|
46005
|
26748
|
116
|
5
|
2eb865d93667be22a84852d18eababb9fa9b30c2
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://github.com/sigstore/cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
37476
|
4
|
1793520124
|
1793520125
|
1793519612
|
1793520125
|
|
1
|
|
0
|
Edit
Delete
|
|
46006
|
26748
|
116
|
5
|
2eb865d93667be22a84852d18eababb9fa9b30c2
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
37477
|
2
|
1793520126
|
1793520140
|
1793519612
|
1793520140
|
|
1
|
|
0
|
Edit
Delete
|
|
46007
|
26749
|
116
|
5
|
1a6575250e19bdc11d9cb8e08539b1dd7fd86a9b
|
0
|
Observe existing runner maintenance boundary
|
1
|
name: Runner maintenance access diagnostic (read o name: Runner maintenance access diagnostic (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-diagnostic.yml]
workflow_dispatch:
jobs:
observe:
name: Observe existing runner maintenance boundary
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read execution identity and existing service metadata
run: |
set -eu
if ! command -v node >/dev/null 2>&1; then
echo 'RUNNER_MAINTENANCE_READONLY_UNAVAILABLE node-not-installed'
exit 2
fi
node <<'NODE'
const fs = require('node:fs');
const os = require('node:os');
const { spawnSync } = require('node:child_process');
const commands = [];
function run(command, args) {
const allowed = { systemctl: ['list-unit-files', 'show'], docker: ['version', 'info', 'ps', 'inspect'] };
const sudoListOnly = command === 'sudo' && JSON.stringify(args) === '["-n","-l"]';
if (!sudoListOnly && !allowed[command]?.includes(args[0])) throw new Error('READ_ONLY_OPERATION_NOT_ALLOWED');
const r = spawnSync(command, args, { encoding: 'utf8', timeout: 5000, maxBuffer: 256 * 1024, input: '' });
commands.push({ command, args, exitCode: r.status, errorCode: r.error?.code ?? null });
return { ok: r.status === 0, stdout: r.stdout ?? '' };
}
function safePath(value) {
if (typeof value !== 'string' || value.length > 300 || /[\r\n]/.test(value)) return 'UNAVAILABLE';
return /secret|credential|token|password|private/i.test(value) ? 'REDACTED_PRIVATE_PATH' : value;
}
function metadata(path) {
try {
const stat = fs.statSync(path);
const access = mode => { try { fs.accessSync(path, mode); return true; } catch { return false; } };
return { path, exists: true, uid: stat.uid, gid: stat.gid, mode: (stat.mode & 0o777).toString(8),
readable: access(fs.constants.R_OK), writable: access(fs.constants.W_OK),
socket: stat.isSocket(), directory: stat.isDirectory() };
} catch { return { path, exists: false }; }
}
function publicFile(path) {
try { return fs.readFileSync(path, 'utf8').slice(0, 8192); } catch { return null; }
}
const report = {
kind: 'RunnerMaintenanceReadOnlyDiagnostic', schemaVersion: 1, observedAtUTC: new Date().toISOString(),
releaseEligible: false, purpose: 'Execution-boundary and existing maintenance-capability observation only',
ci: { repository: process.env.GITHUB_REPOSITORY ?? null, sourceSha: process.env.GITHUB_SHA ?? null,
runId: process.env.GITHUB_RUN_ID ?? null, rawGithubRunAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
rawGiteaRunAttempt: process.env.GITEA_RUN_ATTEMPT ?? null, runnerName: process.env.RUNNER_NAME ?? null },
execution: { hostname: os.hostname(), platform: os.platform(), arch: os.arch(),
uid: process.getuid?.(), gid: process.getgid?.(), groups: process.getgroups?.(),
rootInExecutionContext: process.getuid?.() === 0,
dockerMarker: fs.existsSync('/.dockerenv'), containerEnvMarker: fs.existsSync('/run/.containerenv'),
pid1Command: publicFile('/proc/1/comm')?.trim() ?? null,
uidMap: publicFile('/proc/self/uid_map')?.trim() ?? null },
commonPathMetadataOnly: [
'/var/run/docker.sock', '/run/docker.sock', '/etc/gitea/app.ini',
'/data/gitea/conf/app.ini', '/var/lib/gitea', '/data/gitea', '/data/git/repositories',
'/etc/act_runner/config.yaml', '/etc/gitea-runner/config.yaml',
].map(metadata),
services: [], docker: { accessible: false, relatedContainers: [] },
nonInteractiveSudo: { listingAvailable: false, unrestrictedRuleObserved: false, relevantCommandNames: [] },
};
const osRelease = publicFile('/etc/os-release');
report.execution.osName = osRelease?.match(/^PRETTY_NAME="?([^"\n]+)"?$/m)?.[1] ?? null;
const units = run('systemctl', ['list-unit-files', '--type=service', '--no-legend', '--no-pager']);
if (units.ok) {
const names = units.stdout.split('\n').map(l => l.trim().split(/\s+/)[0])
.filter(n => /^(?:gitea|act[-_]?runner|gitea[-_]?runner)[\w@.-]*\.service$/i.test(n)).slice(0, 20);
for (const name of names) {
const r = run('systemctl', ['show', name, '--no-pager', '--property=LoadState,ActiveState,FragmentPath,User']);
const properties = {};
if (r.ok) for (const line of r.stdout.split('\n')) {
const m = /^(LoadState|ActiveState|FragmentPath|User)=(.*)$/.exec(line);
if (m) properties[m[1]] = m[1] === 'FragmentPath' ? safePath(m[2]) : m[2].slice(0, 150);
}
report.services.push({ name, querySucceeded: r.ok, properties });
}
}
const sudo = run('sudo', ['-n', '-l']);
report.nonInteractiveSudo.listingAvailable = sudo.ok;
if (sudo.ok) {
report.nonInteractiveSudo.unrestrictedRuleObserved = /^\s*\([^)\n]+\)\s*(?:NOPASSWD:\s*)?ALL\s*$/m.test(sudo.stdout);
report.nonInteractiveSudo.relevantCommandNames = ['systemctl','docker','podman','pg_dump','pg_restore','mysqldump','gitea','act_runner','gitea-runner']
.filter(n => sudo.stdout.includes(n));
}
const version = run('docker', ['version', '--format', '{{.Server.Version}}']);
report.docker.accessible = version.ok;
report.docker.serverVersion = version.ok ? version.stdout.trim().slice(0, 80) : null;
if (version.ok) {
const info = run('docker', ['info', '--format', '{{json .Name}}']);
if (info.ok) { try { report.docker.daemonName = JSON.parse(info.stdout); } catch {} }
const list = run('docker', ['ps', '-a', '--format', '{{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}']);
if (list.ok) for (const line of list.stdout.split('\n')) {
const [id, name, image, status] = line.split('\t');
if (!/^[a-f0-9]{12,64}$/.test(id ?? '') || !/gitea|act[-_]?runner|gitea[-_]?runner/i.test((name ?? '') + ' ' + (image ?? ''))) continue;
if (report.docker.relatedContainers.length >= 15) break;
const container = { id, name, image, status };
const mounts = run('docker', ['inspect', '--format', '{{json .Mounts}}', id]);
if (mounts.ok) {
try { container.mounts = JSON.parse(mounts.stdout).map(m => ({
type: m.Type, source: safePath(m.Source), destination: safePath(m.Destination), rw: m.RW,
})); } catch { container.mounts = 'UNPARSEABLE'; }
}
const workingDir = run('docker', ['inspect', '--format', '{{index .Config.Labels "com.docker.compose.project.working_dir"}}', id]);
if (workingDir.ok) container.composeWorkingDirectory = safePath(workingDir.stdout.trim());
const configFiles = run('docker', ['inspect', '--format', '{{index .Config.Labels "com.docker.compose.project.config_files"}}', id]);
if (configFiles.ok) container.composeConfigFiles = safePath(configFiles.stdout.trim());
report.docker.relatedContainers.push(container);
}
}
report.commands = commands;
report.boundaries = {
repositorySecretsRequested: false, environmentDumped: false, secretConfigContentsRead: false,
dockerEnvironmentInspected: false, privilegedServiceCommandExecuted: false, dockerMutationExecuted: false,
credentialOrPermissionChanges: false, arbitraryNetworkProbes: false, backupsOrServiceChanges: false,
contextRootOrDockerAccessIsNotProofOfGiteaHostOwnership: true,
};
report.conclusion = 'DIAGNOSTIC_ONLY: maintenance admission requires verified target, authorized service control, complete storage inventory and tested backup/restore; unknowns are not passes';
console.log('RUNNER_MAINTENANCE_READONLY_JSON ' + JSON.stringify(report));
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
observe
|
null
|
["ubuntu-latest"]
|
37471
|
1
|
1793520113
|
1793520116
|
1793519845
|
1793520116
|
|
0
|
|
0
|
Edit
Delete
|
|
46008
|
26750
|
116
|
5
|
b2cff86c1cba9e7f9bc40991ed1abc1e73cc281c
|
0
|
Read existing Gitea and runner service layout
|
1
|
name: Runner maintenance inventory (read only)
name: Runner maintenance inventory (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-inventory.yml]
workflow_dispatch:
jobs:
inventory:
name: Read existing Gitea and runner service layout
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read whitelisted deployment metadata without secret output
run: |
set -eu
node <<'NODE'
const fs = require('node:fs');
const path = require('node:path');
const os = require('node:os');
const { spawnSync } = require('node:child_process');
if (process.getuid?.() !== 0 || os.hostname() !== 'iZ2zed3pt2nygf9dy1a9d2Z') throw new Error('EXPECTED_RUNNER_HOST_IDENTITY_REQUIRED');
const commands = [];
function run(command, args) {
const allowed = ['systemctl','sha256sum','df','ps','go','git','getent'];
const versionOnly = path.isAbsolute(command) && args.length === 1 && args[0] === '--version';
if (!allowed.includes(command) && !versionOnly) throw new Error('READ_ONLY_COMMAND_NOT_ALLOWED');
const r = spawnSync(command, args, { encoding:'utf8', timeout:8000, maxBuffer:256*1024, input:'' });
// Never log argv/stdout: startup definitions may contain sensitive values.
