|
44861
|
26523
|
83
|
5
|
8cf50a6ecf537789affa4e7a25d1fc599b7d4fac
|
0
|
Runtime and UI acceptance
|
2
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
CI_SERVICES_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
# G15 database guard requires the juhai_ai_hr_system* prefix.
CI_DATABASE_NAME: juhai_ai_hr_system_ci
CI_POSTGRES_IMAGE: ${{ vars.CI_POSTGRES_IMAGE || 'postgres:16' }}
CI_REDIS_IMAGE: ${{ vars.CI_REDIS_IMAGE || 'redis:7' }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh start "$CI_SERVICES_RUN_ID"
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
- if: always()
name: Remove per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh stop "$CI_SERVICES_RUN_ID"
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
36649
|
3
|
1793103823
|
1793111042
|
1793102531
|
1793111042
|
|
1
|
|
0
|
Edit
Delete
|
|
44862
|
26524
|
83
|
5
|
8cf50a6ecf537789affa4e7a25d1fc599b7d4fac
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36644
|
1
|
1793102732
|
1793102747
|
1793102531
|
1793102747
|
|
0
|
|
0
|
Edit
Delete
|
|
44863
|
26524
|
83
|
5
|
8cf50a6ecf537789affa4e7a25d1fc599b7d4fac
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36647
|
1
|
1793102798
|
1793102798
|
1793102531
|
1793102798
|
|
1
|
|
0
|
Edit
Delete
|
|
44864
|
26525
|
83
|
5
|
98df51ed3f9663364487587882bb82fedab434c8
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36650
|
2
|
1793111044
|
1793111065
|
1793103978
|
1793111066
|
|
0
|
|
0
|
Edit
Delete
|
|
44865
|
26525
|
83
|
5
|
98df51ed3f9663364487587882bb82fedab434c8
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793103978
|
1793111067
|
|
1
|
|
0
|
Edit
Delete
|
|
44866
|
26526
|
83
|
5
|
98df51ed3f9663364487587882bb82fedab434c8
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36651
|
1
|
1793111066
|
1793111081
|
1793103978
|
1793111081
|
|
0
|
|
0
|
Edit
Delete
|
|
44867
|
26526
|
83
|
5
|
98df51ed3f9663364487587882bb82fedab434c8
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36652
|
1
|
1793111083
|
1793111083
|
1793103978
|
1793111083
|
|
1
|
|
0
|
Edit
Delete
|
|
44868
|
26527
|
83
|
5
|
e9b02cfacb7917b8076a7c787ec4ad52f3c60e92
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36653
|
2
|
1793111427
|
1793111451
|
1793111425
|
1793111451
|
|
0
|
|
0
|
Edit
Delete
|
|
44869
|
26527
|
83
|
5
|
e9b02cfacb7917b8076a7c787ec4ad52f3c60e92
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793111425
|
1793111451
|
|
1
|
|
0
|
Edit
Delete
|
|
44870
|
26528
|
83
|
5
|
e9b02cfacb7917b8076a7c787ec4ad52f3c60e92
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36654
|
1
|
1793111451
|
1793111465
|
1793111425
|
1793111465
|
|
0
|
|
0
|
Edit
Delete
|
|
44871
|
26528
|
83
|
5
|
e9b02cfacb7917b8076a7c787ec4ad52f3c60e92
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36655
|
1
|
1793111468
|
1793111468
|
1793111425
|
1793111468
|
|
1
|
|
0
|
Edit
Delete
|
|
44872
|
26529
|
83
|
5
|
070da690b882bd6a6e8ab1f38fe715eaa702807b
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
# OS is single-host (NestJS) since lock 1b8ae0d; compat no longer reads an api-fastify build.
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36656
|
2
|
1793111608
|
1793111817
|
1793111606
|
1793111817
|
|
0
|
|
0
|
Edit
Delete
|
|
44873
|
26529
|
83
|
5
|
070da690b882bd6a6e8ab1f38fe715eaa702807b
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
CI_SERVICES_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
# G15 database guard requires the juhai_ai_hr_system* prefix.
CI_DATABASE_NAME: juhai_ai_hr_system_ci
CI_POSTGRES_IMAGE: ${{ vars.CI_POSTGRES_IMAGE || 'postgres:16' }}
CI_REDIS_IMAGE: ${{ vars.CI_REDIS_IMAGE || 'redis:7' }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh start "$CI_SERVICES_RUN_ID"
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
- if: always()
name: Remove per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh stop "$CI_SERVICES_RUN_ID"
