|
30851
|
23389
|
6
|
5
|
d9e0ab1d9cbc0d7707781f8b0c9a5a49103ace8b
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
26991
|
1
|
1779687283
|
1779688228
|
1779687046
|
1779688229
|
|
0
|
|
0
|
Edit
Delete
|
|
30852
|
23389
|
6
|
5
|
d9e0ab1d9cbc0d7707781f8b0c9a5a49103ace8b
|
0
|
Unit Tests (HARD GATE)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
unit-tests:
name: Unit Tests (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run unit tests
run: pnpm -C backend run test:unit
...
|
unit-tests
|
["frontend-typecheck","lint-and-typech ["frontend-typecheck","lint-and-typecheck"]...
|
["ubuntu-latest"]
|
26993
|
2
|
1779688278
|
1779688812
|
1779687046
|
1779688812
|
|
1
|
|
0
|
Edit
Delete
|
|
30853
|
23389
|
6
|
5
|
d9e0ab1d9cbc0d7707781f8b0c9a5a49103ace8b
|
0
|
Governance Audit (HARD GATE)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
governance-audit:
name: Governance Audit (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Audit 多租户隔离（HARD GATE / 红线1，不豁免）
run: pnpm -C backend run audit:tenant
- name: Audit Prisma↔Zod 契约
run: pnpm -C backend exec tsx scripts/audit-prisma-zod-contract.ts
continue-on-error: true
- name: Audit FormRules↔Zod
run: pnpm run audit:formrules-zod
continue-on-error: true
- name: Audit Response Columns
run: pnpm run audit:response-columns
continue-on-error: true
- name: Audit Field Payload
run: pnpm run audit:field-payload
continue-on-error: true
- name: Audit Enum Consistency
run: pnpm run audit:enum-consistency
continue-on-error: true
- name: Audit useListPage ↔ Router
run: pnpm run audit:list-page-routes
continue-on-error: true
- name: Audit Page AI Assist Coverage
run: pnpm run audit:ai-assist-coverage
continue-on-error: true
- name: Audit Page AI Assist Skill Binding
run: pnpm run audit:ai-assist-skill-binding
continue-on-error: true
- name: Audit Page AI Assist Context Providers
run: pnpm run audit:context-provider-redact
continue-on-error: true
- name: Audit Coach Script Library
run: pnpm run audit:coach-script-library
continue-on-error: true
- name: Audit AI Decision Quality
run: pnpm run audit:ai-decision-quality
continue-on-error: true
- name: Audit Event Publishing
run: pnpm -C backend run audit:events
continue-on-error: true
- name: Audit State Machines
run: pnpm -C backend run audit:state-machines
continue-on-error: true
- name: Audit Money Decimal Purity (CFO-P0 防御)
run: node --import tsx scripts/audit-money-decimal-purity.ts
continue-on-error: true
- name: Audit Nested Transaction (CFO-P0-1 + RO-P0-3 防御)
run: node --import tsx scripts/audit-nested-transaction.ts
continue-on-error: true
- name: Audit Test Assertion Density (QA-P0 防御)
run: node --import tsx scripts/audit-test-assertion-density.ts
continue-on-error: true
- name: Audit API Test Coverage (probe-only / read-covered / action-covered / complete-crud)
run: pnpm -C backend run audit:api-test-coverage
continue-on-error: true
- name: Harness Report 聚合
run: pnpm harness report --save
continue-on-error: true
- if: always()
name: Upload audit reports
uses: https://gitea.com/actions/upload-artifact@v3
with:
name: governance-audit-reports
path: |
reports/prisma-zod-contract-audit.latest.json
reports/formrules-zod-audit.latest.json
reports/response-columns-audit.latest.json
reports/field-payload-audit.latest.json
reports/enum-consistency-audit.latest.json
reports/list-page-routes-audit.latest.json
reports/ai-assist-coverage.latest.json
reports/ai-assist-skill-binding.latest.json
reports/ai-assist-context-providers.latest.json
reports/coach-script-library.latest.json
reports/ai-decision-quality.latest.json
reports/event-publishing-audit.latest.json
reports/state-machine-integration-audit.latest.json
reports/harness-dashboard.latest.json
reports/module-grades.latest.json
reports/money-decimal-purity-audit.latest.json
reports/nested-transaction-audit.latest.json
reports/test-assertion-density-audit.latest.json
reports/api-test-coverage.latest.json
retention-days: "14"
- if: always()
name: 输出 governance summary
run: |
if [ -f reports/harness-dashboard.latest.json ]; then
node -e "
const d = require('./reports/harness-dashboard.latest.json');
const s = d.summary || {};
const lines = [
'## Governance Audit Summary',
'',
'| Severity | Count |',
'|---|---|',
\`| CRITICAL | \${s.critical ?? 0} |\`,
\`| HIGH | \${s.high ?? 0} |\`,
\`| MEDIUM | \${s.medium ?? 0} |\`,
\`| LOW | \${s.low ?? 0} |\`,
\`| INFO | \${s.info ?? 0} |\`,
'',
\`- 总 finding: \${s.total ?? 0}\`,
\`- 涉及模块: \${s.modulesAffected ?? 0}\`,
\`- 审计执行: \${s.auditsRun ?? 0}\`,
\`- 审计 missing: \${s.reportsMissing ?? 0}\`,
\`- 审计 stale (>7d): \${s.reportsStale ?? 0}\`,
\`- 审计 invalid: \${s.reportsInvalid ?? 0}\`,
'',
'**门禁规则：HIGH+CRITICAL+MEDIUM 必须为 0，且 reportsMissing/Stale/Invalid 必须为 0。**',
];
const fs = require('fs');
const out = process.env.GITHUB_STEP_SUMMARY;
if (out) fs.appendFileSync(out, lines.join('\n') + '\n');
else console.log(lines.join('\n'));
"
else
echo '⚠️ harness-dashboard.latest.json 未生成，治理门禁判定失败'
fi
- name: 治理硬门禁 — 豁免感知 verdict（HARD）
run: node --import tsx scripts/harness/governance-gate.ts
- name: 文档对账 — CLAUDE.md GOVERNANCE-BASELINE ↔ reports 实测（HARD）
run: node --import tsx scripts/harness/baseline-reconcile.ts
- name: Harness Gate 综合 PR 验收（HARD）
run: pnpm harness gate
...
