
5
|
55e503496f87829e9ddabee297d7d523b2746fea
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738659
|
1794738418
|
1794738659
|
|
0
|
|
0
|
Edit
Delete
|
|
49329
|
27444
|
84
|
5
|
55e503496f87829e9ddabee297d7d523b2746fea
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_knowledge_cloud_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_knowledge_cloud_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_knowledge_cloud_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738659
|
1794738418
|
1794738659
|
|
0
|
|
0
|
Edit
Delete
|
|
49330
|
27445
|
57
|
5
|
b70fbbbf08deade5fc7c0742a62d7a7fd27852f9
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version-file: .node-version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/hi-atelier-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/hi-atelier-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
- name: Runtime and development dependency audit
run: pnpm check:deps
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794738780
|
1794738429
|
1794738780
|
|
0
|
|
0
|
Edit
Delete
|
|
49331
|
27446
|
81
|
5
|
5f0f1255caabcd6bbcdd85e2c4419ee6facfeb91
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
fetch-depth: "0"
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 89b2adeeda1017b1ac4f66fb1ff5f89e0a21fcef
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Configure Gitea npm read access
run: |
test -n "$JUHAI_NPM_READ_TOKEN" || { echo "JUHAI_NPM_READ_TOKEN secret is required to install @juhai/kernel and @juhai/governance-kit"; exit 1; }
echo "//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=${JUHAI_NPM_READ_TOKEN}" >> "$HOME/.npmrc"
env:
JUHAI_NPM_READ_TOKEN: ${{ secrets.JUHAI_NPM_READ_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739676
|
1794738435
|
1794739676
|
|
0
|
|
0
|
Edit
Delete
|
|
49332
|
27446
|
81
|
5
|
5f0f1255caabcd6bbcdd85e2c4419ee6facfeb91
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_after_sales_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Configure Gitea npm read access
run: |
test -n "$JUHAI_NPM_READ_TOKEN" || { echo "JUHAI_NPM_READ_TOKEN secret is required to install @juhai/kernel and @juhai/governance-kit"; exit 1; }
echo "//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=${JUHAI_NPM_READ_TOKEN}" >> "$HOME/.npmrc"
env:
JUHAI_NPM_READ_TOKEN: ${{ secrets.JUHAI_NPM_READ_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Build workspace packages
run: pnpm --filter "./packages/**" build
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_after_sales_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_after_sales_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739676
|
1794738435
|
1794739676
|
|
0
|
|
0
|
Edit
Delete
|
|
49333
|
27447
|
51
|
5
|
42474ed02e2acf90840ab0095bd0945a13e76aad
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
env:
# 无DB单测会 import config/env（zod 启动校验，仅校验格式不连库）：提供合法 DATABASE_URL/JWT_SECRET 让校验通过。
# 纯函数单测（leads.canTransition / platforms.platformConnectionTruth 等）不发查询，无需真实 DB 服务。
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
JWT_SECRET: ci-jwt-secret-not-for-prod
USE_MOCK_ADAPTERS: 'true'
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run check:enterprise
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794744991
|
1794738456
|
1794744991
|
|
0
|
|
0
|
Edit
Delete
|
|
49334
|
27447
|
51
|
5
|
42474ed02e2acf90840ab0095bd0945a13e76aad
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794744991
|
1794738456
|
1794744991
|
|
0
|
|
0
|
Edit
Delete
|
|
49335
|
27447
|
51
|
5
|
42474ed02e2acf90840ab0095bd0945a13e76aad
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794744991
|
1794738456
|
1794744991
|
|
0
|
|
0
|
Edit
Delete
|
|
49336
|
27448
|
51
|
5
|
42474ed02e2acf90840ab0095bd0945a13e76aad
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738456
|
1794738456
|
|
0
|
|
0
|
Edit
Delete
|
|
49337
|
27449
|
84
|
5
|
ae4bde9281a1d52f49807a9fc5d8027f3b5b0ea6
