|
46390
|
26901
|
116
|
5
|
0fb38a2262896cb16bf07ea168b88d2dda4cbf6d
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37767
|
2
|
1793578063
|
1793578072
|
1793577996
|
1793578072
|
|
0
|
|
0
|
Edit
Delete
|
|
46391
|
26901
|
116
|
5
|
0fb38a2262896cb16bf07ea168b88d2dda4cbf6d
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37768
|
2
|
1793578072
|
1793578075
|
1793577996
|
1793578075
|
|
0
|
|
0
|
Edit
Delete
|
|
46398
|
26902
|
116
|
5
|
a7560b622e3b594933bda3d1c88cdd73f19a6633
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,RuntimeError) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37769
|
2
|
1793578075
|
1793578076
|
1793578021
|
1793578076
|
|
0
|
|
0
|
Edit
Delete
|
|
46399
|
26903
|
116
|
5
|
f89c8d3dfed121a0d1a84a6bf41ea075a6ca03fd
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,(RuntimeError,ValueError)) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37776
|
2
|
1793578160
|
1793578160
|
1793578159
|
1793578161
|
|
0
|
|
0
|
Edit
Delete
|
|
46400
|
26904
|
133
|
5
|
8a0189100c6edafe263a42bf866057f69195e538
|
0
|
check
|
1
|
name: infra
"on":
push: {branches: [ma name: infra
"on":
push: {branches: [main]}
pull_request:
jobs:
check:
name: check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: npm ci
- name: npm run check（控制面不可得时声明漂移检查自动 SKIP）
run: npm run check
...
|
check
|
null
|
["ubuntu-latest"]
|
37777
|
1
|
1793578190
|
1793578214
|
1793578190
|
1793578215
|
|
0
|
|
0
|
Edit
Delete
|
|
46401
|
26904
|
133
|
5
|
8a0189100c6edafe263a42bf866057f69195e538
|
0
|
declarations-drift
|
1
|
name: infra
"on":
push: {branches: [ma name: infra
"on":
push: {branches: [main]}
pull_request:
jobs:
declarations-drift:
name: declarations-drift
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
path: infra
- uses: actions/checkout@v4
with:
path: enterprise-platform
repository: ${{ github.repository_owner }}/enterprise-platform
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node infra/scripts/sync-declarations.mjs --from enterprise-platform --check
...
|
declarations-drift
|
null
|
["ubuntu-latest"]
|
37778
|
2
|
1793578215
|
1793578231
|
1793578190
|
1793578232
|
|
0
|
|
0
|
Edit
Delete
|
|
46402
|
26905
|
116
|
5
|
fa1f638223ee62ac0fae19b177087232f58f3004
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37779
|
1
|
1793578244
|
1793578253
|
1793578243
|
1793578254
|
|
0
|
|
0
|
Edit
Delete
|
|
46403
|
26906
|
116
|
5
|
37718a544cac68c68a783bb29e612c72d478acd0
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37780
|
2
|
1793578334
|
1793578335
|
1793578332
|
1793578335
|
|
0
|
|
0
|
Edit
Delete
|
|
46404
|
26907
|
116
|
5
|
11ac9dc1eaad0663c9b25cb3fcfd175f18e7d444
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,(RuntimeError,ValueError)) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37781
|
1
|
1793578412
|
1793578412
|
1793578410
|
1793578413
|
|
0
|
|
0
|
Edit
Delete
|
|
46405
|
26908
|
116
|
5
|
11ac9dc1eaad0663c9b25cb3fcfd175f18e7d444
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37782
|
1
|
1793578414
|
1793578415
|
1793578411
|
1793578415
|
|
0
|
|
0
|
Edit
Delete
|
|
46406
|
26909
|
116
|
5
|
