|
31243
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Third-party image scan (prom/prometheus:v3.14.0@sh Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)...
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27274
|
2
|
1788060568
|
1788060616
|
1788059711
|
1788060616
|
|
1
|
|
0
|
Edit
Delete
|
|
31242
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (web)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27273
|
2
|
1788060492
|
1788060567
|
1788059711
|
1788060567
|
|
1
|
|
0
|
Edit
Delete
|
|
31241
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-trace-storage)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27272
|
2
|
1788060461
|
1788060491
|
1788059711
|
1788060492
|
|
1
|
|
0
|
Edit
Delete
|
|
31240
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-tempo)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-tempo)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-tempo:ci
target:
- ops-tempo
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27271
|
2
|
1788060431
|
1788060461
|
1788059711
|
1788060461
|
|
1
|
|
0
|
Edit
Delete
|
|
31239
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-postgres)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27270
|
2
|
1788060401
|
1788060431
|
1788059711
|
1788060431
|
|
1
|
|
0
|
Edit
Delete
|
|
31238
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-pager)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27269
|
2
|
1788060370
|
1788060400
|
1788059711
|
1788060401
|
|
1
|
|
0
|
Edit
Delete
|
|
31237
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-otel-collector)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27268
|
2
|
1788060340
|
1788060370
|
1788059711
|
1788060370
|
|
1
|
|
0
|
Edit
Delete
|
|
31236
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-loki)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27267
|
2
|
1788060309
|
1788060340
|
1788059711
|
1788060340
|
|
1
|
|
0
|
Edit
Delete
|
|
31235
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-gateway)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27266
|
2
|
1788060279
|
1788060309
|
1788059711
|
1788060309
|
|
1
|
|
0
|
Edit
Delete
|
|
31234
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (ops-alertmanager)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27265
|
2
|
1788060189
|
1788060279
|
1788059711
|
1788060279
|
|
1
|
|
0
|
Edit
Delete
|
|
31233
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (api-nestjs)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-nestjs)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-nestjs:ci
target:
- api-nestjs
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27264
|
2
|
1788060112
|
1788060188
|
1788059711
|
1788060189
|
|
1
|
|
0
|
Edit
Delete
|
|
31232
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Application image scan (api-fastify)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-fastify)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-fastify:ci
target:
- api-fastify
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27263
|
2
|
1788060027
|
1788060112
|
1788059711
|
1788060112
|
|
1
|
|
0
|
Edit
Delete
|
|
31248
|
23557
|
91
|
5
|
c1d59277c1c321407babdaf3ad6fe26c73e7cb55
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
# Digital Employee OS 的 engines 要求 node >=22（本仓自身 >=20，取并集）
NODE_VERSION: v22.16.0
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
