|
44373
|
26406
|
51
|
5
|
7e08c05a4c20bce31a280f6ee91a2913165d242b
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
env:
# 无DB单测会 import config/env（zod 启动校验，仅校验格式不连库）：提供合法 DATABASE_URL/JWT_SECRET 让校验通过。
# 纯函数单测（leads.canTransition / platforms.platformConnectionTruth 等）不发查询，无需真实 DB 服务。
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
JWT_SECRET: ci-jwt-secret-not-for-prod
USE_MOCK_ADAPTERS: 'true'
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run check:enterprise
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
36357
|
2
|
1792810468
|
1792810486
|
1792810467
|
1792810487
|
|
0
|
|
0
|
Edit
Delete
|
|
44374
|
26406
|
51
|
5
|
7e08c05a4c20bce31a280f6ee91a2913165d242b
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
36358
|
2
|
1792810487
|
1792810502
|
1792810467
|
1792810503
|
|
0
|
|
0
|
Edit
Delete
|
|
44375
|
26406
|
51
|
5
|
7e08c05a4c20bce31a280f6ee91a2913165d242b
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
36359
|
1
|
1792810503
|
1792810557
|
1792810467
|
1792810557
|
|
0
|
|
0
|
Edit
Delete
|
|
44376
|
26407
|
51
|
5
|
7e08c05a4c20bce31a280f6ee91a2913165d242b
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
1
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
36360
|
2
|
1792810557
|
1792810577
|
1792810467
|
1792810577
|
|
0
|
|
0
|
Edit
Delete
|
|
44377
|
26408
|
135
|
5
|
6b4743d345460a8e8b1dff7e2c6ed259357ce62b
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout device cloud with history
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Setup Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "22"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
- if: always()
name: Upload immutable static governance evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: warn
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: |
reports/*.latest.json
!reports/governance-profile-*.latest.json
!reports/runtime-acceptance.latest.json
!reports/conformance-differential.latest.json
!reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "20"
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36361
|
2
|
1792812701
|
1792812764
|
1792812701
|
1792812764
|
|
0
|
|
0
|
Edit
Delete
|
|
44378
|
26408
|
135
|
5
|
6b4743d345460a8e8b1dff7e2c6ed259357ce62b
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/device_cloud_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout device cloud with history
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Setup Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "22"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- name: Prove release evidence matches current source
run: pnpm check:evidence
- if: always()
name: Upload immutable runtime and UI evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: warn
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: |
reports/runtime-acceptance.latest.json
reports/conformance-differential.latest.json
reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "45"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: device_cloud_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d device_cloud_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792812701
|
1792812765
|
|
1
|
|
0
|
Edit
Delete
|
|
44379
|
26408
|
135
|
5
|
6b4743d345460a8e8b1dff7e2c6ed259357ce62b
|
0
|
Aggregate same-SHA governance evidence
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
governance-evidence:
name: Aggregate same-SHA governance evidence
runs-on: ubuntu-latest
if: always()
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Download static evidence
uses: actions/download-artifact@v4
with:
name: governance-static-governance-${{ github.sha }}-${{ github.run_attempt }}
path: reports
continue-on-error: true
- name: Download runtime and UI evidence
uses: actions/download-artifact@v4
with:
name: governance-runtime-acceptance-${{ github.sha }}-${{ github.run_attempt }}
path: reports
continue-on-error: true
- name: Generate same-SHA profile status manifest
run: node scripts/generate-governance-status.mjs
- if: always()
name: Upload immutable aggregate status
uses: actions/upload-artifact@v4
with:
if-no-files-found: error
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: reports/governance-status.latest.json
retention-days: "30"
- if: always()
name: Preserve upstream gate result
run: |
test "${{ needs.static-governance.result }}" = "success"
test "${{ needs.runtime-acceptance.result }}" = "success"
timeout-minutes: "10"
...
|
governance-evidence
|
["static-governance","runtime-acceptan ["static-governance","runtime-acceptance"]...
