|
36298
|
24620
|
117
|
5
|
ee8545895a6ee2f79fde3f75659c4115a9f878bc
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
30723
|
2
|
1790466156
|
1790466171
|
1790466154
|
1790466171
|
|
0
|
|
0
|
Edit
Delete
|
|
36299
|
24621
|
76
|
5
|
9211af176582cf84be7953284ebaaa8585415582
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
30724
|
2
|
1790466844
|
1790466934
|
1790466842
|
1790466934
|
|
0
|
|
0
|
Edit
Delete
|
|
36314
|
24621
|
76
|
5
|
9211af176582cf84be7953284ebaaa8585415582
|
0
|
Merge gate
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
merge-gate:
name: Merge gate
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Require every governance and scan result
run: node scripts/check-merge-gate.mjs
env:
CI_JOB_RESULTS: ${{ toJSON(needs) }}
permissions:
contents: read
...
|
merge-gate
|
["static-governance","application-imag ["static-governance","application-image-vulnerability-scan","third-party-image-vulnerability-scan","runtime-acceptance"]...
|
["ubuntu-latest"]
|
30726
|
2
|
1790467966
|
1790467972
|
1790466842
|
1790467972
|
|
1
|
|
0
|
Edit
Delete
|
|
36315
|
24622
|
76
|
5
|
9211af176582cf84be7953284ebaaa8585415582
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
30725
|
2
|
1790466934
|
1790467966
|
1790466842
|
1790467966
|
|
0
|
|
0
|
Edit
Delete
|
|
36316
|
24622
|
76
|
5
|
9211af176582cf84be7953284ebaaa8585415582
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
30730
|
2
|
1790468150
|
1790468150
|
1790466842
|
1790468151
|
|
1
|
|
0
|
Edit
Delete
|
|
36319
|
24624
|
83
|
5
|
f8aa03f477027c619e28ce7ac4ddceb99419366b
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@v3
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
30727
|
2
|
1790467972
|
1790468029
|
1790467281
|
1790468029
|
|
0
|
|
0
|
Edit
Delete
|
|
36320
|
24624
|
83
|
5
|
f8aa03f477027c619e28ce7ac4ddceb99419366b
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
30731
|
2
|
1790468152
|
1790468152
|
1790467281
|
1790468152
|
|
1
|
|
0
|
Edit
Delete
|
|
36321
|
24625
|
83
|
5
|
9bd8501f3ca5b64c3cb2ec68dd04606cd859d526
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
30728
|
2
|
1790468029
|
1790468059
|
1790467738
|
1790468060
|
|
0
|
|
0
|
Edit
Delete
|
|
36323
|
24626
|
83
|
5
|
9bd8501f3ca5b64c3cb2ec68dd04606cd859d526
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@v3
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
30729
|
2
|
1790468060
|
1790468150
|
1790467738
|
1790468150
|
|
0
|
|
0
|
Edit
Delete
|
|
36324
|
24626
|
83
|
5
|
9bd8501f3ca5b64c3cb2ec68dd04606cd859d526
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
30732
|
2
|
1790468154
|
1790468154
|
1790467738
|
1790468154
|
|
1
|
|
0
|
Edit
Delete
|
|
36326
|
24627
|
116
|
5
|
db404923b6fdea627d852a993983d906476cfb38
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
GOV_REPORT_RUNNER: gitea-actions
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/conformance-differential.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
30734
|
2
|
1790468917
|
1790468927
|
1790468882
|
1790468927
|
|
0
|
|
0
|
Edit
Delete
|
|
36332
|
24627
|
116
|
5
|
db404923b6fdea627d852a993983d906476cfb38
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
GOV_REPORT_RUNNER: gitea-actions
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${{ github.run_attempt }}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
30741
|
2
|
1790468953
|
1790468969
|
1790468882
|
1790468969
|
|
1
|
|
0
|
Edit
Delete
|
|
36333
|
24628
|
117
|
5
|
866a3a8c5c91b14b377d10a2cba600675d27aefd
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
30735
|
2
|
1790468927
|
1790468942
|
1790468891
|
1790468943
|
|
0
|
|
0
|
Edit
Delete
|
|
36334
|
24629
|
116
|
5
|
56a054288f5aa5b69084a2dae69f7bbb51d9872d
|
0
|
Public static checks (no private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
GOV_REPORT_RUNNER: gitea-actions
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Public static checks (no private packages)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Governance checks (no private packages; contracts deps from public npm)
run: |
pnpm check:module-imports
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
30742
|
2
|
1790469463
|
1790470497
|
1790469462
|
1790470497
|
|
0
|
|
0
|
Edit
Delete
|
|
36335
|
24629
|
116
|
5
|
56a054288f5aa5b69084a2dae69f7bbb51d9872d
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
GOV_REPORT_RUNNER: gitea-actions
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/conformance-differential.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
30743
|
2
|
1790470497
|
1790470508
|
1790469462
|
1790470509
|
|
0
|
|
0
|
Edit
Delete
|
|
36342
|
24630
|
117
|
5
|
e9c7e844efcc979e0914c316a8f5123a798b444f
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
30744
|
2
|
1790470509
|
1790470622
|
1790469481
|
1790470623
|
|
0
|
|
0
|
Edit
Delete
|
|
36351
|
24632
|
116
|
5
|
3b3909bb0708b67e9aa9b101664bf5e15e42c404
|
0
|
Public static checks (no private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
GOV_REPORT_RUNNER: gitea-actions
