wangjia
c34d8d8fb5
支柱 2(契约单源)守门: - ci/check-codegen-drift.sh：重生成 pangolin_tokens.gen.dart,与已提交版本 不一致即失败(改了 CSS 真相源没重生成,或手改了生成物 *.gen.dart) - ci.yml：新增 codegen-drift job(node:20 镜像,含 git/bash) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
111 lines
4.0 KiB
YAML
111 lines
4.0 KiB
YAML
name: ci-pangolin
|
|
|
|
# 触发条件:deploy/ 或 design/ 或 client/ 或 server/ 或 ci/ 变更时，以及所有向 main 的 PR
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'deploy/**'
|
|
- 'design/**'
|
|
- 'client/**'
|
|
- 'server/**'
|
|
- 'ci/**'
|
|
- '.gitea/workflows/ci.yml'
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
|
|
# ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
|
|
lint:
|
|
name: Lint — shellcheck
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: shellcheck 节点脚本(bootstrap + single-node)
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/deploy:/mnt/deploy:ro" \
|
|
koalaman/shellcheck:stable \
|
|
shellcheck -S warning \
|
|
/mnt/deploy/bootstrap/init.sh \
|
|
/mnt/deploy/bootstrap/monitor/pangolin-monitor.sh \
|
|
/mnt/deploy/bootstrap/monitor/deadman-watch.sh \
|
|
/mnt/deploy/single-node/deploy.sh
|
|
|
|
# ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
|
|
openapi-check:
|
|
name: OpenAPI Sync Check
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# openapi-spec-validator 是纯 Python、无外部依赖，校验 OAS 3.0 结构合法性。
|
|
- name: lint design/server/openapi.yaml
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/design/server:/spec:ro" \
|
|
python:3.12-alpine \
|
|
sh -c "pip install openapi-spec-validator --quiet && \
|
|
python -m openapi_spec_validator /spec/openapi.yaml"
|
|
|
|
# ── Job 3: Redline Word Scan (脱敏) ──────────────────────────────────────
|
|
redline-scan:
|
|
name: Redline Scan — 脱敏 (UI 文案)
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: scan UI text resources for prohibited words
|
|
run: bash ci/scan-redline.sh
|
|
|
|
# ── Job 4: Flutter 客户端(分析 + 单测/组件测试)────────────────────────
|
|
flutter-client:
|
|
name: Flutter — analyze + test
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: flutter analyze + test (unit/widget)
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/client:/app" -w /app \
|
|
ghcr.io/cirruslabs/flutter:stable \
|
|
bash -c "flutter pub get && flutter analyze && flutter test test/unit test/widget"
|
|
|
|
# ── Job 5: Portable SQL Scan (支柱 3:双库可移植)─────────────────────────
|
|
# server Go 运行时查询不得含 MySQL 专属构造(同一份 SQL 要跑 mysql 与 sqlite)。
|
|
# 规则与豁免见 ci/scan-portable-sql.sh 头注 + docs/dev-conventions.html 支柱 3。
|
|
portable-sql-scan:
|
|
name: Portable SQL — 可移植性 (mysql/sqlite)
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: scan server Go runtime SQL for MySQL-specific constructs
|
|
run: bash ci/scan-portable-sql.sh
|
|
|
|
# ── Job 6: Codegen Drift (支柱 2:token 单源不漂移)──────────────────────
|
|
# 重新生成 client/lib/pangolin_tokens.gen.dart,与已提交版本不一致即失败
|
|
# (改了 design/colors_and_type.css 没重生成,或手改了生成物)。
|
|
codegen-drift:
|
|
name: Codegen Drift — token 生成物未漂移
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: regenerate flutter tokens & assert no drift
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD:/repo" -w /repo \
|
|
node:20 \
|
|
bash ci/check-codegen-drift.sh
|