HOST_PATH="${GITHUB_SERVER_URL#*://}"
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@${HOST_PATH}/${OS_REPO}.git"
git fetch -q --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27262
|
1
|
1788059969
|
1788060027
|
1788059801
|
1788060027
|
|
0
|
|
0
|
Edit
Delete
|
|
31246
|
23556
|
90
|
5
|
1c5b6ec9fef8d18a24b5bcd6a44665279fb3f493
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27261
|
2
|
1788059948
|
1788059969
|
1788059747
|
1788059969
|
|
0
|
|
0
|
Edit
Delete
|
|
31231
|
23555
|
76
|
5
|
3c4c9aeef2d655c577e467bb2cbb9dd76a2e211b
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27260
|
1
|
1788059713
|
1788059947
|
1788059711
|
1788059948
|
|
0
|
|
0
|
Edit
Delete
|
|
31216
|
23554
|
76
|
5
|
d433548ec7561644062b04334161019919ea233d
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27259
|
3
|
1788059693
|
1788059710
|
1788059683
|
1788059710
|
|
0
|
|
0
|
Edit
Delete
|
|
31214
|
23553
|
90
|
5
|
46dce73b5cfc83e6e6cfb87922f22faee76fdd28
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27258
|
2
|
1788059669
|
1788059693
|
1788059668
|
1788059693
|
|
0
|
|
0
|
Edit
Delete
|
|
31213
|
23552
|
91
|
5
|
48c7ef665e210ef004970fc6f1fdc443a03b48a1
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
NODE_VERSION: v22.16.0
# 大陆网络直连 Playwright CDN 会长时间零进度假死（本机实测 8 分钟 0 字节，
# npmmirror 30 秒完成）；runner 与本机同网段，直接走镜像。
PLAYWRIGHT_DOWNLOAD_HOST: https://cdn.npmmirror.com/binaries/playwright
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Provision PostgreSQL and Redis
run: |
set -euo pipefail
command -v docker >/dev/null 2>&1 || { echo "::error::runner 宿主缺 docker——runtime 验收需要它启动隔离 PostgreSQL/Redis（或改用支持 services 的容器模式 runner）"; exit 1; }
# runner 宿主直连 Docker Hub 被拒（run #7：pull access denied）——大陆网络
# 常态。解析顺序：本地已有镜像（任一命名）→ daocloud/1ms 镜像站 → hub 兜底；
# 首次拉取成功后镜像常驻宿主，后续 run 不再依赖外网。
resolve_image() {
local image="$1" ref
for ref in "docker.io/library/${image}" "docker.m.daocloud.io/library/${image}" "docker.1ms.run/library/${image}" "${image}"; do
if docker image inspect "$ref" >/dev/null 2>&1; then echo "$ref"; return 0; fi
done
for ref in "docker.m.daocloud.io/library/${image}" "docker.1ms.run/library/${image}" "docker.io/library/${image}"; do
if docker pull --quiet "$ref" >/dev/null 2>&1; then echo "$ref"; return 0; fi
done
echo "::error::拉取 ${image} 失败：daocloud/1ms 镜像站与 Docker Hub 均不可达；可在 runner 宿主预拉镜像或给 dockerd 配 registry-mirrors" >&2
return 1
}
PG_IMAGE="$(resolve_image postgres:16)"
REDIS_IMAGE="$(resolve_image redis:7)"
echo "镜像解析：$PG_IMAGE / $REDIS_IMAGE"
PG_NAME="qwen38fn-ci-pg-${GITHUB_RUN_ID}"
REDIS_NAME="qwen38fn-ci-redis-${GITHUB_RUN_ID}"
docker rm -f "$PG_NAME" "$REDIS_NAME" >/dev/null 2>&1 || true
docker run -d --name "$PG_NAME" \
-e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres \
-e POSTGRES_DB=qwen3_8_flash_next_ci \
-p 127.0.0.1::5432 "$PG_IMAGE" >/dev/null
docker run -d --name "$REDIS_NAME" -p 127.0.0.1::6379 "$REDIS_IMAGE" >/dev/null
PG_PORT="$(docker port "$PG_NAME" 5432/tcp | head -n1 | awk -F: '{print $NF}')"
REDIS_PORT="$(docker port "$REDIS_NAME" 6379/tcp | head -n1 | awk -F: '{print $NF}')"
for _ in $(seq 1 60); do
docker exec "$PG_NAME" pg_isready -U postgres >/dev/null 2>&1 && break
sleep 1
done
docker exec "$PG_NAME" pg_isready -U postgres -d qwen3_8_flash_next_ci
[ "$(docker exec "$REDIS_NAME" redis-cli ping)" = "PONG" ]
{
echo "PG_NAME=$PG_NAME"
echo "REDIS_NAME=$REDIS_NAME"