|
["ubuntu-latest"]
|
36364
|
2
|
1792813889
|
1792813919
|
1792812701
|
1792813919
|
|
1
|
|
0
|
Edit
Delete
|
|
44380
|
26409
|
83
|
5
|
de07c3b593c59498d0dce8410c0e8a7538c599a9
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36362
|
3
|
1792812764
|
1792813718
|
1792812748
|
1792813718
|
|
0
|
|
0
|
Edit
Delete
|
|
44381
|
26409
|
83
|
5
|
de07c3b593c59498d0dce8410c0e8a7538c599a9
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
- name: Run Fastify UI acceptance
run: pnpm check:ui:fastify
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
3
|
0
|
1792813718
|
1792812748
|
1792813718
|
|
0
|
|
0
|
Edit
Delete
|
|
44382
|
26410
|
83
|
5
|
de07c3b593c59498d0dce8410c0e8a7538c599a9
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@v3
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36363
|
2
|
1792813798
|
1792813889
|
1792812748
|
1792813889
|
|
0
|
|
0
|
Edit
Delete
|
|
44383
|
26410
|
83
|
5
|
de07c3b593c59498d0dce8410c0e8a7538c599a9
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36368
|
2
|
1792814010
|
1792814010
|
1792812748
|
1792814011
|
|
1
|
|
0
|
Edit
Delete
|
|
44384
|
26411
|
82
|
5
|
f799945209d1c8eff92a1e7f3b14b252b445d4df
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/juhai-ticket-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/juhai-ticket-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36365
|
2
|
1792813919
|
1792813949
|
1792813299
|
1792813949
|
|
0
|
|
0
|
Edit
Delete
|
|
44385
|
26411
|
82
|
5
|
f799945209d1c8eff92a1e7f3b14b252b445d4df
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
S3_ENDPOINT: http://127.0.0.1:9000
S3_ACCESS_KEY_ID: juhai-ci
S3_SECRET_ACCESS_KEY: juhai-ci-secret-change-me
S3_ATTACHMENT_BUCKET: juhai-attachments
S3_REGION: us-east-1
S3_FORCE_PATH_STYLE: "true"
CLAMAV_HOST: 127.0.0.1
CLAMAV_PORT: "3310"
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/juhai-ticket-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/juhai-ticket-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start real S3 and antivirus acceptance infrastructure
run: |
set -euo pipefail
docker run -d --name juhai-ci-minio -p 9000:9000 \
-e MINIO_ROOT_USER=juhai-ci \
-e MINIO_ROOT_PASSWORD=juhai-ci-secret-change-me \
quay.io/minio/minio@sha256:064117214caceaa8d8a90ef7caa58f2b2aeb316b5156afe9ee8da5b4d83e12c8 \
server /data
docker run -d --name juhai-ci-clamav -p 3310:3310 \
clamav/clamav-debian@sha256:967334b92d1782e4d1314ddf903ae537d26792d21c9a39adecb8ac9757980514
for attempt in $(seq 1 60); do
curl --fail --silent http://127.0.0.1:9000/minio/health/live && break
if [[ "$attempt" == 60 ]]; then exit 1; fi
sleep 2
done
docker run --rm --network host \
quay.io/minio/mc@sha256:09f93f534cde415d192bb6084dd0e0ddd1715fb602f8a922ad121fd2bf0f8b44 \
sh -c 'mc alias set local http://127.0.0.1:9000 juhai-ci juhai-ci-secret-change-me && mc mb --ignore-existing local/juhai-attachments'
for attempt in $(seq 1 90); do
docker exec juhai-ci-clamav clamdscan --ping 1 && break
if [[ "$attempt" == 90 ]]; then exit 1; fi
sleep 3
done
shell: bash
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
- name: Reconcile full governance evidence
run: pnpm check:governance
- name: Create verified logical backup
run: bash scripts/backup-postgres.sh
env:
BACKUP_OUTPUT: ${{ runner.temp }}/juhai-ticket-ci.dump
- name: Restore into an isolated database and verify governed facts
run: |
set -euo pipefail
createdb --dbname="postgresql://postgres:postgres@127.0.0.1:5432/postgres" juhai_ai_work_order_system_restore_ci
checksum="$(awk '{print $1}' "${RUNNER_TEMP}/juhai-ticket-ci.dump.sha256")"
BACKUP_INPUT="${RUNNER_TEMP}/juhai-ticket-ci.dump" \
EXPECTED_SHA256="${checksum}" \
RESTORE_DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_work_order_system_restore_ci" \
bash scripts/restore-postgres-drill.sh
shell: bash
services:
postgres:
image: pgvector/pgvector@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b
env:
POSTGRES_DB: juhai_ai_work_order_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_work_order_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792813299
|
1792813951
|
|
1
|
|
0
|
Edit
Delete
|
|
44386
|
26412
|
83
|
5
|
07deabdcf542864541a6f597ed7c0d724d89971b
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36366
|
2
|
1792813950
|
1792813980
|
1792813718
|
1792813980
|
|
0
|
|
0
|
Edit
Delete
|
|
44387
|
26412
|
83
|
5
|
07deabdcf542864541a6f597ed7c0d724d89971b
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/juhai_ai_hr_system_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run real DB and Redis acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run NestJS UI acceptance