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Public static checks (no private packages)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Governance checks (no private packages; contracts deps from public npm)
run: |
pnpm check:module-imports
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm check:caddy
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: always()
name: Upload package tarballs
uses: actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: always()
name: Upload public static evidence
uses: actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
30745
|
2
|
1790470623
|
1790470653
|
1790470599
|
1790470653
|
|
0
|
|
0
|
Edit
Delete
|
|
36352
|
24632
|
116
|
5
|
3b3909bb0708b67e9aa9b101664bf5e15e42c404
|
0
|
Static governance (repo root, private packages)
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
GOV_REPORT_RUNNER: gitea-actions
PNPM_VERSION: 9.15.9
jobs:
static:
name: Static governance (repo root, private packages)
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
cache: pnpm
cache-dependency-path: runtime/pnpm-lock.yaml
node-version: "20"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install runtime workspace (frozen lockfile)
run: pnpm --dir runtime install --frozen-lockfile
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm --dir runtime prisma:generate
- name: Build runtime modules (fixture suites evaluate migrated rules from dist)
run: pnpm runtime:build:modules
- name: Repo-root governance gate
run: pnpm check
- name: Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)
run: |
git status --porcelain | grep -vE '\.latest\.json$' && { echo "::error::静态门禁修改了报告以外的跟踪文件"; exit 1; } || echo "clean apart from latest reports"
- if: always()
name: Upload static evidence
uses: actions/upload-artifact@v3
with:
if-no-files-found: warn
name: platform-static-${{ env.CANDIDATE_TAG }}
path: |
reports/*.latest.json
runtime/reports/*.latest.json
!runtime/reports/runtime-acceptance.latest.json
!runtime/reports/conformance-differential.latest.json
!runtime/reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "30"
permissions:
contents: read
...
|
static
|
null
|
["ubuntu-latest"]
|
30746
|
2
|
1790470653
|
1790470683
|
1790470599
|
1790470683
|
|
0
|
|
0
|
Edit
Delete
|
|
36358
|
24632
|
116
|
5
|
3b3909bb0708b67e9aa9b101664bf5e15e42c404
|
0
|
Release candidate verification + manifest
|
1
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
CANDIDATE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
GOV_REPORT_RUNNER: gitea-actions
PNPM_VERSION: 9.15.9
jobs:
candidate:
name: Release candidate verification + manifest
runs-on: ubuntu-latest
if: always()
steps:
- uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Download static evidence
uses: actions/download-artifact@v3
with:
name: platform-static-${{ env.CANDIDATE_TAG }}
path: candidate/static
continue-on-error: true
- name: Download runtime evidence
uses: actions/download-artifact@v3
with:
name: platform-runtime-${{ env.CANDIDATE_TAG }}
path: candidate/runtime/runtime/reports
continue-on-error: true
- name: Download identity evidence
uses: actions/download-artifact@v3
with:
name: platform-identity-${{ env.CANDIDATE_TAG }}
path: candidate/identity/identity/reports
continue-on-error: true
- name: Download port-conformance evidence
uses: actions/download-artifact@v3
with:
name: platform-port-conformance-${{ env.CANDIDATE_TAG }}
path: candidate/port-conformance/reports
continue-on-error: true
- id: verify
name: Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)
run: node governance/verify-candidate.mjs --candidate candidate --sha "${{ github.sha }}" --run-id "${{ github.run_id }}" --attempt "${{ github.run_attempt }}" --out reports/release-candidate.latest.json
continue-on-error: true
- name: Download image and full SBOM evidence for the same candidate
uses: actions/download-artifact@v3
with:
name: platform-image-${{ env.CANDIDATE_TAG }}
path: reports
- name: Release Manifest (known facts, status partial until all deliverables exist)
run: node governance/release-manifest.mjs
- if: always()
name: Upload candidate evidence
uses: actions/upload-artifact@v3
with:
if-no-files-found: error
name: platform-candidate-${{ env.CANDIDATE_TAG }}
path: |
reports/release-candidate.latest.json
reports/release-manifest.latest.json
retention-days: "30"
- if: always()
name: Propagate upstream results and candidate eligibility
run: |
echo "public-static=${{ needs.public-static.result }} static=${{ needs.static.result }} runtime=${{ needs.runtime.result }} identity=${{ needs.identity.result }} verify=${{ steps.verify.outcome }}"
test "${{ needs.public-static.result }}" = "success"
test "${{ needs.static.result }}" = "success"
test "${{ needs.unit.result }}" = "success"
test "${{ needs.port-conformance.result }}" = "success"
test "${{ needs.runtime.result }}" = "success"
test "${{ needs.identity.result }}" = "success"
test "${{ needs.image.result }}" = "success"
test "${{ steps.verify.outcome }}" = "success"
timeout-minutes: "10"
permissions:
contents: read
...
