|
49230
|
27403
|
81
|
5
|
3773014f6f805640807a31ac4e9a78f4df354a96
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
fetch-depth: "0"
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 89b2adeeda1017b1ac4f66fb1ff5f89e0a21fcef
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Configure Gitea npm read access
run: |
test -n "$JUHAI_NPM_READ_TOKEN" || { echo "JUHAI_NPM_READ_TOKEN secret is required to install @juhai/kernel and @juhai/governance-kit"; exit 1; }
echo "//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=${JUHAI_NPM_READ_TOKEN}" >> "$HOME/.npmrc"
env:
JUHAI_NPM_READ_TOKEN: ${{ secrets.JUHAI_NPM_READ_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794721765
|
1794721765
|
|
0
|
|
0
|
Edit
Delete
|
|
49234
|
27405
|
81
|
5
|
8cf21107c59bef5f08a08d1ade08cb405cae9bad
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
fetch-depth: "0"
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: 89b2adeeda1017b1ac4f66fb1ff5f89e0a21fcef
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Configure Gitea npm read access
run: |
test -n "$JUHAI_NPM_READ_TOKEN" || { echo "JUHAI_NPM_READ_TOKEN secret is required to install @juhai/kernel and @juhai/governance-kit"; exit 1; }
echo "//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=${JUHAI_NPM_READ_TOKEN}" >> "$HOME/.npmrc"
env:
JUHAI_NPM_READ_TOKEN: ${{ secrets.JUHAI_NPM_READ_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794722107
|
1794722107
|
|
0
|
|
0
|
Edit
Delete
|
|
49289
|
27427
|
51
|
5
|
a523109aea2e02013a9d754d1406baa885c826cc
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737355
|
1794737355
|
|
0
|
|
0
|
Edit
Delete
|
|
49292
|
27429
|
83
|
5
|
d1e4030df12d63da3013f2217ecf6ab868133ab8
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737468
|
1794737468
|
|
0
|
|
0
|
Edit
Delete
|
|
49304
|
27433
|
83
|
5
|
73dd46f9babf070d260fb46329915b078db33cfa
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737679
|
1794737679
|
|
0
|
|
0
|
Edit
Delete
|
|
49306
|
27434
|
181
|
5
|
959c4231a67e22e73ebe1e964d0c94ee109faa49
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737918
|
1794737918
|
|
0
|
|
0
|
Edit
Delete
|
|
49309
|
27436
|
83
|
5
|
23a8d5922b22edb4994b383b507579824be28355
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794737951
|
1794737951
|
|
0
|
|
0
|
Edit
Delete
|
|
49314
|
27438
|
51
|
5
|
77256134fac82e3f82816a5110d4c9b459a4d343
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738018
|
1794738018
|
|
0
|
|
0
|
Edit
Delete
|
|
49317
|
27440
|
181
|
5
|
97b01f32ebe3bd1a9263c4faef36a08ba923a83b
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738219
|
1794738219
|
|
0
|
|
0
|
Edit
Delete
|
|
49326
|
27443
|
83
|
5
|
301f1bc87d8dc8b342d3b871076a1bcdfab5f150
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738321
|
1794738321
|
|
0
|
|
0
|
Edit
Delete
|
|
49336
|
27448
|
51
|
5
|
42474ed02e2acf90840ab0095bd0945a13e76aad
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794738456
|
1794738456
|
|
0
|
|
0
|
Edit
Delete
|
|
49392
|
27466
|
83
|
5
|
d1bf788dbde67d8871ea55f35c445b33a0d6e8d0
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794741858
|
1794741858
|
|
0
|
|
0
|
Edit
Delete
|
|
49402
|
27469
|
83
|
5
|
163dfc3cf2f3a996dc35852dc813daedee69a941
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794742314
|
1794742314
|
|
0
|
|
0
|
Edit
Delete
|
|
49404
|
27470
|
181
|
5
|
59fe15ee1a290ef4a76b7179dd9b835577919f07