run: pnpm check:ui
- name: Run Fastify UI acceptance
run: pnpm check:ui:fastify
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: juhai_ai_hr_system_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d juhai_ai_hr_system_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792813718
|
1792813980
|
|
1
|
|
0
|
Edit
Delete
|
|
44388
|
26413
|
83
|
5
|
07deabdcf542864541a6f597ed7c0d724d89971b
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@v3
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36367
|
2
|
1792813980
|
1792814010
|
1792813718
|
1792814010
|
|
0
|
|
0
|
Edit
Delete
|
|
44389
|
26413
|
83
|
5
|
07deabdcf542864541a6f597ed7c0d724d89971b
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36369
|
2
|
1792814012
|
1792814012
|
1792813718
|
1792814013
|
|
1
|
|
0
|
Edit
Delete
|
|
44390
|
26414
|
51
|
5
|
b26105dcbf11b42a6803499eb298627321e8cfd9
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
env:
# 无DB单测会 import config/env（zod 启动校验，仅校验格式不连库）：提供合法 DATABASE_URL/JWT_SECRET 让校验通过。
# 纯函数单测（leads.canTransition / platforms.platformConnectionTruth 等）不发查询，无需真实 DB 服务。
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
JWT_SECRET: ci-jwt-secret-not-for-prod
USE_MOCK_ADAPTERS: 'true'
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run check:enterprise
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
36370
|
2
|
1792814014
|
1792814044
|
1792814014
|
1792814045
|
|
0
|
|
0
|
Edit
Delete
|
|
44391
|
26414
|
51
|
5
|
b26105dcbf11b42a6803499eb298627321e8cfd9
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
36371
|
2
|
1792814045
|
1792814075
|
1792814014
|
1792814075
|
|
0
|
|
0
|
Edit
Delete
|
|
44392
|
26414
|
51
|
5
|
b26105dcbf11b42a6803499eb298627321e8cfd9
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
36372
|
2
|
1792814075
|
1792814105
|
1792814014
|
1792814105
|
|
0
|
|
0
|
Edit
Delete
|
|
44393
|
26415
|
51
|
5
|
b26105dcbf11b42a6803499eb298627321e8cfd9
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
1
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
36373
|
2
|
1792814105
|
1792814136
|
1792814014
|
1792814136
|
|
0
|
|
0
|
Edit
Delete
|
|
44394
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
36374
|
2
|
1792814976
|
1792814987
|
1792814975
|
1792814987
|
|
0
|
|
0
|
Edit
Delete
|
|
44395
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (api-fastify)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-fastify)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-fastify:ci
target:
- api-fastify
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44396
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (api-nestjs)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-nestjs)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-nestjs:ci
target:
- api-nestjs
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44397
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-alertmanager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44398
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-gateway)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44399
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-loki)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44400
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-otel-collector)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44401
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-pager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44402
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-postgres)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44403
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-tempo)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-tempo)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-tempo:ci
target:
- ops-tempo
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44404
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (ops-trace-storage)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44405
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Application image scan (web)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Build immutable application target
run: docker build --secret "id=npmrc,src=${NPM_CONFIG_USERCONFIG}" --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44406
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Third-party image scan (prom/prometheus:v3.14.0@sh Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)...