|
governance-audit
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
26994
|
2
|
1779688812
|
1779689247
|
1779687046
|
1779689247
|
|
1
|
|
0
|
Edit
Delete
|
|
30854
|
23389
|
6
|
5
|
d9e0ab1d9cbc0d7707781f8b0c9a5a49103ace8b
|
0
|
Gate Integrity (meta-gate · HARD)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
26992
|
1
|
1779688229
|
1779688278
|
1779687046
|
1779688278
|
|
0
|
|
0
|
Edit
Delete
|
|
30855
|
23390
|
6
|
5
|
91f125bd289d82c469493539589d79318bb96269
|
0
|
Frontend Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: 前端类型检查（vue-tsc --noEmit）
run: pnpm --filter ./frontend run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
26995
|
1
|
1779786702
|
1779786934
|
1779786701
|
1779786934
|
|
0
|
|
0
|
Edit
Delete
|
|
30856
|
23390
|
6
|
5
|
91f125bd289d82c469493539589d79318bb96269
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
26996
|
1
|
1779786934
|
1779787662
|
1779786701
|
1779787663
|
|
0
|
|
0
|
Edit
Delete
|
|
30857
|
23390
|
6
|
5
|
91f125bd289d82c469493539589d79318bb96269
|
0
|
Unit Tests (HARD GATE)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
unit-tests:
name: Unit Tests (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run unit tests
run: pnpm -C backend run test:unit
...
|
unit-tests
|
["frontend-typecheck","lint-and-typech ["frontend-typecheck","lint-and-typecheck"]...
|
["ubuntu-latest"]
|
26998
|
2
|
1779787721
|
1779788257
|
1779786701
|
1779788257
|
|
1
|
|
0
|
Edit
Delete
|
|
30858
|
23390
|
6
|
5
|
91f125bd289d82c469493539589d79318bb96269
|
0
|
Governance Audit (HARD GATE)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
governance-audit:
name: Governance Audit (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Audit 多租户隔离（HARD GATE / 红线1，不豁免）
run: pnpm -C backend run audit:tenant
- name: Audit Prisma↔Zod 契约
run: pnpm -C backend exec tsx scripts/audit-prisma-zod-contract.ts
continue-on-error: true
- name: Audit FormRules↔Zod
run: pnpm run audit:formrules-zod
continue-on-error: true
- name: Audit Response Columns
run: pnpm run audit:response-columns
continue-on-error: true
- name: Audit Field Payload
run: pnpm run audit:field-payload
continue-on-error: true
- name: Audit Enum Consistency
run: pnpm run audit:enum-consistency
continue-on-error: true
- name: Audit useListPage ↔ Router
run: pnpm run audit:list-page-routes
continue-on-error: true
- name: Audit Page AI Assist Coverage
run: pnpm run audit:ai-assist-coverage
continue-on-error: true
- name: Audit Page AI Assist Skill Binding
run: pnpm run audit:ai-assist-skill-binding
continue-on-error: true
- name: Audit Page AI Assist Context Providers
run: pnpm run audit:context-provider-redact
continue-on-error: true
- name: Audit Coach Script Library
run: pnpm run audit:coach-script-library
continue-on-error: true
- name: Audit AI Decision Quality
run: pnpm run audit:ai-decision-quality
continue-on-error: true
- name: Audit Event Publishing
run: pnpm -C backend run audit:events
continue-on-error: true
- name: Audit State Machines
run: pnpm -C backend run audit:state-machines
continue-on-error: true
- name: Audit Money Decimal Purity (CFO-P0 防御)
run: node --import tsx scripts/audit-money-decimal-purity.ts
continue-on-error: true
- name: Audit Nested Transaction (CFO-P0-1 + RO-P0-3 防御)
run: node --import tsx scripts/audit-nested-transaction.ts
continue-on-error: true
- name: Audit Test Assertion Density (QA-P0 防御)
run: node --import tsx scripts/audit-test-assertion-density.ts
continue-on-error: true
- name: Audit API Test Coverage (probe-only / read-covered / action-covered / complete-crud)
run: pnpm -C backend run audit:api-test-coverage
continue-on-error: true
- name: Harness Report 聚合
run: pnpm harness report --save
continue-on-error: true
- if: always()
name: Upload audit reports