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794742427
|
1794742427
|
|
0
|
|
0
|
Edit
Delete
|
|
49421
|
27475
|
181
|
5
|
e07cc904101d5d50dbe156c7f3f26525df44be4c
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794742795
|
1794742795
|
|
0
|
|
0
|
Edit
Delete
|
|
49468
|
27490
|
51
|
5
|
be963fb05e2eb2b27914754a55aeaa598b589260
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794744991
|
1794744991
|
|
0
|
|
0
|
Edit
Delete
|
|
49478
|
27493
|
51
|
5
|
12d5129f9cc8745d2f9a918f89edbd0dd6f95579
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794745275
|
1794745275
|
|
0
|
|
0
|
Edit
Delete
|
|
49514
|
27504
|
82
|
5
|
e34b309f171e1264726cbfa5e9b515cfc787d9aa
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/juhai-ticket-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/juhai-ticket-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794746786
|
1794746786
|
|
0
|
|
0
|
Edit
Delete
|
|
49531
|
27509
|
83
|
5
|
cce4dacc5126b9ebda9f6dd2cbcc1886f22a991d
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794747079
|
1794747079
|
|
0
|
|
0
|
Edit
Delete
|
|
49535
|
27511
|
83
|
5
|
fddfe48ea2413de6d5d6a8157601d686d8937481
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- id: os-lock
name: Resolve locked Digital Employee OS revision
run: echo "sha=$(node -p "require('./products/juhai.hr/readiness.json').compatibilityLock.osGitSha")" >> "$GITHUB_OUTPUT"
- name: Checkout locked Digital Employee OS
run: |
test -n "$OS_REPO_READ_TOKEN" || { echo "::error::OS_REPO_READ_TOKEN is not available to this run"; exit 1; }
api_status=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token $OS_REPO_READ_TOKEN" \
"${{ github.server_url }}/api/v1/repos/luoanwu/digital-employee-os")
echo "OS repository API probe: HTTP $api_status"
test "$api_status" = 200 || { echo "::error::OS_REPO_READ_TOKEN cannot read luoanwu/digital-employee-os (HTTP $api_status)"; exit 1; }
os_root="$RUNNER_TEMP/digital-employee-os"
git init -q "$os_root"
git -C "$os_root" -c protocol.version=2 -c http.extraHeader="Authorization: token $OS_REPO_READ_TOKEN" \
fetch -q --depth=1 "$OS_REPOSITORY_URL.git" "$OS_SHA"
git -C "$os_root" checkout -q --detach FETCH_HEAD
test "$(git -C "$os_root" rev-parse HEAD)" = "$OS_SHA"
echo "DIGITAL_EMPLOYEE_OS_ROOT=$os_root" >> "$GITHUB_ENV"
env:
OS_REPO_READ_TOKEN: ${{ secrets.OS_REPO_READ_TOKEN }}
OS_SHA: ${{ steps.os-lock.outputs.sha }}
OS_REPOSITORY_URL: ${{ github.server_url }}/luoanwu/digital-employee-os
- name: Build locked OS compatibility sources
run: |
cd "$DIGITAL_EMPLOYEE_OS_ROOT"
pnpm install --frozen-lockfile
pnpm prisma:generate
pnpm exec turbo run build --filter=@repo/contracts --filter=@repo/product-runtime --filter=api-nestjs --filter=api-fastify
test -z "$(git status --porcelain)"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794747241
|
1794747241
|
|
0
|
|
0
|
Edit
Delete
|
|
49537
|
27512
|
83
|
5
|
fddfe48ea2413de6d5d6a8157601d686d8937481
|
0
|
@juhai/* exact pin + contracts fixtures
|
0
|
name: Platform governance (consumer)
"on": name: Platform governance (consumer)
"on":
pull_request:
push:
branches: [main]
jobs:
pins:
name: '@juhai/* exact pin + contracts fixtures'
runs-on: ubuntu-latest
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Checkout
run: |
auth="Authorization: basic $(printf 'x-access-token:%s' "$REPO_TOKEN" | base64 | tr -d '\n')"
git init -q .
