Compare commits
3 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 wangjia
|
fdc13ea06c | ||
|
wangjia
|
f0f845c6e5 | ||
|
wangjia
|
b255fdfb4e |
@@ -1,271 +0,0 @@
|
||||
name: ci-pangolin
|
||||
|
||||
# 触发条件:deploy/ 或 design/ 或 client/ 或 server/ 或 ci/ 变更时，以及所有向 main 的 PR
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
paths:
|
||||
- 'deploy/**'
|
||||
- 'design/**'
|
||||
- 'client/**'
|
||||
- 'server/**'
|
||||
- 'ci/**'
|
||||
- 'scripts/ci/**'
|
||||
- '.gitea/workflows/ci.yml'
|
||||
pull_request:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
|
||||
# runner 分配:
|
||||
# · runs-on: ubuntu-latest —— 在 catthehacker 容器里跑,仅用于纯 bash 扫描
|
||||
# (redline/cleartext/portable-sql);容器内**不能**嵌套 `docker run`(DinD 挂载
|
||||
# 失败,$PWD 在宿主不存在),故套 docker 的 job 不能用它。
|
||||
# · runs-on: mac —— host 模式(mac-pangolin-2 直接在宿主跑),`docker run` 是宿主
|
||||
# 真 docker(非嵌套),可正常拉/跑 node/golang/flutter/python/shellcheck 镜像。
|
||||
# golden 保留 ghcr.io/cirruslabs/flutter Linux 容器 → 与入库基线渲染一致。
|
||||
jobs:
|
||||
|
||||
# ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
|
||||
lint:
|
||||
name: Lint — shellcheck
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: shellcheck 节点脚本(bootstrap + single-node)
|
||||
# 注:koalaman/shellcheck 镜像 ENTRYPOINT 已是 shellcheck,命令里别再写一遍
|
||||
# (否则变 `shellcheck shellcheck …`,把 "shellcheck" 当文件→openBinaryFile 报错)。
|
||||
run: |
|
||||
docker run --rm \
|
||||
-v "$PWD/deploy:/mnt/deploy:ro" \
|
||||
koalaman/shellcheck:stable \
|
||||
-S warning \
|
||||
/mnt/deploy/bootstrap/init.sh \
|
||||
/mnt/deploy/bootstrap/monitor/pangolin-monitor.sh \
|
||||
/mnt/deploy/bootstrap/monitor/deadman-watch.sh \
|
||||
/mnt/deploy/single-node/deploy.sh
|
||||
|
||||
- name: shellcheck CI 脚本(scripts/ci)
|
||||
run: |
|
||||
docker run --rm \
|
||||
-v "$PWD/scripts/ci:/mnt/scripts/ci:ro" \
|
||||
koalaman/shellcheck:stable \
|
||||
-S warning \
|
||||
/mnt/scripts/ci/_env.sh \
|
||||
/mnt/scripts/ci/lib-forgejo.sh \
|
||||
/mnt/scripts/ci/notify.sh \
|
||||
/mnt/scripts/ci/lib-ssh.sh \
|
||||
/mnt/scripts/ci/compile-site.sh \
|
||||
/mnt/scripts/ci/deploy-site.sh \
|
||||
/mnt/scripts/ci/compile-backend.sh \
|
||||
/mnt/scripts/ci/release-server.sh \
|
||||
/mnt/scripts/ci/deploy-server.sh \
|
||||
/mnt/scripts/ci/test.sh \
|
||||
/mnt/scripts/ci/backup-db.sh \
|
||||
/mnt/scripts/ci/compile-android.sh \
|
||||
/mnt/scripts/ci/compile-windows.sh \
|
||||
/mnt/scripts/ci/compile-macos.sh \
|
||||
/mnt/scripts/ci/compile-ios.sh \
|
||||
/mnt/scripts/ci/release-client.sh \
|
||||
/mnt/scripts/ci/deploy-client.sh
|
||||
|
||||
- name: shellcheck CI 脚本(ci/)
|
||||
run: |
|
||||
docker run --rm \
|
||||
-v "$PWD/ci:/mnt/ci:ro" \
|
||||
koalaman/shellcheck:stable \
|
||||
-S warning \
|
||||
/mnt/ci/scan-cleartext.sh
|
||||
|
||||
# ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
|
||||
openapi-check:
|
||||
name: OpenAPI Sync Check
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# openapi-spec-validator 是纯 Python、无外部依赖，校验 OAS 3.0 结构合法性。
|
||||
- name: lint design/server/openapi.yaml
|
||||
run: |
|
||||
docker run --rm \
|
||||
-v "$PWD/design/server:/spec:ro" \
|
||||
python:3.12-alpine \
|
||||
sh -c "pip install openapi-spec-validator --quiet && \
|
||||