uses: https://gitea.com/actions/upload-artifact@v3
with:
name: governance-audit-reports
path: |
reports/prisma-zod-contract-audit.latest.json
reports/formrules-zod-audit.latest.json
reports/response-columns-audit.latest.json
reports/field-payload-audit.latest.json
reports/enum-consistency-audit.latest.json
reports/list-page-routes-audit.latest.json
reports/ai-assist-coverage.latest.json
reports/ai-assist-skill-binding.latest.json
reports/ai-assist-context-providers.latest.json
reports/coach-script-library.latest.json
reports/ai-decision-quality.latest.json
reports/event-publishing-audit.latest.json
reports/state-machine-integration-audit.latest.json
reports/harness-dashboard.latest.json
reports/module-grades.latest.json
reports/money-decimal-purity-audit.latest.json
reports/nested-transaction-audit.latest.json
reports/test-assertion-density-audit.latest.json
reports/api-test-coverage.latest.json
retention-days: "14"
- if: always()
name: 输出 governance summary
run: |
if [ -f reports/harness-dashboard.latest.json ]; then
node -e "
const d = require('./reports/harness-dashboard.latest.json');
const s = d.summary || {};
const lines = [
'## Governance Audit Summary',
'',
'| Severity | Count |',
'|---|---|',
\`| CRITICAL | \${s.critical ?? 0} |\`,
\`| HIGH | \${s.high ?? 0} |\`,
\`| MEDIUM | \${s.medium ?? 0} |\`,
\`| LOW | \${s.low ?? 0} |\`,
\`| INFO | \${s.info ?? 0} |\`,
'',
\`- 总 finding: \${s.total ?? 0}\`,
\`- 涉及模块: \${s.modulesAffected ?? 0}\`,
\`- 审计执行: \${s.auditsRun ?? 0}\`,
\`- 审计 missing: \${s.reportsMissing ?? 0}\`,
\`- 审计 stale (>7d): \${s.reportsStale ?? 0}\`,
\`- 审计 invalid: \${s.reportsInvalid ?? 0}\`,
'',
'**门禁规则：HIGH+CRITICAL+MEDIUM 必须为 0，且 reportsMissing/Stale/Invalid 必须为 0。**',
];
const fs = require('fs');
const out = process.env.GITHUB_STEP_SUMMARY;
if (out) fs.appendFileSync(out, lines.join('\n') + '\n');
else console.log(lines.join('\n'));
"
else
echo '⚠️ harness-dashboard.latest.json 未生成，治理门禁判定失败'
fi
- name: 治理硬门禁 — 豁免感知 verdict（HARD）
run: node --import tsx scripts/harness/governance-gate.ts
- name: 文档对账 — CLAUDE.md GOVERNANCE-BASELINE ↔ reports 实测（HARD）
run: node --import tsx scripts/harness/baseline-reconcile.ts
- name: Harness Gate 综合 PR 验收（HARD）
run: pnpm harness gate
...
|
governance-audit
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
26999
|
2
|
1779788257
|
1779788550
|
1779786701
|
1779788550
|
|
1
|
|
0
|
Edit
Delete
|
|
30859
|
23390
|
6
|
5
|
91f125bd289d82c469493539589d79318bb96269
|
0
|
Gate Integrity (meta-gate · HARD)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
26997
|
1
|
1779787664
|
1779787721
|
1779786701
|
1779787721
|
|
0
|
|
0
|
Edit
Delete
|
|
30860
|
23391
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
27000
|
2
|
1780282828
|
1780282919
|
1780282828
|
1780282919
|
|
0
|
|
0
|
Edit
Delete
|
|
30861
|
23392
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
27001
|
2
|
1780887629
|
1780887670
|
1780887628
|
1780887670
|
|
0
|
|
0
|
Edit
Delete
|
|
30862
|
23393
|
6
|
5
|
c32dc69661d18fedc3e6939936535f3f5906bf7d
|
0
|
Frontend Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
frontend-typecheck:
name: Frontend Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Build shared package
run: pnpm -C shared run build
- name: 前端类型检查（vue-tsc --noEmit）
run: pnpm --filter ./frontend run type-check
...
|
frontend-typecheck
|
null
|
["ubuntu-latest"]
|
27002
|
1
|
1780924424
|
1780925027
|
1780924423
|
1780925027
|
|
0
|
|
0
|
Edit
Delete
|
|
30863
|
23393
|
6
|
5
|
c32dc69661d18fedc3e6939936535f3f5906bf7d
|
0
|
Lint & Type Check
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
lint-and-typecheck:
name: Lint & Type Check
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Backend type check
run: pnpm -C backend run type-check
- name: Lint
run: pnpm -C backend run lint
...