echo "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:${PG_PORT}/qwen3_8_flash_next_ci?schema=public"
echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}"
} >> "$GITHUB_ENV"
echo "PostgreSQL 127.0.0.1:${PG_PORT} / Redis 127.0.0.1:${REDIS_PORT} 就绪"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- if: always()
name: Tear down PostgreSQL and Redis
run: docker rm -f "${PG_NAME:-}" "${REDIS_NAME:-}" >/dev/null 2>&1 || true
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27257
|
1
|
1788058459
|
1788058564
|
1788058396
|
1788058565
|
|
1
|
|
0
|
Edit
Delete
|
|
31212
|
23552
|
91
|
5
|
48c7ef665e210ef004970fc6f1fdc443a03b48a1
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
# Digital Employee OS 的 engines 要求 node >=22（本仓自身 >=20，取并集）
NODE_VERSION: v22.16.0
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
HOST_PATH="${GITHUB_SERVER_URL#*://}"
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@${HOST_PATH}/${OS_REPO}.git"
git fetch -q --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27256
|
1
|
1788058397
|
1788058457
|
1788058396
|
1788058457
|
|
0
|
|
0
|
Edit
Delete
|
|
31211
|
23551
|
91
|
5
|
2235838932d2a3dd2f545bf0f33073983a45ae60
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
NODE_VERSION: v22.16.0
# 大陆网络直连 Playwright CDN 会长时间零进度假死（本机实测 8 分钟 0 字节，
# npmmirror 30 秒完成）；runner 与本机同网段，直接走镜像。
PLAYWRIGHT_DOWNLOAD_HOST: https://cdn.npmmirror.com/binaries/playwright
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Provision PostgreSQL and Redis
run: |
set -euo pipefail
command -v docker >/dev/null 2>&1 || { echo "::error::runner 宿主缺 docker——runtime 验收需要它启动隔离 PostgreSQL/Redis（或改用支持 services 的容器模式 runner）"; exit 1; }
# runner 宿主直连 Docker Hub 被拒（run #7：pull access denied）——大陆网络
# 常态。解析顺序：本地已有镜像（任一命名）→ daocloud/1ms 镜像站 → hub 兜底；
# 首次拉取成功后镜像常驻宿主，后续 run 不再依赖外网。
resolve_image() {
local image="$1" ref
for ref in "docker.io/library/${image}" "docker.m.daocloud.io/library/${image}" "docker.1ms.run/library/${image}" "${image}"; do
if docker image inspect "$ref" >/dev/null 2>&1; then echo "$ref"; return 0; fi
done
for ref in "docker.m.daocloud.io/library/${image}" "docker.1ms.run/library/${image}" "docker.io/library/${image}"; do
if docker pull --quiet "$ref" >/dev/null 2>&1; then echo "$ref"; return 0; fi
done
echo "::error::拉取 ${image} 失败：daocloud/1ms 镜像站与 Docker Hub 均不可达；可在 runner 宿主预拉镜像或给 dockerd 配 registry-mirrors" >&2
return 1
}
PG_IMAGE="$(resolve_image postgres:16)"
REDIS_IMAGE="$(resolve_image redis:7)"
echo "镜像解析：$PG_IMAGE / $REDIS_IMAGE"
PG_NAME="qwen38fn-ci-pg-${GITHUB_RUN_ID}"
REDIS_NAME="qwen38fn-ci-redis-${GITHUB_RUN_ID}"
docker rm -f "$PG_NAME" "$REDIS_NAME" >/dev/null 2>&1 || true
docker run -d --name "$PG_NAME" \
-e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres \
-e POSTGRES_DB=qwen3_8_flash_next_ci \
-p 127.0.0.1::5432 "$PG_IMAGE" >/dev/null
docker run -d --name "$REDIS_NAME" -p 127.0.0.1::6379 "$REDIS_IMAGE" >/dev/null
PG_PORT="$(docker port "$PG_NAME" 5432/tcp | head -n1 | awk -F: '{print $NF}')"
REDIS_PORT="$(docker port "$REDIS_NAME" 6379/tcp | head -n1 | awk -F: '{print $NF}')"
for _ in $(seq 1 60); do
docker exec "$PG_NAME" pg_isready -U postgres >/dev/null 2>&1 && break
sleep 1
done
docker exec "$PG_NAME" pg_isready -U postgres -d qwen3_8_flash_next_ci
[ "$(docker exec "$REDIS_NAME" redis-cli ping)" = "PONG" ]
{
echo "PG_NAME=$PG_NAME"
echo "REDIS_NAME=$REDIS_NAME"
echo "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:${PG_PORT}/qwen3_8_flash_next_ci?schema=public"
echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}"
} >> "$GITHUB_ENV"
echo "PostgreSQL 127.0.0.1:${PG_PORT} / Redis 127.0.0.1:${REDIS_PORT} 就绪"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- if: always()
name: Tear down PostgreSQL and Redis
run: docker rm -f "${PG_NAME:-}" "${REDIS_NAME:-}" >/dev/null 2>&1 || true
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27255
|
1
|
1788057204
|
1788057371
|
1788057141
|
1788057371
|
|
1
|
|
0
|
Edit
Delete
|
|
31210
|
23551
|
91
|
5
|
2235838932d2a3dd2f545bf0f33073983a45ae60
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
# Digital Employee OS 的 engines 要求 node >=22（本仓自身 >=20，取并集）
NODE_VERSION: v22.16.0
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
HOST_PATH="${GITHUB_SERVER_URL#*://}"
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@${HOST_PATH}/${OS_REPO}.git"
git fetch -q --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27254
|
1
|
1788057142
|
1788057201
|
1788057141
|
1788057202
|
|
0
|
|
0
|
Edit
Delete
|
|
31209
|
23550
|
91
|
5
|
284009be92a0f6d8f79682120be0421fa0d80387
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
NODE_VERSION: v22.16.0
# 大陆网络直连 Playwright CDN 会长时间零进度假死（本机实测 8 分钟 0 字节，
# npmmirror 30 秒完成）；runner 与本机同网段，直接走镜像。
PLAYWRIGHT_DOWNLOAD_HOST: https://cdn.npmmirror.com/binaries/playwright
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Provision PostgreSQL and Redis
run: |
set -euo pipefail
command -v docker >/dev/null 2>&1 || { echo "::error::runner 宿主缺 docker——runtime 验收需要它启动隔离 PostgreSQL/Redis（或改用支持 services 的容器模式 runner）"; exit 1; }
# runner 宿主直连 Docker Hub 被拒（run #7：pull access denied）——大陆网络
# 常态。解析顺序：本地已有镜像（任一命名）→ daocloud/1ms 镜像站 → hub 兜底；
# 首次拉取成功后镜像常驻宿主，后续 run 不再依赖外网。
resolve_image() {
local image="$1" ref
for ref in "docker.io/library/${image}" "docker.m.daocloud.io/library/${image}" "docker.1ms.run/library/${image}" "${image}"; do
if docker image inspect "$ref" >/dev/null 2>&1; then echo "$ref"; return 0; fi
done
for ref in "docker.m.daocloud.io/library/${image}" "docker.1ms.run/library/${image}" "docker.io/library/${image}"; do
if docker pull --quiet "$ref" >/dev/null 2>&1; then echo "$ref"; return 0; fi
done
echo "::error::拉取 ${image} 失败：daocloud/1ms 镜像站与 Docker Hub 均不可达；可在 runner 宿主预拉镜像或给 dockerd 配 registry-mirrors" >&2
return 1
}
PG_IMAGE="$(resolve_image postgres:16)"
REDIS_IMAGE="$(resolve_image redis:7)"
echo "镜像解析：$PG_IMAGE / $REDIS_IMAGE"
PG_NAME="qwen38fn-ci-pg-${GITHUB_RUN_ID}"
REDIS_NAME="qwen38fn-ci-redis-${GITHUB_RUN_ID}"
docker rm -f "$PG_NAME" "$REDIS_NAME" >/dev/null 2>&1 || true
docker run -d --name "$PG_NAME" \
-e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres \
-e POSTGRES_DB=qwen3_8_flash_next_ci \
-p 127.0.0.1::5432 "$PG_IMAGE" >/dev/null
docker run -d --name "$REDIS_NAME" -p 127.0.0.1::6379 "$REDIS_IMAGE" >/dev/null
PG_PORT="$(docker port "$PG_NAME" 5432/tcp | head -n1 | awk -F: '{print $NF}')"
REDIS_PORT="$(docker port "$REDIS_NAME" 6379/tcp | head -n1 | awk -F: '{print $NF}')"
for _ in $(seq 1 60); do
docker exec "$PG_NAME" pg_isready -U postgres >/dev/null 2>&1 && break
sleep 1
done
docker exec "$PG_NAME" pg_isready -U postgres -d qwen3_8_flash_next_ci
[ "$(docker exec "$REDIS_NAME" redis-cli ping)" = "PONG" ]
{
echo "PG_NAME=$PG_NAME"
echo "REDIS_NAME=$REDIS_NAME"
echo "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:${PG_PORT}/qwen3_8_flash_next_ci?schema=public"
echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}"
} >> "$GITHUB_ENV"
echo "PostgreSQL 127.0.0.1:${PG_PORT} / Redis 127.0.0.1:${REDIS_PORT} 就绪"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- if: always()
name: Tear down PostgreSQL and Redis
run: docker rm -f "${PG_NAME:-}" "${REDIS_NAME:-}" >/dev/null 2>&1 || true
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27253
|
2
|
1788056270
|
1788056397
|
1788056209
|
1788056398
|
|
1
|
|
0
|
Edit
Delete
|
|
31208
|
23550
|
91
|
5
|
284009be92a0f6d8f79682120be0421fa0d80387
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
# Digital Employee OS 的 engines 要求 node >=22（本仓自身 >=20，取并集）
NODE_VERSION: v22.16.0
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
HOST_PATH="${GITHUB_SERVER_URL#*://}"
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@${HOST_PATH}/${OS_REPO}.git"
git fetch -q --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27252
|
1
|
1788056210
|
1788056268
|
1788056209
|
1788056268
|
|
0
|
|
0
|
Edit
Delete
|
|
31207
|
23549
|
91
|
5
|
b3c5c984414aa860f22c4e16c497d4e25515c067
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
NODE_VERSION: v22.16.0
# 大陆网络直连 Playwright CDN 会长时间零进度假死（本机实测 8 分钟 0 字节，
# npmmirror 30 秒完成）；runner 与本机同网段，直接走镜像。
PLAYWRIGHT_DOWNLOAD_HOST: https://cdn.npmmirror.com/binaries/playwright
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Provision PostgreSQL and Redis
run: |
set -euo pipefail
command -v docker >/dev/null 2>&1 || { echo "::error::runner 宿主缺 docker——runtime 验收需要它启动隔离 PostgreSQL/Redis（或改用支持 services 的容器模式 runner）"; exit 1; }
PG_NAME="qwen38fn-ci-pg-${GITHUB_RUN_ID}"
REDIS_NAME="qwen38fn-ci-redis-${GITHUB_RUN_ID}"
docker rm -f "$PG_NAME" "$REDIS_NAME" >/dev/null 2>&1 || true
docker run -d --name "$PG_NAME" \
-e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres \
-e POSTGRES_DB=qwen3_8_flash_next_ci \
-p 127.0.0.1::5432 postgres:16 >/dev/null
docker run -d --name "$REDIS_NAME" -p 127.0.0.1::6379 redis:7 >/dev/null
PG_PORT="$(docker port "$PG_NAME" 5432/tcp | head -n1 | awk -F: '{print $NF}')"
REDIS_PORT="$(docker port "$REDIS_NAME" 6379/tcp | head -n1 | awk -F: '{print $NF}')"
for _ in $(seq 1 60); do
docker exec "$PG_NAME" pg_isready -U postgres >/dev/null 2>&1 && break
sleep 1
done
docker exec "$PG_NAME" pg_isready -U postgres -d qwen3_8_flash_next_ci
[ "$(docker exec "$REDIS_NAME" redis-cli ping)" = "PONG" ]
{
echo "PG_NAME=$PG_NAME"
echo "REDIS_NAME=$REDIS_NAME"
echo "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:${PG_PORT}/qwen3_8_flash_next_ci?schema=public"
echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}"
} >> "$GITHUB_ENV"
echo "PostgreSQL 127.0.0.1:${PG_PORT} / Redis 127.0.0.1:${REDIS_PORT} 就绪"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- if: always()
name: Tear down PostgreSQL and Redis
run: docker rm -f "${PG_NAME:-}" "${REDIS_NAME:-}" >/dev/null 2>&1 || true
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27251
|
2
|
1788055492
|
1788055528
|
1788055430
|
1788055528
|
|
1
|
|
0
|
Edit
Delete
|
|
31206
|
23549
|
91
|
5
|
b3c5c984414aa860f22c4e16c497d4e25515c067
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
# Digital Employee OS 的 engines 要求 node >=22（本仓自身 >=20，取并集）
NODE_VERSION: v22.16.0
steps:
- name: Checkout (shell, full history)
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
HOST_PATH="${GITHUB_SERVER_URL#*://}"
git init -q .