ccd4e8a1af1b63779fb6694497e0b6846b8374c7
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37783
|
1
|
1793578552
|
1793578555
|
1793578551
|
1793578556
|
|
0
|
|
0
|
Edit
Delete
|
|
46407
|
26910
|
116
|
5
|
63e4dc2d4fee49fe7bab80b0d076349ea6ebd94e
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37784
|
1
|
1793579034
|
1793579036
|
1793579033
|
1793579037
|
|
0
|
|
0
|
Edit
Delete
|
|
46408
|
26911
|
116
|
5
|
2722369f676178f4f529509863063cd70a9261fe
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37785
|
2
|
1793579439
|
1793579443
|
1793579437
|
1793579443
|
|
0
|
|
0
|
Edit
Delete
|
|
46409
|
26911
|
116
|
5
|
2722369f676178f4f529509863063cd70a9261fe
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37786
|
2
|
1793579443
|
1793579446
|
1793579437
|
1793579446
|
|
0
|
|
0
|
Edit
Delete
|
|
46416
|
26912
|
160
|
5
|
782018b7c721129de41189a65276dee1652eb5c5
|
0
|
Frontend Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
37793
|
1
|
1793579632
|
1793579826
|
1793579631
|
1793579826
|
|
0
|
|
0
|
Edit
Delete
|
|
46417
|
26912
|
160
|
5
|
782018b7c721129de41189a65276dee1652eb5c5
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
37794
|
3
|
1793579826
|
1793580013
|
1793579631
|
1793580013
|
|
0
|
|
0
|
Edit
Delete
|
|
46421
|
26912
|
160
|
5
|
782018b7c721129de41189a65276dee1652eb5c5
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793580013
|
1793579631
|
1793580013
|
|
0
|
|
0
|
Edit
Delete
|
|
46422
|
26913
|
116
|
5
|
8bc522dc372989a4082475b1aae88ee1924811e3
|
0
|
cleanup
|
1
|
name: Remove only verified idle duplicate tools fr name: Remove only verified idle duplicate tools from failed maintenance run
"on":
workflow_dispatch:
jobs:
cleanup:
name: cleanup
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform' && github.ref == 'refs/heads/codex/runner-maintenance-diagnostic-20261101'
steps:
- name: Recheck two exact copies and preserve every other task file
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/cleanup-obsolete-tools.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_CLEANUP_SOURCE_REQUIRED')
exec(compile(r.stdout,'cleanup-obsolete-tools.py','exec'),{'__name__':'__main__'})
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
cleanup
|
null
|
["ubuntu-latest"]
|
37795
|
2
|
1793580016
|
1793580024
|
1793580009
|
1793580024
|
|
0
|
|
0
|
Edit
Delete
|
|
46423
|
26914
|
160
|
5
|
c56d74ed8b0eaf2894ef0c944adcf878e03803d0
|
0
|
Frontend Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
37796
|
1
|
1793580024
|
1793580170
|
1793580013
|
1793580170
|
|
0
|
|
0
|
Edit
Delete
|
|
46424
|
26914
|
160
|
5
|
c56d74ed8b0eaf2894ef0c944adcf878e03803d0
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
37797
|
3
|
1793580170
|
1793580541
|
1793580013
|
1793580541
|
|
0
|
|
0
|
Edit
Delete
|
|
46428
|
26914
|
160
|
5
|
c56d74ed8b0eaf2894ef0c944adcf878e03803d0
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793580541
|
1793580013
|
1793580541
|
|
0
|
|
0
|
Edit
Delete
|
|
46429
|
26915
|
116
|
5
|
135dcf751613b903b449be1852b697472becb3ef
|
0
|
inventory
|
1
|
name: Read owned maintenance directory sizes witho name: Read owned maintenance directory sizes without cleanup