commands.push({ command: path.isAbsolute(command) ? path.basename(command) : command, exitCode:r.status, errorCode:r.error?.code ?? null });
return { ok:r.status === 0, stdout:r.stdout ?? '' };
}
function publicPath(p) {
return typeof p === 'string' && p.length <= 400 && !/[\r\n]/.test(p) && !/secret|credential|token|password|private/i.test(p) ? p : 'REDACTED_OR_INVALID_PATH';
}
function meta(p) {
try { const s=fs.statSync(p);return {path:publicPath(p),exists:true,uid:s.uid,gid:s.gid,mode:(s.mode&0o777).toString(8),bytes:s.size,directory:s.isDirectory()}; }
catch { return {path:publicPath(p),exists:false}; }
}
function link(p) { try{return fs.readlinkSync(p);}catch{return null;} }
function splitArgs(s) { return (s.match(/"[^"]*"|'[^']*'|[^\s]+/g) ?? []).map(x=>x.replace(/^(['"])(.*)\1$/,'$2')); }
function flag(args,names) {
for(let i=0;i<args.length;i++) for(const n of names) {
if(args[i]===n) return args[i+1] ?? null;
if(args[i].startsWith(n+'=')) return args[i].slice(n.length+1);
}
return null;
}
const report={kind:'RunnerMaintenanceServiceInventory',schemaVersion:1,observedAtUTC:new Date().toISOString(),
releaseEligible:false,ci:{sourceSha:process.env.GITHUB_SHA??null,runId:process.env.GITHUB_RUN_ID??null},
hostname:os.hostname(),services:[],configs:[],paths:[],sourceTrees:[],tools:{},commands};
const units=['gitea.service','gitea-runner.service','gitea-ext.service','gitea-webapp.service','gitea-webhook.service'];
let giteaArgs=[],giteaBase=null,giteaConfig=null,runnerDir=null;
for(const unit of units) {
const r=run('systemctl',['show',unit,'--no-pager','--property=User,WorkingDirectory,ExecStart,MainPID,FragmentPath,RootDirectory,RootImage']);
if(!r.ok){report.services.push({unit,querySucceeded:false});continue;}
const p={};
for(const l of r.stdout.split('\n')) {const i=l.indexOf('=');if(i>=0)p[l.slice(0,i)]=l.slice(i+1);}
const start=p.ExecStart??'';
const executable=/\bpath=([^ ;]+)\s*;/.exec(start)?.[1] ?? null;
const argv=/argv\[\]=(.*?)\s*;\s*ignore_errors=/s.exec(start)?.[1] ?? '';
const args=splitArgs(argv);
const pid=/^[1-9][0-9]*$/.test(p.MainPID??'')?p.MainPID:null;
const actualExe=pid?link('/proc/'+pid+'/exe'):null;
const actualCwd=pid?link('/proc/'+pid+'/cwd'):null;
const item={unit,user:p.User??null,workingDirectory:publicPath(p.WorkingDirectory??''),
unitFile:publicPath(p.FragmentPath??''),rootDirectory:publicPath(p.RootDirectory??''),
rootImage:publicPath(p.RootImage??''),executable:executable?publicPath(executable):null,
processExecutable:actualExe?publicPath(actualExe):null,processWorkingDirectory:actualCwd?publicPath(actualCwd):null,
scripts:args.filter(x=>path.isAbsolute(x)&&/\.(?:py|js|mjs|cjs|sh)$/.test(x)).map(publicPath),
configFlag:flag(args,['--config','-c'])?publicPath(flag(args,['--config','-c'])):null};
if(unit==='gitea.service'||unit==='gitea-runner.service') {
const binary=actualExe && !actualExe.endsWith(' (deleted)')?actualExe:executable;
if(binary&&path.isAbsolute(binary)&&fs.existsSync(binary)){
const sum=run('sha256sum',[binary]);item.binarySha256=sum.ok?sum.stdout.match(/^[a-f0-9]{64}/)?.[0]??null:null;
const version=run(binary,['--version']);item.version=version.ok?version.stdout.trim().slice(0,400):null;
const go=run('go',['version','-m',binary]);
item.goBuild=go.ok?go.stdout.split('\n').map(l=>l.trim()).filter(l=>/^(?:path|mod)\s+(?:code\.gitea\.io|github\.com\/go-gitea|gitea\.com\/gitea)/.test(l)||/^build\s+vcs(?:\.revision|\.time|\.modified)?=/.test(l)):null;
}
}
report.services.push(item);
if(unit==='gitea.service'){
giteaArgs=args;giteaBase=flag(args,['--work-path','-w'])||actualCwd||p.WorkingDirectory||path.dirname(executable??'/');
giteaConfig=flag(args,['--config','-c']);
}
if(unit==='gitea-runner.service')runnerDir=actualCwd||p.WorkingDirectory;
}
if(giteaConfig && !path.isAbsolute(giteaConfig))giteaConfig=path.resolve(giteaBase,giteaConfig);
const configCandidates=[giteaConfig,path.join(giteaBase||'/nonexistent','custom/conf/app.ini'),
'/etc/gitea/app.ini','/home/git/gitea/custom/conf/app.ini','/home/git/gitea/conf/app.ini'].filter(Boolean);
const safeKeys={
database:['DB_TYPE','HOST','NAME','USER','PATH','SCHEMA','SSL_MODE','CHARSET'],
server:['APP_DATA_PATH','ROOT_URL','DOMAIN','HTTP_ADDR','HTTP_PORT','SSH_DOMAIN','SSH_PORT','START_SSH_SERVER','LOCAL_ROOT_URL'],
repository:['ROOT'],actions:['ENABLED','DEFAULT_ACTIONS_URL','MAX_RERUN_ATTEMPTS','ARTIFACT_RETENTION_DAYS'],
log:['MODE','ROOT_PATH'],
};
const storageKeys=['STORAGE_TYPE','PATH','MINIO_ENDPOINT','MINIO_BUCKET','MINIO_BASE_PATH','MINIO_LOCATION','MINIO_USE_SSL','SERVE_DIRECT'];
const configPaths=new Set();
for(const p of [...new Set(configCandidates)]) {
report.paths.push(meta(p));
if(!fs.existsSync(p)||!fs.statSync(p).isFile()||fs.statSync(p).size>1024*1024)continue;
if(/\/(?:\.secrets|\.evidence-private)\//.test(p))throw new Error('RESTRICTED_PATH_REFUSED');
const ini=fs.readFileSync(p,'utf8');let section='DEFAULT';const selected={};
for(const line of ini.split('\n')) {
const s=line.trim();if(!s||s.startsWith(';')||s.startsWith('#'))continue;
const h=/^\[([^\]]+)\]$/.exec(s);if(h){section=h[1].toLowerCase();continue;}
const m=/^([A-Za-z0-9_]+)\s*=\s*(.*)$/.exec(s);if(!m)continue;
const key=m[1].toUpperCase();
const storage=/^(?:storage(?:\.|$)|lfs$|attachment$|packages$)/.test(section);
if(!(safeKeys[section]??[]).includes(key)&&!(storage&&storageKeys.includes(key)))continue;
let value=m[2].trim().replace(/^(['"])(.*)\1$/,'$2');
if(/PASSW|TOKEN|SECRET|CREDENTIAL|PRIVATE_KEY/i.test(value)){value='REDACTED_SENSITIVE_REFERENCE';}
else if(value.includes('@')){value=value.replace(/[^/@\s]+@/g,'REDACTED@');}
(selected[section]??={})[key]=value.slice(0,500);
if((key==='PATH'||key==='ROOT'||key==='APP_DATA_PATH'||key==='ROOT_PATH')&&path.isAbsolute(value))configPaths.add(value);
}
const sum=run('sha256sum',[p]);
report.configs.push({path:publicPath(p),sha256:sum.ok?sum.stdout.match(/^[a-f0-9]{64}/)?.[0]??null:null,selectedNonSecretFields:selected});
}
for(const p of configPaths)report.paths.push(meta(p));
if(runnerDir){report.runnerWorkingDirectory=publicPath(runnerDir);report.runnerRegistrationMetadataOnly=meta(path.join(runnerDir,'.runner'));}
for(const dir of [...new Set([giteaBase,runnerDir].filter(Boolean))]){
const git=run('git',['-C',dir,'rev-parse','--show-toplevel']);
if(!git.ok)continue;
const root=git.stdout.trim();const head=run('git',['-C',root,'rev-parse','HEAD']);