git remote remove origin 2>/dev/null || true
git remote add origin "https://oauth2:${CLONE_TOKEN}@${HOST_PATH}/${GITHUB_REPOSITORY}.git"
git fetch -q origin "$GITHUB_SHA"
git checkout -q -f --detach "$GITHUB_SHA"
git clean -fdxq -e node_modules -e .turbo
git log --oneline -1
env:
CLONE_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Provision Node.js (npmmirror)
run: |
set -euo pipefail
case "$(uname -m)" in
x86_64) NODE_ARCH=x64 ;;
aarch64|arm64) NODE_ARCH=arm64 ;;
*) echo "::error::未支持的 runner 架构 $(uname -m)"; exit 1 ;;
esac
NODE_DIR="$RUNNER_TEMP/node-${NODE_VERSION}-${NODE_ARCH}"
if [ ! -x "$NODE_DIR/bin/node" ]; then
mkdir -p "$NODE_DIR"
curl -fsSL "https://cdn.npmmirror.com/binaries/node/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
| tar -xJ -C "$NODE_DIR" --strip-components 1
fi
echo "$NODE_DIR/bin" >> "$GITHUB_PATH"
"$NODE_DIR/bin/node" --version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm --version
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
HOST_PATH="${GITHUB_SERVER_URL#*://}"
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@${HOST_PATH}/${OS_REPO}.git"
git fetch -q --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || github.token }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27250
|
1
|
1788055431
|
1788055490
|
1788055430
|
1788055490
|
|
0
|
|
0
|
Edit
Delete
|
|
31204
|
23548
|
91
|
5
|
625450881bfb787bfa4ac092e11bfe534c340163
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@gitea.g-hi.com/${OS_REPO}.git"
git fetch --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || secrets.GITEA_TOKEN }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27249
|
2
|
1788055008
|
1788055099
|
1788055006
|
1788055099
|
|
0
|
|
0
|
Edit
Delete
|
|
31203
|
23547
|
91
|
5
|
fed53f136145fe82cb7dc0a4ee7b8b5453bfddd0
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/qwen3_8_flash_next_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: qwen3_8_flash_next_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d qwen3_8_flash_next_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27248
|
2
|
1788054659
|
1788054676
|
1788054593
|
1788054676
|
|
1
|
|
0
|
Edit
Delete
|
|
31202
|
23547
|
91
|
5
|
fed53f136145fe82cb7dc0a4ee7b8b5453bfddd0
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@gitea.g-hi.com/${OS_REPO}.git"
git fetch --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || secrets.GITEA_TOKEN }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27247
|
1
|
1788054594
|
1788054657
|
1788054593
|
1788054657
|
|
0
|
|
0
|
Edit
Delete
|
|
31200
|
23546
|
91
|
5
|
e465f302d62150997d35782bfec2304043dd605d
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
# check:os-product 的上游：同实例私有仓，按 SHA 钉版（与本地验收口径一致）。
# 升级流程：先在本地以新 SHA 跑绿 check:os-product(:runtime)，再改这里的 OS_SHA。
OS_REPO: luoanwu/digital-employee-os
OS_SHA: fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Checkout Digital Employee OS (check:os-product upstream)
run: |
set -euo pipefail
OS_DIR="$RUNNER_TEMP/digital-employee-os"
rm -rf "$OS_DIR" && mkdir -p "$OS_DIR" && cd "$OS_DIR"
git init -q .
