ci: 加固生产质量门禁 #5

Merged

chengcheng merged 14 commits from codex/production-cicd into main 2026-07-17 17:32:09 +08:00

Conversation 0 Commits 14 Files Changed 23 +3161 -842

chengcheng commented 2026-07-17 14:24:23 +08:00

Owner

Copy Link

增加隔离的 rootless DinD 质量流水线、独立的 Tag 状态上下文、固定工具链以及生产 CD 信任边界文档。本 PR 用于真实 CI/CD 验证。

增加隔离的 rootless DinD 质量流水线、独立的 Tag 状态上下文、固定工具链以及生产 CD 信任边界文档。本 PR 用于真实 CI/CD 验证。

chengcheng added 4 commits 2026-07-17 14:24:26 +08:00

fix(build): 修复前端依赖安全门禁 ... af13a0444e

同步缺失的 Vitest 锁文件，并将 Vitest、Vite 及受影响的传递依赖限制到已修复版本，避免严格 frozen install 和高危依赖审计阻塞 CI。\n\n验证：pnpm frozen install、lint、26 个前端测试、Go 测试、生产构建及 high 级依赖审计通过。

ci: 建立生产镜像与 Tag 发布流水线 ... 745811cc6d

新增独立仓库级 Gitea Runner，main 和 PR 执行完整质量门禁与不可变 SHA 镜像构建；只有来自 main 历史的语义版本 Tag 才调用受限生产发布助手。专属 Buildx builder 将缓存限制为 2 GB。\n\n验证：流水线结构测试、ShellCheck、Go vet/test、govulncheck、前端 lint/test/build、Compose 渲染及高危依赖审计通过。

docs(ci): 记录生产流水线决策与运行手册 ... db85487b73

固化 Tag 发布策略、Runner 信任边界、Secret 位置、数据库回滚限制，以及 Runner 安装、发布、验证和故障恢复步骤。

ci: harden production quality gates 91ea0e6a2d

chengcheng added 1 commit 2026-07-17 14:43:47 +08:00

fix(ci): expose pinned node during runner setup 6ba46514c1

chengcheng added 1 commit 2026-07-17 14:50:59 +08:00

fix(ci): support digest-verified runner mirrors 1f8c5a3d03

chengcheng added 1 commit 2026-07-17 15:09:23 +08:00

ci: validate runner before registration 06f95c5d86

chengcheng added 1 commit 2026-07-17 15:16:16 +08:00

fix(ci): verify rootless pid namespace without proc links 5e8fb4276f

chengcheng added 2 commits 2026-07-17 15:32:04 +08:00

security(ci): bound runner resources e77ec9e842

security(api): upgrade vulnerable crypto dependency c67726ca6b

chengcheng added 1 commit 2026-07-17 15:54:47 +08:00

fix(ci): use reachable vulnerability database mirror a6e95be0c5

chengcheng added 2 commits 2026-07-17 17:01:25 +08:00

Merge remote-tracking branch 'origin/main' into codex/production-cicd ... 74c20b1976

# Conflicts:
#	pnpm-lock.yaml

ci: enforce production-safe database migrations f226f9c953

chengcheng added 1 commit 2026-07-17 17:04:23 +08:00

fix(ci): reject procedural migration bodies 86509d5c43

chengcheng merged commit b638bfaa4b into main 2026-07-17 17:32:09 +08:00

chengcheng referenced this issue from a commit 2026-07-17 17:32:10 +08:00

Merge pull request 'ci: harden production quality gates' (#5)

chengcheng changed title from ci: harden production quality gates to ci: 加固生产质量门禁 2026-07-17 18:14:19 +08:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No Label

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: BCAI/easyai-ai-gateway#5

No description provided.