|
12298
|
9027
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
部署到 Production
|
1
|
name: CI/CD Deploy
"on":
# test-pipeli name: CI/CD Deploy
"on":
# test-pipeline 通过后自动触发（仅 main 分支）
workflow_run:
workflows: ["Test Pipeline"]
types: [completed]
branches: [main]
# 版本标签触发完整部署
push:
tags: ['v*']
# 手动触发
workflow_dispatch:
inputs:
environment:
description: '部署环境'
required: true
default: 'staging'
type: choice
options:
- staging
- production
- aliyun
- rollback-production
- rollback-aliyun
skip_tests:
description: '跳过测试（紧急修复）'
required: false
default: false
type: boolean
version:
description: '部署版本号（留空使用自动版本）'
required: false
type: string
env:
IMAGE_PREFIX: ${{ github.repository_owner }}/juhi
NODE_VERSION: "20"
PNPM_VERSION: "8"
REGISTRY: ghcr.io
jobs:
deploy-production:
name: 部署到 Production
runs-on: ubuntu-latest
if: >-
startsWith(github.ref, 'refs/tags/v') || needs.gate.outputs.target_env == 'production'
steps:
- uses: actions/checkout@v4
- name: 配置 SSH
uses: webfactory/ssh-agent@v0.8.0
with:
ssh-private-key: ${{ secrets.PRODUCTION_SSH_KEY }}
- name: 配置 SSH Known Hosts
run: |
mkdir -p ~/.ssh
echo "${{ secrets.PRODUCTION_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
chmod 644 ~/.ssh/known_hosts
- name: 同步部署文件
run: |
rsync -avz --delete \
docker-compose.prod.yml \
scripts/ \
deploy/ \
$USER@$HOST:$DEPLOY_PATH/
env:
HOST: ${{ secrets.PRODUCTION_HOST }}
USER: ${{ secrets.PRODUCTION_USER }}
DEPLOY_PATH: /opt/juhi
- name: 数据库备份
run: |
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
BACKUP_DIR="/opt/juhi/backups"
mkdir -p "$BACKUP_DIR"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="$BACKUP_DIR/pre_deploy_${TIMESTAMP}.sql"
docker compose -f docker-compose.prod.yml exec -T postgres \
pg_dump -U "${DB_USER:-juhi}" -d "${DB_NAME:-juhi_revops}" -Fc > "$BACKUP_FILE"
if [ $? -eq 0 ]; then
echo "备份完成: $(du -h "$BACKUP_FILE" | cut -f1)"
else
echo "备份失败"
exit 1
fi
find "$BACKUP_DIR" -name "pre_deploy_*.sql" -mtime +30 -delete 2>/dev/null || true
EOF
env:
HOST: ${{ secrets.PRODUCTION_HOST }}
USER: ${{ secrets.PRODUCTION_USER }}
- name: 部署到 Production
run: |
ssh $USER@$HOST << EOF
cd $DEPLOY_PATH
export API_IMAGE="${API_IMAGE}"
export FRONTEND_IMAGE="${FRONTEND_IMAGE}"
docker compose -f docker-compose.prod.yml pull api frontend
# 数据库迁移
echo "==> 数据库迁移..."
docker compose -f docker-compose.prod.yml --profile migrate run --rm migrate
if [ \$? -ne 0 ]; then
echo "数据库迁移失败"
exit 1
fi
# 记录部署历史
CURRENT_API=\$(docker inspect --format='{{.Config.Image}}' juhi-api 2>/dev/null || echo "none")
CURRENT_FE=\$(docker inspect --format='{{.Config.Image}}' juhi-frontend 2>/dev/null || echo "none")
echo "\$(date -Iseconds)|\${CURRENT_API}|\${CURRENT_FE}" >> .deploy-history
tail -20 .deploy-history > .deploy-history.tmp && mv .deploy-history.tmp .deploy-history
# 蓝绿部署
docker compose -f docker-compose.prod.yml up -d --no-deps --scale api=2 api
RETRY=0
MAX_RETRY=15
until curl -sf http://localhost:3000/health > /dev/null 2>&1; do
RETRY=\$((RETRY + 1))
if [ \$RETRY -ge \$MAX_RETRY ]; then
echo "健康检查超时，回滚到单实例"
docker compose -f docker-compose.prod.yml up -d --no-deps --scale api=1 api
exit 1
fi
sleep 5
done
docker compose -f docker-compose.prod.yml up -d --no-deps --scale api=1 api
docker compose -f docker-compose.prod.yml up -d --no-deps frontend
docker compose -f docker-compose.prod.yml exec -T nginx nginx -s reload 2>/dev/null || true
docker image prune -f
echo "${VERSION}" > .deployed_version
echo "==> Production 部署完成: ${VERSION}"
EOF
env:
HOST: ${{ secrets.PRODUCTION_HOST }}
USER: ${{ secrets.PRODUCTION_USER }}
DEPLOY_PATH: /opt/juhi
API_IMAGE: ${{ needs.build-and-push.outputs.api-image }}
FRONTEND_IMAGE: ${{ needs.build-and-push.outputs.frontend-image }}
VERSION: ${{ needs.build-and-push.outputs.version }}
- name: Production 部署验证
run: |
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
if [ -f "./scripts/post-deploy-verify.sh" ]; then
chmod +x ./scripts/post-deploy-verify.sh
./scripts/post-deploy-verify.sh --quick || exit 1
else
curl -sf http://localhost:3000/health || exit 1
UNHEALTHY=$(docker compose -f docker-compose.prod.yml ps --format json | grep -c '"unhealthy"' || true)
if [ "$UNHEALTHY" -gt 0 ]; then
docker compose -f docker-compose.prod.yml ps
exit 1
fi
echo "Production 验证通过"
fi
EOF
env:
HOST: ${{ secrets.PRODUCTION_HOST }}
USER: ${{ secrets.PRODUCTION_USER }}
- if: startsWith(github.ref, 'refs/tags/v')
name: 创建 GitHub Release
uses: softprops/action-gh-release@v2
with:
generate_release_notes: "true"
make_latest: "true"
timeout-minutes: "20"
...
|
deploy-production
|
["gate","build-and-push","depl ["gate","build-and-push","deploy-staging"]...