const status=run('git',['--no-optional-locks','-C',root,'status','--porcelain','--untracked-files=no']);
report.sourceTrees.push({root:publicPath(root),head:head.ok?head.stdout.trim():null,trackedDirty:status.ok?status.stdout.trim().length>0:null});
}
const processes=run('ps',['-eo','pid=,comm=']);
report.relevantProcessNames=processes.ok?processes.stdout.split('\n').map(l=>l.trim().split(/\s+/)).filter(a=>/^(?:postgres|mysqld|mariadbd|sqlite3|gitea|act_runner|gitea-runner|nginx)$/.test(a[1]??'')).map(a=>({pid:Number(a[0]),command:a[1]})).slice(0,30):[];
const disk=run('df',['-Pk','/']);
report.rootFilesystem=disk.ok?disk.stdout.trim().split('\n').slice(-1)[0].trim().split(/\s+/).slice(1,6):null;
for(const tool of ['pg_dump','pg_restore','mysqldump','mariadb-dump','sqlite3','python3','tar','unzip','curl','git','go']){
report.tools[tool]=['/usr/bin/','/usr/local/bin/','/bin/'].map(p=>p+tool).find(p=>fs.existsSync(p))??null;
}
report.boundaries={configBodyPrinted:false,secretValuesPrinted:false,environmentRead:false,registrationBodyRead:false,serviceChanges:false,backupsOrUpgrades:false};
report.conclusion='READ_ONLY_INVENTORY_ONLY: target/storage/backup-restore and fixed-version compatibility still require verification before maintenance';
console.log('RUNNER_MAINTENANCE_INVENTORY_JSON '+JSON.stringify(report));
NODE
shell: bash
timeout-minutes: "4"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37478
|
1
|
1793520334
|
1793520336
|
1793520334
|
1793520336
|
|
0
|
|
0
|
Edit
Delete
|
|
46009
|
26751
|
116
|
5
|
aa84ee9822653378826fda649c445d2f0b5e462e
|
0
|
Verify actual storage capacity and schema metadata
|
1
|
name: Runner maintenance storage preflight (read o name: Runner maintenance storage preflight (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-preflight.yml]
workflow_dispatch:
jobs:
preflight:
name: Verify actual storage capacity and schema metadata
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read storage sizes and public build metadata
run: |
set -eu
python3 <<'PY'
import configparser, datetime, hashlib, json, mmap, os, pathlib, socket, sqlite3, struct, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z': raise RuntimeError('EXPECTED_HOST_REQUIRED')
config_path=pathlib.Path('/home/git/gitea/config/app.ini')
if hashlib.sha256(config_path.read_bytes()).hexdigest()!='8923b93032ec5c303317b02a7011f756c0ee8e6c2756d4cd4286dd9b5c54d072': raise RuntimeError('CONFIG_CHANGED_REINVENTORY_REQUIRED')
report={'kind':'RunnerMaintenanceStoragePreflight','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sizes':[],'storageSections':[]}
def command(args,timeout=40):
r=subprocess.run(args,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=timeout)
return r.returncode,r.stdout
for p in ['/home/git/gitea','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/root/gitea-ext','/root/gitea-code-review']:
if not pathlib.Path(p).exists(): continue
code,out=command(['du','-sx','--block-size=1',p])
report['sizes'].append({'path':p,'bytes':int(out.split()[0]) if code==0 else None,'exitCode':code})
st=os.statvfs('/')
report['rootFilesystem']={'availableBytes':st.f_bavail*st.f_frsize,'totalBytes':st.f_blocks*st.f_frsize}
cfg=configparser.RawConfigParser(strict=False);cfg.read(config_path)
for section in cfg.sections():
if section.lower().startswith(('storage','lfs','attachment','packages','actions')):
report['storageSections'].append({'section':section,'keys':[k for k in cfg[section] if not any(x in k.lower() for x in ['secret','password','token','access_key'])]})
db='/home/git/gitea/data/gitea.db'
connection=sqlite3.connect('file:'+db+'?mode=ro',uri=True,timeout=10)
connection.execute('PRAGMA query_only=ON')
tables={r[0] for r in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
report['database']={'path':db,'sqliteVersion':sqlite3.sqlite_version,'tableCount':len(tables),'hasAttemptTable':'action_run_attempt' in tables}
if 'version' in tables:
columns=[r[1] for r in connection.execute('PRAGMA table_info("version")')]
col=next((x for x in columns if x.lower()=='version'),None)
if col: report['database']['schemaVersions']=[r[0] for r in connection.execute('SELECT "'+col.replace('"','""')+'" FROM "version" LIMIT 5')]
report['database']['journalMode']=connection.execute('PRAGMA journal_mode').fetchone()[0]
connection.close()
def go_build(path):
try:
with open(path,'rb') as f, mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0:return {'format':'not-found'}
ptr_size=data[at+14];flags=data[at+15]
if not flags&2:return {'format':'pointer-layout','pointerSize':ptr_size,'flags':flags}
pos=at+32
def readvar(pos):
value=0;shift=0
for i in range(10):
b=data[pos];pos+=1;value|=(b&127)<<shift
if b<128:return value,pos
shift+=7
raise ValueError('invalid-varint')
size,pos=readvar(pos);version=bytes(data[pos:pos+size]).decode(errors='replace');pos+=size
size,pos=readvar(pos);mod=bytes(data[pos:pos+size]).decode(errors='replace')
selected=[]
for line in mod.splitlines():
if line.startswith('path\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('mod\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('build\tvcs'): selected.append(line[:200])
return {'format':'inline','goVersion':version,'selectedModuleFields':selected}
except Exception as e:return {'errorClass':type(e).__name__}
report['giteaGoBuild']=go_build('/usr/local/bin/gitea')
report['runnerGoBuild']=go_build('/opt/gitea-runner/act-runner')
for p in ['/home/git/gitea/custom','/home/git/gitea/config','/usr/local/bin/data','/opt/gitea-runner']:
root=pathlib.Path(p)
if not root.is_dir():continue
children=[]
for child in sorted(root.iterdir()):
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','token','password','credential','private']):continue
if p=='/opt/gitea-runner' and child.name not in ['config.yaml','config.yml','act-runner','act_runner']:continue
children.append({'name':child.name,'directory':child.is_dir(),'bytes':child.stat().st_size})
report.setdefault('layoutMetadata',[]).append({'path':p,'children':children[:30]})
report['boundaries']={'serviceChanges':False,'dataWrites':False,'secretValuesPrinted':False,'backupsOrUpgrades':False}
print('RUNNER_MAINTENANCE_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
preflight
|
null
|
["ubuntu-latest"]
|
37479
|
2
|
1793520494
|
1793520533
|
1793520493
|
1793520534
|
|
0
|
|
0
|
Edit
Delete
|
|
46010
|
26752
|
116
|
5
|
d55b0f60f2be02e655419627c2cdbc4a428a721a
|
0
|
Verify actual storage capacity and schema metadata
|
1
|