python -m openapi_spec_validator /spec/openapi.yaml"
|
||||
|
||||
# ── Job 3: Redline Word Scan (脱敏) ──────────────────────────────────────
|
||||
redline-scan:
|
||||
name: Redline Scan — 脱敏 (UI 文案)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: scan UI text resources for prohibited words
|
||||
run: bash ci/scan-redline.sh
|
||||
|
||||
# ── Job 3b: Cleartext Scan (Android 禁全局明文,#25 控制面已 https) ──────
|
||||
cleartext-scan:
|
||||
name: Cleartext Scan — Android 禁明文
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: scan Android manifest for global cleartext
|
||||
run: bash ci/scan-cleartext.sh
|
||||
|
||||
# ── Job 4: Flutter 客户端(分析 + 单测/组件测试)────────────────────────
|
||||
flutter-client:
|
||||
name: Flutter — analyze + test
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: flutter analyze + test + coverage
|
||||
run: |
|
||||
mkdir -p "$HOME/.cache/pangolin-ci/pubcache"
|
||||
docker run --rm \
|
||||
-v "$PWD/client:/app" -w /app \
|
||||
-v "$HOME/.cache/pangolin-ci/pubcache:/root/.pub-cache" \
|
||||
ghcr.io/cirruslabs/flutter:stable \
|
||||
bash -c "flutter pub get && flutter analyze --no-fatal-infos && flutter test --coverage test/unit test/widget test/contract"
|
||||
# 覆盖率闸(host 侧解析 lcov):防断崖,低于阈值即失败。
|
||||
COV=$(awk -F: '/^LF:/{f+=$2} /^LH:/{h+=$2} END{if(f>0)printf "%.1f",h/f*100}' client/coverage/lcov.info)
|
||||
echo "flutter 行覆盖 ${COV}%"
|
||||
awk -v c="$COV" 'BEGIN{ if(c+0 < 28){ print "❌ flutter 覆盖率 "c"% < 阈值 28%"; exit 1 } print "✅ flutter 覆盖率 "c"% ≥ 28%" }'
|
||||
|
||||
# ── Job 5: Portable SQL Scan (支柱 3:双库可移植)─────────────────────────
|
||||
# server Go 运行时查询不得含 MySQL 专属构造(同一份 SQL 要跑 mysql 与 sqlite)。
|
||||
# 规则与豁免见 ci/scan-portable-sql.sh 头注 + docs/dev-conventions.html 支柱 3。
|
||||
portable-sql-scan:
|
||||
name: Portable SQL — 可移植性 (mysql/sqlite)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: scan server Go runtime SQL for MySQL-specific constructs
|
||||
run: bash ci/scan-portable-sql.sh
|
||||
|
||||
# ── Job 6: Codegen Drift (支柱 2:token 单源不漂移)──────────────────────
|
||||
# 重新生成 client/lib/pangolin_tokens.gen.dart,与已提交版本不一致即失败
|
||||
# (改了 design/colors_and_type.css 没重生成,或手改了生成物)。
|
||||
codegen-drift:
|
||||
name: Codegen Drift — token 生成物未漂移
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: regenerate flutter tokens & assert no drift
|
||||
run: |
|
||||
docker run --rm \
|
||||
-v "$PWD:/repo" -w /repo \
|
||||
node:20 \
|
||||
bash ci/check-codegen-drift.sh
|
||||
|
||||
ds-flow:
|
||||
name: DS-flow — 原型/跨端同源/代码色单源闸
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: 原型校验(check-ds)
|
||||
run: docker run --rm -v "$PWD:/repo" -w /repo node:20 node design/prototype/tools/check-ds.mjs
|
||||
|
||||
- name: 跨端同源(check-l1-sync)
|
||||
run: docker run --rm -v "$PWD:/repo" -w /repo node:20 node tools/check-l1-sync.mjs
|
||||
|
||||
- name: Flutter 颜色单源(check_ds_code --strict)
|
||||
run: docker run --rm -v "$PWD/client:/app" -w /app node:20 node tool/check_ds_code.mjs --strict
|
||||
|
||||
# ── Job 7: Go 服务端(build + test:含契约快照 + sqlite 真库,跳过 integration)──
|
||||
# 此前 server 测试未进 CI;契约快照(支柱 2)等需在此守门。integration 测试走
|
||||
# -tags integration(需 docker 起 mysql/redis),见 go-integration job。
|
||||
go-server:
|
||||
name: Go — build + test