|
["ubuntu-latest"]
|
10350
|
4
|
1774692671
|
1774692671
|
1774692657
|
1774692672
|
|
1
|
|
0
|
Edit
Delete
|
|
12299
|
9027
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
部署到阿里云
|
1
|
name: CI/CD Deploy
"on":
# test-pipeli name: CI/CD Deploy
"on":
# test-pipeline 通过后自动触发（仅 main 分支）
workflow_run:
workflows: ["Test Pipeline"]
types: [completed]
branches: [main]
# 版本标签触发完整部署
push:
tags: ['v*']
# 手动触发
workflow_dispatch:
inputs:
environment:
description: '部署环境'
required: true
default: 'staging'
type: choice
options:
- staging
- production
- aliyun
- rollback-production
- rollback-aliyun
skip_tests:
description: '跳过测试（紧急修复）'
required: false
default: false
type: boolean
version:
description: '部署版本号（留空使用自动版本）'
required: false
type: string
env:
IMAGE_PREFIX: ${{ github.repository_owner }}/juhi
NODE_VERSION: "20"
PNPM_VERSION: "8"
REGISTRY: ghcr.io
jobs:
deploy-aliyun:
name: 部署到阿里云
runs-on: ubuntu-latest
if: needs.gate.outputs.target_env == 'aliyun'
steps:
- uses: actions/checkout@v4
- name: 配置 SSH
uses: webfactory/ssh-agent@v0.8.0
with:
ssh-private-key: ${{ secrets.ALIYUN_SSH_PRIVATE_KEY }}
- name: 配置 SSH Known Hosts
run: |
mkdir -p ~/.ssh
echo "${{ secrets.ALIYUN_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
chmod 644 ~/.ssh/known_hosts
- name: 同步部署文件
run: |
rsync -avz --delete \
--exclude 'node_modules' --exclude '.git' \
--exclude 'backups' --exclude 'data' --exclude 'logs' \
docker-compose.prod.yml \
scripts/ \
deploy/ \
.env.production.example \
$USER@$HOST:$DEPLOY_PATH/
env:
HOST: ${{ secrets.ALIYUN_HOST }}
USER: ${{ secrets.ALIYUN_USER }}
DEPLOY_PATH: /opt/juhi
- name: 部署前检查
run: |
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
command -v docker &> /dev/null || { echo "Docker 未安装"; exit 1; }
docker compose version &> /dev/null || docker-compose version &> /dev/null || { echo "Docker Compose 未安装"; exit 1; }
DISK_USAGE=$(df / | tail -1 | awk '{print $5}' | sed 's/%//')
if [ "$DISK_USAGE" -gt 90 ]; then
echo "磁盘使用率过高: ${DISK_USAGE}%"
exit 1
fi
EOF
env:
HOST: ${{ secrets.ALIYUN_HOST }}
USER: ${{ secrets.ALIYUN_USER }}
- name: 数据库备份
run: |
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
BACKUP_DIR="/opt/juhi/backups"
mkdir -p "$BACKUP_DIR"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="$BACKUP_DIR/pre_deploy_${TIMESTAMP}.sql.gz"
docker exec juhi-postgres pg_dump -U "${DB_USER:-juhi_user}" -d "${DB_NAME:-juhi_db}" | gzip > "$BACKUP_FILE"
if [ $? -eq 0 ]; then
echo "备份完成: $(du -h "$BACKUP_FILE" | cut -f1)"
else
echo "备份失败"
exit 1
fi
find "$BACKUP_DIR" -name "*.sql.gz" -mtime +30 -delete 2>/dev/null || true
EOF
env:
HOST: ${{ secrets.ALIYUN_HOST }}
USER: ${{ secrets.ALIYUN_USER }}
- name: 部署到阿里云
run: |
ssh $USER@$HOST << EOF
cd $DEPLOY_PATH
CURRENT_VERSION=\$(cat .deployed_version 2>/dev/null || echo "unknown")
docker compose -f docker-compose.prod.yml pull api frontend
echo "==> 数据库迁移..."
docker compose -f docker-compose.prod.yml --profile migrate run --rm migrate
if [ \$? -ne 0 ]; then
echo "数据库迁移失败"
exit 1
fi
docker compose -f docker-compose.prod.yml up -d --no-deps --remove-orphans api
RETRY=0
MAX_RETRY=15
until curl -sf http://localhost:3000/health > /dev/null 2>&1; do
RETRY=\$((RETRY + 1))
if [ \$RETRY -ge \$MAX_RETRY ]; then
echo "API 健康检查超时"
docker compose -f docker-compose.prod.yml logs --tail=50 api
exit 1
fi
sleep 5
done
docker compose -f docker-compose.prod.yml up -d --no-deps frontend
docker compose -f docker-compose.prod.yml exec -T nginx nginx -s reload 2>/dev/null || true
docker image prune -f --filter "until=24h"
echo "${VERSION}" > .deployed_version
echo "\$(date -Iseconds)|${VERSION}|\${CURRENT_VERSION}" >> .deploy-history
tail -20 .deploy-history > .deploy-history.tmp && mv .deploy-history.tmp .deploy-history
echo "==> 阿里云部署完成: ${VERSION}"
EOF
env:
HOST: ${{ secrets.ALIYUN_HOST }}
USER: ${{ secrets.ALIYUN_USER }}
DEPLOY_PATH: /opt/juhi
VERSION: ${{ needs.build-and-push.outputs.version }}
- name: 部署验证
run: |
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
if [ -f "./scripts/post-deploy-verify.sh" ]; then
chmod +x ./scripts/post-deploy-verify.sh
./scripts/post-deploy-verify.sh --quick
else
curl -sf http://localhost:3000/health || exit 1
curl -sf http://localhost/ || echo "前端检查跳过"
UNHEALTHY=$(docker compose -f docker-compose.prod.yml ps --format json | grep -c '"unhealthy"' || true)
if [ "$UNHEALTHY" -gt 0 ]; then
docker compose -f docker-compose.prod.yml ps
exit 1
fi
echo "阿里云部署验证通过"
fi
EOF
env:
HOST: ${{ secrets.ALIYUN_HOST }}
USER: ${{ secrets.ALIYUN_USER }}
- if: startsWith(github.ref, 'refs/tags/v')
name: 创建 GitHub Release
uses: softprops/action-gh-release@v2
with:
generate_release_notes: "true"
make_latest: "true"
timeout-minutes: "20"
...
|
deploy-aliyun
|
["gate","build-and-push"]
|
["ubuntu-latest"]
|
10349
|
4
|
1774692669
|
1774692669
|
1774692657
|
1774692670
|
|
1
|
|
0
|
Edit
Delete
|
|
12300
|
9027
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
Production 自动回滚
|
1
|
name: CI/CD Deploy
"on":
# test-pipeli name: CI/CD Deploy
"on":
# test-pipeline 通过后自动触发（仅 main 分支）
workflow_run:
workflows: ["Test Pipeline"]
types: [completed]
branches: [main]
# 版本标签触发完整部署
push:
tags: ['v*']
# 手动触发
workflow_dispatch:
inputs:
environment:
description: '部署环境'
required: true
default: 'staging'
type: choice
options:
- staging
- production
- aliyun
- rollback-production
- rollback-aliyun
skip_tests:
description: '跳过测试（紧急修复）'
required: false
default: false
type: boolean
version:
description: '部署版本号（留空使用自动版本）'
required: false
type: string
env:
IMAGE_PREFIX: ${{ github.repository_owner }}/juhi
NODE_VERSION: "20"
PNPM_VERSION: "8"
REGISTRY: ghcr.io
jobs:
auto-rollback-production:
name: Production 自动回滚
runs-on: ubuntu-latest
if: failure() && needs.deploy-production.result == 'failure'
steps:
- uses: webfactory/ssh-agent@v0.8.0
with:
ssh-private-key: ${{ secrets.PRODUCTION_SSH_KEY }}
- name: 配置 SSH Known Hosts
run: |
mkdir -p ~/.ssh
echo "${{ secrets.PRODUCTION_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
chmod 644 ~/.ssh/known_hosts
- name: 执行回滚
run: |
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
echo "==> Production 自动回滚..."