name: Runner maintenance storage preflight (read o name: Runner maintenance storage preflight (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-preflight.yml]
workflow_dispatch:
jobs:
preflight:
name: Verify actual storage capacity and schema metadata
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read storage sizes and public build metadata
run: |
set -eu
python3 <<'PY'
import configparser, datetime, hashlib, json, mmap, os, pathlib, socket, sqlite3, struct, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z': raise RuntimeError('EXPECTED_HOST_REQUIRED')
config_path=pathlib.Path('/home/git/gitea/config/app.ini')
if hashlib.sha256(config_path.read_bytes()).hexdigest()!='8923b93032ec5c303317b02a7011f756c0ee8e6c2756d4cd4286dd9b5c54d072': raise RuntimeError('CONFIG_CHANGED_REINVENTORY_REQUIRED')
report={'kind':'RunnerMaintenanceStoragePreflight','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sizes':[],'storageSections':[]}
def command(args,timeout=40):
r=subprocess.run(args,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=timeout)
return r.returncode,r.stdout
for p in ['/home/git/gitea','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/root/gitea-ext','/root/gitea-code-review']:
if not pathlib.Path(p).exists(): continue
code,out=command(['du','-sx','--block-size=1',p])
report['sizes'].append({'path':p,'bytes':int(out.split()[0]) if code==0 else None,'exitCode':code})
st=os.statvfs('/')
report['rootFilesystem']={'availableBytes':st.f_bavail*st.f_frsize,'totalBytes':st.f_blocks*st.f_frsize}
# Gitea INI permits top-level APP_NAME/RUN_USER before its first section.
cfg=configparser.RawConfigParser(strict=False);cfg.read_string('[DEFAULT]\n'+config_path.read_text())
for section in cfg.sections():
if section.lower().startswith(('storage','lfs','attachment','packages','actions')):
report['storageSections'].append({'section':section,'keys':[k for k in cfg[section] if not any(x in k.lower() for x in ['secret','password','token','access_key'])]})
db='/home/git/gitea/data/gitea.db'
connection=sqlite3.connect('file:'+db+'?mode=ro',uri=True,timeout=10)
connection.execute('PRAGMA query_only=ON')
tables={r[0] for r in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
report['database']={'path':db,'sqliteVersion':sqlite3.sqlite_version,'tableCount':len(tables),'hasAttemptTable':'action_run_attempt' in tables}
if 'version' in tables:
columns=[r[1] for r in connection.execute('PRAGMA table_info("version")')]
col=next((x for x in columns if x.lower()=='version'),None)
if col: report['database']['schemaVersions']=[r[0] for r in connection.execute('SELECT "'+col.replace('"','""')+'" FROM "version" LIMIT 5')]
report['database']['journalMode']=connection.execute('PRAGMA journal_mode').fetchone()[0]
connection.close()
def go_build(path):
try:
with open(path,'rb') as f, mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0:return {'format':'not-found'}
ptr_size=data[at+14];flags=data[at+15]
if not flags&2:return {'format':'pointer-layout','pointerSize':ptr_size,'flags':flags}
pos=at+32
def readvar(pos):
value=0;shift=0
for i in range(10):
b=data[pos];pos+=1;value|=(b&127)<<shift
if b<128:return value,pos
shift+=7
raise ValueError('invalid-varint')
size,pos=readvar(pos);version=bytes(data[pos:pos+size]).decode(errors='replace');pos+=size
size,pos=readvar(pos);mod=bytes(data[pos:pos+size]).decode(errors='replace')
selected=[]
for line in mod.splitlines():
if line.startswith('path\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('mod\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('build\tvcs'): selected.append(line[:200])
return {'format':'inline','goVersion':version,'selectedModuleFields':selected}
except Exception as e:return {'errorClass':type(e).__name__}
report['giteaGoBuild']=go_build('/usr/local/bin/gitea')
report['runnerGoBuild']=go_build('/opt/gitea-runner/act-runner')
for p in ['/home/git/gitea/custom','/home/git/gitea/config','/usr/local/bin/data','/opt/gitea-runner']:
root=pathlib.Path(p)
if not root.is_dir():continue
children=[]
for child in sorted(root.iterdir()):
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','token','password','credential','private']):continue
if p=='/opt/gitea-runner' and child.name not in ['config.yaml','config.yml','act-runner','act_runner']:continue
children.append({'name':child.name,'directory':child.is_dir(),'bytes':child.stat().st_size})
report.setdefault('layoutMetadata',[]).append({'path':p,'children':children[:30]})
report['boundaries']={'serviceChanges':False,'dataWrites':False,'secretValuesPrinted':False,'backupsOrUpgrades':False}
print('RUNNER_MAINTENANCE_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
preflight
|
null
|
["ubuntu-latest"]
|
37480
|
1
|
1793520610
|
1793520612
|
1793520609
|
1793520612
|
|
0
|
|
0
|
Edit
Delete
|
|
46011
|
26753
|
116
|
5
|
43749e863bb29a4099fef7730f962c9bde7ba4ba
|
0
|
Verify actual storage capacity and schema metadata
|
1
|
name: Runner maintenance storage preflight (read o name: Runner maintenance storage preflight (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-preflight.yml]
workflow_dispatch:
jobs:
preflight:
name: Verify actual storage capacity and schema metadata
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read storage sizes and public build metadata
run: |
set -eu
python3 <<'PY'
import configparser, datetime, hashlib, json, mmap, os, pathlib, socket, sqlite3, struct, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z': raise RuntimeError('EXPECTED_HOST_REQUIRED')
config_path=pathlib.Path('/home/git/gitea/config/app.ini')
if hashlib.sha256(config_path.read_bytes()).hexdigest()!='8923b93032ec5c303317b02a7011f756c0ee8e6c2756d4cd4286dd9b5c54d072': raise RuntimeError('CONFIG_CHANGED_REINVENTORY_REQUIRED')
report={'kind':'RunnerMaintenanceStoragePreflight','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sizes':[],'storageSections':[]}
def command(args,timeout=40):
r=subprocess.run(args,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=timeout)
return r.returncode,r.stdout
for p in ['/home/git/gitea','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/root/gitea-ext','/root/gitea-code-review']:
if not pathlib.Path(p).exists(): continue
code,out=command(['du','-sx','--block-size=1',p])
report['sizes'].append({'path':p,'bytes':int(out.split()[0]) if code==0 else None,'exitCode':code})
st=os.statvfs('/')
report['rootFilesystem']={'availableBytes':st.f_bavail*st.f_frsize,'totalBytes':st.f_blocks*st.f_frsize}