|
lint-and-typecheck
|
null
|
["ubuntu-latest"]
|
27003
|
1
|
1780925028
|
1780925955
|
1780924423
|
1780925955
|
|
0
|
|
0
|
Edit
Delete
|
|
30864
|
23393
|
6
|
5
|
c32dc69661d18fedc3e6939936535f3f5906bf7d
|
0
|
Unit Tests (HARD GATE)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
unit-tests:
name: Unit Tests (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run unit tests
run: pnpm -C backend run test:unit
...
|
unit-tests
|
["frontend-typecheck","lint-and-typech ["frontend-typecheck","lint-and-typecheck"]...
|
["ubuntu-latest"]
|
27005
|
2
|
1780926013
|
1780926415
|
1780924423
|
1780926415
|
|
1
|
|
0
|
Edit
Delete
|
|
30865
|
23393
|
6
|
5
|
c32dc69661d18fedc3e6939936535f3f5906bf7d
|
0
|
State Machine Model-Based (HARD GATE)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
state-machine-model:
name: State Machine Model-Based (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Run state machine model-based tests
run: pnpm -C backend run test:state-machines:model
...
|
state-machine-model
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
27006
|
1
|
1780926415
|
1780926753
|
1780924423
|
1780926753
|
|
1
|
|
0
|
Edit
Delete
|
|
30866
|
23393
|
6
|
5
|
c32dc69661d18fedc3e6939936535f3f5906bf7d
|
0
|
Governance Audit (HARD GATE)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
governance-audit:
name: Governance Audit (HARD GATE)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: Generate Prisma Client
run: pnpm -C backend exec prisma generate
- name: Build shared package
run: pnpm -C shared run build
- name: Audit 多租户隔离（HARD GATE / 红线1，不豁免）
run: pnpm -C backend run audit:tenant
- name: Audit Prisma Schema 镜像一致性（HARD GATE）
run: pnpm run audit:prisma-schema-source
- name: Audit Prisma↔Zod 契约
run: pnpm -C backend exec tsx scripts/audit-prisma-zod-contract.ts
continue-on-error: true
- name: Audit FormRules↔Zod
run: pnpm run audit:formrules-zod
continue-on-error: true
- name: Audit Response Columns
run: pnpm run audit:response-columns
continue-on-error: true
- name: Audit Field Payload
run: pnpm run audit:field-payload
continue-on-error: true
- name: Audit Enum Consistency
run: pnpm run audit:enum-consistency
continue-on-error: true
- name: Audit useListPage ↔ Router
run: pnpm run audit:list-page-routes
continue-on-error: true
- name: Audit 前端权限键 ↔ 后端真源（HARD GATE / 防按钮 fail-closed 隐藏）
run: pnpm run audit:permission-keys
- name: Audit Page AI Assist Coverage
run: pnpm run audit:ai-assist-coverage
continue-on-error: true
- name: Audit Page AI Assist Skill Binding
run: pnpm run audit:ai-assist-skill-binding
continue-on-error: true
- name: Audit Page AI Assist Context Providers
run: pnpm run audit:context-provider-redact
continue-on-error: true
- name: Audit Coach Script Library
run: pnpm run audit:coach-script-library
continue-on-error: true
- name: Audit AI Decision Quality
run: pnpm run audit:ai-decision-quality
continue-on-error: true
- name: Audit Event Publishing
run: pnpm -C backend run audit:events
continue-on-error: true
- name: Audit State Machines
run: pnpm -C backend run audit:state-machines
continue-on-error: true
- name: Audit Money Decimal Purity (CFO-P0 防御)
run: node --import tsx scripts/audit-money-decimal-purity.ts
continue-on-error: true
- name: Audit Nested Transaction (CFO-P0-1 + RO-P0-3 防御)
run: node --import tsx scripts/audit-nested-transaction.ts
continue-on-error: true
- name: Audit Test Assertion Density (QA-P0 防御)
run: node --import tsx scripts/audit-test-assertion-density.ts
continue-on-error: true
- name: Audit API Test Coverage (probe-only / read-covered / action-covered / complete-crud)
run: pnpm -C backend run audit:api-test-coverage
continue-on-error: true
- name: Audit Consumer Test Authenticity (断言剧场防御 / 假绿防御)
run: node --import tsx scripts/audit-consumer-test-authenticity.ts
continue-on-error: true
- name: Audit Consumer Idempotency (去重路径假覆盖防御)
run: node --import tsx scripts/audit-consumer-idempotency.ts
continue-on-error: true
- name: Audit State Machine Unwired Guards (死守卫 / 假保护防御)
run: node --import tsx scripts/audit-state-machine-unwired-guards.ts
continue-on-error: true
- name: Audit Migration Topology (影子迁移防御)
run: node --import tsx scripts/audit-migration-topology.ts
continue-on-error: true
- name: Audit API Test Fixed IDs (并行化降债棘轮 / write-pk)