if [ -f "./scripts/rollback.sh" ]; then
chmod +x ./scripts/rollback.sh
./scripts/rollback.sh --confirm -y
else
PREV_LINE=$(tail -1 .deploy-history 2>/dev/null)
PREV_API=$(echo "$PREV_LINE" | cut -d'|' -f2)
PREV_FE=$(echo "$PREV_LINE" | cut -d'|' -f3)
if [ -n "$PREV_API" ] && [ "$PREV_API" != "none" ]; then
export API_IMAGE="$PREV_API"
export FRONTEND_IMAGE="$PREV_FE"
docker compose -f docker-compose.prod.yml up -d --no-deps api frontend
RETRY=0
until curl -sf http://localhost:3000/health > /dev/null 2>&1; do
RETRY=$((RETRY + 1))
[ $RETRY -ge 12 ] && { echo "回滚后健康检查失败"; exit 1; }
sleep 5
done
echo "==> 回滚成功"
else
echo "无法获取上一版本，需要手动回滚"
exit 1
fi
fi
EOF
env:
HOST: ${{ secrets.PRODUCTION_HOST }}
USER: ${{ secrets.PRODUCTION_USER }}
timeout-minutes: "10"
...
|
auto-rollback-production
|
["deploy-production"]
|
["ubuntu-latest"]
|
10352
|
4
|
1774692675
|
1774692675
|
1774692657
|
1774692676
|
|
1
|
|
0
|
Edit
Delete
|
|
12301
|
9027
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
阿里云自动回滚
|
1
|
name: CI/CD Deploy
"on":
# test-pipeli name: CI/CD Deploy
"on":
# test-pipeline 通过后自动触发（仅 main 分支）
workflow_run:
workflows: ["Test Pipeline"]
types: [completed]
branches: [main]
# 版本标签触发完整部署
push:
tags: ['v*']
# 手动触发
workflow_dispatch:
inputs:
environment:
description: '部署环境'
required: true
default: 'staging'
type: choice
options:
- staging
- production
- aliyun
- rollback-production
- rollback-aliyun
skip_tests:
description: '跳过测试（紧急修复）'
required: false
default: false
type: boolean
version:
description: '部署版本号（留空使用自动版本）'
required: false
type: string
env:
IMAGE_PREFIX: ${{ github.repository_owner }}/juhi
NODE_VERSION: "20"
PNPM_VERSION: "8"
REGISTRY: ghcr.io
jobs:
auto-rollback-aliyun:
name: 阿里云自动回滚
runs-on: ubuntu-latest
if: failure() && needs.deploy-aliyun.result == 'failure'
steps:
- uses: webfactory/ssh-agent@v0.8.0
with:
ssh-private-key: ${{ secrets.ALIYUN_SSH_PRIVATE_KEY }}
- name: 配置 SSH Known Hosts
run: |
mkdir -p ~/.ssh
echo "${{ secrets.ALIYUN_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
chmod 644 ~/.ssh/known_hosts
- name: 执行回滚
run: |
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
echo "==> 阿里云自动回滚..."
if [ -f "./scripts/rollback.sh" ]; then
chmod +x ./scripts/rollback.sh
./scripts/rollback.sh --version 1 --confirm
else
PREV_VERSION=$(tail -1 .deploy-history 2>/dev/null | cut -d'|' -f3)
if [ -n "$PREV_VERSION" ]; then
docker compose -f docker-compose.prod.yml up -d --no-deps api frontend
echo "==> 回滚完成"
else
echo "无法获取上一版本"
exit 1
fi
fi
EOF
env:
HOST: ${{ secrets.ALIYUN_HOST }}
USER: ${{ secrets.ALIYUN_USER }}
timeout-minutes: "10"
...
|
auto-rollback-aliyun
|
["deploy-aliyun"]
|
["ubuntu-latest"]
|
10351
|
4
|
1774692673
|
1774692674
|
1774692657
|
1774692674
|
|
1
|
|
0
|
Edit
Delete
|
|
12302
|
9027
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
手动回滚
|
1
|
name: CI/CD Deploy
"on":
# test-pipeli name: CI/CD Deploy
"on":
# test-pipeline 通过后自动触发（仅 main 分支）
workflow_run:
workflows: ["Test Pipeline"]
types: [completed]
branches: [main]
# 版本标签触发完整部署
push:
tags: ['v*']
# 手动触发
workflow_dispatch:
inputs:
environment:
description: '部署环境'
required: true
default: 'staging'
type: choice
options:
- staging
- production
- aliyun
- rollback-production
- rollback-aliyun
skip_tests:
description: '跳过测试（紧急修复）'
required: false
default: false
type: boolean
version:
description: '部署版本号（留空使用自动版本）'
required: false
type: string
env:
IMAGE_PREFIX: ${{ github.repository_owner }}/juhi
NODE_VERSION: "20"
PNPM_VERSION: "8"
REGISTRY: ghcr.io
jobs:
manual-rollback:
name: 手动回滚
runs-on: ubuntu-latest
if: needs.gate.outputs.is_rollback == 'true'
steps:
- uses: actions/checkout@v4
- if: needs.gate.outputs.target_env == 'rollback-production'
name: 配置 SSH（Production）
uses: webfactory/ssh-agent@v0.8.0
with:
ssh-private-key: ${{ secrets.PRODUCTION_SSH_KEY }}
- if: needs.gate.outputs.target_env == 'rollback-aliyun'
name: 配置 SSH（阿里云）
uses: webfactory/ssh-agent@v0.8.0
with:
ssh-private-key: ${{ secrets.ALIYUN_SSH_PRIVATE_KEY }}
- name: 配置 SSH Known Hosts
run: |
mkdir -p ~/.ssh
if [ "${{ needs.gate.outputs.target_env }}" == "rollback-production" ]; then
echo "${{ secrets.PRODUCTION_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
else
echo "${{ secrets.ALIYUN_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
fi
chmod 644 ~/.ssh/known_hosts
- name: 执行回滚
run: |
if [ "${{ needs.gate.outputs.target_env }}" == "rollback-production" ]; then
HOST="${{ secrets.PRODUCTION_HOST }}"
USER="${{ secrets.PRODUCTION_USER }}"
else
HOST="${{ secrets.ALIYUN_HOST }}"
USER="${{ secrets.ALIYUN_USER }}"
fi
ssh $USER@$HOST << 'EOF'
cd /opt/juhi
echo "==> 手动回滚..."