# Gitea INI permits top-level APP_NAME/RUN_USER before its first section.
cfg=configparser.RawConfigParser(strict=False);cfg.read_string('[DEFAULT]\n'+config_path.read_text())
for section in cfg.sections():
if section.lower().startswith(('storage','lfs','attachment','packages','actions')):
report['storageSections'].append({'section':section,'keys':[k for k in cfg[section] if not any(x in k.lower() for x in ['secret','password','token','access_key'])]})
db='/home/git/gitea/data/gitea.db'
connection=sqlite3.connect('file:'+db+'?mode=ro',uri=True,timeout=10)
connection.execute('PRAGMA query_only=ON')
tables={r[0] for r in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
report['database']={'path':db,'sqliteVersion':sqlite3.sqlite_version,'tableCount':len(tables),'hasAttemptTable':'action_run_attempt' in tables}
if 'version' in tables:
columns=[r[1] for r in connection.execute('PRAGMA table_info("version")')]
col=next((x for x in columns if x.lower()=='version'),None)
if col: report['database']['schemaVersions']=[r[0] for r in connection.execute('SELECT "'+col.replace('"','""')+'" FROM "version" LIMIT 5')]
report['database']['journalMode']=connection.execute('PRAGMA journal_mode').fetchone()[0]
connection.close()
def go_build(path):
try:
with open(path,'rb') as f, mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0:return {'format':'not-found'}
ptr_size=data[at+14];flags=data[at+15]
if not flags&2:return {'format':'pointer-layout','pointerSize':ptr_size,'flags':flags}
pos=at+32
def readvar(pos):
value=0;shift=0
for i in range(10):
b=data[pos];pos+=1;value|=(b&127)<<shift
if b<128:return value,pos
shift+=7
raise ValueError('invalid-varint')
size,pos=readvar(pos);version=bytes(data[pos:pos+size]).decode(errors='replace');pos+=size
size,pos=readvar(pos);mod=bytes(data[pos:pos+size]).decode(errors='replace')
selected=[]
for line in mod.splitlines():
if line.startswith('path\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('mod\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('build\tvcs'): selected.append(line[:200])
return {'format':'inline','goVersion':version,'selectedModuleFields':selected}
except Exception as e:return {'errorClass':type(e).__name__}
report['giteaGoBuild']=go_build('/usr/local/bin/gitea')
report['runnerGoBuild']=go_build('/opt/gitea-runner/act-runner')
for p in ['/home/git/gitea/custom','/home/git/gitea/config','/usr/local/bin/data','/opt/gitea-runner']:
root=pathlib.Path(p)
if not root.is_dir():continue
children=[]
for child in sorted(root.iterdir()):
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','token','password','credential','private']):continue
if p=='/opt/gitea-runner' and child.name not in ['config.yaml','config.yml','act-runner','act_runner']:continue
children.append({'name':child.name,'directory':child.is_dir(),'bytes':child.stat().st_size})
report.setdefault('layoutMetadata',[]).append({'path':p,'children':children[:30]})
report['sourceCandidates']=[]
for base in ['/root','/opt','/home/git','/usr/local/src','/srv']:
root=pathlib.Path(base)
if not root.is_dir():continue
for candidate in root.iterdir():
if not candidate.is_dir() or 'gitea' not in candidate.name.lower() or candidate.name.startswith('.'):continue
for project in [candidate,candidate/'gitea',candidate/'src']:
if not (project/'.git').exists():continue
code,head=command(['git','--no-optional-locks','-C',str(project),'rev-parse','HEAD'])
sc,dirty=command(['git','--no-optional-locks','-C',str(project),'status','--porcelain','--untracked-files=no'])
rc,origin=command(['git','--no-optional-locks','-C',str(project),'remote','get-url','origin'])
import re
safe_origin=re.sub(r'://[^/@]+@','://REDACTED@',origin.strip()).split('?',1)[0]
report['sourceCandidates'].append({'path':str(project),'head':head.strip() if code==0 else None,'trackedDirty':bool(dirty.strip()) if sc==0 else None,'origin':safe_origin if rc==0 else None})
report['sizeBreakdown']=[]
for parent in ['/home/git/gitea','/root/gitea-code-review']:
for child in pathlib.Path(parent).iterdir():
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','credential','token','password','private']):continue
if not child.is_dir():continue
code,out=command(['du','-sx','--block-size=1',str(child)])
report['sizeBreakdown'].append({'path':str(child),'bytes':int(out.split()[0]) if code==0 else None})
cfgfile=pathlib.Path('/opt/gitea-runner/config.yaml')
if cfgfile.is_file():
selected={};parent=None
allowed={'log':{'level'},'runner':{'capacity','timeout','shutdown_timeout','fetch_timeout','fetch_interval','file'},'container':{'network','privileged','docker_host'},'cache':{'enabled','dir','host','port'}}
for line in cfgfile.read_text().splitlines():
if not line.strip() or line.lstrip().startswith('#'):continue
if not line.startswith((' ','\t')):parent=line.split(':',1)[0].strip();continue
if ':' not in line:continue
key,value=line.strip().split(':',1)
if key in allowed.get(parent,set()):selected[parent+'.'+key]=value.strip()[:200]
report['runnerConfigWhitelist']=selected
report['boundaries']={'serviceChanges':False,'dataWrites':False,'secretValuesPrinted':False,'backupsOrUpgrades':False}
print('RUNNER_MAINTENANCE_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
preflight
|
null
|
["ubuntu-latest"]
|
37481
|
1
|
1793520767
|
1793520770
|
1793520766
|
1793520770
|
|
0
|
|
0
|
Edit
Delete
|
|
46012
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37482
|
2
|
1793520810
|
1793520815
|
1793520809
|
1793520815
|
|
0
|
|
0
|
Edit
Delete
|
|
46013
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37483
|
2
|
1793520815
|
1793520817
|
1793520809
|
1793520818
|
|
0
|
|
0
|
Edit
Delete
|
|
46014
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
37484
|
4
|
1793520820
|
1793520820
|
1793520809
|
1793520820
|
|
1
|
|
0
|
Edit
Delete
|
|
46015
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: always()
name: Upload port conformance evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
37485
|
4
|
1793520822
|
1793520822
|
1793520809
|
1793520822
|
|
1
|
|
0
|
Edit
Delete
|
|
46016
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: always()
name: Upload workbench browser diagnostics
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: always()
name: Upload runtime and UI evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: always()
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
37486
|
4
|
1793520824
|
1793520824
|
1793520809
|
1793520824
|
|
1
|
|
0
|
Edit
Delete
|
|
46017
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: always()
name: Upload identity evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
37487
|
4
|
1793520826
|
1793520826
|
1793520809
|
1793520826
|
|
1
|
|
0
|
Edit
Delete
|
|
46018
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://github.com/sigstore/cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
37488
|
4
|
1793520828
|
1793520828
|
1793520809
|
1793520828
|
|
1
|
|
0
|
Edit
Delete
|
|
46019
|
26754
|
116
|
5
|
76f97a2f6dc2bd6b257455e845d4eacd141db62f
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
37489
|
2
|
1793520830
|
1793520839
|
1793520809
|
1793520839
|
|
1
|
|
0
|
Edit
Delete
|
|
46020
|
26755
|
116
|
5
|
f24a6b3ed9c82f3ee43458ef7d9f61ba6eab585b
|
0
|
Verify actual storage capacity and schema metadata
|
1
|
name: Runner maintenance storage preflight (read o name: Runner maintenance storage preflight (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/runner-maintenance-preflight.yml]
workflow_dispatch:
jobs:
preflight:
name: Verify actual storage capacity and schema metadata
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read storage sizes and public build metadata
run: |
set -eu
python3 <<'PY'
import configparser, datetime, hashlib, json, mmap, os, pathlib, socket, sqlite3, struct, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z': raise RuntimeError('EXPECTED_HOST_REQUIRED')
config_path=pathlib.Path('/home/git/gitea/config/app.ini')
if hashlib.sha256(config_path.read_bytes()).hexdigest()!='8923b93032ec5c303317b02a7011f756c0ee8e6c2756d4cd4286dd9b5c54d072': raise RuntimeError('CONFIG_CHANGED_REINVENTORY_REQUIRED')
report={'kind':'RunnerMaintenanceStoragePreflight','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sizes':[],'storageSections':[]}
def command(args,timeout=40):
r=subprocess.run(args,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=timeout)
return r.returncode,r.stdout
for p in ['/home/git/gitea','/home/git/repositories','/usr/local/bin/data','/opt/gitea-runner','/root/gitea-ext','/root/gitea-code-review']:
if not pathlib.Path(p).exists(): continue
code,out=command(['du','-sx','--block-size=1',p])
report['sizes'].append({'path':p,'bytes':int(out.split()[0]) if code==0 else None,'exitCode':code})
st=os.statvfs('/')
report['rootFilesystem']={'availableBytes':st.f_bavail*st.f_frsize,'totalBytes':st.f_blocks*st.f_frsize}