git remote add origin "$REPO_URL" 2>/dev/null || git remote set-url origin "$REPO_URL"
git -c protocol.version=2 -c http.extraHeader="$auth" fetch -q --prune --tags origin \
"+refs/heads/*:refs/remotes/origin/*" "$CHECKOUT_SHA"
git checkout -q -f --detach "$CHECKOUT_SHA"
git clean -ffdxq
test "$(git rev-parse HEAD)" = "$CHECKOUT_SHA"
env:
REPO_TOKEN: ${{ github.token }}
REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
CHECKOUT_SHA: ${{ github.sha }}
- name: Setup Node.js
run: bash scripts/ci-setup-node.sh 22.23.2
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
name: Configure read-only platform package authentication
run: node scripts/configure-platform-npm.mjs
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install (frozen lockfile)
run: pnpm install --frozen-lockfile --ignore-scripts
- name: check:pins（必需检查）
run: pnpm exec juhai-governance check:pins --require @juhai/contracts --require @juhai/governance
- name: check:fixtures（必需检查）
run: pnpm exec juhai-governance check:fixtures --suite governance/fixtures/contracts.suite.json
- if: always()
name: Print governance reports
run: |
for report in reports/*.latest.json; do
[ -f "$report" ] || continue
echo "::group::$report"
cat "$report"
echo "::endgroup::"
done
timeout-minutes: "15"
permissions:
contents: read
...
|
pins
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794747241
|
1794747241
|
|
0
|
|
0
|
Edit
Delete
|
|
49539
|
27513
|
181
|
5
|
2f7c2f51d6dfaed7747a3c3f95fc388d79f825a6
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794747614
|
1794747614
|
|
0
|
|
0
|
Edit
Delete
|
|
49546
|
27515
|
181
|
5
|
8a36fda8a5882daeba0d34cabd6a68252788d413
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794748486
|
1794748486
|
|
0
|
|
0
|
Edit
Delete
|
|
49547
|
27516
|
117
|
5
|
33fd887d120ff2a439c5beaa727471d4ee5730f3
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
0
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794748952
|
1794748952
|
|
0
|
|
0
|
Edit
Delete
|
|
49550
|
27518
|
51
|
5
|
49d548b29129b9c8b47b2fce6ca059baf37707fb
|
0
|
后端 · lint + 类型 + 无DB单测(含契约)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-checks:
name: 后端 · lint + 类型 + 无DB单测(含契约)
runs-on: ubuntu-latest
env:
# 无DB单测会 import config/env（zod 启动校验，仅校验格式不连库）：提供合法 DATABASE_URL/JWT_SECRET 让校验通过。
# 纯函数单测（leads.canTransition / platforms.platformConnectionTruth 等）不发查询，无需真实 DB 服务。
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
JWT_SECRET: ci-jwt-secret-not-for-prod
USE_MOCK_ADAPTERS: 'true'
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run check:enterprise
- run: npm run check:http-host
- run: npm run lint
- run: npm run build
- run: npm run test:unit
defaults:
run:
working-directory: server
...
|
server-checks
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749012
|
1794749012
|
|
0
|
|
0
|
Edit
Delete
|
|
49551
|
27518
|
51
|
5
|
49d548b29129b9c8b47b2fce6ca059baf37707fb
|
0
|
后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
server-integration:
name: 后端 · 真实DB集成测试(多租户/RBAC/并发/状态机/归因)
runs-on: ubuntu-latest
env:
# global-setup 会用这个串跑 prisma migrate deploy + seed，再运行 vitest。
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
# CI 专用占位密钥（仅满足 env.ts 的 zod 校验，绝非生产值）。
JWT_SECRET: ci-jwt-secret-not-for-prod
JWT_REFRESH_SECRET: ci-jwt-refresh-secret-not-for-prod
# 用 Mock 适配层：CI 不打外部 LLM/平台，确定性、零外部依赖。
USE_MOCK_ADAPTERS: 'true'
NODE_ENV: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: server/package-lock.json
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
- run: npm run test:integration
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong_test
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong_test" --health-interval 5s --health-timeout 5s --health-retries 20
defaults:
run:
working-directory: server
...