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793111606
|
1793111817
|
|
1
|
|
0
|
Edit
Delete
|
|
44874
|
26530
|
83
|
5
|
070da690b882bd6a6e8ab1f38fe715eaa702807b
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36657
|
1
|
1793111817
|
1793111832
|
1793111606
|
1793111832
|
|
0
|
|
0
|
Edit
Delete
|
|
44875
|
26530
|
83
|
5
|
070da690b882bd6a6e8ab1f38fe715eaa702807b
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36662
|
1
|
1793111905
|
1793111905
|
1793111606
|
1793111905
|
|
1
|
|
0
|
Edit
Delete
|
|
44876
|
26531
|
83
|
5
|
902d50f31af13d4535d3cc5a2e7724ee169aeb42
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36658
|
2
|
1793111832
|
1793111854
|
1793111730
|
1793111854
|
|
0
|
|
0
|
Edit
Delete
|
|
44877
|
26531
|
83
|
5
|
902d50f31af13d4535d3cc5a2e7724ee169aeb42
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793111730
|
1793111856
|
|
1
|
|
0
|
Edit
Delete
|
|
44878
|
26532
|
83
|
5
|
902d50f31af13d4535d3cc5a2e7724ee169aeb42
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36659
|
1
|
1793111854
|
1793111868
|
1793111730
|
1793111868
|
|
0
|
|
0
|
Edit
Delete
|
|
44879
|
26532
|
83
|
5
|
902d50f31af13d4535d3cc5a2e7724ee169aeb42
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36663
|
1
|
1793111907
|
1793111907
|
1793111730
|
1793111907
|
|
1
|
|
0
|
Edit
Delete
|
|
44880
|
26533
|
83
|
5
|
7835e3b3d156a8fc07dadd6f6ac47b669673f9e7
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36660
|
2
|
1793111868
|
1793111890
|
1793111736
|
1793111890
|
|
0
|
|
0
|
Edit
Delete
|
|
44881
|
26533
|
83
|
5
|
7835e3b3d156a8fc07dadd6f6ac47b669673f9e7
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793111736
|
1793111892
|
|
1
|
|
0
|
Edit
Delete
|
|
44882
|
26534
|
83
|
5
|
7835e3b3d156a8fc07dadd6f6ac47b669673f9e7
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36661
|
1
|
1793111890
|
1793111905
|
1793111736
|
1793111905
|
|
0
|
|
0
|
Edit
Delete
|
|
44883
|
26534
|
83
|
5
|
7835e3b3d156a8fc07dadd6f6ac47b669673f9e7
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36664
|
1
|
1793111909
|
1793111909
|
1793111736
|
1793111909
|
|
1
|
|
0
|
Edit
Delete
|
|
44884
|
26535
|
83
|
5
|
10f2dae7965057f89b254f27c365081e57a9b773
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
# OS is single-host (NestJS) since lock 1b8ae0d; compat no longer reads an api-fastify build.
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36665
|
2
|
1793112257
|
1793112467
|
1793112256
|
1793112467
|
|
0
|
|
0
|
Edit
Delete
|
|
44885
|
26535
|
83
|
5
|
10f2dae7965057f89b254f27c365081e57a9b773
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
CI_SERVICES_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
# G15 database guard requires the juhai_ai_hr_system* prefix.
CI_DATABASE_NAME: juhai_ai_hr_system_ci
CI_POSTGRES_IMAGE: ${{ vars.CI_POSTGRES_IMAGE || 'postgres:16' }}
CI_REDIS_IMAGE: ${{ vars.CI_REDIS_IMAGE || 'redis:7' }}
if: ${{ !cancelled() }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh start "$CI_SERVICES_RUN_ID"
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
- if: always()
name: Remove per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh stop "$CI_SERVICES_RUN_ID"