|
candidate
|
["public-static","static","uni ["public-static","static","unit","port-conformance","runtime","identity","image"]...
|
["ubuntu-latest"]
|
30754
|
2
|
1790470724
|
1790471641
|
1790470599
|
1790471641
|
|
1
|
|
0
|
Edit
Delete
|
|
36359
|
24633
|
117
|
5
|
ced84657d281bfd71d4aff61aa230de97780ef33
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
30747
|
2
|
1790470683
|
1790470699
|
1790470629
|
1790470699
|
|
0
|
|
0
|
Edit
Delete
|
|
36360
|
24634
|
117
|
5
|
77dfc5dfee8540b683415046dc118f6a267a2ebb
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
1
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
30753
|
2
|
1790470709
|
1790470724
|
1790470690
|
1790470724
|
|
0
|
|
0
|
Edit
Delete
|
|
36361
|
24635
|
76
|
5
|
bf3489874b13f86fd2a36d382c4bbf7fc6adcddd
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
30755
|
2
|
1790471641
|
1790471650
|
1790471202
|
1790471650
|
|
0
|
|
0
|
Edit
Delete
|
|
36376
|
24635
|
76
|
5
|
bf3489874b13f86fd2a36d382c4bbf7fc6adcddd
|
0
|
Merge gate
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
merge-gate:
name: Merge gate
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Require every governance and scan result
run: node scripts/check-merge-gate.mjs
env:
CI_JOB_RESULTS: ${{ toJSON(needs) }}
permissions:
contents: read
...
|
merge-gate
|
["static-governance","application-imag ["static-governance","application-image-vulnerability-scan","third-party-image-vulnerability-scan","runtime-acceptance"]...
|
["ubuntu-latest"]
|
30757
|
2
|
1790471659
|
1790471664
|
1790471202
|
1790471665
|
|
1
|
|
0
|
Edit
Delete
|
|
36377
|
24636
|
76
|
5
|
bf3489874b13f86fd2a36d382c4bbf7fc6adcddd
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
30756
|
2
|
1790471650
|
1790471659
|
1790471202
|
1790471659
|
|
0
|
|
0
|
Edit
Delete
|
|
36378
|
24636
|
76
|
5
|
bf3489874b13f86fd2a36d382c4bbf7fc6adcddd
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
30758
|
2
|
1790471665
|
1790471665
|
1790471202
|
1790471665
|
|
1
|
|
0
|
Edit
Delete
|
|
36379
|
24637
|
76
|
5
|
df2aef526eda9ed1dc816004cde4d617e5e0c1dd
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Rebuild approved dependency scripts
run: pnpm dependencies:rebuild-approved
- name: Audit production dependencies
run: pnpm audit --prod --audit-level high
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
30759
|
2
|
1790475590
|
1790475681
|
1790475589
|
1790475681
|
|
0
|
|
0
|
Edit
Delete
|
|
36394
|
24637
|
76
|
5
|
df2aef526eda9ed1dc816004cde4d617e5e0c1dd
|
0
|
Merge gate
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
merge-gate:
name: Merge gate
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Require every governance and scan result
run: node scripts/check-merge-gate.mjs
env:
CI_JOB_RESULTS: ${{ toJSON(needs) }}
permissions:
contents: read
...
|
merge-gate
|
["static-governance","application-imag ["static-governance","application-image-vulnerability-scan","third-party-image-vulnerability-scan","runtime-acceptance"]...