run: pnpm -C backend run audit:api-test-fixed-ids
continue-on-error: true
- name: 30d Evidence - Launch Smoke Scope
run: pnpm run audit:launch-smoke-scope
continue-on-error: true
- name: 30d Evidence - Rollout Scope Freeze
run: pnpm run audit:rollout-scope-freeze
continue-on-error: true
- name: 30d Evidence - Production Foundation
run: pnpm run audit:production-foundation-evidence
continue-on-error: true
- name: 30d Evidence - RLS Staging Canary Plan
run: pnpm run audit:rls-staging-canary
continue-on-error: true
- name: 30d Evidence - Customer Signoff Status
run: node --import tsx scripts/harness/customer-signoff-status.ts
continue-on-error: true
- name: 30d Evidence - Production Gate Projection
run: node --import tsx scripts/production-release-gate.ts --no-fail
continue-on-error: true
- name: 30d Evidence - Gate Integrity
run: pnpm run audit:production-release-gate-integrity
continue-on-error: true
- name: Harness Report 聚合
run: pnpm harness report --save
continue-on-error: true
- name: 30d Evidence - Harness Meta Tests
run: pnpm run harness:test
- name: 30d Evidence - War Plan Markdown
run: node --import tsx scripts/governance-30d-war-plan.ts
- if: always()
name: Upload audit reports
uses: https://gitea.com/actions/upload-artifact@v3
with:
name: governance-audit-reports
path: |
reports/prisma-zod-contract-audit.latest.json
reports/formrules-zod-audit.latest.json
reports/response-columns-audit.latest.json
reports/field-payload-audit.latest.json
reports/enum-consistency-audit.latest.json
reports/list-page-routes-audit.latest.json
reports/ai-assist-coverage.latest.json
reports/ai-assist-skill-binding.latest.json
reports/ai-assist-context-providers.latest.json
reports/coach-script-library.latest.json
reports/ai-decision-quality.latest.json
reports/event-publishing-audit.latest.json
reports/state-machine-integration-audit.latest.json
reports/harness-dashboard.latest.json
reports/module-grades.latest.json
reports/money-decimal-purity-audit.latest.json
reports/nested-transaction-audit.latest.json
reports/test-assertion-density-audit.latest.json
reports/api-test-coverage.latest.json
reports/api-test-fixed-ids-audit.latest.json
reports/consumer-test-authenticity-audit.latest.json
reports/consumer-idempotency-audit.latest.json
reports/state-machine-unwired-guards-audit.latest.json
reports/migration-topology-audit.latest.json
reports/customer-signoff-status.latest.json
reports/p0-customer-input-status.latest.json
reports/rollout-scope-freeze.latest.json
reports/rollout-scope-freeze.latest.md
reports/production-foundation-evidence.latest.json
reports/production-foundation-evidence.latest.md
reports/launch-smoke-scope.latest.json
reports/launch-smoke-scope.latest.md
reports/rls-staging-canary.latest.json
reports/rls-staging-canary.latest.md
reports/production-release-gate.latest.json
reports/production-release-gate.latest.md
reports/production-release-actions.latest.json
reports/production-release-actions.latest.md
reports/production-release-gate-integrity.latest.json
reports/production-release-gate-integrity.latest.md
reports/governance-30d-war-plan.latest.md
retention-days: "14"
- if: always()
name: 输出 governance summary
run: node --import tsx scripts/ci-governance-summary.ts --title "Governance Audit Summary" --include-rules
- name: 治理硬门禁 — 豁免感知 verdict（HARD）
run: node --import tsx scripts/harness/governance-gate.ts
- name: 文档对账 — CLAUDE.md GOVERNANCE-BASELINE ↔ reports 实测（HARD）
run: node --import tsx scripts/harness/baseline-reconcile.ts
- name: Harness Gate 综合 PR 验收（HARD）
run: pnpm harness gate
...
|
governance-audit
|
["lint-and-typecheck"]
|
["ubuntu-latest"]
|
27007
|
2
|
1780926753
|
1780928762
|
1780924423
|
1780928762
|
|
1
|
|
0
|
Edit
Delete
|
|
30867
|
23393
|
6
|
5
|
c32dc69661d18fedc3e6939936535f3f5906bf7d
|
0
|
Gate Integrity (meta-gate · HARD)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_VERSION: "20"
jobs:
gate-integrity:
name: Gate Integrity (meta-gate · HARD)
runs-on: ubuntu-latest
steps:
- uses: https://gitea.com/actions/checkout@v4
- uses: https://gitea.com/pnpm/action-setup@v4
- uses: https://gitea.com/actions/setup-node@v4
with:
cache: pnpm
node-version: ${{ env.NODE_VERSION }}
- run: pnpm install --frozen-lockfile --ignore-scripts
- name: 校验治理硬门禁未被软化
run: node --import tsx scripts/harness/gate-integrity-check.ts
...