|
server-integration
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749012
|
1794749012
|
|
0
|
|
0
|
Edit
Delete
|
|
49552
|
27518
|
51
|
5
|
49d548b29129b9c8b47b2fce6ca059baf37707fb
|
0
|
前端 · 静态契约 + 屏幕治理 + lint + AOT构建
|
0
|
name: CI
"on":
push:
branches: name: CI
"on":
push:
branches: [main]
pull_request:
branches: [main]
jobs:
frontend-static:
name: 前端 · 静态契约 + 屏幕治理 + lint + AOT构建
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
cache: npm
cache-dependency-path: 团购本地生活AI运营App/package-lock.json
node-version: "20"
- run: npm ci
- run: npm run vendor
- run: npm test
- run: npm run lint
- run: npm run build
defaults:
run:
working-directory: 团购本地生活AI运营App
...
|
frontend-static
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749012
|
1794749012
|
|
0
|
|
0
|
Edit
Delete
|
|
49553
|
27519
|
51
|
5
|
49d548b29129b9c8b47b2fce6ca059baf37707fb
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749012
|
1794749012
|
|
0
|
|
0
|
Edit
Delete
|
|
49557
|
27521
|
51
|
5
|
1d131537c41e9467d9242c31064949576e8a05d2
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749018
|
1794749018
|
|
0
|
|
0
|
Edit
Delete
|
|
49562
|
27524
|
84
|
5
|
9a18a13b9e2c1bfc051752c2b44fdeea0d088a85
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749160
|
1794749160
|
|
0
|
|
0
|
Edit
Delete
|
|
49566
|
27526
|
117
|
5
|
11fe261f084393e257386cea8d7273770c7b5e56
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
0
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749632
|
1794749632
|
|
0
|
|
0
|
Edit
Delete
|
|
49567
|
27527
|
117
|
5
|
d7c865d1ae9f208a773fd2b86a62b74c7262a45b
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
0
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749783
|
1794749783
|
|
0
|
|
0
|
Edit
Delete
|
|
49568
|
27528
|
181
|
5
|
34236620b79f35ec3da03b92641ec30fb13644bb
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794749887
|
1794749887
|
|
0
|
|
0
|
Edit
Delete
|
|
49583
|
27532
|
181
|
5
|
1c8363f035c11eaafc88626b25fb0af875566d60
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794750234
|
1794750234
|
|
0
|
|
0
|
Edit
Delete
|
|
49584
|
27533
|
117
|
5
|
320aa8950d06eb00ebf767bd422e9cfc0810525c
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
0
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794750255
|
1794750255
|
|
0
|
|
0
|
Edit
Delete
|
|
49614
|
27542
|
51
|
5
|
1dc7158050c62d8ea7a16e0243af1ac5add3291a
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794752059
|
1794752059
|
|
0
|
|
0
|
Edit
Delete
|
|
49619
|
27545
|
51
|
5
|
e20c744f027de8714a3893a0c30289f9bda02e59
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794752490
|
1794752490
|
|
0
|
|
0
|
Edit
Delete
|
|
49620
|
27546
|
135
|
5
|
81dd9e63b622375cc4a89e577402d7268ec63ba4
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout device cloud with history
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Setup Node.js
uses: actions/setup-node@v4
with:
cache: pnpm
node-version: "22"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
- if: always()
name: Upload immutable static governance evidence
uses: actions/upload-artifact@v4
with:
if-no-files-found: warn
name: governance-${{ github.job }}-${{ github.sha }}-${{ github.run_attempt }}
path: |
reports/*.latest.json
!reports/governance-profile-*.latest.json
!reports/runtime-acceptance.latest.json
!reports/conformance-differential.latest.json
!reports/ui-acceptance.latest.json
retention-days: "30"
timeout-minutes: "20"
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794753882
|
1794753882
|
|
0
|
|
0
|
Edit
Delete
|
|
49629
|
27550
|
81
|
5
|
54299d91ee46485130ff6289b12aa03459304a05
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
env:
DIGITAL_EMPLOYEE_OS_ROOT: ${{ github.workspace }}/digital-employee-os