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: go build + vet + test + coverage
|
||||
run: |
|
||||
# 宿主持久缓存(host-mode runner):省掉每次 `go: downloading` 全量拉依赖。
|
||||
mkdir -p "$HOME/.cache/pangolin-ci/gomod" "$HOME/.cache/pangolin-ci/gobuild"
|
||||
docker run --rm \
|
||||
-v "$PWD/server:/app" -w /app \
|
||||
-v "$HOME/.cache/pangolin-ci/gomod:/go/pkg/mod" \
|
||||
-v "$HOME/.cache/pangolin-ci/gobuild:/root/.cache/go-build" \
|
||||
golang:1.25 \
|
||||
bash -c "go build ./... && go vet ./... && go test -coverprofile=cover.out ./... && go tool cover -func=cover.out > coverage.txt"
|
||||
tail -1 server/coverage.txt
|
||||
# 覆盖率闸(host 侧解析,避开容器引号转义):防断崖,低于阈值即失败。
|
||||
COV=$(grep '^total:' server/coverage.txt | grep -oE '[0-9]+\.[0-9]+')
|
||||
awk -v c="$COV" 'BEGIN{ if(c+0 < 30){ print "❌ Go 覆盖率 "c"% < 阈值 30%"; exit 1 } print "✅ Go 覆盖率 "c"% ≥ 30%" }'
|
||||
|
||||
# ── Job 8: E2E Smoke (L4 进程级端到端,含 gRPC 全链路)───────────────────
|
||||
# 真起打包的 server 二进制(sqlite 临时库 + 内嵌 miniredis,无需 docker-in-docker)
|
||||
# → enroll(mTLS)→ ReportUsage 注入用量 → /v1/usage 断言统计真入库真读出。
|
||||
# 详见 scripts/e2e-smoke.sh + server/test/e2e/。
|
||||
e2e-smoke:
|
||||
name: E2E Smoke — L4 进程级端到端
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: 进程级端到端冒烟 (server 二进制 + miniredis + gRPC 全链路)
|
||||
run: |
|
||||
mkdir -p "$HOME/.cache/pangolin-ci/gomod" "$HOME/.cache/pangolin-ci/gobuild"
|
||||
docker run --rm \
|
||||
-v "$PWD:/repo" -w /repo \
|
||||
-v "$HOME/.cache/pangolin-ci/gomod:/go/pkg/mod" \
|
||||
-v "$HOME/.cache/pangolin-ci/gobuild:/root/.cache/go-build" \
|
||||
golang:1.25 \
|
||||
bash -c "bash scripts/e2e-smoke.sh"
|
||||
# 注:openssl/curl/python3 已在 golang:1.25 镜像内,无需 apt 安装
|
||||
# (原 apt-get 会走 Docker Desktop 代理→本机 clash 死口,徒增网络脆性)。
|
||||
|
||||
# ── Job 10: Go 集成测试 (L2:真 mysql8/redis 经 testcontainers)──────────
|
||||
# 跨库可移植(支柱 3)+ 按租户流量记账(usage)+ 配额(devices)+ 兑换(codes)+
|
||||
# 节点生命周期(nodes)+ migrate/时区(store)的真库行为,sqlite 单测覆盖不到。
|
||||
# 走 -tags integration,testcontainers 自起 mysql:8/redis 容器。
|
||||
# · 在 host-mode runner 的宿主机直接跑 go(不套 golang 容器):testcontainers 要真
|
||||
# docker,DooD 套在容器里在 Docker Desktop(mac)上网络不通。依赖宿主 go + docker。
|
||||
# · -p 1 串行:一次只起一个 mysql 容器,避免并发把 Docker Desktop 压垮/端口资源争用。
|
||||
go-integration:
|
||||
name: Go — integration (mysql/redis testcontainers)
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: go test -tags integration (宿主 docker + testcontainers)
|
||||
run: |
|
||||
cd server
|
||||
go test -tags integration -count=1 -p 1 ./...
|
||||
|
||||
# ── Job 9: Golden 视觉回归 (L3 子集:components + auth)──────────────────
|
||||
# Linux 权威基线(scripts/update-goldens.sh 生成;mac 渲染不一致故钉死 Linux 容器)。
|
||||
# tablet/desktop-stats golden 与 stats-overhaul 工作区耦合,待其合并后并入本 job。
|
||||
golden:
|
||||
name: Golden — 视觉回归 (全量:components/auth/desktop/tablet)
|
||||
runs-on: mac
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: flutter test golden (Linux 权威基线)
|
||||
run: |
|
||||
mkdir -p "$HOME/.cache/pangolin-ci/pubcache"
|
||||
docker run --rm \
|
||||
-v "$PWD/client:/app" -w /app \
|
||||
-v "$HOME/.cache/pangolin-ci/pubcache:/root/.pub-cache" \
|
||||
ghcr.io/cirruslabs/flutter:stable \
|
||||
bash -c "flutter pub get && flutter test test/golden"
|
||||
@@ -90,25 +90,16 @@ jobs:
|
||||
name: windows
|
||||
path: dist/
|
||||
|
||||
# Why build-macos/build-ios don't block the working android+windows pipeline
|
||||
# when Apple secrets aren't configured yet (they aren't, as of this writing):
|
||||
# 1. release-deploy's `needs:` below is [build-android, build-windows]
|
||||
# ONLY — macOS/iOS are NOT dependencies, so release-deploy never waits
|
||||
# on them and never fails because of them.
|
||||
# 2. `continue-on-error: true` on both jobs keeps the overall workflow-run
|
||||
# status green even while compile-macos.sh hard-fails (Apple Developer
|
||||
# ID / notary secrets absent — see its fail-fast checks) — that failure
|
||||
# is real signal ("go configure the secrets"), but it shouldn't read as
|
||||
# "the release pipeline is broken" when android+windows shipped fine.
|
||||
# 3. compile-macos.sh's own default behavior is to hard-fail (not skip)
|
||||
# when its secrets are missing (macOS distribution must never ship
|
||||
# unsigned/unnotarized — see its header comment); compile-ios.sh's
|
||||
# default is to skip gracefully (exit 0) since an unconfigured iOS
|
||||
# account is a normal "not set up yet" state, not a defect. Either way
|
||||
# the job produces no dist/pangolin-macos-x64.zip, and
|
||||
# release-deploy's "Download all artifacts" step (no `name:` filter)
|
||||
# simply picks up whatever artifacts DO exist — an absent "macos"
|
||||
# artifact is not an error there.
|
||||
# build-macos/build-ios 用 `continue-on-error: true` → 即便 Apple 侧构建抖了
|
||||
# (frps 拉 sing-box 源码 / 公证超时等),也不阻塞 android+windows 发布:
|
||||
# 1. release-deploy 现在 `needs:` 全部四个平台(见下),所以它会**等**全部
|
||||
# build 完成再发布 —— 避免旧 `needs: [build-android]` 只等 android、
|
||||
# macos/ios 还没传产物就发布导致漏平台的竞态。
|
||||
# 2. continue-on-error 让 macos/ios 失败仍算「completed」满足 needs,不使整个
|
||||
# workflow 变红、不阻断已成功平台的发布;release-deploy 的「Download all
|
||||
# artifacts」(无 name 过滤)只捡实际存在的产物,缺某平台不报错。
|
||||
# 3. Apple 签名 secret 现已在 gitea 用户级配齐(DEVELOPER_ID_P12/IOS_DIST_P12/
|
||||
# APPSTORE_API_* 等),macos/ios 正常应成功;continue-on-error 只是抖动兜底。
|
||||
build-macos:
|
||||
runs-on: mac
|
||||
continue-on-error: true
|
||||
@@ -177,8 +168,15 @@ jobs:
|
||||
# dist-raw/ 里"当时存在"的产物。windows 机离线 / Apple secret 未配 都不阻塞发版
|
||||
# (对应平台下载保留 pangolin1 上一版,待可用时下个 client-v* 追上)。
|
||||
release-deploy:
|
||||
needs: [build-android]
|
||||
runs-on: mac
|
||||
# 等全部平台 build 完再发布,否则 download-artifact 会漏掉尚未上传的平台
|
||||
# (原来只 needs build-android → android 一完就发,macos/ios 常还没传产物)。
|
||||
needs: [build-android, build-windows, build-macos, build-ios]
|
||||
# ubuntu-latest = 家里 nas act_runner,与 gitea 同机/同网:Release → Forgejo 的
|
||||
# API 调用走本地不过 frps 隧道(mac runner 走 git.51yanmei.com→frps→抖,curl 超时
|
||||
# exit 28,3m3s=release_ensure 60s×3 重试耗尽)。deploy-server/deploy-site 同为
|
||||
# ubuntu-latest,其 Forgejo release 步稳定通过(server 仅 13s)。此 job 全为网络/
|
||||
# SSH 步骤(下载产物/传 Forgejo/SSH pangolin1/通知),无 mac 专属需求。
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
# .githooks/pre-commit — 闸 3:提交前本地把关(复用 CI 同款检查的快子集)。
|
||||
#
|
||||
# 启用:bash ci/install-hooks.sh (设 git core.hooksPath=.githooks)
|
||||
# 设计:成功静默、失败才打详情;只放秒级检查。flutter/go test 较慢,留给 CI(闸 4)。
|
||||
# 设计:成功静默、失败才打详情;只放秒级检查。flutter/go test 较慢,不放这里 ——
|
||||
# 提交/发版前手动跑 `bash ci/check-local.sh`(取代已删的 pipeline ci.yml)。
|
||||
#
|
||||
# 跑:红线词扫描 + 可移植 SQL 扫描 + codegen 漂移检查。
|
||||
set -euo pipefail
|
||||
@@ -48,4 +49,4 @@ if command -v node >/dev/null 2>&1; then
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "[pre-commit] ✓ 本地闸通过(完整测试见 CI)"
|
||||
echo "[pre-commit] ✓ 本地快闸通过(完整校验跑 bash ci/check-local.sh)"
|
||||
|
||||
@@ -83,10 +83,18 @@ server 已与具体 DB 解绑(裸 SQL + 薄方言层,`internal/db/dialect.go`):
|
||||
|
||||
## CI/CD
|
||||
|
||||
`.gitea/workflows/`(runner = 家里 NAS 上的 act_runner;job `runs-on: ubuntu-latest` 由它在
|
||||
`catthehacker/ubuntu:act-latest` 容器承接):
|
||||
- **`ci.yml`**(push/PR,**仅校验**):shellcheck、OpenAPI 结构校验、UI 文案脱敏扫描、Flutter