git remote add origin "https://oauth2:${OS_TOKEN}@gitea.g-hi.com/${OS_REPO}.git"
git fetch --depth 1 origin "$OS_SHA"
git checkout -q --detach FETCH_HEAD
echo "DIGITAL_EMPLOYEE_OS_ROOT=$OS_DIR" >> "$GITHUB_ENV"
echo "DIGITAL_EMPLOYEE_OS_SHA=$OS_SHA" >> "$GITHUB_ENV"
env:
OS_TOKEN: ${{ secrets.OS_CHECKOUT_TOKEN || secrets.GITEA_TOKEN }}
- name: Build Digital Employee OS contracts
run: |
set -euo pipefail
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm --filter @repo/contracts build
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27246
|
2
|
1788054332
|
1788054370
|
1788054330
|
1788054370
|
|
0
|
|
0
|
Edit
Delete
|
|
31198
|
23545
|
91
|
5
|
e20004f4776df6413cdfa4d0b49afdd9bea5b69e
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27245
|
2
|
1788053742
|
1788053761
|
1788053741
|
1788053762
|
|
0
|
|
0
|
Edit
Delete
|
|
31196
|
23544
|
91
|
5
|
3ace3ff6a846bd8e245bbeb090fd28d683945735
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27244
|
2
|
1788053600
|
1788053619
|
1788053599
|
1788053619
|
|
0
|
|
0
|
Edit
Delete
|
|
31194
|
23543
|
91
|
5
|
3c6f499596071037b0035ababe289c015f79d83e
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27243
|
2
|
1788052881
|
1788052901
|
1788052880
|
1788052902
|
|
0
|
|
0
|
Edit
Delete
|
|
31192
|
23542
|
90
|
5
|
dcd85b10ac06ae862fe3789b6bd548838487b8fe
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27242
|
2
|
1788052201
|
1788052223
|
1788052201
|
1788052223
|
|
0
|
|
0
|
Edit
Delete
|
|
31176
|
23541
|
76
|
5
|
fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27241
|
2
|
1787979103
|
1787979523
|
1787979102
|
1787979523
|
|
0
|
|
0
|
Edit
Delete
|
|
31175
|
23540
|
57
|
5
|
0c21eecc828c12daebc00845c14482c3b9d58823
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27240
|
2
|
1787969912
|
1787969939
|
1787969911
|
1787969939
|
|
0
|
|
0
|
Edit
Delete
|
|
31173
|
23539
|
82
|
5
|
f78be17ac5fecb9cfa36e167b1e85ea26a48fa45
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27239
|
2
|
1787913991
|
1787914025
|
1787913990
|
1787914025
|
|
0
|
|
0
|
Edit
Delete
|
|
31171
|
23538
|
84
|
5
|
4459ca7bf19df30ae3879f2027b7fb05b3e3ba2d
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27238
|
2
|
1787836636
|
1787836653
|
1787836636
|
1787836653
|
|
0
|
|
0
|
Edit
Delete
|
|
31169
|
23537
|
81
|
5
|
466e9752ba0f670d790b5134ff2d12e5b0e974ea
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 5cb2f1cc2f9953d47fa0bcfac541400d01603f78
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27237
|
2
|
1787820687
|
1787820696
|
1787820687
|
1787820696
|
|
0
|
|
0
|
Edit
Delete
|
|
31167
|
23536
|
54
|
5
|
53991090b821b76dff11eee3a2e92806ed3ab173
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27236
|
2
|
1787787572
|
1787787593
|
1787787571
|
1787787593
|
|
0
|
|
0
|
Edit
Delete
|
|
31165
|
23535
|
81
|
5
|
3d56a9a4fb9cccedf11cfdb53a470fa7f29e94c7
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 5cb2f1cc2f9953d47fa0bcfac541400d01603f78
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27235
|
2
|
1787714350
|
1787714358
|
1787714348
|
1787714358
|
|
0
|
|
0
|
Edit
Delete
|
|
31163
|
23534
|
81
|
5
|
fbedaf6d0398693dc8466b4b72b6265d2397d93c
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 5cb2f1cc2f9953d47fa0bcfac541400d01603f78
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27234
|
2
|
1787712441
|
1787712471
|
1787711431
|
1787712471
|
|
0
|
|
0
|
Edit
Delete
|
|
31156
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/digital_employee_os_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
env:
# O1：runtime 验收的遗留 delayed job 不得漏进 UI 阶段共享的 BullMQ 队列，
# Redis 逻辑库隔离（镜像本地 /2 vs /3 约定）。
REDIS_URL: redis://127.0.0.1:6379/1
services:
postgres:
image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
env:
POSTGRES_DB: digital_employee_os_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d digital_employee_os_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27233
|
2
|
1787712411
|
1787712441
|
1787708829
|
1787712441
|
|
1
|
|
0
|
Edit
Delete
|
|
31155
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Third-party image scan (redis:7-alpine@sha256:ff02 Third-party image scan (redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf)...