if [ -f "./scripts/rollback.sh" ]; then
chmod +x ./scripts/rollback.sh
./scripts/rollback.sh --version 1 --confirm
else
echo "rollback.sh 不存在，需要手动操作"
echo "部署历史:"
tail -10 .deploy-history 2>/dev/null || echo "(无记录)"
exit 1
fi
if [ -f "./scripts/post-deploy-verify.sh" ]; then
chmod +x ./scripts/post-deploy-verify.sh
./scripts/post-deploy-verify.sh --quick
fi
EOF
timeout-minutes: "10"
...
|
manual-rollback
|
["gate"]
|
["ubuntu-latest"]
|
10346
|
4
|
1774692661
|
1774692661
|
1774692657
|
1774692662
|
|
1
|
|
0
|
Edit
Delete
|
|
12303
|
9027
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
部署通知
|
1
|
name: CI/CD Deploy
"on":
# test-pipeli name: CI/CD Deploy
"on":
# test-pipeline 通过后自动触发（仅 main 分支）
workflow_run:
workflows: ["Test Pipeline"]
types: [completed]
branches: [main]
# 版本标签触发完整部署
push:
tags: ['v*']
# 手动触发
workflow_dispatch:
inputs:
environment:
description: '部署环境'
required: true
default: 'staging'
type: choice
options:
- staging
- production
- aliyun
- rollback-production
- rollback-aliyun
skip_tests:
description: '跳过测试（紧急修复）'
required: false
default: false
type: boolean
version:
description: '部署版本号（留空使用自动版本）'
required: false
type: string
env:
IMAGE_PREFIX: ${{ github.repository_owner }}/juhi
NODE_VERSION: "20"
PNPM_VERSION: "8"
REGISTRY: ghcr.io
jobs:
notify:
name: 部署通知
runs-on: ubuntu-latest
if: always()
steps:
- name: 生成部署报告
run: |
echo "## CI/CD 部署报告" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "- **触发**: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
echo "- **分支**: \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
echo "- **提交**: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
echo "- **触发者**: ${{ github.actor }}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "| 阶段 | 状态 |" >> $GITHUB_STEP_SUMMARY
echo "|------|------|" >> $GITHUB_STEP_SUMMARY
echo "| Staging | ${{ needs.deploy-staging.result || 'skipped' }} |" >> $GITHUB_STEP_SUMMARY
echo "| Production | ${{ needs.deploy-production.result || 'skipped' }} |" >> $GITHUB_STEP_SUMMARY
echo "| 阿里云 | ${{ needs.deploy-aliyun.result || 'skipped' }} |" >> $GITHUB_STEP_SUMMARY
echo "| 手动回滚 | ${{ needs.manual-rollback.result || 'skipped' }} |" >> $GITHUB_STEP_SUMMARY
- if: always() && (secrets.SLACK_WEBHOOK != '')
name: Slack 通知
uses: 8398a7/action-slack@v3
with:
status: ${{ job.status }}
text: CI/CD Deploy - ${{ needs.gate.outputs.target_env }} - ${{ github.ref_name }}
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
...
|
notify
|
["gate","deploy-staging","depl ["gate","deploy-staging","deploy-production","deploy-aliyun","manual-rollback","auto-rollback-production","auto-rollback-aliyun"]...
|
["ubuntu-latest"]
|
10353
|
2
|
1774692677
|
1774692707
|
1774692657
|
1774692708
|
|
1
|
|
0
|
Edit
Delete
|
|
12304
|
9028
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
生产环境健康检查
|
1
|
name: Health Check
"on":
schedule:
name: Health Check
"on":
schedule:
# 每 5 分钟检查一次
- cron: '*/5 * * * *'
workflow_dispatch:
jobs:
health-check:
name: 生产环境健康检查
runs-on: ubuntu-latest
if: github.repository == 'your-org/juhi' # 替换为实际仓库
steps:
- id: api-health
name: API 健康检查
run: |
RESPONSE=$(curl -sf https://juhi.example.com/v1/health || echo '{"status":"error"}')
echo "response=$RESPONSE" >> $GITHUB_OUTPUT
STATUS=$(echo $RESPONSE | jq -r '.status // "error"')
if [ "$STATUS" != "ok" ]; then
echo "API 健康检查失败"
exit 1
fi
echo "API 健康检查通过"
- name: 前端可访问性检查
run: |
HTTP_STATUS=$(curl -so /dev/null -w "%{http_code}" https://juhi.example.com/)
if [ "$HTTP_STATUS" != "200" ]; then
echo "前端返回 HTTP $HTTP_STATUS"
exit 1
fi
echo "前端可访问性检查通过"
- name: SSL 证书检查
run: |
EXPIRY_DATE=$(echo | openssl s_client -servername juhi.example.com -connect juhi.example.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))
echo "SSL 证书剩余 $DAYS_LEFT 天"
if [ $DAYS_LEFT -lt 7 ]; then
echo "::warning::SSL 证书将在 $DAYS_LEFT 天后过期！"
fi
if [ $DAYS_LEFT -lt 0 ]; then
echo "SSL 证书已过期"
exit 1
fi
- name: 响应时间检查
run: |
RESPONSE_TIME=$(curl -so /dev/null -w "%{time_total}" https://juhi.example.com/v1/health)
echo "API 响应时间: ${RESPONSE_TIME}s"
# 响应时间超过 5 秒告警
if (( $(echo "$RESPONSE_TIME > 5.0" | bc -l) )); then
echo "::warning::API 响应时间过长: ${RESPONSE_TIME}s"
fi
- if: failure()
name: Slack 通知（失败时）
uses: 8398a7/action-slack@v3
with:
fields: repo,message,commit,author,action,eventName,workflow
status: ${{ job.status }}
text: "\U0001F6A8 生产环境健康检查失败！请立即检查。"
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
...