steps:
- name: Checkout service system
uses: actions/checkout@v4
with:
fetch-depth: "0"
path: service-system
- name: Checkout locked Digital Employee OS baseline
uses: actions/checkout@v4
with:
path: digital-employee-os
ref: e1eb04e5f69cdc2f31a075a270fc948dca9539b1
repository: laoluojuhai/digital-employee-os
token: ${{ secrets.DIGITAL_EMPLOYEE_OS_READ_TOKEN }}
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Configure Gitea npm read access
run: |
test -n "$JUHAI_NPM_READ_TOKEN" || { echo "JUHAI_NPM_READ_TOKEN secret is required to install @juhai/kernel and @juhai/governance-kit"; exit 1; }
echo "//gitea.g-hi.com/api/packages/luoanwu/npm/:_authToken=${JUHAI_NPM_READ_TOKEN}" >> "$HOME/.npmrc"
env:
JUHAI_NPM_READ_TOKEN: ${{ secrets.JUHAI_NPM_READ_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build locked Digital Employee OS compatibility packages
run: |
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" install --frozen-lockfile
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/contracts build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/skill-runtime build
pnpm --dir "$DIGITAL_EMPLOYEE_OS_ROOT" --filter @repo/tool-runtime build
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
defaults:
run:
working-directory: service-system
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794754241
|
1794754241
|
|
0
|
|
0
|
Edit
Delete
|
|
49639
|
27552
|
117
|
5
|
5e2870d74bc40ccd0c6711d6488c5968f7389b9e
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
0
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794755099
|
1794755099
|
|
0
|
|
0
|
Edit
Delete
|
|
49640
|
27553
|
181
|
5
|
26a1215fa5fb063cf02d699eb4249e2015449a3b
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794755821
|
1794755821
|
|
0
|
|
0
|
Edit
Delete
|
|
49649
|
27555
|
117
|
5
|
f3d41a5f030e05a590204370fee1e18f5abe063d
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
0
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794757110
|
1794757110
|
|
0
|
|
0
|
Edit
Delete
|
|
49659
|
27558
|
51
|
5
|
0db31ea2048eceae421fed64d6da02529b540cd6
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794759326
|
1794759326
|
|
0
|
|
0
|
Edit
Delete
|
|
49663
|
27560
|
51
|
5
|
9b1c7d8cb70b8a7b453f323e5934ad86c96563f7
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794759907
|
1794759907
|
|
0
|
|
0
|
Edit
Delete
|
|
49667
|
27562
|
51
|
5
|
fd922c0d6f5f948d6a32452317c1790b9cf7e5e8
|
0
|
Playwright 全栈回放（chromium 桌面+移动）
|
0
|
name: E2E
"on":
push:
branches name: E2E
"on":
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
jobs:
e2e:
name: Playwright 全栈回放（chromium 桌面+移动）
runs-on: ubuntu-latest
env:
# playwright.config / webServer 据此连库；test-db-up.mjs 会据此名建 bentong_test
TEST_DATABASE_URL: postgresql://bentong:bentong@localhost:5432/bentong_test?schema=public
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: "22"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- run: npm ci
working-directory: server
env:
NODE_AUTH_TOKEN: ${{ secrets.JUHAI_NPM_TOKEN }}
- run: npx prisma generate
working-directory: server
- run: npm ci
working-directory: 团购本地生活AI运营App
- run: npm run vendor
working-directory: 团购本地生活AI运营App
- run: npm ci
working-directory: e2e
- run: npx playwright install --with-deps chromium
working-directory: e2e
- run: npm test
working-directory: e2e
- if: always()
uses: actions/upload-artifact@v4
with:
name: playwright-report
path: e2e/playwright-report
retention-days: "7"
timeout-minutes: "25"
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: bentong
POSTGRES_PASSWORD: bentong
POSTGRES_USER: bentong
ports:
- 5432:5432
options: --health-cmd "pg_isready -U bentong -d bentong" --health-interval 5s --health-timeout 5s --health-retries 20
...