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
36667
|
2
|
1793112489
|
1793112733
|
1793112256
|
1793112734
|
|
1
|
|
0
|
Edit
Delete
|
|
44886
|
26536
|
83
|
5
|
10f2dae7965057f89b254f27c365081e57a9b773
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36666
|
1
|
1793112467
|
1793112489
|
1793112256
|
1793112489
|
|
0
|
|
0
|
Edit
Delete
|
|
44887
|
26536
|
83
|
5
|
10f2dae7965057f89b254f27c365081e57a9b773
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36668
|
1
|
1793112734
|
1793112734
|
1793112256
|
1793112734
|
|
1
|
|
0
|
Edit
Delete
|
|
44888
|
26537
|
83
|
5
|
b99daae930c98448ae3ec72c3a6a4ef90f18e035
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
# OS is single-host (NestJS) since lock 1b8ae0d; compat no longer reads an api-fastify build.
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36669
|
2
|
1793113224
|
1793113430
|
1793113222
|
1793113430
|
|
0
|
|
0
|
Edit
Delete
|
|
44889
|
26537
|
83
|
5
|
b99daae930c98448ae3ec72c3a6a4ef90f18e035
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
CI_SERVICES_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
# G15 database guard requires the juhai_ai_hr_system* prefix.
CI_DATABASE_NAME: juhai_ai_hr_system_ci
CI_POSTGRES_IMAGE: ${{ vars.CI_POSTGRES_IMAGE || 'postgres:16' }}
CI_REDIS_IMAGE: ${{ vars.CI_REDIS_IMAGE || 'redis:7' }}
if: ${{ !cancelled() }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh start "$CI_SERVICES_RUN_ID"
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Pick free UI acceptance ports
run: bash scripts/ci-ui-ports.sh
- name: Run NestJS UI acceptance
run: pnpm check:ui
- if: always()
name: Remove per-run PostgreSQL and Redis
run: bash scripts/ci-acceptance-services.sh stop "$CI_SERVICES_RUN_ID"
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
36671
|
2
|
1793113478
|
1793113868
|
1793113222
|
1793113868
|
|
1
|
|
0
|
Edit
Delete
|
|
44890
|
26538
|
83
|
5
|
b99daae930c98448ae3ec72c3a6a4ef90f18e035
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36670
|
1
|
1793113430
|
1793113478
|
1793113222
|
1793113478
|
|
0
|
|
0
|
Edit
Delete
|
|
44891
|
26538
|
83
|
5
|
b99daae930c98448ae3ec72c3a6a4ef90f18e035
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36672
|
1
|
1793113868
|
1793113869
|
1793113222
|
1793113869
|
|
1
|
|
0
|
Edit
Delete
|
|
44892
|
26539
|
83
|
5
|
bdadea1df796dfbc8add8800f8a4878bb6a89a59
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36673
|
2
|
1793113916
|
1793113938
|
1793113915
|
1793113939
|
|
0
|
|
0
|
Edit
Delete
|
|
44893
|
26539
|
83
|
5
|
bdadea1df796dfbc8add8800f8a4878bb6a89a59
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793113915
|
1793113940
|
|
1
|
|
0
|
Edit
Delete
|
|
44894
|
26540
|
83
|
5
|
bdadea1df796dfbc8add8800f8a4878bb6a89a59
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36674
|
1
|
1793113939
|
1793113953
|
1793113915
|
1793113953
|
|
0
|
|
0
|
Edit
Delete
|
|
44895
|
26540
|
83
|
5
|
bdadea1df796dfbc8add8800f8a4878bb6a89a59
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36675
|
1
|
1793113955
|
1793113955
|
1793113915
|
1793113956
|
|
1
|
|
0
|
Edit
Delete
|
|
44896
|
26541
|
83
|
5
|
4e5693d2725c1e961526d3455cfc963a3cea7500