# Gitea INI permits top-level APP_NAME/RUN_USER before its first section.
cfg=configparser.RawConfigParser(strict=False);cfg.read_string('[DEFAULT]\n'+config_path.read_text())
for section in cfg.sections():
if section.lower().startswith(('storage','lfs','attachment','packages','actions')):
report['storageSections'].append({'section':section,'keys':[k for k in cfg[section] if not any(x in k.lower() for x in ['secret','password','token','access_key'])]})
db='/home/git/gitea/data/gitea.db'
connection=sqlite3.connect('file:'+db+'?mode=ro',uri=True,timeout=10)
connection.execute('PRAGMA query_only=ON')
tables={r[0] for r in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
report['database']={'path':db,'sqliteVersion':sqlite3.sqlite_version,'tableCount':len(tables),'hasAttemptTable':'action_run_attempt' in tables}
if 'version' in tables:
columns=[r[1] for r in connection.execute('PRAGMA table_info("version")')]
col=next((x for x in columns if x.lower()=='version'),None)
if col: report['database']['schemaVersions']=[r[0] for r in connection.execute('SELECT "'+col.replace('"','""')+'" FROM "version" LIMIT 5')]
report['database']['journalMode']=connection.execute('PRAGMA journal_mode').fetchone()[0]
connection.close()
def go_build(path):
try:
with open(path,'rb') as f, mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0:return {'format':'not-found'}
ptr_size=data[at+14];flags=data[at+15]
if not flags&2:return {'format':'pointer-layout','pointerSize':ptr_size,'flags':flags}
pos=at+32
def readvar(pos):
value=0;shift=0
for i in range(10):
b=data[pos];pos+=1;value|=(b&127)<<shift
if b<128:return value,pos
shift+=7
raise ValueError('invalid-varint')
size,pos=readvar(pos);version=bytes(data[pos:pos+size]).decode(errors='replace');pos+=size
size,pos=readvar(pos);mod=bytes(data[pos:pos+size]).decode(errors='replace')
selected=[]
for line in mod.splitlines():
if line.startswith('path\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('mod\t') and ('gitea' in line or 'runner' in line): selected.append(line[:300])
elif line.startswith('build\tvcs'): selected.append(line[:200])
return {'format':'inline','goVersion':version,'selectedModuleFields':selected}
except Exception as e:return {'errorClass':type(e).__name__}
report['giteaGoBuild']=go_build('/usr/local/bin/gitea')
report['runnerGoBuild']=go_build('/opt/gitea-runner/act-runner')
for p in ['/home/git/gitea/custom','/home/git/gitea/config','/usr/local/bin/data','/opt/gitea-runner']:
root=pathlib.Path(p)
if not root.is_dir():continue
children=[]
for child in sorted(root.iterdir()):
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','token','password','credential','private']):continue
if p=='/opt/gitea-runner' and child.name not in ['config.yaml','config.yml','act-runner','act_runner']:continue
children.append({'name':child.name,'directory':child.is_dir(),'bytes':child.stat().st_size})
report.setdefault('layoutMetadata',[]).append({'path':p,'children':children[:30]})
report['sourceCandidates']=[]
for base in ['/root','/opt','/home/git','/usr/local/src','/srv']:
root=pathlib.Path(base)
if not root.is_dir():continue
for candidate in root.iterdir():
if not candidate.is_dir() or 'gitea' not in candidate.name.lower() or candidate.name.startswith('.'):continue
for project in [candidate,candidate/'gitea',candidate/'src']:
if not (project/'.git').exists():continue
code,head=command(['git','--no-optional-locks','-C',str(project),'rev-parse','HEAD'])
sc,dirty=command(['git','--no-optional-locks','-C',str(project),'status','--porcelain','--untracked-files=no'])
rc,origin=command(['git','--no-optional-locks','-C',str(project),'remote','get-url','origin'])
import re
safe_origin=re.sub(r'://[^/@]+@','://REDACTED@',origin.strip()).split('?',1)[0]
dc,delta=command(['git','--no-optional-locks','-C',str(project),'diff','--numstat'])
changed=[]
if dc==0:
for row in delta.splitlines():
fields=row.split('\t',2)
if len(fields)!=3:continue
name=fields[2]
if any(x in name.lower() for x in ['secret','credential','token','password','private','.env']):name='REDACTED_SENSITIVE_PATH'
changed.append({'added':fields[0],'removed':fields[1],'path':name})
report['sourceCandidates'].append({'path':str(project),'head':head.strip() if code==0 else None,'trackedDirty':bool(dirty.strip()) if sc==0 else None,'origin':safe_origin if rc==0 else None,'changedFiles':changed[:60]})
report['sizeBreakdown']=[]
for parent in ['/home/git/gitea','/root/gitea-code-review']:
for child in pathlib.Path(parent).iterdir():
if child.name.startswith('.') or any(x in child.name.lower() for x in ['secret','credential','token','password','private']):continue
if not child.is_dir():continue
code,out=command(['du','-sx','--block-size=1',str(child)])
report['sizeBreakdown'].append({'path':str(child),'bytes':int(out.split()[0]) if code==0 else None})
cfgfile=pathlib.Path('/opt/gitea-runner/config.yaml')
if cfgfile.is_file():
selected={};parent=None
allowed={'log':{'level'},'runner':{'capacity','timeout','shutdown_timeout','fetch_timeout','fetch_interval','file'},'container':{'network','privileged','docker_host'},'cache':{'enabled','dir','host','port'}}
for line in cfgfile.read_text().splitlines():
if not line.strip() or line.lstrip().startswith('#'):continue
if not line.startswith((' ','\t')):parent=line.split(':',1)[0].strip();continue
if ':' not in line:continue
key,value=line.strip().split(':',1)
if key in allowed.get(parent,set()):selected[parent+'.'+key]=value.strip()[:200]
report['runnerConfigWhitelist']=selected
report['extraTools']={}
for executable in ['/usr/local/go/bin/go','/usr/bin/node','/usr/bin/gpg','/usr/bin/zstd','/usr/bin/nsenter','/usr/bin/systemd-run']:
if not pathlib.Path(executable).is_file():continue
args=[executable,'version'] if executable.endswith('/go') else [executable,'--version']
code,version=command(args,timeout=10)
report['extraTools'][executable]={'exists':True,'versionFirstLine':version.splitlines()[0][:200] if code==0 and version.splitlines() else None}
import urllib.request,urllib.error,re
report['officialChecksumReachability']=[]
for url in ['https://dl.gitea.com/gitea/28.2.0/gitea-28.2.0-linux-amd64.sha256','https://dl.gitea.com/gitea-runner/5.0.0/gitea-runner-5.0.0-linux-amd64.sha256']:
item={'url':url}
try:
with urllib.request.urlopen(url,timeout=15) as response:
body=response.read(4096).decode();item['httpStatus']=response.status
match=re.search(r'\b[a-f0-9]{64}\b',body);item['sha256']=match.group(0) if match else None
except Exception as error:item.update({'errorClass':type(error).__name__,'httpStatus':getattr(error,'code',None)})
report['officialChecksumReachability'].append(item)
report['boundaries']={'serviceChanges':False,'dataWrites':False,'secretValuesPrinted':False,'backupsOrUpgrades':False}
print('RUNNER_MAINTENANCE_PREFLIGHT_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
preflight
|
null
|
["ubuntu-latest"]
|
37490
|
1
|
1793520919
|
1793520926
|
1793520918
|
1793520927
|
|
0
|
|
0
|
Edit
Delete
|
|
46021
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37491
|
2
|
1793521421
|
1793521425
|
1793521420
|
1793521425
|
|
0
|
|
0
|
Edit
Delete
|
|
46022
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37492
|
2
|
1793521425
|
1793521428
|
1793521420
|
1793521428
|
|
0
|
|
0
|
Edit
Delete
|
|
46023
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
37493
|
4
|
1793521430
|
1793521430
|
1793521420
|
1793521430
|
|
1
|
|
0
|
Edit
Delete
|
|
46024
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: always()