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44407
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Third-party image scan (redis:7-alpine@sha256:ff02 Third-party image scan (redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf)...
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
third-party-image-vulnerability-scan:
name: Third-party image scan (redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf)
runs-on: ubuntu-latest
steps:
- name: Reject third-party HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
permissions:
contents: read
...
|
third-party-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44408
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Runtime and UI acceptance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
runtime-acceptance:
name: Runtime and UI acceptance
runs-on: ubuntu-latest
env:
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/digital_employee_os_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
FACT_TEST_BROKERS: 127.0.0.1:59092
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Start isolated fact broker
run: |
docker run --rm -d --name runtime-fact-broker -p 127.0.0.1:59092:19092 \
--health-cmd "rpk cluster health | grep -E 'Healthy:.+true' || exit 1" \
--health-interval 2s --health-timeout 5s --health-retries 30 \
docker.redpanda.com/redpandadata/redpanda@sha256:04baa40ed34edf86028396f762be802f3b6b0acaab65e9de696a3f15d54c550f \
redpanda start --mode=dev-container --smp=1 --memory=1G --overprovisioned \
--kafka-addr=internal://0.0.0.0:9092,external://0.0.0.0:19092 \
--advertise-kafka-addr=internal://127.0.0.1:9092,external://127.0.0.1:59092 \
--rpc-addr=0.0.0.0:33145 --advertise-rpc-addr=127.0.0.1:33145
for attempt in {1..45}; do
if [ "$(docker inspect -f '{{.State.Health.Status}}' runtime-fact-broker)" = healthy ]; then exit 0; fi
sleep 1
done
docker logs runtime-fact-broker
exit 1
- name: Run real DB Redis and Kafka acceptance
run: pnpm check:runtime
- name: Install Playwright browser
run: pnpm --filter web exec playwright install --with-deps chromium
- name: Run UI acceptance
run: pnpm check:ui
env:
# O1：runtime 验收的遗留 delayed job 不得漏进 UI 阶段共享的 BullMQ 队列，
# Redis 逻辑库隔离（镜像本地 /2 vs /3 约定）。
REDIS_URL: redis://127.0.0.1:6379/1
- if: ${{ always() }}
name: Stop isolated fact broker
run: docker rm -f runtime-fact-broker
services:
postgres:
image: postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685
env:
POSTGRES_DB: digital_employee_os_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d digital_employee_os_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime-acceptance
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1792814975
|
1792814989
|
|
1
|
|
0
|
Edit
Delete
|
|
44409
|
26416
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Merge gate
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
merge-gate:
name: Merge gate
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Require every governance and scan result
run: node scripts/check-merge-gate.mjs
env:
CI_JOB_RESULTS: ${{ toJSON(needs) }}
permissions:
contents: read
...
|
merge-gate
|
["static-governance","application-imag ["static-governance","application-image-vulnerability-scan","third-party-image-vulnerability-scan","runtime-acceptance"]...