|
health-check
|
null
|
["ubuntu-latest"]
|
10354
|
4
|
1774692918
|
1774692918
|
1774692918
|
1774692918
|
|
0
|
|
0
|
Edit
Delete
|
|
12305
|
9029
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
生产环境健康检查
|
1
|
name: Health Check
"on":
schedule:
name: Health Check
"on":
schedule:
# 每 5 分钟检查一次
- cron: '*/5 * * * *'
workflow_dispatch:
jobs:
health-check:
name: 生产环境健康检查
runs-on: ubuntu-latest
if: github.repository == 'your-org/juhi' # 替换为实际仓库
steps:
- id: api-health
name: API 健康检查
run: |
RESPONSE=$(curl -sf https://juhi.example.com/v1/health || echo '{"status":"error"}')
echo "response=$RESPONSE" >> $GITHUB_OUTPUT
STATUS=$(echo $RESPONSE | jq -r '.status // "error"')
if [ "$STATUS" != "ok" ]; then
echo "API 健康检查失败"
exit 1
fi
echo "API 健康检查通过"
- name: 前端可访问性检查
run: |
HTTP_STATUS=$(curl -so /dev/null -w "%{http_code}" https://juhi.example.com/)
if [ "$HTTP_STATUS" != "200" ]; then
echo "前端返回 HTTP $HTTP_STATUS"
exit 1
fi
echo "前端可访问性检查通过"
- name: SSL 证书检查
run: |
EXPIRY_DATE=$(echo | openssl s_client -servername juhi.example.com -connect juhi.example.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))
echo "SSL 证书剩余 $DAYS_LEFT 天"
if [ $DAYS_LEFT -lt 7 ]; then
echo "::warning::SSL 证书将在 $DAYS_LEFT 天后过期！"
fi
if [ $DAYS_LEFT -lt 0 ]; then
echo "SSL 证书已过期"
exit 1
fi
- name: 响应时间检查
run: |
RESPONSE_TIME=$(curl -so /dev/null -w "%{time_total}" https://juhi.example.com/v1/health)
echo "API 响应时间: ${RESPONSE_TIME}s"
# 响应时间超过 5 秒告警
if (( $(echo "$RESPONSE_TIME > 5.0" | bc -l) )); then
echo "::warning::API 响应时间过长: ${RESPONSE_TIME}s"
fi
- if: failure()
name: Slack 通知（失败时）
uses: 8398a7/action-slack@v3
with:
fields: repo,message,commit,author,action,eventName,workflow
status: ${{ job.status }}
text: "\U0001F6A8 生产环境健康检查失败！请立即检查。"
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
...
|
health-check
|
null
|
["ubuntu-latest"]
|
10355
|
4
|
1774693218
|
1774693218
|
1774693218
|
1774693218
|
|
0
|
|
0
|
Edit
Delete
|
|
12306
|
9030
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
生产环境健康检查
|
1
|
name: Health Check
"on":
schedule:
name: Health Check
"on":
schedule:
# 每 5 分钟检查一次
- cron: '*/5 * * * *'
workflow_dispatch:
jobs:
health-check:
name: 生产环境健康检查
runs-on: ubuntu-latest
if: github.repository == 'your-org/juhi' # 替换为实际仓库
steps:
- id: api-health
name: API 健康检查
run: |
RESPONSE=$(curl -sf https://juhi.example.com/v1/health || echo '{"status":"error"}')
echo "response=$RESPONSE" >> $GITHUB_OUTPUT
STATUS=$(echo $RESPONSE | jq -r '.status // "error"')
if [ "$STATUS" != "ok" ]; then
echo "API 健康检查失败"
exit 1
fi
echo "API 健康检查通过"
- name: 前端可访问性检查
run: |
HTTP_STATUS=$(curl -so /dev/null -w "%{http_code}" https://juhi.example.com/)
if [ "$HTTP_STATUS" != "200" ]; then
echo "前端返回 HTTP $HTTP_STATUS"
exit 1
fi
echo "前端可访问性检查通过"
- name: SSL 证书检查
run: |
EXPIRY_DATE=$(echo | openssl s_client -servername juhi.example.com -connect juhi.example.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))
echo "SSL 证书剩余 $DAYS_LEFT 天"
if [ $DAYS_LEFT -lt 7 ]; then
echo "::warning::SSL 证书将在 $DAYS_LEFT 天后过期！"
fi
if [ $DAYS_LEFT -lt 0 ]; then
echo "SSL 证书已过期"
exit 1
fi
- name: 响应时间检查
run: |
RESPONSE_TIME=$(curl -so /dev/null -w "%{time_total}" https://juhi.example.com/v1/health)
echo "API 响应时间: ${RESPONSE_TIME}s"
# 响应时间超过 5 秒告警
if (( $(echo "$RESPONSE_TIME > 5.0" | bc -l) )); then
echo "::warning::API 响应时间过长: ${RESPONSE_TIME}s"
fi
- if: failure()
name: Slack 通知（失败时）
uses: 8398a7/action-slack@v3
with:
fields: repo,message,commit,author,action,eventName,workflow
status: ${{ job.status }}
text: "\U0001F6A8 生产环境健康检查失败！请立即检查。"
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
...
|
health-check
|
null
|
["ubuntu-latest"]
|
10356
|
4
|
1774693518
|
1774693518
|
1774693518
|
1774693518
|
|
0
|
|
0
|
Edit
Delete
|
|
12307
|
9031
|
6
|
5
|
f60415723c7e4450e3f307a54e65df5fbb4d38d2
|
0
|
生产环境健康检查
|
1
|
name: Health Check
"on":
schedule:
name: Health Check
"on":
schedule:
# 每 5 分钟检查一次
- cron: '*/5 * * * *'
workflow_dispatch:
jobs:
health-check:
name: 生产环境健康检查
runs-on: ubuntu-latest
if: github.repository == 'your-org/juhi' # 替换为实际仓库
steps:
- id: api-health
name: API 健康检查
run: |
RESPONSE=$(curl -sf https://juhi.example.com/v1/health || echo '{"status":"error"}')
echo "response=$RESPONSE" >> $GITHUB_OUTPUT
STATUS=$(echo $RESPONSE | jq -r '.status // "error"')
if [ "$STATUS" != "ok" ]; then
echo "API 健康检查失败"
exit 1
fi
echo "API 健康检查通过"
- name: 前端可访问性检查
run: |
HTTP_STATUS=$(curl -so /dev/null -w "%{http_code}" https://juhi.example.com/)
if [ "$HTTP_STATUS" != "200" ]; then
echo "前端返回 HTTP $HTTP_STATUS"
exit 1
fi
echo "前端可访问性检查通过"
- name: SSL 证书检查
run: |
EXPIRY_DATE=$(echo | openssl s_client -servername juhi.example.com -connect juhi.example.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))
echo "SSL 证书剩余 $DAYS_LEFT 天"
if [ $DAYS_LEFT -lt 7 ]; then
echo "::warning::SSL 证书将在 $DAYS_LEFT 天后过期！"
fi
if [ $DAYS_LEFT -lt 0 ]; then
echo "SSL 证书已过期"
exit 1
fi
- name: 响应时间检查
run: |
RESPONSE_TIME=$(curl -so /dev/null -w "%{time_total}" https://juhi.example.com/v1/health)
echo "API 响应时间: ${RESPONSE_TIME}s"
# 响应时间超过 5 秒告警
if (( $(echo "$RESPONSE_TIME > 5.0" | bc -l) )); then
echo "::warning::API 响应时间过长: ${RESPONSE_TIME}s"
fi
- if: failure()
name: Slack 通知（失败时）
uses: 8398a7/action-slack@v3
with:
fields: repo,message,commit,author,action,eventName,workflow
status: ${{ job.status }}
text: "\U0001F6A8 生产环境健康检查失败！请立即检查。"
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
...