|
gate-integrity
|
null
|
["ubuntu-latest"]
|
27004
|
1
|
1780925956
|
1780926012
|
1780924423
|
1780926013
|
|
0
|
|
0
|
Edit
Delete
|
|
30868
|
23394
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
27008
|
2
|
1781492429
|
1781492519
|
1781492428
|
1781492519
|
|
0
|
|
0
|
Edit
Delete
|
|
30869
|
23395
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
27009
|
2
|
1782097229
|
1782097259
|
1782097228
|
1782097259
|
|
0
|
|
0
|
Edit
Delete
|
|
30870
|
23396
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
27010
|
2
|
1782702029
|
1782703072
|
1782702028
|
1782703072
|
|
0
|
|
0
|
Edit
Delete
|
|
30871
|
23397
|
51
|
5
|
6c1f58f4c1c7dce5c443bbe14d34521de581cbf6
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
- run: npm ci
- run: npx prisma generate
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
27011
|
2
|
1782979376
|
1782979467
|
1782979375
|
1782979467
|
|
0
|
|
0
|
Edit
Delete
|
|
30872
|
23397
|
51
|
5
|
6c1f58f4c1c7dce5c443bbe14d34521de581cbf6
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
- run: npm ci
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
27012
|
2
|
1782979467
|
1782979557
|
1782979375
|
1782979557
|
|
0
|
|
0
|
Edit
Delete
|
|
30873
|
23397
|
51
|
5
|
6c1f58f4c1c7dce5c443bbe14d34521de581cbf6
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
27013
|
2
|
1782979558
|
1782979588
|
1782979375
|
1782979588
|
|
0
|
|
0
|
Edit
Delete
|
|
30874
|
23398
|
50
|
5
|
87bcbf6ebbf43784219f8e6a5a40d6cd8fc3041c
|
0
|
remote-safe-governance
|
1
|
name: Lyra Production Governance
"on":
name: Lyra Production Governance
"on":
pull_request:
push:
branches:
- main
- "codex/**"
jobs:
remote-safe-governance:
name: remote-safe-governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install
run: pnpm install --frozen-lockfile
- name: Remote-safe checks
run: pnpm check:ci
- name: Runtime acceptance boundary
run: |
echo "Remote CI does not claim runtime acceptance."
echo "Real DB/API/browser/model acceptance remains reports/runtime-acceptance.latest.json, reports/http-ui-acceptance.latest.json, and reports/ui-click-acceptance.latest.json."
timeout-minutes: "20"
...
|
remote-safe-governance
|
null
|
["ubuntu-latest"]
|
27014
|
1
|
1782983354
|
1782983489
|
1782983352
|
1782983489
|
|
0
|
|
0
|
Edit
Delete
|
|
30875
|
23399
|
50
|
5
|
87bcbf6ebbf43784219f8e6a5a40d6cd8fc3041c
|
0
|
remote-safe-governance
|
1
|
name: Lyra Production Governance
"on":
name: Lyra Production Governance
"on":
pull_request:
push:
branches:
- main
- "codex/**"
jobs:
remote-safe-governance:
name: remote-safe-governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install
run: pnpm install --frozen-lockfile
- name: Remote-safe checks
run: pnpm check:ci
- name: Runtime acceptance boundary
run: |
echo "Remote CI does not claim runtime acceptance."
echo "Real DB/API/browser/model acceptance remains reports/runtime-acceptance.latest.json, reports/http-ui-acceptance.latest.json, and reports/ui-click-acceptance.latest.json."
timeout-minutes: "20"
...
|
remote-safe-governance
|
null
|
["ubuntu-latest"]
|
27015
|
1
|
1782983511
|
1782983569
|
1782983510
|
1782983569
|
|
0
|
|
0
|
Edit
Delete
|
|
30876
|
23400
|
51
|
5
|
ad491b380b573d1f4389aa0e3a1aae0eceb467d8
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
- run: npm ci
- run: npx prisma generate
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
27016
|
1
|
1782987178
|
1782987251
|
1782987176
|
1782987251
|
|
0
|
|
0
|
Edit
Delete
|
|
30877
|
23400
|
51
|
5
|
ad491b380b573d1f4389aa0e3a1aae0eceb467d8
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
- run: npm ci
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
27017
|
2
|
1782987251
|
1782987281
|
1782987176
|
1782987282
|
|
0
|
|
0
|
Edit
Delete
|
|
30878
|
23400
|
51
|
5
|
ad491b380b573d1f4389aa0e3a1aae0eceb467d8
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
27018
|
2
|
1782987282
|
1782987297
|
1782987176
|
1782987297
|
|
0
|
|
0
|
Edit
Delete
|
|
30879
|
23401
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
27019
|
2
|
1783306829
|
1783306920
|
1783306828
|
1783306920
|
|
0
|
|
0
|
Edit
Delete
|
|
30880
|
23402
|
50
|
5
|
00a617f128624eeadc28167b5f20da59a402fc2f
|
0
|
remote-safe-governance
|
1
|
name: Lyra Production Governance
"on":
name: Lyra Production Governance
"on":
pull_request:
push:
branches:
- main
- "codex/**"
jobs:
remote-safe-governance:
name: remote-safe-governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install
run: pnpm install --frozen-lockfile
- name: Remote-safe checks
run: pnpm check:ci
- name: Runtime acceptance boundary
run: |
echo "Remote CI does not claim runtime acceptance."
echo "Real DB/API/browser/model acceptance remains reports/runtime-acceptance.latest.json, reports/http-ui-acceptance.latest.json, and reports/ui-click-acceptance.latest.json."
timeout-minutes: "20"
...