name: Upload port conformance evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
37494
|
4
|
1793521432
|
1793521432
|
1793521420
|
1793521432
|
|
1
|
|
0
|
Edit
Delete
|
|
46025
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: always()
name: Upload workbench browser diagnostics
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: always()
name: Upload runtime and UI evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: always()
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
37495
|
4
|
1793521434
|
1793521434
|
1793521420
|
1793521434
|
|
1
|
|
0
|
Edit
Delete
|
|
46026
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: always()
name: Upload identity evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
37496
|
4
|
1793521436
|
1793521436
|
1793521420
|
1793521436
|
|
1
|
|
0
|
Edit
Delete
|
|
46027
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://github.com/sigstore/cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
37497
|
4
|
1793521438
|
1793521438
|
1793521420
|
1793521438
|
|
1
|
|
0
|
Edit
Delete
|
|
46028
|
26756
|
116
|
5
|
f2bafab2f52ef009dc61ecee0ab1e8a1ffbf09a9
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
37498
|
2
|
1793521440
|
1793521450
|
1793521420
|
1793521450
|
|
1
|
|
0
|
Edit
Delete
|
|
46029
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37499
|
2
|
1793521516
|
1793521520
|
1793521515
|
1793521520
|
|
0
|
|
0
|
Edit
Delete
|
|
46030
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37500
|
2
|
1793521520
|
1793521523
|
1793521515
|
1793521523
|
|
0
|
|
0
|
Edit
Delete
|
|
46031
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
37501
|
4
|
1793521525
|
1793521525
|
1793521515
|
1793521526
|
|
1
|
|
0
|
Edit
Delete
|
|
46032
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: always()
name: Upload port conformance evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
37502
|
4
|
1793521527
|
1793521527
|
1793521515
|
1793521528
|
|
1
|
|
0
|
Edit
Delete
|
|
46033
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: always()
name: Upload workbench browser diagnostics
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: always()
name: Upload runtime and UI evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: always()
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
37503
|
4
|
1793521529
|
1793521529
|
1793521515
|
1793521530
|
|
1
|
|
0
|
Edit
Delete
|
|
46034
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: always()
name: Upload identity evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
37504
|
4
|
1793521531
|
1793521531
|
1793521515
|
1793521532
|
|
1
|
|
0
|
Edit
Delete
|
|
46035
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://github.com/sigstore/cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
37505
|
4
|
1793521533
|
1793521533
|
1793521515
|
1793521534
|
|
1
|
|
0
|
Edit
Delete
|
|
46036
|
26757
|
116
|
5
|
836466a5e468320ad6a530fa57d86f484eceb807
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
37506
|
2
|
1793521535
|
1793521544
|
1793521515
|
1793521544
|
|
1
|
|
0
|
Edit
Delete
|
|
46037
|
26758
|
116
|
5
|
02740b6b7da73e4541fa136c6ef7a6ae003c0f67
|
0
|
Verify current custom build without service change Verify current custom build without service changes...
|
1
|
name: Gitea offline build identity check
"on&# name: Gitea offline build identity check
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-offline-repro.yml]
workflow_dispatch:
jobs:
reproduce:
name: Verify current custom build without service changes
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Reproduce offline in private resource-limited workspace
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, mmap, os, pathlib, socket, subprocess, re
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
source=pathlib.Path('/root/gitea-src')
binary=pathlib.Path('/usr/local/bin/gitea')
def sha(p):
h=hashlib.sha256()
with open(p,'rb') as f:
for b in iter(lambda:f.read(1024*1024),b''):h.update(b)
return h.hexdigest()
if sha(binary)!='640efd1256fe5ace902a1185bd6fdedd063ec1eec08422aceded8cc9559a8dc9':raise RuntimeError('RUNNING_BINARY_CHANGED')
with open(binary,'rb') as f,mmap.mmap(f.fileno(),0,access=mmap.ACCESS_READ) as data:
at=data.find(b'\xff Go buildinf:')
if at<0 or not data[at+15]&2:raise RuntimeError('INLINE_BUILD_INFO_REQUIRED')
def varint(pos):
n=0;shift=0
for i in range(10):
b=data[pos];pos+=1;n|=(b&127)<<shift
if b<128:return n,pos
shift+=7
raise RuntimeError('INVALID_BUILD_INFO')
pos=at+32;n,pos=varint(pos);goversion=bytes(data[pos:pos+n]).decode();pos+=n
n,pos=varint(pos);module=bytes(data[pos:pos+n]).decode(errors='replace')
settings={}
for line in module.splitlines():
if line.startswith('build\t') and '=' in line[6:]:
k,v=line[6:].split('=',1);settings[k]=v
report={'kind':'GiteaOfflineReproducibilityProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'requiredGoVersion':goversion,'status':'PREPARING','liveServicesChanged':False,'liveDataChanged':False,'sourceWritten':False,'newCredentials':False}
candidates=[pathlib.Path('/usr/local/go/bin/go')]
for root in ['/root/go/pkg/mod/golang.org','/root/sdk','/usr/local','/opt']:
p=pathlib.Path(root)
if not p.is_dir():continue
for d in p.iterdir():
if d.is_dir() and (d.name.startswith('toolchain@') or d.name.startswith('go')):
candidates.append(d/'bin/go')
compiler=None
report['toolchains']=[]
for p in dict.fromkeys(candidates):
if not p.is_file():continue
r=subprocess.run([str(p),'version'],capture_output=True,text=True,timeout=10,env={'PATH':'/usr/bin:/bin','GOTOOLCHAIN':'local'})
text=r.stdout.strip() if r.returncode==0 else ''
report['toolchains'].append({'path':str(p),'version':text[:150]})
if goversion in text.split():compiler=p
def emit():
print('GITEA_OFFLINE_REPRO_JSON '+json.dumps(report,separators=(',',':')))
if compiler is None:
report['status']='BLOCKED_MATCHING_TOOLCHAIN_NOT_FOUND';emit();raise SystemExit(0)
if settings.get('-buildmode','exe')!='exe' or settings.get('-compiler','gc')!='gc':
report['status']='BLOCKED_UNSUPPORTED_BUILD_SETTINGS';emit();raise SystemExit(0)
linkflags=settings.get('-ldflags','')
if re.search(r'password|secret|token|private.?key',linkflags,re.I):
report['status']='BLOCKED_SENSITIVE_LINK_FLAGS';emit();raise SystemExit(0)
def fingerprint():
h=hashlib.sha256();count=0
for root,dirs,files in os.walk(source):
dirs[:]=sorted(d for d in dirs if d not in ['.git','node_modules','.cache','.secrets','.evidence-private'])
for name in sorted(files):
if name.startswith('.env') or name.endswith(('.key','.pem')):continue
p=pathlib.Path(root)/name
if p.is_symlink() or not p.is_file():continue
h.update(str(p.relative_to(source)).encode()+b'\0'+bytes.fromhex(sha(p)));count+=1
return h.hexdigest(),count
before,count=fingerprint();report['inputFingerprintBefore']=before;report['inputFiles']=count
base=pathlib.Path('/var/lib/eios-r1-maintenance')
if base.exists() and (base.is_symlink() or base.stat().st_uid!=0 or base.stat().st_mode&0o077):raise RuntimeError('PRIVATE_WORKSPACE_PERMISSIONS_REQUIRED')
base.mkdir(mode=0o700,exist_ok=True)
runid=os.environ.get('GITHUB_RUN_ID')
if not runid or not runid.isdigit():raise RuntimeError('REAL_RUN_ID_REQUIRED')
work=base/('repro-'+runid);work.mkdir(mode=0o700)
for name in ['cache','tmp']:(work/name).mkdir(mode=0o700)
args=[str(compiler),'build','-mod=readonly','-p','2','-o',str(work/'gitea')]
for setting in ['-tags','-trimpath','-asmflags','-gcflags','-ldflags']:
if setting in settings:args.append(setting+'='+settings[setting])
args.append('.')