|
health-check
|
null
|
["ubuntu-latest"]
|
10357
|
4
|
1774693818
|
1774693818
|
1774693818
|
1774693818
|
|
0
|
|
0
|
Edit
Delete
|
|
1
|
1
|
3
|
4
|
f6b6a3099bdc2128ef1527c4935844f1e9358dac
|
0
|
build
|
1
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [master, main, develop]
tags: ['v*']
pull_request:
branches: [master, main]
jobs:
build:
name: build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Set up JDK 11
uses: actions/setup-java@v3
with:
cache: gradle
distribution: temurin
java-version: "11"
- name: Grant execute permission for gradlew
run: chmod +x gradlew
- name: Build Debug APK
run: ./gradlew assembleDebug
- if: startsWith(github.ref, 'refs/tags/')
name: Build Release AAR
run: ./gradlew assembleRelease
- name: Upload Debug artifacts
uses: actions/upload-artifact@v3
with:
name: debug-build
path: build/outputs/
retention-days: "7"
- if: startsWith(github.ref, 'refs/tags/')
name: Upload Release artifacts
uses: actions/upload-artifact@v3
with:
name: release-build
path: build/outputs/
retention-days: "30"
...
|
build
|
null
|
["ubuntu-latest"]
|
1
|
2
|
1770362250
|
1770362250
|
1770360030
|
1770362251
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
2
|
1
|
3
|
4
|
f6b6a3099bdc2128ef1527c4935844f1e9358dac
|
0
|
test
|
0
|
name: Android CI
"on":
push:
b name: Android CI
"on":
push:
branches: [master, main, develop]
tags: ['v*']
pull_request:
branches: [master, main]
jobs:
test:
name: test
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Set up JDK 11
uses: actions/setup-java@v3
with:
cache: gradle
distribution: temurin
java-version: "11"
- name: Grant execute permission for gradlew
run: chmod +x gradlew
- name: Run unit tests
run: ./gradlew test
- name: Run lint check
run: ./gradlew lint
continue-on-error: true
- if: always()
name: Upload test results
uses: actions/upload-artifact@v3
with:
name: test-results
path: |
build/reports/tests/
build/reports/lint-results.html
retention-days: "7"
...
|
test
|
["build"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1770360030
|
1770362252
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
31688
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27504
|
2
|
1788584337
|
1788584474
|
1788584337
|
1788584474
|
|
0
|
|
0
|
Edit
Delete
|
|
31689
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (api-fastify)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-fastify)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-fastify:ci
target:
- api-fastify
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31690
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (api-nestjs)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-nestjs)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-nestjs:ci
target:
- api-nestjs
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31691
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-alertmanager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31692
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-gateway)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31693
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-loki)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31694
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-otel-collector)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31695
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-pager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31696
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-postgres)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31697
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-tempo)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-tempo)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-tempo:ci
target:
- ops-tempo
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31698
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (ops-trace-storage)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31699
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Application image scan (web)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31700
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Third-party image scan (prom/prometheus:v3.14.0@sh Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)...
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31701
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Third-party image scan (redis:7-alpine@sha256:ff02 Third-party image scan (redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf)...
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31702
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/digital_employee_os_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
env:
# O1：runtime 验收的遗留 delayed job 不得漏进 UI 阶段共享的 BullMQ 队列，
# Redis 逻辑库隔离（镜像本地 /2 vs /3 约定）。
REDIS_URL: redis://127.0.0.1:6379/1
services:
postgres:
image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
env:
POSTGRES_DB: digital_employee_os_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d digital_employee_os_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788584337
|
1788584476
|
|
1
|
|
0
|
Edit
Delete
|
|
31703
|
23638
|
76
|
5
|
f6bd2a9868bc86b739584c2b3833b3d98d3eaf07
|
0
|
Merge gate
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
merge-gate:
name: Merge gate
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Require every governance and scan result
run: node scripts/check-merge-gate.mjs
env:
CI_JOB_RESULTS: ${{ toJSON(needs) }}
permissions:
contents: read
...
|
merge-gate
|
["static-governance","application-imag ["static-governance","application-image-vulnerability-scan","third-party-image-vulnerability-scan","runtime-acceptance"]...
|
["ubuntu-latest"]
|
27505
|
2
|
1788584477
|
1788584483
|
1788584337
|
1788584483
|
|
1
|
|
0
|
Edit
Delete
|
|
30892
|
23410
|
60
|
5
|
f73daf0a17c4cd19344f03ba21afcc326a49a650
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27032
|
2
|
1784003176
|
1784003267
|
1784003175
|
1784003267
|
|
0
|
|
0
|
Edit
Delete
|
|
30893
|
23410
|
60
|
5
|
f73daf0a17c4cd19344f03ba21afcc326a49a650
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/base_framework_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
STORAGE_ENDPOINT: http://127.0.0.1:19000
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
minio:
image: bitnami/minio:latest
env:
MINIO_ROOT_PASSWORD: minioadmin
MINIO_ROOT_USER: minioadmin
ports:
- 19000:9000
options: --health-cmd "curl -f http://localhost:9000/minio/health/live" --health-interval 5s --health-timeout 5s --health-retries 20
postgres:
image: postgres:16
env:
POSTGRES_DB: base_framework_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d base_framework_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1784003175
|
1784003269
|
|
1
|
|
0
|
Edit
Delete
|
|
31442
|
23594
|
105
|
5
|
f76fa1f553ada89174b9b59a934711373396a1f5
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Setup Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
- if: always()
name: Upload immutable static governance evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: warn
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: |
reports/*.latest.json
!reports/governance-profile-*.latest.json
!reports/runtime-acceptance.latest.json
!reports/conformance-differential.latest.json
!reports/ui-acceptance.latest.json
!reports/os-product-runtime.latest.json
retention-days: "30"
timeout-minutes: "20"
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27378
|
2
|
1788278840
|
1788279540
|
1788271185
|
1788279540
|
|
0
|
|
0
|
Edit
Delete
|
|
31443
|
23594
|
105
|
5
|
f76fa1f553ada89174b9b59a934711373396a1f5
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/data_analytics_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Setup Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- if: always()
name: Upload immutable runtime and UI evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: warn
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: |
reports/runtime-acceptance.latest.json
reports/conformance-differential.latest.json
reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "45"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: data_analytics_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d data_analytics_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1788373230
|
1788271185
|
1788373230
|
|
0
|
|
0
|
Edit
Delete
|
|
31444
|
23594
|
105
|
5
|
f76fa1f553ada89174b9b59a934711373396a1f5
|
0
|
Aggregate same-SHA governance evidence
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
governance-evidence:
name: Aggregate same-SHA governance evidence
runs-on: ubuntu-latest
if: always()
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Download static evidence
uses: actions/download-artifact@v4
with:
name: governance-static-governance-${{ github.sha }}-${{ github.run_attempt }}
path: reports
continue-on-error: true
- name: Download runtime and UI evidence
uses: actions/download-artifact@v4
with:
name: governance-runtime-acceptance-${{ github.sha }}-${{ github.run_attempt }}
path: reports
continue-on-error: true
- name: Generate same-SHA profile status manifest
run: node scripts/generate-governance-status.mjs
- if: always()
name: Upload immutable aggregate status
uses: actions/upload-artifact@v4
with:
if-no-files-found: error
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: reports/governance-status.latest.json
retention-days: "30"
- if: always()
name: Preserve upstream gate result
run: |
test "${{ needs.static-governance.result }}" = "success"
test "${{ needs.runtime-acceptance.result }}" = "success"
timeout-minutes: "10"
...