"on":
workflow_dispatch:
jobs:
inventory:
name: inventory
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Inspect fixed task directory metadata only
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/inventory-window-capacity.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_INVENTORY_SOURCE_REQUIRED')
exec(compile(r.stdout,'inventory-window-capacity.py','exec'))
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
inventory
|
null
|
["ubuntu-latest"]
|
37798
|
1
|
1793580544
|
1793580556
|
1793580291
|
1793580557
|
|
0
|
|
0
|
Edit
Delete
|
|
46430
|
26916
|
160
|
5
|
fdbbc6a81d6a13324ed848c4b56231faf6c3d3eb
|
0
|
Frontend Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
37799
|
1
|
1793580557
|
1793580701
|
1793580541
|
1793580702
|
|
0
|
|
0
|
Edit
Delete
|
|
46431
|
26916
|
160
|
5
|
fdbbc6a81d6a13324ed848c4b56231faf6c3d3eb
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
37800
|
1
|
1793580702
|
1793581576
|
1793580541
|
1793581576
|
|
0
|
|
0
|
Edit
Delete
|
|
46435
|
26916
|
160
|
5
|
fdbbc6a81d6a13324ed848c4b56231faf6c3d3eb
|
0
|
Gate Integrity (meta-gate · HARD)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
37801
|
1
|
1793581577
|
1793581621
|
1793580541
|
1793581621
|
|
0
|
|
0
|
Edit
Delete
|
|
46436
|
26917
|
116
|
5
|
03f3fff139ed461e4d27a1b738dc4fe339454b06
|
0
|
cleanup
|
1
|
name: Remove only verified idle duplicate tools fr name: Remove only verified idle duplicate tools from failed maintenance run
"on":
workflow_dispatch:
jobs:
cleanup:
name: cleanup
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform' && github.ref == 'refs/heads/codex/runner-maintenance-diagnostic-20261101'
steps:
- name: Recheck two exact copies and preserve every other task file
run: |
set -eu
python3 <<'PY'
import os,re,subprocess
sha=os.environ['GITHUB_SHA'];repo='/home/git/repositories/luoanwu/enterprise-platform.git'
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
r=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/cleanup-obsolete-tools.py'],capture_output=True,timeout=20)
if r.returncode:raise RuntimeError('FIXED_CLEANUP_SOURCE_REQUIRED')
exec(compile(r.stdout,'cleanup-obsolete-tools.py','exec'),{'__name__':'__main__'})
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
...
|
cleanup
|
null
|
["ubuntu-latest"]
|
37804
|
1
|
1793582118
|
1793582151
|
1793581650
|
1793582151
|
|
0
|
|
0
|
Edit
Delete
|
|
46437
|
26918
|
116
|
5
|
696d3ff871cdce70e0ab256c5eb08091e0967a33
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37805
|
2
|
1793582151
|
1793582242
|
1793581908
|
1793582242
|
|
0
|
|
0
|
Edit
Delete
|
|
46438
|
26918
|
116
|
5
|
696d3ff871cdce70e0ab256c5eb08091e0967a33
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37806
|
2
|
1793582242
|
1793582536
|
1793581908
|
1793582536
|
|
0
|
|
0
|
Edit
Delete
|
|
46445
|
26919
|
160
|
5
|
26b9d70c2f1e7ce41ba1e2e515e6b25b8b7fa82b
|
0
|
Frontend Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582181
|
1793582117
|
1793582181
|
|
0
|
|
0
|
Edit
Delete
|
|
46446
|
26919
|
160
|
5
|
26b9d70c2f1e7ce41ba1e2e515e6b25b8b7fa82b
|
0
|