|
||||
analyze+test、codegen 漂移闸(`ci/check-codegen-drift.sh`:token/l10n/原型 i18n)。
|
||||
**校验(CI)已迁本地,不再上 pipeline**:原 `ci.yml`(push/PR)跑在 mac-pangolin-2 runner 上,
|
||||
该 runner 不稳(重 job 频繁整体超时/失败),已**删除**。校验改为本地手动跑
|
||||
**`bash ci/check-local.sh`**(dev mac 原生工具齐全):
|
||||
- 默认档(快):shellcheck + 脱敏红线 + Android 明文 + 可移植SQL + OpenAPI + codegen漂移 +
|
||||
ds-flow 三闸 + `go build/vet/test ./...` + `flutter analyze+test`(各带覆盖率闸)。
|
||||
- `--full`:追加 golden(**docker Linux flutter**,mac 原生像素对不上基线)+ go integration
|
||||
(testcontainers,docker)+ e2e-smoke。`--only <名>` 单跑,`--list` 列项。
|
||||
- 秒级子集仍由 `.githooks/pre-commit` 提交时自动跑(`bash ci/install-hooks.sh` 启用一次);
|
||||
完整校验靠 `ci/check-local.sh`。**改 CI 检查逻辑改 `ci/*.sh` 与本脚本,不要再加 workflow。**
|
||||
|
||||
`.gitea/workflows/` 现**只剩发版流水线**(deploy-server/client/site,tag 触发;runner 同为家里
|
||||
NAS act_runner):
|
||||
- **发版走 tag 触发**(cicd-design 已落地,取代旧「无部署」):`server-vX.Y.Z` → `deploy-server.yml`
|
||||
= compile-backend → `test.sh server`(**`go test ./...`**,全绿才继续)→ Forgejo release →
|
||||
`deploy-server.sh` 到 pangolin1(**备份DB→migrate up→换二进制→重启→本地 `/healthz` 权威闸**,
|
||||
@@ -125,7 +133,7 @@ cd web/website && npm run gen:tokens
|
||||
> 标注「⏳」的部件正在建，未标注的已生效。参考样板 `~/code/jiu`。
|
||||
|
||||
**心智模型**：设计只有一个出生地（**原型单源**），代码永远是镜像；跨端副本是否走样由
|
||||
**静态闸**在提交/CI 前拦截，像素是否还原由 **golden/fidelity 双级验收**兜底。主题：**light / dark 双主题**。
|
||||
**静态闸**在提交/本地校验(check-local)前拦截，像素是否还原由 **golden/fidelity 双级验收**兜底。主题：**light / dark 双主题**。
|
||||
|
||||
**原型单源** `design/prototype/`（⏳ 建设中，Phase 1）：
|
||||
- `tokens.css` — 令牌真源：基础 `:root`（主题无关标量：间距/圆角/字号/字体/阴影/动效）+ `[data-theme=dark]` 颜色覆盖块。
|
||||
@@ -149,10 +157,10 @@ cd web/website && npm run gen:tokens
|
||||
|
||||
| 闸 | 拦什么 | 何时 |
|
||||
|---|---|---|
|
||||
| 原型校验 `check-ds.mjs`（⏳ Phase 5） | 硬编码色/未定义 token/未登记组件/魔法数断点… 12 道 | pre-commit（动了原型）+ CI |
|
||||
| 跨端同源 `check-l1-sync.mjs`（⏳ Phase 2） | tokens 逐值/icons 同集/Web hex 白名单 | CI |
|
||||
| 代码色单源 `check_ds_code.mjs`（⏳ Phase 5） | Flutter 裸 `Color(0x)`/具名 `Colors.x`（`// ds-ignore: 理由` 豁免） | pre-commit（`--changed`）+ CI |
|
||||
| codegen 零 diff `ci/check-codegen-drift.sh`（**已生效**） | 重生成 token 后 `git diff` 非空即 fail | pre-commit + CI |
|
||||
| 原型校验 `check-ds.mjs`（⏳ Phase 5） | 硬编码色/未定义 token/未登记组件/魔法数断点… 12 道 | pre-commit（动了原型）+ check-local |
|
||||
| 跨端同源 `check-l1-sync.mjs`（⏳ Phase 2） | tokens 逐值/icons 同集/Web hex 白名单 | check-local |
|
||||
| 代码色单源 `check_ds_code.mjs`（⏳ Phase 5） | Flutter 裸 `Color(0x)`/具名 `Colors.x`（`// ds-ignore: 理由` 豁免） | pre-commit（`--changed`）+ check-local |
|
||||
| codegen 零 diff `ci/check-codegen-drift.sh`（**已生效**） | 重生成 token 后 `git diff` 非空即 fail | pre-commit + check-local |
|
||||
|
||||
**双级像素验收**：
|
||||
- **golden**（**已有**，`client/test/golden/`）：多主题回归自比（同渲染器），抓串色/漏 token；真字体加载防豆腐块、钉死 viewport/dpr/动态值。重录 `flutter test --update-goldens`，随功能 commit 入库。
|
||||
|
||||
Executable
+169
@@ -0,0 +1,169 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# ci/check-local.sh — 本地跑完整 CI 校验闸(取代已删的 .gitea/workflows/ci.yml)。
|
||||
#
|
||||
# 背景:CI 校验原先跑在自建 gitea 的 mac-pangolin-2 runner 上,该 runner 不稳定
|
||||
# (重 job 频繁超时/整体失败)。既然开发就在 mac 上、原生工具齐全,把校验迁回本地:
|
||||
# 提交前 / 发版前手动跑本脚本,取代 pipeline 上那套 ci.yml。
|
||||
# 部署流水线(.gitea/workflows/deploy-*.yml,tag 触发)保留 —— 发版时仍过 go test。
|
||||
#
|
||||
# 用法:
|
||||
# bash ci/check-local.sh # 默认档(快,原生):静态闸 + go build/test + flutter analyze/test
|
||||
# bash ci/check-local.sh --full # 追加重档:golden(docker) + go integration(docker) + e2e
|
||||
# bash ci/check-local.sh --only go # 只跑某一项(名字见下方 CHECK 列表,可用前缀)
|
||||
# bash ci/check-local.sh --list # 列出所有检查项
|
||||
#
|
||||
# 各检查与 .gitea/workflows/ci.yml 的 job 一一对应;命令尽量原生(dev mac 有
|
||||
# go/node/flutter/python/shellcheck),仅 golden 因 Linux 权威基线仍走 docker。
|
||||
# 缺工具的检查标 SKIP(不算失败,但会在汇总里提示「未验证」)。
|
||||
#
|
||||
set -uo pipefail
|
||||
|
||||
SRC="${BASH_SOURCE[0]}"
|
||||
DIR="${SRC%/*}"; [ "$DIR" = "$SRC" ] && DIR="."