|
["ubuntu-latest"]
|
30761
|
2
|
1790475711
|
1790475742
|
1790475589
|
1790475742
|
|
1
|
|
0
|
Edit
Delete
|
|
36395
|
24638
|
76
|
5
|
df2aef526eda9ed1dc816004cde4d617e5e0c1dd
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
30760
|
2
|
1790475681
|
1790475711
|
1790475589
|
1790475711
|
|
0
|
|
0
|
Edit
Delete
|
|
36396
|
24638
|
76
|
5
|
df2aef526eda9ed1dc816004cde4d617e5e0c1dd
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
30762
|
2
|
1790475742
|
1790475742
|
1790475589
|
1790475742
|
|
1
|
|
0
|
Edit
Delete
|
|
36397
|
24639
|
83
|
5
|
5df3d8bdb23929348dd87a448e74eb442a290414
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
30763
|
2
|
1790476600
|
1790476658
|
1790476598
|
1790476658
|
|
0
|
|
0
|
Edit
Delete
|
|
36401
|
24641
|
83
|
5
|
0bfbacf591e40a08a4b1ec032491c0ab2c31e3e3
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
30766
|
2
|
1790477536
|
1790477597
|
1790477536
|
1790477597
|
|
0
|
|
0
|
Edit
Delete
|
|
36405
|
24643
|
83
|
5
|
14861eb6af3192643ae427d3a11efa6d0ce702db
|
0
|
Static governance
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
30769
|
2
|
1790477885
|
1790477975
|
1790477883
|
1790477975
|
|
0
|
|
0
|
Edit
Delete
|
|
36407
|
24644
|
83
|
5
|
14861eb6af3192643ae427d3a11efa6d0ce702db
|
0
|
@juhai/* exact pin + contracts fixtures
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Upload governance reports
uses: actions/upload-artifact@v3
with:
if-no-files-found: ignore
name: governance-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: reports/*.latest.json
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
30770
|
2
|
1790477975
|
1790479000
|
1790477883
|
1790479001
|
|
0
|
|
0
|
Edit
Delete
|
|
36408
|
24644
|
83
|
5
|
14861eb6af3192643ae427d3a11efa6d0ce702db
|
0
|
Platform consumer gate
|
1
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
required:
name: Platform consumer gate
runs-on: ubuntu-latest
if: always()
steps:
- name: Require completed pins and fixture checks
run: test "$PINS_RESULT" = success
env:
PINS_RESULT: ${{ needs.pins.result }}
timeout-minutes: "2"
permissions:
contents: read
...
|
required
|
["pins"]
|
["ubuntu-latest"]
|
30771
|
2
|
1790479003
|
1790479003
|
1790477883
|
1790479003
|
|
1
|
|
0
|
Edit
Delete
|
|
36409
|
24645
|
13
|
5
|
6c80c00976d1c5ac4aaa5f76d10cf1e7b4f59448
|
0
|
Analyze (java)
|
1
|
name: CodeQL Analysis
"on":
push:
name: CodeQL Analysis
"on":
push:
branches: [develop, master, main]
pull_request:
branches: [develop, master, main]
schedule:
# 每周一凌晨3点运行
- cron: '0 3 * * 1'
jobs:
analyze:
name: Analyze (java)
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
cache: gradle
distribution: temurin
java-version: "17"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: +security-extended,security-and-quality
- name: Grant Execute Permission
run: chmod +x ./gradlew
- name: Build
run: ./gradlew assembleDebug --stacktrace
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: /language:${{ matrix.language }}
timeout-minutes: "30"
strategy:
fail-fast: "false"
matrix:
language:
- java
permissions:
actions: read
contents: read
security-events: write
...