|
remote-safe-governance
|
null
|
["ubuntu-latest"]
|
27020
|
1
|
1783323702
|
1783323765
|
1783323702
|
1783323765
|
|
0
|
|
0
|
Edit
Delete
|
|
30881
|
23403
|
55
|
5
|
8b9d81d390dac8db76b755c9d7a25f7439e2a59b
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27021
|
1
|
1783326647
|
1783326773
|
1783326647
|
1783326774
|
|
0
|
|
0
|
Edit
Delete
|
|
30882
|
23403
|
55
|
5
|
8b9d81d390dac8db76b755c9d7a25f7439e2a59b
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/base_framework_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: base_framework_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d base_framework_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27022
|
2
|
1783326778
|
1783326794
|
1783326647
|
1783326795
|
|
1
|
|
0
|
Edit
Delete
|
|
30883
|
23404
|
56
|
5
|
e65fc3036083a4118e0c909bd6a58914e6b33fef
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27023
|
1
|
1783326795
|
1783326829
|
1783326783
|
1783326829
|
|
0
|
|
0
|
Edit
Delete
|
|
30884
|
23404
|
56
|
5
|
e65fc3036083a4118e0c909bd6a58914e6b33fef
|
0
|
Runtime and UI acceptance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/base_framework_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: base_framework_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d base_framework_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
27024
|
2
|
1783326831
|
1783326922
|
1783326783
|
1783326922
|
|
1
|
|
0
|
Edit
Delete
|
|
30885
|
23405
|
50
|
5
|
00a617f128624eeadc28167b5f20da59a402fc2f
|
0
|
remote-safe-governance
|
1
|
name: Lyra Production Governance
"on":
name: Lyra Production Governance
"on":
pull_request:
push:
branches:
- main
- "codex/**"
jobs:
remote-safe-governance:
name: remote-safe-governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install
run: pnpm install --frozen-lockfile
- name: Remote-safe checks
run: pnpm check:ci
- name: Runtime acceptance boundary
run: |
echo "Remote CI does not claim runtime acceptance."
echo "Real DB/API/browser/model acceptance remains reports/runtime-acceptance.latest.json, reports/http-ui-acceptance.latest.json, and reports/ui-click-acceptance.latest.json."
timeout-minutes: "20"
...
|
remote-safe-governance
|
null
|
["ubuntu-latest"]
|
27025
|
2
|
1783327280
|
1783327370
|
1783327280
|
1783327370
|
|
0
|
|
0
|
Edit
Delete
|
|
30886
|
23406
|
50
|
5
|
c51dc5edc2fdf269634a6cbbc50e18200230e42d
|
0
|
remote-safe-governance
|
1
|
name: Lyra Production Governance
"on":
name: Lyra Production Governance
"on":
pull_request:
push:
branches:
- main
- "codex/**"
jobs:
remote-safe-governance:
name: remote-safe-governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install
run: pnpm install --frozen-lockfile
- name: Remote-safe checks
run: pnpm check:ci
- name: Runtime acceptance boundary
run: |
echo "Remote CI does not claim runtime acceptance."
echo "Real DB/API/browser/model acceptance remains reports/runtime-acceptance.latest.json, reports/http-ui-acceptance.latest.json, and reports/ui-click-acceptance.latest.json."
timeout-minutes: "20"
...
|
remote-safe-governance
|
null
|
["ubuntu-latest"]
|
27026
|
2
|
1783431502
|
1783431543
|
1783431501
|
1783431544
|
|
0
|
|
0
|
Edit
Delete
|
|
30887
|
23407
|
50
|
5
|
c51dc5edc2fdf269634a6cbbc50e18200230e42d
|
0
|
remote-safe-governance
|
1
|
name: Lyra Production Governance
"on":
name: Lyra Production Governance
"on":
pull_request:
push:
branches:
- main
- "codex/**"
jobs:
remote-safe-governance:
name: remote-safe-governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "20"
- name: Install
run: pnpm install --frozen-lockfile
- name: Remote-safe checks
run: pnpm check:ci
- name: Runtime acceptance boundary
run: |
echo "Remote CI does not claim runtime acceptance."
echo "Real DB/API/browser/model acceptance remains reports/runtime-acceptance.latest.json, reports/http-ui-acceptance.latest.json, and reports/ui-click-acceptance.latest.json."
timeout-minutes: "20"
...