|
||||
cd "$DIR/.." || exit 1; REPO="$PWD"
|
||||
|
||||
# ── 颜色 / 汇总 ───────────────────────────────────────────────────────────
|
||||
G=$'\033[0;32m'; R=$'\033[0;31m'; Y=$'\033[1;33m'; B=$'\033[1;34m'; Z=$'\033[0m'
|
||||
PASS=(); FAIL=(); SKIP=()
|
||||
|
||||
have(){ command -v "$1" >/dev/null 2>&1; }
|
||||
|
||||
# run_check <名称> <命令...> —— 跑一项检查,记录结果,失败也继续(最后汇总)。
|
||||
run_check(){
|
||||
local name="$1"; shift
|
||||
printf '%s▶ %s%s\n' "$B" "$name" "$Z"
|
||||
if "$@"; then PASS+=("$name"); printf '%s ✓ %s%s\n\n' "$G" "$name" "$Z"
|
||||
else FAIL+=("$name"); printf '%s ✗ %s%s\n\n' "$R" "$name" "$Z"; fi
|
||||
}
|
||||
skip(){ SKIP+=("$1"); printf '%s⏭ SKIP %s(%s)%s\n\n' "$Y" "$1" "$2" "$Z"; }
|
||||
|
||||
# ── 各检查(与 ci.yml job 对应)──────────────────────────────────────────
|
||||
|
||||
check_shellcheck(){
|
||||
have shellcheck || { skip "shellcheck" "未装 shellcheck(brew install shellcheck)"; return 0; }
|
||||
shellcheck -S warning \
|
||||
deploy/bootstrap/init.sh \
|
||||
deploy/bootstrap/monitor/pangolin-monitor.sh \
|
||||
deploy/bootstrap/monitor/deadman-watch.sh \
|
||||
deploy/single-node/deploy.sh \
|
||||
scripts/ci/*.sh \
|
||||
ci/*.sh
|
||||
}
|
||||
|
||||
check_openapi(){
|
||||
# 原生优先;缺模块就跳过并提示一次性安装(不走 docker+pip:每次拉镜像装包太慢)。
|
||||
if have python3 && python3 -c "import openapi_spec_validator" 2>/dev/null; then
|
||||
python3 -m openapi_spec_validator design/server/openapi.yaml
|
||||
else
|
||||
skip "openapi" "缺模块,一次性装:pip3 install openapi-spec-validator"; return 0
|
||||
fi
|
||||
}
|
||||
|
||||
check_redline(){ bash ci/scan-redline.sh; }
|
||||
check_cleartext(){ bash ci/scan-cleartext.sh; }
|
||||
check_portable_sql(){ bash ci/scan-portable-sql.sh; }
|
||||
|
||||
check_codegen_drift(){ have node || { skip "codegen-drift" "未装 node"; return 0; }; bash ci/check-codegen-drift.sh; }
|
||||
|
||||
check_ds_flow(){
|
||||
have node || { skip "ds-flow" "未装 node"; return 0; }
|
||||
node design/prototype/tools/check-ds.mjs \
|
||||
&& node tools/check-l1-sync.mjs \
|
||||
&& ( cd client && node tool/check_ds_code.mjs --strict )
|
||||
}
|
||||
|
||||
check_go(){
|
||||
have go || { skip "go build+test" "未装 go"; return 0; }
|
||||
( cd server \
|
||||
&& go build ./... \
|
||||
&& go vet ./... \
|
||||
&& go test -coverprofile=cover.out ./... \
|
||||
&& go tool cover -func=cover.out > coverage.txt \
|
||||
&& tail -1 coverage.txt \
|
||||
&& awk '/^total:/{c=$3; sub(/%/,"",c); if(c+0<30){print "❌ Go 覆盖率 "c"% < 30%"; exit 1} print "✅ Go 覆盖率 "c"% ≥ 30%"}' coverage.txt )
|
||||
}
|
||||
|
||||
check_flutter(){
|
||||
have flutter || { skip "flutter analyze+test" "未装 flutter"; return 0; }
|
||||
( cd client \
|
||||
&& flutter pub get \
|
||||
&& flutter analyze --no-fatal-infos \
|
||||
&& flutter test --coverage test/unit test/widget test/contract \
|
||||
&& awk -F: '/^LF:/{f+=$2} /^LH:/{h+=$2} END{c=(f>0)?h/f*100:0; if(c<28){printf "❌ flutter 覆盖率 %.1f%% < 28%%\n",c; exit 1} printf "✅ flutter 覆盖率 %.1f%% ≥ 28%%\n",c}' coverage/lcov.info )
|
||||
}
|
||||
|
||||
# ── 重档(--full):需 docker / 更慢 ──────────────────────────────────────
|
||||
check_golden(){
|
||||
# Linux 权威基线(mac 原生渲染像素对不上),必须 docker Linux flutter。
|
||||
have docker || { skip "golden" "未装 docker(golden 需 Linux 容器)"; return 0; }
|
||||
mkdir -p "$HOME/.cache/pangolin-ci/pubcache"
|
||||
docker run --rm -v "$REPO/client:/app" -w /app \