|
analyze
|
null
|
["ubuntu-latest"]
|
30772
|
2
|
1790564415
|
1790564449
|
1790564415
|
1790564449
|
|
0
|
|
0
|
Edit
Delete
|
|
36410
|
24646
|
121
|
5
|
0463b998f7fecbdea518bacdf53a9a46f6c52d19
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const admin = new URL('postgres://postgres@postgres:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const runtime = new URL('postgres://erk_app@postgres:5432/enterprise_reality_kernel');
runtime.password = runtimePassword;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
container: node:22-bookworm
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30773
|
2
|
1790699683
|
1790699714
|
1790699681
|
1790699714
|
|
0
|
|
0
|
Edit
Delete
|
|
36411
|
24647
|
121
|
5
|
0d5b830cbe47876ebe8086fd1f15612466463cec
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const admin = new URL('postgres://postgres@postgres:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const runtime = new URL('postgres://erk_app@postgres:5432/enterprise_reality_kernel');
runtime.password = runtimePassword;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30774
|
2
|
1790699818
|
1790699946
|
1790699816
|
1790699946
|
|
0
|
|
0
|
Edit
Delete
|
|
36412
|
24648
|
121
|
5
|
b9c01e45eb5c807f7cbede70a6aebfbc8d0d60be
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const admin = new URL('postgres://postgres@postgres:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const runtime = new URL('postgres://erk_app@postgres:5432/enterprise_reality_kernel');
runtime.password = runtimePassword;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30775
|
2
|
1790699946
|
1790699962
|
1790699839
|
1790699962
|
|
0
|
|
0
|
Edit
Delete
|
|
36413
|
24649
|
121
|
5
|
b9ae9838a77688fb2e40e839c7416057071ca33a
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const admin = new URL('postgres://postgres@127.0.0.1:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const runtime = new URL('postgres://erk_app@127.0.0.1:5432/enterprise_reality_kernel');
runtime.password = runtimePassword;
const client = new pg.Client({ connectionString: admin.href });
await client.connect();
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- 5432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30776
|
2
|
1790700077
|
1790700090
|
1790700075
|
1790700091
|
|
0
|
|
0
|
Edit
Delete
|
|
36414
|
24650
|
121
|
5
|
a36511f3577f8c6e3b0198eed24ed3ebef756a15
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import { readFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const port = Number(process.env.CI_POSTGRES_PORT);
if (!Number.isInteger(port) || port < 1 || port > 65535) {
throw new Error('PostgreSQL service did not publish a valid port');
}
const defaultRoute = readFileSync('/proc/net/route', 'utf8').split('\n').find((line) => line.split('\t')[1] === '00000000');
const gatewayHex = defaultRoute?.split('\t')[2];
const gateway = gatewayHex && gatewayHex.length === 8
? gatewayHex.match(/../g).reverse().map((part) => parseInt(part, 16)).join('.')
: null;
const hosts = ['127.0.0.1', 'host.docker.internal', gateway].filter(Boolean);
let admin;
let client;
for (const host of hosts) {
const candidate = new URL(`postgres://postgres@${host}:${port}/enterprise_reality_kernel`);
candidate.password = process.env.CI_ADMIN_PASSWORD;
const probe = new pg.Client({ connectionString: candidate.href, connectionTimeoutMillis: 2000 });
try {
await probe.connect();
const identity = await probe.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
admin = candidate;
client = probe;
break;
} catch {
await probe.end().catch(() => {});
}
}
if (!admin || !client) throw new Error('Disposable PostgreSQL service is unreachable from this runner');
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
CI_POSTGRES_PORT: ${{ job.services.postgres.ports[5432] }}
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- "5432"
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30777
|
2
|
1790700179
|
1790700196
|
1790700178
|
1790700197
|
|
0
|
|
0
|
Edit
Delete
|
|
36415
|
24651
|
121
|
5
|
ed1670dc7e6483bacae603db2f59b4b0ecddd81c
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import { readFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const port = Number(process.env.CI_POSTGRES_PORT);
if (!Number.isInteger(port) || port < 1 || port > 65535) {
throw new Error('PostgreSQL service did not publish a valid port');
}
const defaultRoute = readFileSync('/proc/net/route', 'utf8').split('\n').find((line) => line.split('\t')[1] === '00000000');
const gatewayHex = defaultRoute?.split('\t')[2];
const gateway = gatewayHex && gatewayHex.length === 8
? gatewayHex.match(/../g).reverse().map((part) => parseInt(part, 16)).join('.')
: null;
const hosts = ['127.0.0.1', 'host.docker.internal', gateway].filter(Boolean);
let admin;
let client;
for (const host of hosts) {
const candidate = new URL(`postgres://postgres@${host}:${port}/enterprise_reality_kernel`);
candidate.password = process.env.CI_ADMIN_PASSWORD;
const probe = new pg.Client({ connectionString: candidate.href, connectionTimeoutMillis: 2000 });
try {
await probe.connect();
const identity = await probe.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
admin = candidate;
client = probe;
break;
} catch {
await probe.end().catch(() => {});
}
}
if (!admin || !client) throw new Error('Disposable PostgreSQL service is unreachable from this runner');
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
CI_POSTGRES_PORT: '55432'
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- 55432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30778
|
2
|
1790700249
|
1790700263
|
1790700247
|
1790700263
|
|
0
|
|
0
|
Edit
Delete
|
|
36416
|
24652
|
121
|
5
|
531738daba6ed7d634074e65138f030ab7bf8aa9
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import { readFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const port = Number(process.env.CI_POSTGRES_PORT);
if (!Number.isInteger(port) || port < 1 || port > 65535) {
throw new Error('PostgreSQL service did not publish a valid port');
}
const defaultRoute = readFileSync('/proc/net/route', 'utf8').split('\n').find((line) => line.split('\t')[1] === '00000000');
const gatewayHex = defaultRoute?.split('\t')[2];
const gateway = gatewayHex && gatewayHex.length === 8
? gatewayHex.match(/../g).reverse().map((part) => parseInt(part, 16)).join('.')