Lint & Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582181
|
1793582117
|
1793582181
|
|
0
|
|
0
|
Edit
Delete
|
|
46450
|
26919
|
160
|
5
|
26b9d70c2f1e7ce41ba1e2e515e6b25b8b7fa82b
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582181
|
1793582117
|
1793582181
|
|
0
|
|
0
|
Edit
Delete
|
|
46451
|
26920
|
160
|
5
|
4c925eb3ff629a4aa96c6819d5d09617e97c5c79
|
0
|
Frontend Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582299
|
1793582181
|
1793582299
|
|
0
|
|
0
|
Edit
Delete
|
|
46452
|
26920
|
160
|
5
|
4c925eb3ff629a4aa96c6819d5d09617e97c5c79
|
0
|
Lint & Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582299
|
1793582181
|
1793582299
|
|
0
|
|
0
|
Edit
Delete
|
|
46456
|
26920
|
160
|
5
|
4c925eb3ff629a4aa96c6819d5d09617e97c5c79
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582299
|
1793582181
|
1793582299
|
|
0
|
|
0
|
Edit
Delete
|
|
46457
|
26921
|
117
|
5
|
39d750b05efde005c447d16a6f035a179d5ea1e1
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
37807
|
1
|
1793582536
|
1793582560
|
1793582244
|
1793582567
|
|
0
|
|
0
|
Edit
Delete
|
|
46458
|
26922
|
160
|
5
|
a4045b6870a3eb41c3fd261818f78e49f509b891
|
0
|
Frontend Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582534
|
1793582299
|
1793582534
|
|
0
|
|
0
|
Edit
Delete
|
|
46459
|
26922
|
160
|
5
|
a4045b6870a3eb41c3fd261818f78e49f509b891
|
0
|
Lint & Type Check
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582534
|
1793582299
|
1793582534
|
|
0
|
|
0
|
Edit
Delete
|
|
46463
|
26922
|
160
|
5
|
a4045b6870a3eb41c3fd261818f78e49f509b891
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582535
|
1793582299
|
1793582535
|
|
0
|
|
0
|
Edit
Delete
|
|
46464
|
26923
|
116
|
5
|
696d3ff871cdce70e0ab256c5eb08091e0967a33
|
0
|
validate
|
1
|
name: Validate complete window backup helpers and name: Validate complete window backup helpers and sandbox prerequisites
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-final-window-preflight.yml]
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Validate fixed reviewed inputs in private resource limited units
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
maintenanceLoaderSha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',maintenanceLoaderSha):raise RuntimeError('FIXED_SHA_REQUIRED')
command=['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',maintenanceLoaderSha+':ops/gitea-r1/window-preflight.py']
result=subprocess.run(command,capture_output=True,timeout=30)
if result.returncode:raise RuntimeError('FIXED_SCRIPT_UNAVAILABLE')
try:exec(compile(result.stdout,'window-preflight.py','exec'))
except Exception as error:
message=str(error)
safe=message if isinstance(error,RuntimeError) and re.fullmatch(r'[A-Z_]+(?::[A-Za-z0-9_./,:]+)?',message) else type(error).__name__
print('GITEA_FINAL_WINDOW_PREFLIGHT_JSON '+json.dumps({'kind':'GiteaFinalWindowPreflight','ci':{'sourceSha':maintenanceLoaderSha,'runId':os.environ.get('GITHUB_RUN_ID')},'status':'FAILED_PREPARATION','error':safe,'releaseEligible':False,'liveServicesChanged':False,'liveDatabaseChanged':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "95"
permissions:
contents: read
...