|
||||
-v "$HOME/.cache/pangolin-ci/pubcache:/root/.pub-cache" \
|
||||
ghcr.io/cirruslabs/flutter:stable \
|
||||
bash -c "flutter pub get && flutter test test/golden"
|
||||
}
|
||||
|
||||
check_go_integration(){
|
||||
have go || { skip "go integration" "未装 go"; return 0; }
|
||||
have docker || { skip "go integration" "未装 docker(testcontainers 需 docker)"; return 0; }
|
||||
( cd server && go test -tags integration -count=1 -p 1 ./... )
|
||||
}
|
||||
|
||||
check_e2e(){
|
||||
have go || { skip "e2e-smoke" "未装 go"; return 0; }
|
||||
bash scripts/e2e-smoke.sh
|
||||
}
|
||||
|
||||
# 检查登记表:名字 → 档位(fast|full)。名字→函数用 case 分发(避开关联数组的
|
||||
# bash4+ 依赖与 set -u subscript 求值坑)。
|
||||
FAST=(shellcheck openapi redline cleartext portable-sql codegen-drift ds-flow go flutter)
|
||||
FULL=(golden go-integration e2e)
|
||||
dispatch(){
|
||||
case "$1" in
|
||||
shellcheck) check_shellcheck ;;
|
||||
openapi) check_openapi ;;
|
||||
redline) check_redline ;;
|
||||
cleartext) check_cleartext ;;
|
||||
portable-sql) check_portable_sql ;;
|
||||
codegen-drift) check_codegen_drift ;;
|
||||
ds-flow) check_ds_flow ;;
|
||||
go) check_go ;;
|
||||
flutter) check_flutter ;;
|
||||
golden) check_golden ;;
|
||||
go-integration) check_go_integration ;;
|
||||
e2e) check_e2e ;;
|
||||
*) echo "未知检查:$1"; return 2 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# ── 参数 ────────────────────────────────────────────────────────────────
|
||||
MODE=fast; ONLY=""
|
||||
for a in "$@"; do
|
||||
case "$a" in
|
||||
--full) MODE=full ;;
|
||||
--fast) MODE=fast ;;
|
||||
--list) printf 'fast: %s\nfull: %s\n' "${FAST[*]}" "${FULL[*]}"; exit 0 ;;
|
||||
--only=*) ONLY="${a#--only=}" ;;
|
||||
--only) MODE=only ;; # 兼容 `--only go`(下一个 token 当名字)
|
||||
-h|--help) sed -n '2,26p' "$SRC"; exit 0 ;;
|
||||
*) [ "$MODE" = only ] && ONLY="$a" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -n "$ONLY" ]; then
|
||||
ORDER=()
|
||||
for k in "${FAST[@]}" "${FULL[@]}"; do [[ "$k" == "$ONLY"* ]] && ORDER+=("$k"); done
|
||||
[ ${#ORDER[@]} -eq 0 ] && { echo "无匹配 '$ONLY';可选:${FAST[*]} ${FULL[*]}"; exit 2; }
|
||||
elif [ "$MODE" = full ]; then ORDER=("${FAST[@]}" "${FULL[@]}")
|
||||
else ORDER=("${FAST[@]}"); fi
|
||||
|
||||
printf '%s== 本地 CI 校验(%s档,%d 项)==%s\n\n' "$B" "$MODE" "${#ORDER[@]}" "$Z"
|
||||
for k in "${ORDER[@]}"; do run_check "$k" dispatch "$k"; done
|
||||
|
||||
# ── 汇总 ────────────────────────────────────────────────────────────────
|
||||
printf '%s══════ 汇总 ══════%s\n' "$B" "$Z"
|
||||
printf '%s通过 %d%s | %s失败 %d%s | %s跳过 %d%s\n' "$G" "${#PASS[@]}" "$Z" "$R" "${#FAIL[@]}" "$Z" "$Y" "${#SKIP[@]}" "$Z"
|
||||
[ ${#SKIP[@]} -gt 0 ] && printf '%s跳过(未验证):%s%s\n' "$Y" "${SKIP[*]}" "$Z"
|
||||
if [ ${#FAIL[@]} -gt 0 ]; then printf '%s失败:%s%s\n' "$R" "${FAIL[*]}" "$Z"; exit 1; fi
|
||||
printf '%s全部通过 ✓%s\n' "$G" "$Z"
|
||||
@@ -6,6 +6,9 @@
|
||||
export GOPROXY="${GOPROXY:-https://goproxy.cn,direct}"
|
||||
export PUB_HOSTED_URL="${PUB_HOSTED_URL:-https://pub.flutter-io.cn}"
|
||||
export FLUTTER_STORAGE_BASE_URL="${FLUTTER_STORAGE_BASE_URL:-https://storage.flutter-io.cn}"
|
||||
# npm/npx 国内镜像:site 流水线(Astro 官网 + Next.js 用户中心 + npx wrangler)在
|
||||
# 墙内 nas runner 上直连 registry.npmjs.org 会慢/抖断,与 Go/Flutter 同样需镜像。
|
||||
export NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY:-https://registry.npmmirror.com}"