: null;
const hosts = ['127.0.0.1', 'host.docker.internal', gateway].filter(Boolean);
let admin;
let client;
for (const host of hosts) {
const candidate = new URL(`postgres://postgres@${host}:${port}/enterprise_reality_kernel`);
candidate.password = process.env.CI_ADMIN_PASSWORD;
const probe = new pg.Client({ connectionString: candidate.href, connectionTimeoutMillis: 2000 });
try {
await probe.connect();
const identity = await probe.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
admin = candidate;
client = probe;
break;
} catch {
await probe.end().catch(() => {});
}
}
if (!admin || !client) throw new Error('Disposable PostgreSQL service is unreachable from this runner');
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
CI_POSTGRES_PORT: '55432'
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- 55432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30779
|
2
|
1790700305
|
1790700319
|
1790700304
|
1790700319
|
|
0
|
|
0
|
Edit
Delete
|
|
36417
|
24653
|
121
|
5
|
495fc74942c3d101613165202d9e5b8016969eb8
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import { readFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const port = Number(process.env.CI_POSTGRES_PORT);
if (!Number.isInteger(port) || port < 1 || port > 65535) {
throw new Error('PostgreSQL service did not publish a valid port');
}
const defaultRoute = readFileSync('/proc/net/route', 'utf8').split('\n').find((line) => line.split('\t')[1] === '00000000');
const gatewayHex = defaultRoute?.split('\t')[2];
const gateway = gatewayHex && gatewayHex.length === 8
? gatewayHex.match(/../g).reverse().map((part) => parseInt(part, 16)).join('.')
: null;
const hosts = ['127.0.0.1', 'host.docker.internal', gateway].filter(Boolean);
let admin;
let client;
for (const host of hosts) {
const candidate = new URL(`postgres://postgres@${host}:${port}/enterprise_reality_kernel`);
candidate.password = process.env.CI_ADMIN_PASSWORD;
const probe = new pg.Client({ connectionString: candidate.href, connectionTimeoutMillis: 2000 });
try {
await probe.connect();
const identity = await probe.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
admin = candidate;
client = probe;
break;
} catch {
await probe.end().catch(() => {});
}
}
if (!admin || !client) throw new Error('Disposable PostgreSQL service is unreachable from this runner');
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
CI_POSTGRES_PORT: '55432'
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- 55432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30780
|
2
|
1790701525
|
1790701542
|
1790701524
|
1790701542
|
|
0
|
|
0
|
Edit
Delete
|
|
36418
|
24654
|
121
|
5
|
3ba1a77bc465975ce829de1a44fb90623e01f069
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import { readFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const port = Number(process.env.CI_POSTGRES_PORT);
if (!Number.isInteger(port) || port < 1 || port > 65535) {
throw new Error('PostgreSQL service did not publish a valid port');
}
const defaultRoute = readFileSync('/proc/net/route', 'utf8').split('\n').find((line) => line.split('\t')[1] === '00000000');
const gatewayHex = defaultRoute?.split('\t')[2];
const gateway = gatewayHex && gatewayHex.length === 8
? gatewayHex.match(/../g).reverse().map((part) => parseInt(part, 16)).join('.')
: null;
const hosts = ['127.0.0.1', 'host.docker.internal', gateway].filter(Boolean);
let admin;
let client;
for (const host of hosts) {
const candidate = new URL(`postgres://postgres@${host}:${port}/enterprise_reality_kernel`);
candidate.password = process.env.CI_ADMIN_PASSWORD;
const probe = new pg.Client({ connectionString: candidate.href, connectionTimeoutMillis: 2000 });
try {
await probe.connect();
const identity = await probe.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
admin = candidate;
client = probe;
break;
} catch {
await probe.end().catch(() => {});
}
}
if (!admin || !client) throw new Error('Disposable PostgreSQL service is unreachable from this runner');
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
CI_POSTGRES_PORT: '55432'
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- 55432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30781
|
2
|
1790701756
|
1790701771
|
1790701755
|
1790701771
|
|
0
|
|
0
|
Edit
Delete
|
|
36419
|
24655
|
121
|
5
|
bc4d59f2822b56e8b97570d25cfd4d8b61cdde12
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import { readFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const port = Number(process.env.CI_POSTGRES_PORT);
if (!Number.isInteger(port) || port < 1 || port > 65535) {
throw new Error('PostgreSQL service did not publish a valid port');
}
const defaultRoute = readFileSync('/proc/net/route', 'utf8').split('\n').find((line) => line.split('\t')[1] === '00000000');
const gatewayHex = defaultRoute?.split('\t')[2];
const gateway = gatewayHex && gatewayHex.length === 8
? gatewayHex.match(/../g).reverse().map((part) => parseInt(part, 16)).join('.')