|
["ubuntu-latest"]
|
36376
|
2
|
1792814997
|
1792815003
|
1792814975
|
1792815003
|
|
1
|
|
0
|
Edit
Delete
|
|
44410
|
26417
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
36375
|
2
|
1792814988
|
1792814997
|
1792814976
|
1792814997
|
|
0
|
|
0
|
Edit
Delete
|
|
44411
|
26417
|
76
|
5
|
cde28cf277ed694be3e2f4273fc80ab0163cadb3
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
36377
|
2
|
1792815003
|
1792815003
|
1792814976
|
1792815003
|
|
1
|
|
0
|
Edit
Delete
|
|
44412
|
26418
|
51
|
5
|
0927261201c363a6e4e3ea1f06cd17caedc6527e
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
env:
# 无DB单测会 import config/env（zod 启动校验，仅校验格式不连库）：提供合法 DATABASE_URL/JWT_SECRET 让校验通过。
# 纯函数单测（leads.canTransition / platforms.platformConnectionTruth 等）不发查询，无需真实 DB 服务。
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
JWT_SECRET: ci-jwt-secret-not-for-prod
USE_MOCK_ADAPTERS: 'true'
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run check:enterprise
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
36378
|
2
|
1792815605
|
1792815621
|
1792815605
|
1792815622
|
|
0
|
|
0
|
Edit
Delete
|
|
44413
|
26418
|
51
|
5
|
0927261201c363a6e4e3ea1f06cd17caedc6527e
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
36379
|
2
|
1792815622
|
1792815637
|
1792815605
|
1792815637
|
|
0
|
|
0
|
Edit
Delete
|
|
44414
|
26418
|
51
|
5
|
0927261201c363a6e4e3ea1f06cd17caedc6527e
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
1
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
36380
|
1
|
1792815638
|
1792815681
|
1792815605
|
1792815682
|
|
0
|
|
0
|
Edit
Delete
|
|
44415
|
26419
|
51
|
5
|
0927261201c363a6e4e3ea1f06cd17caedc6527e
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
1
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
36381
|
2
|
1792815683
|
1792815700
|
1792815605
|
1792815700
|
|
0
|
|
0
|
Edit
Delete
|
|
44416
|
26420
|
116
|
5
|
846cefa17b80596ef5767341337b2e71e91397ce
|
0
|
Static checks (locked engineering dependency)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://gitea.g-hi.com/luoanwu/actions-checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://gitea.g-hi.com/luoanwu/actions-setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
36382
|
2
|
1792817516
|
1792817517
|
1792817515
|
1792817517
|
|
0
|
|
0
|
Edit
Delete
|
|
44417
|
26420
|
116
|
5
|
846cefa17b80596ef5767341337b2e71e91397ce
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://gitea.g-hi.com/luoanwu/actions-checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://gitea.g-hi.com/luoanwu/actions-setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/conformance-differential.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
36383
|
2
|
1792817518
|
1792817518
|
1792817515
|
1792817519
|
|
0
|
|
0
|
Edit
Delete
|
|
44418
|
26420
|
116
|
5
|
846cefa17b80596ef5767341337b2e71e91397ce
|
0
|
Unit tests without DB (modules / packages / govern Unit tests without DB (modules / packages / governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
unit:
name: Unit tests without DB (modules / packages / governance)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: https://gitea.g-hi.com/luoanwu/actions-checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://gitea.g-hi.com/luoanwu/actions-setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Generate clients for authority module unit imports (no database)
run: pnpm --dir runtime prisma:generate
- name: Module / package unit tests
run: pnpm --dir runtime exec turbo run test --filter='./modules/*' --filter='./packages/*' --filter='./clients/*' --force
- name: Governance package tests
run: pnpm governance:test
timeout-minutes: "20"
permissions:
contents: read
...