|
||||
|
||||
# Forgejo/Gitea repo coordinates (used by lib-forgejo.sh). Secrets
|
||||
# FORGEJO_TOKEN / FORGEJO_URL are injected by the CI runner, not set here.
|
||||
@@ -44,3 +47,16 @@ flutter_pub_get_retry() {
|
||||
echo "==> flutter pub get 5 次仍失败,放弃" >&2
|
||||
return 1
|
||||
}
|
||||
|
||||
# npm_ci_retry — 同理:npmmirror 偶发抖断时重试 `npm ci`。在含 package-lock.json 的
|
||||
# 目录调用(site 各 web 子项目根)。已由 NPM_CONFIG_REGISTRY 指向国内镜像。
|
||||
npm_ci_retry() {
|
||||
local i
|
||||
for i in 1 2 3 4 5; do
|
||||
if npm ci; then return 0; fi
|
||||
echo "==> npm ci 失败(第 ${i}/5 次,registry 抖?),8s 后重试..." >&2
|
||||
sleep 8
|
||||
done
|
||||
echo "==> npm ci 5 次仍失败,放弃" >&2
|
||||
return 1
|
||||
}
|
||||
|
||||
@@ -4,16 +4,19 @@
|
||||
# web/website/astro.config.mjs) — must match the deploy target host name so
|
||||
# canonical URLs / sitemap resolve correctly.
|
||||
#
|
||||
# Run inside a node:20 container by .gitea/workflows/deploy-site.yml; this
|
||||
# script itself just runs npm and assumes it is invoked from the repo root.
|
||||
# 由 .gitea/workflows/deploy-site.yml 在 ubuntu runner 上从 repo 根调用(runner
|
||||
# 镜像自带 node/npx,直接跑)。source _env.sh 取 npm 国内镜像 + 重试助手(墙内)。
|
||||
set -euo pipefail
|
||||
|
||||
# shellcheck source=scripts/ci/_env.sh
|
||||
. scripts/ci/_env.sh
|
||||
|
||||
SITE_URL="${SITE_URL:-https://pangolin.yanmeiai.com}"
|
||||
export SITE_URL
|
||||
echo "==> compile-site: SITE_URL=${SITE_URL}"
|
||||
echo "==> compile-site: SITE_URL=${SITE_URL} NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}"
|
||||
|
||||
cd web/website
|
||||
npm ci
|
||||
npm_ci_retry
|
||||
npm run build
|
||||
|
||||
echo "==> compile-site: done — dist/ contents:"
|
||||
|
||||
@@ -11,12 +11,15 @@
|
||||
# 由 .gitea/workflows/deploy-site.yml 在 ubuntu runner 上调用,从 repo 根运行。
|
||||
set -euo pipefail
|
||||
|
||||
# shellcheck source=scripts/ci/_env.sh
|
||||
. scripts/ci/_env.sh
|
||||
|
||||
export NEXT_PUBLIC_API_MODE="${NEXT_PUBLIC_API_MODE:-http}"
|
||||
export NEXT_PUBLIC_API_DOMAINS="${NEXT_PUBLIC_API_DOMAINS:-https://api.yanmeiai.com}"
|
||||
echo "==> compile-usercenter: API_MODE=${NEXT_PUBLIC_API_MODE} API_DOMAINS=${NEXT_PUBLIC_API_DOMAINS}"
|
||||
echo "==> compile-usercenter: API_MODE=${NEXT_PUBLIC_API_MODE} API_DOMAINS=${NEXT_PUBLIC_API_DOMAINS} NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}"
|
||||
|
||||
cd web/usercenter
|
||||
npm ci
|
||||
npm_ci_retry
|
||||
npm run build
|
||||
|
||||
echo "==> compile-usercenter: done — out/ contents:"
|
||||
|
||||
@@ -10,6 +10,9 @@
|
||||
# 由 compile-site.sh 先产出 web/website/dist/;从 repo 根调用。
|
||||
set -euo pipefail
|
||||
|
||||
# shellcheck source=scripts/ci/_env.sh
|
||||
. scripts/ci/_env.sh # NPM_CONFIG_REGISTRY:让 `npx wrangler@4` 从国内镜像拉包
|
||||
|
||||
if [ ! -d web/website/dist ]; then
|
||||
echo "==> deploy-site: web/website/dist/ 不存在 — 拒绝部署" >&2
|
||||
exit 1
|
||||
|
||||
Reference in New Issue
Block a user