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27232
|
2
|
1787712380
|
1787712410
|
1787708829
|
1787712411
|
|
1
|
|
0
|
Edit
Delete
|
|
31154
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Third-party image scan (prom/prometheus:v3.14.0@sh Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)...
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27231
|
2
|
1787711980
|
1787712380
|
1787708829
|
1787712380
|
|
1
|
|
0
|
Edit
Delete
|
|
31153
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Third-party image scan (otel/opentelemetry-collect Third-party image scan (otel/opentelemetry-collector-contrib:0.159.0@sha256:1f2c54a30e713fac6b3ae77a1ec84010c2007e29ced8ec666214fc2f6739c1cc)...
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (otel/opentelemetry-collector-contrib:0.159.0@sha256:1f2c54a30e713fac6b3ae77a1ec84010c2007e29ced8ec666214fc2f6739c1cc)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- otel/opentelemetry-collector-contrib:0.159.0@sha256:1f2c54a30e713fac6b3ae77a1ec84010c2007e29ced8ec666214fc2f6739c1cc
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27230
|
2
|
1787711889
|
1787711979
|
1787708829
|
1787711980
|
|
1
|
|
0
|
Edit
Delete
|
|
31152
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Third-party image scan (grafana/tempo:3.0.3@sha256 Third-party image scan (grafana/tempo:3.0.3@sha256:0296560ac66f8a3600d7fb3014a52c189d4d9c3549ad6ff441bf2409855d68d5)...
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (grafana/tempo:3.0.3@sha256:0296560ac66f8a3600d7fb3014a52c189d4d9c3549ad6ff441bf2409855d68d5)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- grafana/tempo:3.0.3@sha256:0296560ac66f8a3600d7fb3014a52c189d4d9c3549ad6ff441bf2409855d68d5
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27229
|
2
|
1787711859
|
1787711889
|
1787708829
|
1787711889
|
|
1
|
|
0
|
Edit
Delete
|
|
31151
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Third-party image scan (grafana/loki:3.7.6@sha256: Third-party image scan (grafana/loki:3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952)...
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (grafana/loki:3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- grafana/loki:3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27228
|
2
|
1787711768
|
1787711858
|
1787708829
|
1787711859
|
|
1
|
|
0
|
Edit
Delete
|
|
31150
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Third-party image scan (grafana/alloy:v1.19.0@sha2 Third-party image scan (grafana/alloy:v1.19.0@sha256:c958aef7294bc40c67caadb2bcecc93b95ab7961ff8afae3abee170d77426193)...
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (grafana/alloy:v1.19.0@sha256:c958aef7294bc40c67caadb2bcecc93b95ab7961ff8afae3abee170d77426193)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- grafana/alloy:v1.19.0@sha256:c958aef7294bc40c67caadb2bcecc93b95ab7961ff8afae3abee170d77426193
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27227
|
2
|
1787711678
|
1787711768
|
1787708829
|
1787711768
|
|
1
|
|
0
|
Edit
Delete
|
|
31149
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Application image scan (web)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27226
|
2
|
1787710645
|
1787711677
|
1787708829
|
1787711678
|
|
1
|
|
0
|
Edit
Delete
|
|
31148
|
23530
|
76
|
5
|
4a222fb5f11f2640e5e3d214e856b703128ee62c
|
0
|
Application image scan (ops-trace-storage)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27225
|
2
|
1787709612
|
1787710645
|
1787708829
|
1787710645
|
|
1
|
|
0
|
Edit
Delete
|