|
unit
|
["static"]
|
["ubuntu-latest"]
|
36384
|
4
|
1792817520
|
1792817520
|
1792817515
|
1792817521
|
|
1
|
|
0
|
Edit
Delete
|
|
44419
|
26420
|
116
|
5
|
846cefa17b80596ef5767341337b2e71e91397ce
|
0
|
Port conformance (kernel / modules / clients)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
port-conformance:
name: Port conformance (kernel / modules / clients)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://gitea.g-hi.com/luoanwu/actions-checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://gitea.g-hi.com/luoanwu/actions-setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Run port conformance with complete suite coverage
run: pnpm check:port-conformance
- if: always()
name: Upload port conformance evidence
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: error
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: reports/port-conformance.latest.json
retention-days: "30"
timeout-minutes: "20"
permissions:
contents: read
...
|
port-conformance
|
["static"]
|
["ubuntu-latest"]
|
36385
|
4
|
1792817522
|
1792817522
|
1792817515
|
1792817523
|
|
1
|
|
0
|
Edit
Delete
|
|
44420
|
26420
|
116
|
5
|
846cefa17b80596ef5767341337b2e71e91397ce
|
0
|
Runtime and UI acceptance (real PostgreSQL + Redis Runtime and UI acceptance (real PostgreSQL + Redis)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
runtime:
name: Runtime and UI acceptance (real PostgreSQL + Redis)
runs-on: ubuntu-latest
env:
# 库名前缀由 runtime/package.json name 派生（G15 基座守卫：enterprise_platform*）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_platform_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379
KAFKA_BROKERS: 127.0.0.1:59092
MAINLINE_CHAOS_CONTAINER: enterprise-platform-ms23-ci-redpanda-1
# Compose parses all services even for --no-deps redpanda and down.
# These unused service values deliberately cannot start a runtime.
PLATFORM_DEPLOYMENT_ENV: test
PLATFORM_RUNTIME_IMAGE: enterprise-platform/runtime:ci-not-started
PLATFORM_RUNTIME_DATABASE_RUNTIME_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_DATABASE_SYSTEM_URL: postgresql://unused@127.0.0.1:1/unused
PLATFORM_RUNTIME_REDIS_URL: redis://127.0.0.1:1/15
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://gitea.g-hi.com/luoanwu/actions-checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://gitea.g-hi.com/luoanwu/actions-setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install Playwright browser
run: pnpm --dir runtime --filter web exec playwright install --with-deps chromium
- name: Workbench browser regressions (intercepted read APIs)
run: pnpm check:workbench-ui
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build persistence modules and provision every module acceptance database
run: |
pnpm runtime:build:modules
node governance/prepare-module-databases.mjs
- name: Prepare mainline fixtures and verify identity ordinary-role databases
run: |
pnpm mainline:prepare
pnpm identity:prepare
- name: Policy activation concurrency and lease fencing (isolated PostgreSQL with RLS)
run: pnpm check:policy-governance
- name: Build isolated MinIO from pinned upstream source
run: docker build -t enterprise-platform/test-minio:a6c538c5 stack/test-minio
- name: Real file and notification execution slices (S3, ClamAV, durable receiver receipts)
run: pnpm check:execution-slices
env:
EXECUTION_CLAMAV_PORT: "3310"
- name: Registry admission and central audit recovery
run: pnpm check:registry-admission
- name: Start isolated Redpanda and provision registered topics
run: |
docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml up -d --wait --no-deps redpanda
bash stack/provision/redpanda-topics.sh --apply
- name: Real DB and Redis acceptance (deploy → RLS roles → differential → tests incl. 7 profile boots)
run: pnpm runtime:check:runtime
- name: Configuration snapshots, tenant isolation and remote SDK acceptance