|
governance-evidence
|
["static-governance","runtime-acceptan ["static-governance","runtime-acceptance"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1788373230
|
1788271185
|
1788373230
|
|
0
|
|
0
|
Edit
Delete
|
|
30957
|
23443
|
64
|
5
|
f78049d487372e5538b1d202b65aa252031c8887
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27076
|
1
|
1784706014
|
1784706050
|
1784706012
|
1784706050
|
|
0
|
|
0
|
Edit
Delete
|
|
30958
|
23443
|
64
|
5
|
f78049d487372e5538b1d202b65aa252031c8887
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/voice_conversion_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- name: Bind runtime evidence to clean commit
run: pnpm check:report-provenance --require-clean-current runtime-acceptance.latest.json ui-acceptance.latest.json
- if: always()
name: Upload governance evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: error
name: governance-reports-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: voice_conversion_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d voice_conversion_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27078
|
2
|
1784706089
|
1784706107
|
1784706012
|
1784706107
|
|
1
|
|
0
|
Edit
Delete
|
|
31173
|
23539
|
82
|
5
|
f78be17ac5fecb9cfa36e167b1e85ea26a48fa45
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27239
|
2
|
1787913991
|
1787914025
|
1787913990
|
1787914025
|
|
0
|
|
0
|
Edit
Delete
|
|
31174
|
23539
|
82
|
5
|
f78be17ac5fecb9cfa36e167b1e85ea26a48fa45
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
S3_ENDPOINT: http://127.0.0.1:9000
S3_ACCESS_KEY_ID: juhai-ci
S3_SECRET_ACCESS_KEY: juhai-ci-secret-change-me
S3_ATTACHMENT_BUCKET: juhai-attachments
S3_REGION: us-east-1
S3_FORCE_PATH_STYLE: "true"
CLAMAV_HOST: 127.0.0.1
CLAMAV_PORT: "3310"
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start real S3 and antivirus acceptance infrastructure
run: |
set -euo pipefail
docker run -d --name juhai-ci-minio -p 9000:9000 \
-e MINIO_ROOT_USER=juhai-ci \
-e MINIO_ROOT_PASSWORD=juhai-ci-secret-change-me \
quay.io/minio/minio@sha256:064117214caceaa8d8a90ef7caa58f2b2aeb316b5156afe9ee8da5b4d83e12c8 \
server /data
docker run -d --name juhai-ci-clamav -p 3310:3310 \
clamav/clamav-debian@sha256:967334b92d1782e4d1314ddf903ae537d26792d21c9a39adecb8ac9757980514
for attempt in $(seq 1 60); do
curl --fail --silent http://127.0.0.1:9000/minio/health/live && break
if [[ "$attempt" == 60 ]]; then exit 1; fi
sleep 2
done
docker run --rm --network host \
quay.io/minio/mc@sha256:09f93f534cde415d192bb6084dd0e0ddd1715fb602f8a922ad121fd2bf0f8b44 \
sh -c 'mc alias set local http://127.0.0.1:9000 juhai-ci juhai-ci-secret-change-me && mc mb --ignore-existing local/juhai-attachments'
for attempt in $(seq 1 90); do
docker exec juhai-ci-clamav clamdscan --ping 1 && break
if [[ "$attempt" == 90 ]]; then exit 1; fi
sleep 3
done
shell: bash
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- name: Reconcile full governance evidence
run: pnpm check:governance
- name: Create verified logical backup
run: bash scripts/backup-postgres.sh
env:
BACKUP_OUTPUT: ${{ runner.temp }}/juhai-ticket-ci.dump
- name: Restore into an isolated database and verify governed facts
run: |
set -euo pipefail
createdb --dbname="postgresql://postgres:postgres@127.0.0.1:5432/postgres" juhai_ai_work_order_system_restore_ci
checksum="$(awk '{print $1}' "${RUNNER_TEMP}/juhai-ticket-ci.dump.sha256")"
BACKUP_INPUT="${RUNNER_TEMP}/juhai-ticket-ci.dump" \
EXPECTED_SHA256="${checksum}" \
RESTORE_DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_restore_ci" \
bash scripts/restore-postgres-drill.sh
shell: bash
services:
postgres:
image: pgvector/pgvector@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b
env:
POSTGRES_DB: juhai_ai_work_order_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_work_order_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1787913990
|
1787914026
|
|
1
|
|
0
|
Edit
Delete
|
|
31159
|
23532
|
81
|
5
|
f7f15c92e83a6df0de98d1d5df4dfdd9b63cd284
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 5cb2f1cc2f9953d47fa0bcfac541400d01603f78
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27218
|
2
|
1787709144
|
1787709151
|
1787709129
|
1787709152
|
|
0
|
|
0
|
Edit
Delete
|
|
31160
|
23532
|
81
|
5
|
f7f15c92e83a6df0de98d1d5df4dfdd9b63cd284
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_after_sales_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_after_sales_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_after_sales_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1787709129
|
1787709153
|
|
1
|
|
0
|
Edit
Delete
|
|
30933
|
23431
|
63
|
5
|
f7f58401d267fffa37e2c7282f531354478eeebf
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27057
|
1
|
1784681970
|
1784682010
|
1784681969
|
1784682010
|
|
0
|
|
0
|
Edit
Delete
|
|
30934
|
23431
|
63
|
5
|
f7f58401d267fffa37e2c7282f531354478eeebf
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/forced_alignment_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: forced_alignment_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d forced_alignment_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27058
|
2
|
1784682012
|
1784682042
|
1784681969
|
1784682042
|
|
1
|
|
0
|
Edit
Delete
|
|
312
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
检测代码变更
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
detect-changes:
name: 检测代码变更
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- id: filter
uses: dorny/paths-filter@v3
with:
filters: |
backend:
- 'backend/**'
- 'shared/**'
frontend:
- 'frontend/**'
- 'shared/**'
mobile:
- 'mobile/**'
- 'shared/**'
shared:
- 'shared/**'
workflows:
- '.github/workflows/**'
outputs:
backend: ${{ steps.filter.outputs.backend }}
frontend: ${{ steps.filter.outputs.frontend }}
mobile: ${{ steps.filter.outputs.mobile }}
shared: ${{ steps.filter.outputs.shared }}
workflows: ${{ steps.filter.outputs.workflows }}
...