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36676
|
2
|
1793114287
|
1793114311
|
1793114287
|
1793114311
|
|
0
|
|
0
|
Edit
Delete
|
|
44897
|
26541
|
83
|
5
|
4e5693d2725c1e961526d3455cfc963a3cea7500
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793114287
|
1793114312
|
|
1
|
|
0
|
Edit
Delete
|
|
44898
|
26542
|
83
|
5
|
4e5693d2725c1e961526d3455cfc963a3cea7500
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36677
|
1
|
1793114311
|
1793114325
|
1793114287
|
1793114326
|
|
0
|
|
0
|
Edit
Delete
|
|
44899
|
26542
|
83
|
5
|
4e5693d2725c1e961526d3455cfc963a3cea7500
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36680
|
1
|
1793114362
|
1793114362
|
1793114287
|
1793114362
|
|
1
|
|
0
|
Edit
Delete
|
|
44900
|
26543
|
83
|
5
|
93b11674246ff8957578c65a9bfa1d92a02d1144
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36678
|
2
|
1793114326
|
1793114347
|
1793114295
|
1793114348
|
|
0
|
|
0
|
Edit
Delete
|
|
44901
|
26543
|
83
|
5
|
93b11674246ff8957578c65a9bfa1d92a02d1144
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793114295
|
1793114348
|
|
1
|
|
0
|
Edit
Delete
|
|
44902
|
26544
|
83
|
5
|
93b11674246ff8957578c65a9bfa1d92a02d1144
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36679
|
1
|
1793114348
|
1793114362
|
1793114295
|
1793114362
|
|
0
|
|
0
|
Edit
Delete
|
|
44903
|
26544
|
83
|
5
|
93b11674246ff8957578c65a9bfa1d92a02d1144
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36681
|
1
|
1793114364
|
1793114364
|
1793114295
|
1793114365
|
|
1
|
|
0
|
Edit
Delete
|
|
44904
|
26545
|
83
|
5
|
e47f5b97f09355d489aae8e027b9f55440f7a130
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36682
|
2
|
1793115452
|
1793115474
|
1793115451
|
1793115474
|
|
0
|
|
0
|
Edit
Delete
|
|
44905
|
26545
|
83
|
5
|
e47f5b97f09355d489aae8e027b9f55440f7a130
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1793115451
|
1793115475
|
|
1
|
|
0
|
Edit
Delete
|
|
44906
|
26546
|
83
|
5
|
e47f5b97f09355d489aae8e027b9f55440f7a130
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36683
|
1
|
1793115474
|
1793115489
|
1793115451
|
1793115489
|
|
0
|
|
0
|
Edit
Delete
|
|
44907
|
26546
|
83
|
5
|
e47f5b97f09355d489aae8e027b9f55440f7a130
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36684
|
1
|
1793115491
|
1793115491
|
1793115451
|
1793115491
|
|
1
|
|
0
|
Edit
Delete
|
|
44908
|
26547
|
116
|
5
|
936dc8784cac49476e29ec7c54790c265b95306e
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
36685
|
2
|
1793118476
|
1793118488
|
1793118475
|
1793118488
|
|
0
|
|
0
|
Edit
Delete
|
|
44909
|
26547
|
116
|
5
|
936dc8784cac49476e29ec7c54790c265b95306e
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://github.com/actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
36686
|
2
|
1793118488
|
1793118492
|
1793118475
|
1793118493
|
|
0
|
|
0
|
Edit
Delete
|
|
44910
|
26547
|
116
|
5
|
936dc8784cac49476e29ec7c54790c265b95306e
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: https://github.com/actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://github.com/actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
36687
|
4
|
1793118495
|
1793118495
|
1793118475
|
1793118495
|
|
1
|
|
0
|
Edit
Delete
|