wangjia
2bf6701def
执行机制四道闸 → 闸4(CI 硬闸) + 评审兜底落地： - ci/scan-portable-sql.sh：扫 server Go 运行时查询禁用 MySQL 专属构造 (UTC_TIMESTAMP/UTC_DATE/NOW()/FIELD(/ON DUPLICATE KEY/IFNULL)， 豁免方言层 dialect*.go / _test.go / 注释行；当前 152 文件 0 违规 - ci.yml：新增 portable-sql-scan job；push 触发路径补 server/** - .gitea/PULL_REQUEST_TEMPLATE.md：可测试性五支柱 + 测试 + 红线自检清单 - 守支柱 3(纯逻辑/IO 分离·双库可移植)，见 docs/dev-conventions.html Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
name: ci-pangolin
|
|
|
|
# 触发条件:deploy/ 或 design/ 或 client/ 或 server/ 或 ci/ 变更时，以及所有向 main 的 PR
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'deploy/**'
|
|
- 'design/**'
|
|
- 'client/**'
|
|
- 'server/**'
|
|
- 'ci/**'
|
|
- '.gitea/workflows/ci.yml'
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
|
|
# ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
|
|
lint:
|
|
name: Lint — shellcheck
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: shellcheck 节点脚本(bootstrap + single-node)
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/deploy:/mnt/deploy:ro" \
|
|
koalaman/shellcheck:stable \
|
|
shellcheck -S warning \
|
|
/mnt/deploy/bootstrap/init.sh \
|
|
/mnt/deploy/bootstrap/monitor/pangolin-monitor.sh \
|
|
/mnt/deploy/bootstrap/monitor/deadman-watch.sh \
|
|
/mnt/deploy/single-node/deploy.sh
|
|
|
|
# ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
|
|
openapi-check:
|
|
name: OpenAPI Sync Check
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# openapi-spec-validator 是纯 Python、无外部依赖，校验 OAS 3.0 结构合法性。
|
|
- name: lint design/server/openapi.yaml
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/design/server:/spec:ro" \
|
|
python:3.12-alpine \
|
|
sh -c "pip install openapi-spec-validator --quiet && \
|
|
python -m openapi_spec_validator /spec/openapi.yaml"
|
|
|
|
# ── Job 3: Redline Word Scan (脱敏) ──────────────────────────────────────
|
|
redline-scan:
|
|
name: Redline Scan — 脱敏 (UI 文案)
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: scan UI text resources for prohibited words
|
|
run: bash ci/scan-redline.sh
|
|
|
|
# ── Job 4: Flutter 客户端(分析 + 单测/组件测试)────────────────────────
|
|
flutter-client:
|
|
name: Flutter — analyze + test
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: flutter analyze + test (unit/widget)
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/client:/app" -w /app \
|
|
ghcr.io/cirruslabs/flutter:stable \
|
|
bash -c "flutter pub get && flutter analyze && flutter test test/unit test/widget"
|
|
|
|
# ── Job 5: Portable SQL Scan (支柱 3:双库可移植)─────────────────────────
|
|
# server Go 运行时查询不得含 MySQL 专属构造(同一份 SQL 要跑 mysql 与 sqlite)。
|
|
# 规则与豁免见 ci/scan-portable-sql.sh 头注 + docs/dev-conventions.html 支柱 3。
|
|
portable-sql-scan:
|
|
name: Portable SQL — 可移植性 (mysql/sqlite)
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: scan server Go runtime SQL for MySQL-specific constructs
|
|
run: bash ci/scan-portable-sql.sh
|