|
validate
|
null
|
["ubuntu-latest"]
|
37808
|
1
|
1793582567
|
1793582609
|
1793582490
|
1793582609
|
|
0
|
|
0
|
Edit
Delete
|
|
46465
|
26924
|
160
|
5
|
d3059e00d13d45d0ec6bfc9910cba358185d6f73
|
0
|
Frontend Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
37809
|
1
|
1793582609
|
1793582751
|
1793582535
|
1793582751
|
|
0
|
|
0
|
Edit
Delete
|
|
46466
|
26924
|
160
|
5
|
d3059e00d13d45d0ec6bfc9910cba358185d6f73
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
37810
|
3
|
1793582751
|
1793582836
|
1793582535
|
1793582836
|
|
0
|
|
0
|
Edit
Delete
|
|
46470
|
26924
|
160
|
5
|
d3059e00d13d45d0ec6bfc9910cba358185d6f73
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582836
|
1793582535
|
1793582836
|
|
0
|
|
0
|
Edit
Delete
|
|
46471
|
26925
|
160
|
5
|
049fb184bfbad7f1046fa3fcac99b049b3b5c978
|
0
|
Frontend Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: React 前端类型检查（tsc --noEmit）
run: pnpm --filter ./frontend-react run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
37816
|
1
|
1793582849
|
1793582996
|
1793582836
|
1793582997
|
|
0
|
|
0
|
Edit
Delete
|
|
46472
|
26925
|
160
|
5
|
049fb184bfbad7f1046fa3fcac99b049b3b5c978
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
37817
|
3
|
1793582997
|
1793583387
|
1793582836
|
1793583387
|
|
0
|
|
0
|
Edit
Delete
|
|
46476
|
26925
|
160
|
5
|
049fb184bfbad7f1046fa3fcac99b049b3b5c978
|
0
|
Gate Integrity (meta-gate · HARD)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793583387
|
1793582836
|
1793583387
|
|
0
|
|
0
|
Edit
Delete
|
|
46477
|
26926
|
116
|
5
|
4b638279784a9769b8887745def83009b257c16f
|
0
|
Static checks (locked engineering dependency)
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582964
|
1793582898
|
1793582964
|
|
0
|
|
0
|
Edit
Delete
|
|
46478
|
26926
|
116
|
5
|
4b638279784a9769b8887745def83009b257c16f
|
0
|
Static governance (repo root, private packages)
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1793582964
|
1793582898
|
1793582964
|
|
0
|
|
0
|
Edit
Delete
|
|
46485
|
26927
|
116
|
5
|
4b638279784a9769b8887745def83009b257c16f
|
0
|
prepare
|
1
|
name: Prepare exact public maintenance receipt wit name: Prepare exact public maintenance receipt without activation
"on":
workflow_dispatch:
jobs:
prepare:
name: prepare
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Prepare copies and test synthetic projection in a private network
run: |
set -eu
python3 <<'PY'
import os,re,subprocess,json
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[a-f0-9]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
result=subprocess.run(['git','-c','safe.directory='+repo,'-C',repo,'show',sha+':ops/gitea-r1/window-receipt-preflight.py'],capture_output=True,timeout=20)
if result.returncode:raise RuntimeError('FIXED_PREFLIGHT_SOURCE_REQUIRED')
try:exec(compile(result.stdout,'window-receipt-preflight.py','exec'))
except Exception as error:
text=str(error)
safe=text if isinstance(error,(RuntimeError,ValueError)) and re.fullmatch('[A-Z_]+',text) else type(error).__name__
print('GITEA_PUBLIC_RECEIPT_PREPARATION_JSON '+json.dumps({'kind':'GiteaPublicReceiptPreparation','ci':{'runId':os.environ.get('GITHUB_RUN_ID'),'sourceSha':sha},'status':'PREPARATION_FAILED_NO_ACTIVATION','error':safe,'liveNginxChanged':False,'liveServicesChanged':False,'maintenanceLaunched':False,'releaseEligible':False}),flush=True)
raise SystemExit(1)
PY
shell: bash
timeout-minutes: "5"
permissions:
contents: read
...
|
prepare
|
null
|
["ubuntu-latest"]
|
37818
|
1
|
1793583390
|
1793583392
|
1793582932
|
1793583393
|
|
0
|
|
0
|
Edit
Delete
|
|
46486
|
26928
|
116
|
5
|
618eef5158ff45e70e90b705e0a6e06b47f7eac8
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
37819
|
2
|
1793583393
|
1793583412
|
1793582965
|
1793583412
|
|
0
|
|
0
|
Edit
Delete
|
|
46487
|
26928
|
116
|
5
|
618eef5158ff45e70e90b705e0a6e06b47f7eac8
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
37820
|
2
|
1793583413
|
1793583415
|
1793582965
|
1793583416
|
|
0
|
|
0
|
Edit
Delete
|