unit='eios-r1-repro-'+runid
command=['systemd-run','--quiet','--wait','--collect','--unit='+unit,'--working-directory='+str(source),
'--property=User=root','--property=Nice=10','--property=CPUQuota=150%','--property=MemoryMax=2G',
'--property=PrivateNetwork=yes','--property=ProtectSystem=strict','--property=ProtectHome=read-only',
'--property=PrivateTmp=yes','--property=ReadWritePaths='+str(work),
'--property=StandardOutput=file:'+str(work/'build.stdout'),'--property=StandardError=file:'+str(work/'build.stderr'),
'--setenv=PATH=/usr/bin:/bin','--setenv=GOTOOLCHAIN=local','--setenv=GOPROXY=off','--setenv=GOSUMDB=off',
'--setenv=GOMODCACHE=/root/go/pkg/mod','--setenv=GOCACHE='+str(work/'cache'),'--setenv=TMPDIR='+str(work/'tmp'),
'--setenv=GIT_OPTIONAL_LOCKS=0']+args
r=subprocess.run(command,stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=1200)
report['buildExitCode']=r.returncode
after,_=fingerprint();report['inputFingerprintAfter']=after
if before!=after:report['status']='BLOCKED_SOURCE_CHANGED_DURING_BUILD'
elif r.returncode!=0:report['status']='OFFLINE_REPRO_BUILD_FAILED'
elif (work/'gitea').is_file():
report['reproducedSha256']=sha(work/'gitea')
report['matchesRunningBinary']=report['reproducedSha256']==sha(binary)
report['status']='REPRODUCED_MATCH' if report['matchesRunningBinary'] else 'REPRODUCED_DIFFERENT_HASH'
else:report['status']='OFFLINE_REPRO_OUTPUT_MISSING'
report['privateWorkspace']=str(work);report['networkIsolated']=True;report['liveSourceReadOnly']=True
(work/'receipt.json').write_text(json.dumps(report,indent=2)+'\n')
emit()
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
...
|
reproduce
|
null
|
["ubuntu-latest"]
|
37507
|
1
|
1793521559
|
1793522041
|
1793521558
|
1793522041
|
|
0
|
|
0
|
Edit
Delete
|
|
46038
|
26759
|
116
|
5
|
246c4232d67843cc6f47fd8e49d04eb906873ecd
|
0
|
inspect
|
1
|
name: Gitea migration identity (read only)
"on name: Gitea migration identity (read only)
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-migration-identity.yml]
workflow_dispatch:
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Read migration mapping and schema column names
run: |
set -eu
python3 <<'PY'
import datetime, hashlib, json, os, pathlib, re, socket, sqlite3, subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
source=pathlib.Path('/root/gitea-src')
env=dict(os.environ,GIT_OPTIONAL_LOCKS='0')
def git(*args):
r=subprocess.run(['git','--no-optional-locks','-C',str(source),*args],capture_output=True,text=True,timeout=30,env=env)
if r.returncode:raise RuntimeError('SOURCE_READ_FAILED')
return r.stdout
head=git('rev-parse','HEAD').strip()
if head!='287bf811487c04cd90bcf07aa04905cbaf2e4c2d':raise RuntimeError('SOURCE_BASE_CHANGED')
report={'kind':'GiteaMigrationIdentityProbe','observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'ci':{'sourceSha':os.environ.get('GITHUB_SHA'),'runId':os.environ.get('GITHUB_RUN_ID')},'releaseEligible':False,'sourceHead':head,'serviceChanges':False,'databaseWrites':False}
path='models/migrations/migrations.go'
current=(source/path).read_text()
base=git('show','HEAD:'+path)
# This emits migration code only, from two fixed source paths; never configuration or row data.
def entries(text):
return [{'number':int(m.group(1)), 'description':m.group(2), 'function':m.group(3)} for m in re.finditer(r'newMigration\(\s*(\d+)\s*,\s*"([^"]+)"\s*,\s*([a-zA-Z0-9_.]+)',text)]
report['baseMigrationEntries']=entries(base)
report['workingMigrationEntries']=entries(current)
report['migrationFileSha256']=hashlib.sha256(current.encode()).hexdigest()
delta=git('diff','--no-ext-diff','--unified=3','HEAD','--',path,'models/migrations/v1_22/v299.go')
# Any unexpectedly embedded credential literal stops export, without printing it.
if re.search(r'(?:password|secret|token|private.?key)\s*[:=]\s*["\'][^"\']{8,}["\']',delta,re.I):raise RuntimeError('SENSITIVE_LITERAL_REFUSED')
report['migrationSourceDiff']=delta
report['goModuleHeader']=[x for x in (source/'go.mod').read_text().splitlines()[:6] if x.startswith(('module ','go ','toolchain '))]
connection=sqlite3.connect('file:/home/git/gitea/data/gitea.db?mode=ro',uri=True,timeout=15)
connection.execute('PRAGMA query_only=ON')
tables={row[0] for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")}
selected=['version','action_run','action_run_job','action_run_attempt','action_artifact','protected_branch','repository','team','user']
report['schemaColumns']={t:[r[1] for r in connection.execute('PRAGMA table_info("'+t+'")')] if t in tables else None for t in selected}
report['schemaVersion']=connection.execute('SELECT version FROM version WHERE id=1').fetchone()[0]
connection.close()
print('GITEA_MIGRATION_IDENTITY_JSON '+json.dumps(report,separators=(',',':')))
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
inspect
|
null
|
["ubuntu-latest"]
|
37510
|
1
|
1793522135
|
1793522135
|
1793521654
|
1793522136
|
|
1
|
|
0
|
Edit
Delete
|
|
46039
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
Static checks (locked engineering dependency)
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46040
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
Static governance (repo root, private packages)
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46041
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46042
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
Port conformance (kernel / modules / clients)
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: always()
name: Upload port conformance evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46043
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: always()
name: Upload workbench browser diagnostics
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: always()
name: Upload runtime and UI evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: always()
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46044
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: always()
name: Upload identity evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46045
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://github.com/sigstore/cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46046
|
26760
|
116
|
5
|
efcd1ef325b241e56e5ed348a946c1b7bbeb603d
|
0
|
Release candidate verification + manifest
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793521754
|
1793521667
|
1793521754
|
|
0
|
|
0
|
Edit
Delete
|
|
46047
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37508
|
2
|
1793522041
|
1793522131
|
1793521755
|
1793522132
|
|
0
|
|
0
|
Edit
Delete
|
|
46048
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37509
|
2
|
1793522132
|
1793522135
|
1793521755
|
1793522135
|
|
0
|
|
0
|
Edit
Delete
|
|
46049
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
37511
|
4
|
1793522137
|
1793522137
|
1793521755
|
1793522137
|
|
1
|
|
0
|
Edit
Delete
|
|
46050
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: always()
name: Upload port conformance evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
37512
|
4
|
1793522139
|
1793522139
|
1793521755
|
1793522139
|
|
1
|
|
0
|
Edit
Delete
|
|
46051
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: always()
name: Upload workbench browser diagnostics
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: always()
name: Upload runtime and UI evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: always()
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
37513
|
4
|
1793522141
|
1793522141
|
1793521755
|
1793522141
|
|
1
|
|
0
|
Edit
Delete
|
|
46052
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity --filter api-nestjs
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (single NestJS host, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (single NestJS host)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: always()
name: Upload identity evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
37514
|
4
|
1793522143
|
1793522143
|
1793521755
|
1793522143
|
|
1
|
|
0
|
Edit
Delete
|
|
46053
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://github.com/sigstore/cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
37515
|
4
|
1793522145
|
1793522145
|
1793521755
|
1793522145
|
|
1
|
|
0
|
Edit
Delete
|
|
46054
|
26761
|
116
|
5
|
4c2cfd53802075ca008755d01e8924cd52709e59
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${GITHUB_RUN_ATTEMPT}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: https://github.com/actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
37516
|
2
|
1793522147
|
1793522194
|
1793521755
|
1793522195
|
|
1
|
|
0
|
Edit
Delete
|