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794742769
|
1794738659
|
1794742769
|
|
0
|
|
0
|
Edit
Delete
|
|
49338
|
27449
|
84
|
5
|
ae4bde9281a1d52f49807a9fc5d8027f3b5b0ea6
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_knowledge_cloud_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_knowledge_cloud_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_knowledge_cloud_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794742769
|
1794738659
|
1794742769
|
|
0
|
|
0
|
Edit
Delete
|
|
49339
|
27450
|
57
|
5
|
2057a4afe0d74fd29db380314e6ff07a392dc0bd
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version-file: .node-version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/hi-atelier-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/hi-atelier-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
- name: Runtime and development dependency audit
run: pnpm check:deps
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794743279
|
1794738780
|
1794743279
|
|
0
|
|
0
|
Edit
Delete
|
|
49340
|
27451
|
82
|
5
|
209285fbe98ab614216975c4390eb58636358c59
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/juhai-ticket-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/juhai-ticket-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739171
|
1794738965
|
1794739171
|
|
0
|
|
0
|
Edit
Delete
|
|
49341
|
27451
|
82
|
5
|
209285fbe98ab614216975c4390eb58636358c59
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
S3_ENDPOINT: http://127.0.0.1:9000
S3_ACCESS_KEY_ID: juhai-ci
S3_SECRET_ACCESS_KEY: juhai-ci-secret-change-me
S3_ATTACHMENT_BUCKET: juhai-attachments
S3_REGION: us-east-1
S3_FORCE_PATH_STYLE: "true"
CLAMAV_HOST: 127.0.0.1
CLAMAV_PORT: "3310"
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/juhai-ticket-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/juhai-ticket-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start real S3 and antivirus acceptance infrastructure
run: |
set -euo pipefail
docker run -d --name juhai-ci-minio -p 9000:9000 \
-e MINIO_ROOT_USER=juhai-ci \
-e MINIO_ROOT_PASSWORD=juhai-ci-secret-change-me \
quay.io/minio/minio@sha256:064117214caceaa8d8a90ef7caa58f2b2aeb316b5156afe9ee8da5b4d83e12c8 \
server /data
docker run -d --name juhai-ci-clamav -p 3310:3310 \
clamav/clamav-debian@sha256:967334b92d1782e4d1314ddf903ae537d26792d21c9a39adecb8ac9757980514
for attempt in $(seq 1 60); do
curl --fail --silent http://127.0.0.1:9000/minio/health/live && break
if [[ "$attempt" == 60 ]]; then exit 1; fi
sleep 2
done
docker run --rm --network host \
quay.io/minio/mc@sha256:09f93f534cde415d192bb6084dd0e0ddd1715fb602f8a922ad121fd2bf0f8b44 \
sh -c 'mc alias set local http://127.0.0.1:9000 juhai-ci juhai-ci-secret-change-me && mc mb --ignore-existing local/juhai-attachments'
for attempt in $(seq 1 90); do
docker exec juhai-ci-clamav clamdscan --ping 1 && break
if [[ "$attempt" == 90 ]]; then exit 1; fi
sleep 3
done
shell: bash
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- name: Reconcile full governance evidence
run: pnpm check:governance
- name: Create verified logical backup
run: bash scripts/backup-postgres.sh
env:
BACKUP_OUTPUT: ${{ runner.temp }}/juhai-ticket-ci.dump
- name: Restore into an isolated database and verify governed facts
run: |
set -euo pipefail
createdb --dbname="postgresql://postgres:postgres@127.0.0.1:5432/postgres" juhai_ai_work_order_system_restore_ci
checksum="$(awk '{print $1}' "${RUNNER_TEMP}/juhai-ticket-ci.dump.sha256")"
BACKUP_INPUT="${RUNNER_TEMP}/juhai-ticket-ci.dump" \
EXPECTED_SHA256="${checksum}" \
RESTORE_DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_restore_ci" \
bash scripts/restore-postgres-drill.sh
shell: bash
services:
postgres:
image: pgvector/pgvector@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b
env:
POSTGRES_DB: juhai_ai_work_order_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_work_order_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794739171