: null;
const hosts = ['127.0.0.1', 'host.docker.internal', gateway].filter(Boolean);
let admin;
let client;
for (const host of hosts) {
const candidate = new URL(`postgres://postgres@${host}:${port}/enterprise_reality_kernel`);
candidate.password = process.env.CI_ADMIN_PASSWORD;
const probe = new pg.Client({ connectionString: candidate.href, connectionTimeoutMillis: 2000 });
try {
await probe.connect();
const identity = await probe.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
admin = candidate;
client = probe;
break;
} catch {
await probe.end().catch(() => {});
}
}
if (!admin || !client) throw new Error('Disposable PostgreSQL service is unreachable from this runner');
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
CI_POSTGRES_PORT: '55432'
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- 55432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30782
|
2
|
1790701881
|
1790701895
|
1790701880
|
1790701895
|
|
0
|
|
0
|
Edit
Delete
|
|
36420
|
24656
|
121
|
5
|
8bb41429437f46d37678921b75ffcaff1ed78841
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Use Node.js 22
uses: https://gitea.com/actions/setup-node@v4
with:
node-version: "22"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import { readFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const port = Number(process.env.CI_POSTGRES_PORT);
if (!Number.isInteger(port) || port < 1 || port > 65535) {
throw new Error('PostgreSQL service did not publish a valid port');
}
const defaultRoute = readFileSync('/proc/net/route', 'utf8').split('\n').find((line) => line.split('\t')[1] === '00000000');
const gatewayHex = defaultRoute?.split('\t')[2];
const gateway = gatewayHex && gatewayHex.length === 8
? gatewayHex.match(/../g).reverse().map((part) => parseInt(part, 16)).join('.')
: null;
const hosts = ['127.0.0.1', 'host.docker.internal', gateway].filter(Boolean);
let admin;
let client;
for (const host of hosts) {
const candidate = new URL(`postgres://postgres@${host}:${port}/enterprise_reality_kernel`);
candidate.password = process.env.CI_ADMIN_PASSWORD;
const probe = new pg.Client({ connectionString: candidate.href, connectionTimeoutMillis: 2000 });
try {
await probe.connect();
const identity = await probe.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
admin = candidate;
client = probe;
break;
} catch {
await probe.end().catch(() => {});
}
}
if (!admin || !client) throw new Error('Disposable PostgreSQL service is unreachable from this runner');
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
CI_POSTGRES_PORT: '55432'
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
ports:
- 55432:5432
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30783
|
2
|
1790702047
|
1790702061
|
1790702045
|
1790702062
|
|
0
|
|
0
|
Edit
Delete
|
|
36421
|
24657
|
121
|
5
|
21d073490c60bb141a267af9424b9f0ef7c3440d
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const admin = new URL('postgres://postgres@postgres:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const client = new pg.Client({ connectionString: admin.href, connectionTimeoutMillis: 3000 });
await client.connect();
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
const identity = await client.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
container: node:22-bookworm
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30784
|
2
|
1790702130
|
1790702160
|
1790702129
|
1790702161
|
|
0
|
|
0
|
Edit
Delete
|
|
36422
|
24658
|
121
|
5
|
5f607eb22a5ef160fdc74423910299d135063168
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const admin = new URL('postgres://postgres@postgres:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const client = new pg.Client({ connectionString: admin.href, connectionTimeoutMillis: 3000 });
await client.connect();
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
const identity = await client.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
container: node:22-bookworm
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30785
|
2
|
1790704681
|
1790704711
|
1790704679
|
1790704711
|
|
0
|
|
0
|
Edit
Delete
|
|
36423
|
24659
|
121
|
5
|
236c67c85b0ed28961bd3807befc1c00d6573f6b
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const admin = new URL('postgres://postgres@postgres:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const client = new pg.Client({ connectionString: admin.href, connectionTimeoutMillis: 3000 });