|
e2e
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794759992
|
1794759992
|
|
0
|
|
0
|
Edit
Delete
|
|
49668
|
27563
|
84
|
5
|
98794f4e9556dae93590e926e48c2587065465db
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: "0"
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
registry-url: https://gitea.g-hi.com/api/packages/luoanwu/npm/
scope: '@juhai'
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794761796
|
1794761796
|
|
0
|
|
0
|
Edit
Delete
|
|
49670
|
27564
|
57
|
5
|
c34ab24a23f10be31bc149c71d21b45434bec50f
|
0
|
Static governance
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
static-governance:
name: Static governance
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version-file: .node-version
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@9.15.9 --activate
- name: Prepare scoped package authentication
run: node scripts/prepare-ci-npmrc.mjs
env:
GITEA_NPM_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
- name: Install dependencies
run: pnpm install --frozen-lockfile
env:
NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/hi-atelier-npmrc
- if: always()
name: Remove temporary package authentication
run: rm -f -- "${RUNNER_TEMP}/hi-atelier-npmrc"
- name: Generate Prisma clients
run: pnpm prisma:generate
- name: Run static governance gate
run: pnpm check
- name: Runtime and development dependency audit
run: pnpm check:deps
permissions:
contents: read
...
|
static-governance
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794763107
|
1794763107
|
|
0
|
|
0
|
Edit
Delete
|
|
49679
|
27566
|
117
|
5
|
10a41d9b2abf0d3eec997fd4fdc29b99f8d26834
|
0
|
Governance tests (report-only until act_runner is Governance tests (report-only until act_runner is enabled)...
|
0
|
name: Governance
"on":
push:
b name: Governance
"on":
push:
branches: [main]
pull_request:
workflow_dispatch:
env:
FOUNDATION_REPORT_DIR: ${{ runner.temp }}/foundation-reports
PNPM_VERSION: 9.15.9
jobs:
governance-tests:
name: Governance tests (report-only until act_runner is enabled)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: actions/setup-node@v4
with:
node-version: "22"
- name: Governance tests
run: pnpm --dir 平台治理/基础 test
continue-on-error: true
- name: Governance gates (all gates run to completion; not blocking yet)
run: pnpm --dir 平台治理/基础 check
continue-on-error: true
- name: Tracked-secrets gate (root scope; the only gate whose CI result is meaningful without nested repos)
run: node 平台治理/基础/scripts/check-tracked-secrets.mjs --scope=root
timeout-minutes: "20"
permissions:
contents: read
...
|
governance-tests
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794763719
|
1794763719
|
|
0
|
|
0
|
Edit
Delete
|
|
49680
|
27567
|
181
|
5
|
c942699781ff3b72a1c7404e79eda27b321c60d5
|
0
|
manifest-and-code
|
0
|
name: Platform overlay
"on": [push, pull_r name: Platform overlay
"on": [push, pull_request]
jobs:
manifest-and-code:
name: manifest-and-code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
with:
version: 9.15.9
- uses: actions/setup-node@v4
with:
node-version: "22"
- run: node scripts/platform/with-registry.mjs -- install --frozen-lockfile
env:
PLATFORM_NPM_TOKEN: ${{ secrets.PLATFORM_NPM_TOKEN }}
- run: pnpm --filter @repo/contracts... build
- run: pnpm check:platform
...
|
manifest-and-code
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794763752
|
1794763752
|
|
0
|
|
0
|
Edit
Delete
|
|
49689
|
27569
|
116
|
5
|
79882851f09c75754dccf96530f836ffbaabce98
|
0
|
Static checks (locked engineering dependency)
|
0
|
name: Platform
"on":
pull_request:
name: Platform
"on":
pull_request:
push:
branches: [main]
workflow_dispatch:
env:
GITEA_ACTIONS: "true"
PNPM_VERSION: 9.15.9
jobs:
public-static:
name: Static checks (locked engineering dependency)
runs-on: ubuntu-latest
steps:
- name: Candidate tag (real run attempt, computed per job)
run: |
if ! [[ "${GITHUB_RUN_ATTEMPT:-}" =~ ^[1-9][0-9]*$ ]]; then
echo "::error::GITHUB_RUN_ATTEMPT is missing or invalid on this runner; the candidate tag needs the real attempt (no fallback, decision 2026-10-11)"
exit 1
fi