|
1794738965
|
1794739171
|
|
0
|
|
0
|
Edit
Delete
|
|
49342
|
27452
|
82
|
5
|
b0833f2d1023d45fe9682d7560c750c2b7a7cba0
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/juhai-ticket-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/juhai-ticket-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794741707
|
1794739171
|
1794741707
|
|
0
|
|
0
|
Edit
Delete
|
|
49343
|
27452
|
82
|
5
|
b0833f2d1023d45fe9682d7560c750c2b7a7cba0
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
S3_ENDPOINT: http://127.0.0.1:9000
S3_ACCESS_KEY_ID: juhai-ci
S3_SECRET_ACCESS_KEY: juhai-ci-secret-change-me
S3_ATTACHMENT_BUCKET: juhai-attachments
S3_REGION: us-east-1
S3_FORCE_PATH_STYLE: "true"
CLAMAV_HOST: 127.0.0.1
CLAMAV_PORT: "3310"
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/juhai-ticket-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/juhai-ticket-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start real S3 and antivirus acceptance infrastructure
run: |
set -euo pipefail
docker run -d --name juhai-ci-minio -p 9000:9000 \
-e MINIO_ROOT_USER=juhai-ci \
-e MINIO_ROOT_PASSWORD=juhai-ci-secret-change-me \
quay.io/minio/minio@sha256:064117214caceaa8d8a90ef7caa58f2b2aeb316b5156afe9ee8da5b4d83e12c8 \
server /data
docker run -d --name juhai-ci-clamav -p 3310:3310 \
clamav/clamav-debian@sha256:967334b92d1782e4d1314ddf903ae537d26792d21c9a39adecb8ac9757980514
for attempt in $(seq 1 60); do
curl --fail --silent http://127.0.0.1:9000/minio/health/live && break
if [[ "$attempt" == 60 ]]; then exit 1; fi
sleep 2
done
docker run --rm --network host \
quay.io/minio/mc@sha256:09f93f534cde415d192bb6084dd0e0ddd1715fb602f8a922ad121fd2bf0f8b44 \
sh -c 'mc alias set local http://127.0.0.1:9000 juhai-ci juhai-ci-secret-change-me && mc mb --ignore-existing local/juhai-attachments'
for attempt in $(seq 1 90); do
docker exec juhai-ci-clamav clamdscan --ping 1 && break
if [[ "$attempt" == 90 ]]; then exit 1; fi
sleep 3
done
shell: bash
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- name: Reconcile full governance evidence
run: pnpm check:governance
- name: Create verified logical backup
run: bash scripts/backup-postgres.sh
env:
BACKUP_OUTPUT: ${{ runner.temp }}/juhai-ticket-ci.dump
- name: Restore into an isolated database and verify governed facts
run: |
set -euo pipefail
createdb --dbname="postgresql://postgres:postgres@127.0.0.1:5432/postgres" juhai_ai_work_order_system_restore_ci
checksum="$(awk '{print $1}' "${RUNNER_TEMP}/juhai-ticket-ci.dump.sha256")"
BACKUP_INPUT="${RUNNER_TEMP}/juhai-ticket-ci.dump" \
EXPECTED_SHA256="${checksum}" \
RESTORE_DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_restore_ci" \
bash scripts/restore-postgres-drill.sh
shell: bash
services:
postgres:
image: pgvector/pgvector@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b
env:
POSTGRES_DB: juhai_ai_work_order_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_work_order_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794741707
|
1794739171
|
1794741707
|
|
0
|
|
0
|
Edit
Delete
|
|
49344
|
27453
|
135
|
5
|
6047f1ab4053db4fa270184b427141b54c7118cd
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout device cloud with history
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Setup Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "22"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
- if: always()
name: Upload immutable static governance evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: warn
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: |
reports/*.latest.json
!reports/governance-profile-*.latest.json
!reports/runtime-acceptance.latest.json
!reports/conformance-differential.latest.json
!reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "20"
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794740507
|
1794739304
|
1794740507
|
|
0
|