run: pnpm acceptance:configuration
- name: Persistent mainline, audit tamper, revocation SLA and real broker failure
run: pnpm mainline:check
- name: Identity signing against isolated OpenBao Transit
run: pnpm identity:check:transit
- name: UI acceptance (NestJS / Fastify x WS / SSE)
run: pnpm runtime:check:ui
env:
UI_MATRIX: "1"
- name: Identity module browser acceptance (login / MFA / consent / sessions)
run: pnpm identity:check:module-ui
- name: MCP controlled writes (isolated IdP, Owner receipt, retry and revocation)
run: pnpm check:mcp-writes
- if: always()
name: Upload workbench browser diagnostics
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: warn
name: platform-workbench-browser-${{ env.CANDIDATE_TAG }}
path: /tmp/platform-workbench-ui-*/
retention-days: "7"
- if: always()
name: Upload runtime and UI evidence
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: warn
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: |
runtime/reports/runtime-acceptance.latest.json
runtime/reports/conformance-differential.latest.json
runtime/reports/ui-acceptance.latest.json
reports/workbench-ui.latest.json
reports/identity-ui.latest.json
reports/mcp-writes.latest.json
reports/mainline-acceptance.latest.json
reports/configuration-runtime.latest.json
reports/revocation-sla.latest.json
reports/policy-governance.latest.json
reports/execution-slices.latest.json
reports/registry-admission.latest.json
reports/identity-transit.latest.json
reports/scope-http.latest.json
reports/scope-fact-sla.latest.json
reports/machine-revocation-sla.latest.json
reports/credential-m1-sla.latest.json
retention-days: "30"
- if: always()
name: Stop isolated acceptance broker
run: docker compose -p enterprise-platform-ms23-ci -f stack/compose.yaml -f stack/overlays/test.yaml down
timeout-minutes: "50"
services:
clamav:
image: clamav/clamav-debian@sha256:be3cb41d9833ce9ffb98f3d3e1483c35c0d87060c2bda3624d75fd28bbf0b3bd
ports:
- 3310:3310
options: --health-cmd "clamdcheck.sh" --health-start-period 120s --health-interval 10s --health-timeout 5s --health-retries 24
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_platform_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_platform_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
runtime
|
["static"]
|
["ubuntu-latest"]
|
36386
|
4
|
1792817524
|
1792817525
|
1792817515
|
1792817525
|
|
1
|
|
0
|
Edit
Delete
|
|
44421
|
26420
|
116
|
5
|
846cefa17b80596ef5767341337b2e71e91397ce
|
0
|
M1 identity transitional workspace (IdP static → E M1 identity transitional workspace (IdP static → E2 → governance)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
identity:
name: M1 identity transitional workspace (IdP static → E2 → governance)
runs-on: ubuntu-latest
env:
# 库名前缀由 identity/package.json name 派生（enterprise_idp*）；Redis 必须 db 0（老框架 C22）
DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/enterprise_idp_ci?schema=public
REDIS_URL: redis://127.0.0.1:6379/0
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://gitea.g-hi.com/luoanwu/actions-checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://gitea.g-hi.com/luoanwu/actions-setup-node@v4
with:
cache: pnpm
cache-dependency-path: identity/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig; shared runtime identity fixture dependencies)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Install identity workspace (frozen lockfile)
run: pnpm --dir identity install --frozen-lockfile
- name: Build shared identity fixture dependencies from this checkout
run: |
pnpm --dir runtime install --frozen-lockfile --filter @juhai/module-identity... --filter @juhai/client-identity
pnpm --dir runtime --filter @juhai/module-identity prisma:generate
pnpm --dir runtime exec turbo run build --filter=@juhai/module-identity... --filter=@juhai/client-identity...