|
remote-safe-governance
|
null
|
["ubuntu-latest"]
|
27027
|
2
|
1783431544
|
1783431580
|
1783431501
|
1783431580
|
|
0
|
|
0
|
Edit
Delete
|
|
30888
|
23408
|
51
|
5
|
49de0c2d382fe761e459574e38b67a4d09f4604d
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
- run: npm ci
- run: npx prisma generate
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
27028
|
1
|
1783576800
|
1783576867
|
1783576799
|
1783576867
|
|
0
|
|
0
|
Edit
Delete
|
|
30889
|
23408
|
51
|
5
|
49de0c2d382fe761e459574e38b67a4d09f4604d
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
- run: npm ci
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
27029
|
2
|
1783576867
|
1783576897
|
1783576799
|
1783576897
|
|
0
|
|
0
|
Edit
Delete
|
|
30890
|
23408
|
51
|
5
|
49de0c2d382fe761e459574e38b67a4d09f4604d
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
27030
|
2
|
1783576897
|
1783576912
|
1783576799
|
1783576912
|
|
0
|
|
0
|
Edit
Delete
|
|
30891
|
23409
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
27031
|
2
|
1783911629
|
1783911720
|
1783911628
|
1783911720
|
|
0
|
|
0
|
Edit
Delete
|
|
30892
|
23410
|
60
|
5
|
f73daf0a17c4cd19344f03ba21afcc326a49a650
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
27032
|
2
|
1784003176
|
1784003267
|
1784003175
|
1784003267
|
|
0
|
|
0
|
Edit
Delete
|
|
30893
|
23410
|
60
|
5
|
f73daf0a17c4cd19344f03ba21afcc326a49a650
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/base_framework_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
STORAGE_ENDPOINT: http://127.0.0.1:19000
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
minio:
image: bitnami/minio:latest
env:
MINIO_ROOT_PASSWORD: minioadmin
MINIO_ROOT_USER: minioadmin
ports:
- 19000:9000
options: --health-cmd "curl -f http://localhost:9000/minio/health/live" --health-interval 5s --health-timeout 5s --health-retries 20
postgres:
image: postgres:16
env:
POSTGRES_DB: base_framework_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d base_framework_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1784003175
|
1784003269
|
|
1
|
|
0
|
Edit
Delete
|
|
30894
|
23411
|
61
|
5
|
7e38caa7a9a622e250ab06620cd295404fd97f4a
|
0
|
free-gates
|
1
|
name: kb-governance
"on":
pull_request name: kb-governance
"on":
pull_request:
push:
branches: [main]
jobs:
free-gates:
name: free-gates
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.11"
- run: pip install -r requirements.txt -r requirements-ingest.txt
- run: bash eval/ci.sh
...
|
free-gates
|
null
|
["ubuntu-latest"]
|
27033
|
2
|
1784003957
|
1784011490
|
1784003956
|
1784011490
|
|
0
|
|
0
|
Edit
Delete
|
|
30895
|
23412
|
60
|
5
|
a6e738a4e2b096ebd400cc03e3cbd92e6d3234f3
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1784010092
|
1784009830
|
1784010092
|
|
0
|
|
0
|
Edit
Delete
|
|
30896
|
23412
|
60
|
5
|
a6e738a4e2b096ebd400cc03e3cbd92e6d3234f3
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/base_framework_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
STORAGE_ENDPOINT: http://127.0.0.1:19000
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
minio:
image: bitnami/minio:latest
env:
MINIO_ROOT_PASSWORD: minioadmin
MINIO_ROOT_USER: minioadmin
ports:
- 19000:9000
options: --health-cmd "curl -f http://localhost:9000/minio/health/live" --health-interval 5s --health-timeout 5s --health-retries 20
postgres:
image: postgres:16
env:
POSTGRES_DB: base_framework_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d base_framework_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1784010092
|
1784009830
|
1784010092
|
|
0
|
|
0
|
Edit
Delete
|
|
30897
|
23413
|
60
|
5
|
1270a9b62cf64e8bf85e71686a39728438f36160
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
env:
GOVERNANCE_SKIP_LOCAL_ASSET_GATES: "true"
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1784010285
|
1784010092
|
1784010285
|
|
0
|
|
0
|
Edit
Delete
|
|
30898
|
23413
|
60
|
5
|
1270a9b62cf64e8bf85e71686a39728438f36160
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/base_framework_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
STORAGE_ENDPOINT: http://127.0.0.1:19000
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
minio:
image: bitnami/minio:latest
env:
MINIO_ROOT_PASSWORD: minioadmin
MINIO_ROOT_USER: minioadmin
ports:
- 19000:9000
options: --health-cmd "curl -f http://localhost:9000/minio/health/live" --health-interval 5s --health-timeout 5s --health-retries 20
postgres:
image: postgres:16
env:
POSTGRES_DB: base_framework_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d base_framework_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1784010285
|
1784010092
|
1784010285
|
|
0
|
|
0
|
Edit
Delete
|
|
30899
|
23414
|
60
|
5
|
2454d24e46f12337b9574f9d677ddf051fb17005
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
env:
GOVERNANCE_SKIP_LOCAL_ASSET_GATES: "true"
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1784010778
|
1784010285
|
1784010778
|
|
0
|
|
0
|
Edit
Delete
|
|
30900
|
23414
|
60
|
5
|
2454d24e46f12337b9574f9d677ddf051fb17005
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/base_framework_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
STORAGE_ENDPOINT: http://127.0.0.1:19000
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Start MinIO (official image, same command as local doctrine)
run: |
docker run -d --name minio -p 19000:9000 minio/minio server /data
for i in $(seq 1 30); do
curl -sf http://127.0.0.1:19000/minio/health/live && break
sleep 2
done
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: base_framework_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d base_framework_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1784010778
|
1784010285
|
1784010778
|
|
0
|
|
0
|
Edit
Delete
|