|
detect-changes
|
null
|
["ubuntu-latest"]
|
47
|
3
|
1771862915
|
1771862929
|
1771862907
|
1771862929
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
313
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
安装依赖
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
setup:
name: 安装依赖
runs-on: ubuntu-latest
steps:
- name: 检出代码
uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- name: 安装依赖
run: pnpm install --frozen-lockfile
- name: 构建共享包
run: pnpm --filter @juhi/shared run build
- name: 缓存 node_modules
uses: actions/cache/save@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
e2e/node_modules
...
|
setup
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862929
|
1771862907
|
1771862929
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
314
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
共享包检查
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
shared-check:
name: 共享包检查
runs-on: ubuntu-latest
if: needs.detect-changes.outputs.shared == 'true'
steps:
- uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: 恢复依赖缓存
uses: actions/cache/restore@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
- name: TypeScript 类型检查
run: pnpm --filter @juhi/shared run build
- name: 运行共享层单元测试
run: pnpm --filter @juhi/shared run test:coverage
- name: 上传共享层覆盖率报告
uses: codecov/codecov-action@v4
with:
fail_ci_if_error: "false"
files: shared/coverage/lcov.info
flags: shared
- name: 验证导出
run: |
cd shared
node -e "import('./dist/index.js').then(m => console.log('✅ 共享包导出验证通过'))"
...
|
shared-check
|
["setup","detect-changes"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862929
|
1771862907
|
1771862929
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
315
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
后端代码检查
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
backend-lint:
name: 后端代码检查
runs-on: ubuntu-latest
if: needs.detect-changes.outputs.backend == 'true'
steps:
- uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: 恢复依赖缓存
uses: actions/cache/restore@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
- name: 生成 Prisma Client
run: pnpm --filter juhi-api run db:generate
- name: ESLint 检查
run: pnpm --filter juhi-api run lint
- name: TypeScript 类型检查
run: pnpm --filter juhi-api run type-check
- name: API 路由契约检查
run: pnpm --filter juhi-api run audit:route-contract
- name: 状态机集成审计
run: pnpm --filter juhi-api run audit:state-machines
- name: 事件发布覆盖审计
run: pnpm --filter juhi-api run audit:events
- name: 审计基线门禁（防回退）
run: pnpm --filter juhi-api run audit:gate
...
|
backend-lint
|
["setup","detect-changes"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862929
|
1771862907
|
1771862929
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
316
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
后端单元测试
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
backend-test:
name: 后端单元测试
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: 恢复依赖缓存
uses: actions/cache/restore@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
- name: 生成 Prisma Client
run: pnpm --filter juhi-api run db:generate
- name: 运行单元测试
run: pnpm --filter juhi-api run test:ci
env:
DATABASE_URL: postgresql://test:test@localhost:5432/juhi_test
REDIS_URL: redis://localhost:6379
JWT_SECRET: test-secret-key
NODE_ENV: test
- name: 上传覆盖率报告
uses: codecov/codecov-action@v4
with:
fail_ci_if_error: "false"
files: backend/coverage/lcov.info
flags: backend
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: juhi_test
POSTGRES_PASSWORD: test
POSTGRES_USER: test
ports:
- 5432:5432
options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
redis:
image: redis:7-alpine
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
...
|
backend-test
|
["backend-lint"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862930
|
1771862907
|
1771862930
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
317
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
后端构建检查
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
backend-build:
name: 后端构建检查
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: 恢复依赖缓存
uses: actions/cache/restore@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
- name: 生成 Prisma Client
run: pnpm --filter juhi-api run db:generate
- name: 构建
run: pnpm --filter juhi-api run build
- name: 验证构建产物
run: |
if [ ! -d "backend/dist" ]; then
echo "❌ 构建产物不存在"
exit 1
fi
echo "✅ 后端构建验证通过"
...
|
backend-build
|
["backend-lint"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862930
|
1771862907
|
1771862930
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
318
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
前端代码检查
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
frontend-lint:
name: 前端代码检查
runs-on: ubuntu-latest
if: needs.detect-changes.outputs.frontend == 'true'
steps:
- uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: 恢复依赖缓存
uses: actions/cache/restore@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
- name: ESLint 检查
run: pnpm --filter juhi-frontend run lint
- name: 数组守卫检查
run: pnpm --filter juhi-frontend run check:array-guard
- name: TypeScript 类型检查
run: pnpm --filter juhi-frontend run type-check
...
|
frontend-lint
|
["setup","detect-changes"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862930
|
1771862907
|
1771862930
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
319
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
前端构建检查
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
frontend-build:
name: 前端构建检查
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: 恢复依赖缓存
uses: actions/cache/restore@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
- name: 构建
run: pnpm --filter juhi-frontend run build
- name: 验证构建产物
run: |
if [ ! -d "frontend/dist" ]; then
echo "❌ 构建产物不存在"
exit 1
fi
echo "✅ 前端构建验证通过"
- name: 上传构建产物
uses: actions/upload-artifact@v4
with:
name: frontend-dist
path: frontend/dist
retention-days: "7"
...
|
frontend-build
|
["frontend-lint"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862930
|
1771862907
|
1771862930
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|
|
320
|
60
|
6
|
5
|
f8a1588d13917a22d3710214cee7468768c4490e
|
0
|
移动端检查
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main, develop, 'feature/**', 'claude/**']
pull_request:
branches: [main, develop]
env:
NODE_VERSION: "20"
PNPM_VERSION: "8"
jobs:
mobile-check:
name: 移动端检查
runs-on: ubuntu-latest
if: needs.detect-changes.outputs.mobile == 'true'
steps:
- uses: actions/checkout@v4
- name: 安装 pnpm
uses: pnpm/action-setup@v4
with:
version: ${{ env.PNPM_VERSION }}
- name: 设置 Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: 恢复依赖缓存
uses: actions/cache/restore@v4
with:
key: deps-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
path: |
node_modules
backend/node_modules
frontend/node_modules
mobile/node_modules
shared/node_modules
shared/dist
- name: ESLint 检查
run: pnpm --filter juhi-mobile run lint || true
- name: TypeScript 类型检查
run: pnpm --filter juhi-mobile run type-check || true
...
|
mobile-check
|
["setup","detect-changes"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1771862930
|
1771862907
|
1771862930
|
NULL
|
NULL
|
|
0
|
Edit
Delete
|