|
0
|
Edit
Delete
|
|
49345
|
27453
|
135
|
5
|
6047f1ab4053db4fa270184b427141b54c7118cd
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/device_cloud_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout device cloud with history
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Setup Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "22"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- name: Prove release evidence matches current source
run: pnpm check:evidence
- if: always()
name: Upload immutable runtime and UI evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: warn
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: |
reports/runtime-acceptance.latest.json
reports/conformance-differential.latest.json
reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "45"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: device_cloud_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d device_cloud_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794740507
|
1794739304
|
1794740507
|
|
0
|
|
0
|
Edit
Delete
|
|
49346
|
27453
|
135
|
5
|
6047f1ab4053db4fa270184b427141b54c7118cd
|
0
|
Aggregate same-SHA governance evidence
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
governance-evidence:
name: Aggregate same-SHA governance evidence
runs-on: ubuntu-latest
if: always()
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Download static evidence
uses: actions/download-artifact@v4
with:
name: governance-static-governance-${{ github.sha }}-${{ github.run_attempt }}
path: reports
continue-on-error: true
- name: Download runtime and UI evidence
uses: actions/download-artifact@v4
with:
name: governance-runtime-acceptance-${{ github.sha }}-${{ github.run_attempt }}
path: reports
continue-on-error: true
- name: Generate same-SHA profile status manifest
run: node scripts/generate-governance-status.mjs
- if: always()
name: Upload immutable aggregate status
uses: actions/upload-artifact@v4
with:
if-no-files-found: error
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: reports/governance-status.latest.json
retention-days: "30"
- if: always()
name: Preserve upstream gate result
run: |
test "${{ needs.static-governance.result }}" = "success"
test "${{ needs.runtime-acceptance.result }}" = "success"
timeout-minutes: "10"
...
|
governance-evidence
|
["static-governance","runtime-acceptan ["static-governance","runtime-acceptance"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794740507
|
1794739304
|
1794740507
|
|
0
|
|
0
|
Edit
Delete
|
|
49347
|
27454
|
160
|
5
|
7a369d494b4eb9e37887f1b37cc99db6cf9a5c7b
|
0
|
Frontend Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794740536
|
1794739405
|
1794740536
|
|
0
|
|
0
|
Edit
Delete
|
|
49348
|
27454
|
160
|
5
|
7a369d494b4eb9e37887f1b37cc99db6cf9a5c7b
|
0
|
Lint & Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794740536
|
1794739405
|
1794740536
|
|
0
|
|
0
|
Edit
Delete
|
|
49349
|
27454
|
160
|
5
|
7a369d494b4eb9e37887f1b37cc99db6cf9a5c7b
|
0
|
Unit Tests (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
unit-tests:
name: Unit Tests (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run unit tests
run: pnpm -C backend run test:unit
...
|
unit-tests
|
["frontend-typecheck","lint-and-typech ["frontend-typecheck","lint-and-typecheck"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794740536
|
1794739405
|
1794740536
|
|
0
|
|
0
|
Edit
Delete
|
|
49350
|
27454
|
160
|
5
|
7a369d494b4eb9e37887f1b37cc99db6cf9a5c7b
|
0
|
State Machine Model-Based (HARD GATE)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
state-machine-model:
name: State Machine Model-Based (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run state machine model-based tests
run: pnpm -C backend run test:state-machines:model
...
|
state-machine-model
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1794740536
|
1794739405
|
1794740536
|
|
0
|
|
0
|
Edit
Delete
|