echo "CANDIDATE_TAG=${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_ENV"
- name: Prepare fixed Actions using existing read-only job token
run: |
python3 <<'PYTHON'
import hashlib,os,pathlib,re,subprocess,tempfile,urllib.request
sha=os.environ.get('GITHUB_SHA','')
if not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_SOURCE_REQUIRED')
if os.environ.get('GITHUB_SERVER_URL','').rstrip('/')!='https://gitea.g-hi.com' or os.environ.get('GITHUB_REPOSITORY')!='luoanwu/enterprise-platform':raise RuntimeError('UNEXPECTED_ORIGIN')
token=os.environ.get('CI_ACTION_READ_TOKEN','')
if not token or any(c in token for c in '\r\n'):raise RuntimeError('JOB_TOKEN_REQUIRED')
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
request=urllib.request.Request('https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/raw/ci/prepare-actions.py?ref='+sha,headers={'Authorization':'token '+token})
with urllib.request.build_opener(NoRedirect()).open(request,timeout=20) as response:
data=response.read(65537)
if len(data)>65536 or hashlib.sha256(data).hexdigest()!='2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728':raise RuntimeError('BOOTSTRAP_2bcd53f681a4ce771cc5f5a8820eb65a07b197e210a5685d9f2331d505f39728_MISMATCH')
with tempfile.TemporaryDirectory(prefix='verified-action-bootstrap-') as td:
script=pathlib.Path(td,'prepare-actions.py');script.write_bytes(data)
subprocess.run(['python3',str(script)],check=True,timeout=510)
PYTHON
shell: bash
env:
CI_ACTION_READ_TOKEN: ${{ github.token }}
- uses: ./.git/ci-actions/checkout
with:
fetch-depth: "0"
persist-credentials: "false"
- name: Enable pnpm
run: |
corepack enable
corepack prepare pnpm@${PNPM_VERSION} --activate
- uses: ./.git/ci-actions/setup-node
with:
node-version: "22"
- name: Private registry auth (temporary userconfig)
uses: ./.github/actions/private-npm
with:
token: ${{ secrets.PLATFORM_NPM_TOKEN }}
- name: Install locked governance tools
run: pnpm --dir governance install --frozen-lockfile --ignore-scripts
- name: Test bounded Action preparation (synthetic credentials only)
run: PYTHONDONTWRITEBYTECODE=1 python3 ci/test-prepare-actions.py
- name: Test image release credential preflight (synthetic credentials only)
run: node --test .github/scripts/test/*.test.mjs
- name: Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)
run: pnpm --dir contracts install --frozen-lockfile
- name: Install dictionary service dependencies (independent frozen lockfile)
run: pnpm --dir runtime/services/master-data-registry install --frozen-lockfile
- name: Docker CLI for pinned-image syntax checks (runner images may ship without it)
run: command -v docker >/dev/null || { apt-get update && apt-get install -y --no-install-recommends docker.io; }
- name: Caddy and alert rule syntax (compose-pinned images; skipped fails here)
run: |
pnpm check:caddy
pnpm check:otel
env:
CHECK_SYNTAX_REQUIRED: "1"
- name: Governance checks (exact engineering package; public contracts dependencies)
run: |
pnpm check:module-imports
pnpm check:canonical-ids
pnpm check:code-sets
pnpm check:omni-platform
pnpm check:fact-pii
pnpm check:catalog
pnpm check:migration-decs
pnpm test
pnpm contracts:check:local
- name: Pack publishable packages (contracts + governance; no publish)
run: |
rm -rf dist-artifacts
pnpm --dir contracts build
pnpm --dir governance pack --pack-destination ../dist-artifacts
pnpm --dir contracts pack --pack-destination ../dist-artifacts
ls -la dist-artifacts
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload package tarballs
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: error
name: platform-packages-${{ env.CANDIDATE_TAG }}
path: dist-artifacts/*.tgz
retention-days: "30"
- if: ${{ always() && env.CANDIDATE_TAG != '' }}
name: Upload public static evidence
uses: ./.git/ci-actions/upload-artifact
with:
if-no-files-found: warn
name: platform-public-static-${{ env.CANDIDATE_TAG }}
path: reports/*.latest.json
retention-days: "30"
timeout-minutes: "15"
permissions:
contents: read
...
|
public-static
|
null
|
["ubuntu-latest"]
|
0
|
5
|
0
|
0
|
1794764285
|
1794764285
|
|
0
|
|
0
|
Edit
Delete
|