pnpm --dir identity --filter api-nestjs exec node -e "require('node:assert/strict').strictEqual(require('@juhai/module-kit'), require('../../../runtime/modules/kit'))"
- name: Provision ordinary owner for the isolated identity test database
run: |
psql "${DATABASE_URL%%\?*}" -v ON_ERROR_STOP=1 <<'SQL'
CREATE ROLE enterprise_idp_ci_rt LOGIN PASSWORD 'ci-test-only' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;
ALTER DATABASE enterprise_idp_ci OWNER TO enterprise_idp_ci_rt;
ALTER SCHEMA public OWNER TO enterprise_idp_ci_rt;
SQL
echo 'DATABASE_URL=postgresql://enterprise_idp_ci_rt:ci-test-only@127.0.0.1:5432/enterprise_idp_ci?schema=public' >> "$GITHUB_ENV"
- name: Generate Prisma clients
run: pnpm --dir identity prisma:generate
- name: IdP static sub-checks (independent of runtime / UI reports)
run: pnpm identity:check:static
- name: IdP real DB acceptance (255 tests, serialized)
run: pnpm identity:check:runtime
- name: Install Playwright browser
run: pnpm --dir identity --filter web exec playwright install --with-deps chromium
- name: IdP UI acceptance (12 cases)
run: pnpm identity:check:ui
- name: IdP final governance aggregation (same checkout, fresh runtime / UI reports)
run: pnpm identity:check:governance
- if: always()
name: Upload identity evidence
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: warn
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: identity/reports/*.latest.json
retention-days: "30"
timeout-minutes: "50"
services:
postgres:
image: postgres:16
env:
POSTGRES_DB: enterprise_idp_ci
POSTGRES_PASSWORD: postgres
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_idp_ci" --health-interval 5s --health-timeout 5s --health-retries 20
redis:
image: redis:7
ports:
- 6379:6379
options: --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 20
permissions:
contents: read
...
|
identity
|
["static"]
|
["ubuntu-latest"]
|
36387
|
4
|
1792817526
|
1792817527
|
1792817515
|
1792817527
|
|
1
|
|
0
|
Edit
Delete
|
|
44422
|
26420
|
116
|
5
|
846cefa17b80596ef5767341337b2e71e91397ce
|
0
|
Runtime image build + SBOM (+ cosign when a key is Runtime image build + SBOM (+ cosign when a key is provided)...
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
image:
name: Runtime image build + SBOM (+ cosign when a key is provided)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- uses: https://gitea.g-hi.com/luoanwu/actions-checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: https://gitea.g-hi.com/luoanwu/actions-setup-node@v4
with:
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Resolve npmrc for BuildKit secret (never printed)
run: |
cfg="${RUNNER_TEMP}/platform-npmrc-resolved"
umask 077
printf '@juhai:registry=https://gitea.g-hi.com/api/packages/luoanwu/npm/\n//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=%s\n' "${GITEA_NPM_TOKEN}" > "${cfg}"
echo "PLATFORM_NPMRC=${cfg}" >> "${GITHUB_ENV}"
- name: Build runtime image from git archive HEAD:runtime (reports/image-digest.json)
run: node governance/build-image.mjs --context head --npmrc "${PLATFORM_NPMRC}"
- name: Install syft (pinned) and generate SPDX SBOM
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "${RUNNER_TEMP}/bin" v1.20.0
PATH="${RUNNER_TEMP}/bin:${PATH}" node governance/sbom.mjs
- name: Install cosign (pinned)
uses: https://gitea.g-hi.com/luoanwu/sigstore-cosign-installer@v3
with:
cosign-release: v2.4.1
- name: Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)
run: |
if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
umask 077; printf '%s' "${COSIGN_PRIVATE_KEY}" > "${RUNNER_TEMP}/cosign.key"
COSIGN_KEY="${RUNNER_TEMP}/cosign.key" node governance/sign-image.mjs
else
node governance/sign-image.mjs
fi
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- if: always()
name: Upload image evidence
uses: https://gitea.g-hi.com/luoanwu/actions-upload-artifact@v3
with:
if-no-files-found: warn
name: platform-image-${{ env.CANDIDATE_TAG }}
path: |
reports/image-digest.json
reports/sbom.spdx.json
reports/sbom.latest.json
reports/signature.json
retention-days: "30"
timeout-minutes: "40"
permissions:
contents: read
...
|
image
|
["static"]
|
["ubuntu-latest"]
|
36388
|
4
|
1792817528
|
1792817528
|
1792817515
|
1792817529
|
|
1
|
|
0
|
Edit
Delete
|