await client.connect();
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
const identity = await client.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
container: node:22-bookworm
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30786
|
2
|
1790704736
|
1790704736
|
1790704735
|
1790704736
|
|
0
|
|
0
|
Edit
Delete
|
|
36424
|
24660
|
121
|
5
|
fde5331617b33e7df7ff5c3b2893c2053144142e
|
0
|
acceptance
|
1
|
name: Kernel V1.0 CI
"on":
push:
name: Kernel V1.0 CI
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
jobs:
acceptance:
name: acceptance
runs-on: ubuntu-latest
steps:
- name: Checkout fixed source
uses: https://gitea.com/actions/checkout@v4
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Install locked dependencies
run: |
set -eu
corepack enable
corepack prepare pnpm@9.15.9 --activate
pnpm install --frozen-lockfile
- name: Check documentation claims
run: node scripts/check-doc-claims.js
- name: Check invariants
run: node scripts/check-invariants.js
- name: Check module boundaries
run: node scripts/check-module-boundaries.js
- name: Check model
run: node scripts/check-model.js
- name: Check spec source
run: node scripts/check-spec-source.js
- name: Check full spec
run: node scripts/check-full-spec.js
- name: Check cross-owner write exceptions
run: node scripts/check-cross-owner-writes.js
- name: Check plan ledger against Git history
run: pnpm check:plan-ledger
- name: Configure isolated database roles
run: |
set -eu
node --input-type=module <<'NODE'
import { randomBytes } from 'node:crypto';
import { appendFileSync } from 'node:fs';
import pg from 'pg';
const runtimePassword = randomBytes(24).toString('hex');
const tokenSecret = randomBytes(32).toString('hex');
const migrationTestDatabase = `erk_migration_test_${randomBytes(6).toString('hex')}`;
const admin = new URL('postgres://postgres@postgres:5432/enterprise_reality_kernel');
admin.password = process.env.CI_ADMIN_PASSWORD;
const client = new pg.Client({ connectionString: admin.href, connectionTimeoutMillis: 3000 });
await client.connect();
const runtime = new URL(admin.href);
runtime.username = 'erk_app';
runtime.password = runtimePassword;
try {
const identity = await client.query('SELECT current_database() AS name, current_user AS role');
if (identity.rows[0]?.name !== 'enterprise_reality_kernel' || identity.rows[0]?.role !== 'postgres') {
throw new Error('Unexpected PostgreSQL service identity');
}
await client.query(`CREATE DATABASE ${migrationTestDatabase}`);
} finally {
await client.end();
}
const migrationTest = new URL(admin.href);
migrationTest.pathname = `/${migrationTestDatabase}`;
appendFileSync(process.env.GITHUB_ENV, [
`MIGRATION_DATABASE_URL=${admin.href}`,
`MIGRATION_TEST_DATABASE_URL=${migrationTest.href}`,
`DATABASE_URL=${runtime.href}`,
`TEST_DATABASE_URL=${runtime.href}`,
`RUNTIME_DB_PASSWORD=${runtimePassword}`,
`KERNEL_TOKEN_SECRET=${tokenSecret}`
].join('\n') + '\n');
NODE
env:
CI_ADMIN_PASSWORD: erk_ci_disposable_admin
- name: Migrate as postgres owner
run: pnpm db:migrate
- name: Test as restricted erk_app
run: pnpm test
- name: Check database roles and cross-owner references
run: |
set -eu
pnpm check:db-roles
pnpm check:cross-refs
pnpm check:cross-fks
- name: Check event histories
run: |
set -eu
pnpm check:all-events
pnpm check:integration-events
pnpm check:external-sales-order-history
pnpm check:schedule-history
pnpm check:trigger-condition-history
pnpm check:trigger-authorization-history
pnpm check:trigger-state-history
- name: Check partitions and audit chain
run: |
set -eu
pnpm check:partition-identities
pnpm check:partition-references
pnpm check:partition-horizon
pnpm check:partition-cutover
pnpm check:audit-chain
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: enterprise_reality_kernel
POSTGRES_PASSWORD: erk_ci_disposable_admin
POSTGRES_USER: postgres
options: --health-cmd "pg_isready -U postgres -d enterprise_reality_kernel" --health-interval 2s --health-timeout 3s --health-retries 30
container: node:22-bookworm
permissions:
contents: read
...
|
acceptance
|
null
|
["ubuntu-latest"]
|
30787
|
2
|
1790704840
|
1790704870
|
1790704838
|
1790704870
|
|
0
|
|
0
|
Edit
Delete
|