wangjia
c92cd11cc5
新增 .gitea/workflows/ci.yml 五个 Job：
1. lint — shellcheck -S warning 扫描全部 deploy/ shell 脚本
2. unit-test — docker-compose config 语法校验 + nginx -t（桩证书）
3. openapi-check — openapi-spec-validator 验证 design/server/openapi.yaml
4. redline-scan — ci/scan-redline.sh 扫描 UI 文案红线词（design/ jsx/dart/html）
5. image-build — docker build pangolin-edge:ci
附带：
- ci/scan-redline.sh：脱敏扫描脚本，过滤注释行与外部渠道 handle
- ci/nginx-test.sh：自签桩证书 + nginx -t，CI 免依赖真实 Let's Encrypt
- design/server/openapi.yaml：依据 ARCHITECTURE.md §3 展开的 OAS 3.0 完整契约
- dparts.jsx / parts.jsx：修复 killSwitchSub EN 文案「the VPN drops」红线词
→ 改为「connection drops」（行为描述，不提产品类别）
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
97 lines
3.3 KiB
YAML
97 lines
3.3 KiB
YAML
name: ci-pangolin
|
|
|
|
# 触发条件:deploy/ 或 design/ 或 ci/ 变更时，以及所有向 main 的 PR
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'deploy/**'
|
|
- 'design/**'
|
|
- 'ci/**'
|
|
- '.gitea/workflows/ci.yml'
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
|
|
# ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
|
|
lint:
|
|
name: Lint — shellcheck
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: shellcheck deploy/scripts/*.sh
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/deploy:/mnt/deploy:ro" \
|
|
koalaman/shellcheck:stable \
|
|
shellcheck -S warning \
|
|
/mnt/deploy/scripts/gen-secrets.sh \
|
|
/mnt/deploy/scripts/print-clients.sh \
|
|
/mnt/deploy/scripts/deploy.sh \
|
|
/mnt/deploy/scripts/cutover.sh \
|
|
/mnt/deploy/scripts/rollback.sh
|
|
|
|
- name: shellcheck deploy/edge/pangolin-entrypoint.sh
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/deploy/edge:/mnt/edge:ro" \
|
|
koalaman/shellcheck:stable \
|
|
shellcheck -S warning /mnt/edge/pangolin-entrypoint.sh
|
|
|
|
# ── Job 2: Unit Tests ────────────────────────────────────────────────────
|
|
unit-test:
|
|
name: Unit Tests — nginx cfg + compose
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: validate docker-compose.yml (syntax)
|
|
run: docker-compose -f deploy/docker-compose.yml config -q
|
|
|
|
- name: nginx config lint with stub certs
|
|
run: bash ci/nginx-test.sh
|
|
|
|
# ── Job 3: OpenAPI Sync Check ────────────────────────────────────────────
|
|
openapi-check:
|
|
name: OpenAPI Sync Check
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# openapi-spec-validator 是纯 Python、无外部依赖，校验 OAS 3.0 结构合法性。
|
|
- name: lint design/server/openapi.yaml
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD/design/server:/spec:ro" \
|
|
python:3.12-alpine \
|
|
sh -c "pip install openapi-spec-validator --quiet && \
|
|
python -m openapi_spec_validator /spec/openapi.yaml"
|
|
|
|
# ── Job 4: Redline Word Scan (脱敏) ──────────────────────────────────────
|
|
redline-scan:
|
|
name: Redline Scan — 脱敏 (UI 文案)
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: scan UI text resources for prohibited words
|
|
run: bash ci/scan-redline.sh
|
|
|
|
# ── Job 5: Container Image Build ────────────────────────────────────────
|
|
image-build:
|
|
name: Image Build — pangolin-edge
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: build pangolin-edge:ci
|
|
run: docker build -t pangolin-edge:ci ./deploy/edge
|