chengcheng
745811cc6d
新增独立仓库级 Gitea Runner，main 和 PR 执行完整质量门禁与不可变 SHA 镜像构建；只有来自 main 历史的语义版本 Tag 才调用受限生产发布助手。专属 Buildx builder 将缓存限制为 2 GB。\n\n验证：流水线结构测试、ShellCheck、Go vet/test、govulncheck、前端 lint/test/build、Compose 渲染及高危依赖审计通过。
78 lines
3.1 KiB
Bash
Executable File
78 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# shellcheck disable=SC2016 # Assertions intentionally match literal workflow variables.
|
|
set -euo pipefail
|
|
|
|
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
|
|
workflow=$root/.gitea/workflows/ci.yml
|
|
runner_service=$root/deploy/ci/easyai-gateway-act-runner.service
|
|
runner_config=$root/deploy/ci/act-runner-config.yaml
|
|
provision=$root/scripts/provision-ci-runner.sh
|
|
build_images=$root/scripts/ci-build-images.sh
|
|
|
|
for file in "$workflow" "$runner_service" "$runner_config" "$provision" "$build_images"; do
|
|
[[ -f $file ]] || {
|
|
printf 'missing CI/CD file: %s\n' "$file" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
grep -q '^name: ci$' "$workflow"
|
|
grep -q '^ branches: \[main\]$' "$workflow"
|
|
grep -q "^ tags: \['v\*'\]$" "$workflow"
|
|
grep -q '^ pull_request:$' "$workflow"
|
|
grep -q '^ runs-on: easyai-gateway-linux$' "$workflow"
|
|
grep -q '^ - name: Checkout without external Actions$' "$workflow"
|
|
grep -q '^ - name: Verify release tag ancestry$' "$workflow"
|
|
grep -Fq "if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')" "$workflow"
|
|
grep -Fq 'git merge-base --is-ancestor "$CI_SHA" refs/remotes/origin/main' "$workflow"
|
|
grep -q '^ - run: ./scripts/ci-build-images.sh$' "$workflow"
|
|
grep -q '^ - name: Deploy verified release to Production$' "$workflow"
|
|
grep -q '^ sudo -n /usr/local/sbin/easyai-ai-gateway-release "$CI_SHA"$' "$workflow"
|
|
|
|
for gate in \
|
|
'gofmt -l' \
|
|
'go vet ./...' \
|
|
'go test ./...' \
|
|
'pnpm install --frozen-lockfile' \
|
|
'pnpm lint' \
|
|
'pnpm test' \
|
|
'pnpm build' \
|
|
'docker compose -f docker-compose.yml config --quiet' \
|
|
'govulncheck ./...' \
|
|
'trivy fs'; do
|
|
grep -Fq "$gate" "$workflow" || {
|
|
printf 'workflow is missing quality gate: %s\n' "$gate" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
grep -q '^User=easyai-gateway-runner$' "$runner_service"
|
|
grep -q '^Group=easyai-gateway-runner$' "$runner_service"
|
|
grep -q '^NoNewPrivileges=false$' "$runner_service"
|
|
grep -q '^ProtectSystem=strict$' "$runner_service"
|
|
grep -q '^ProtectHome=true$' "$runner_service"
|
|
grep -q '^ReadWritePaths=/var/lib/easyai-gateway-runner$' "$runner_service"
|
|
grep -q '^ExecStart=/opt/easyai-gateway-ci/bin/gitea-runner --config /etc/easyai-gateway-runner/config.yaml daemon --once$' "$runner_service"
|
|
grep -q 'easyai-gateway-linux:host' "$runner_config"
|
|
grep -q '^ capacity: 1$' "$runner_config"
|
|
|
|
grep -q '^GITEA_RUNNER_VERSION=2.0.0$' "$provision"
|
|
grep -q '^GO_VERSION=1.26.5$' "$provision"
|
|
grep -q '^NODE_VERSION=24.16.0$' "$provision"
|
|
grep -q '^TRIVY_VERSION=0.70.0$' "$provision"
|
|
grep -Fq 'usermod -aG docker "$RUNNER_USER"' "$provision"
|
|
grep -Fq 'RUNNER_REGISTRATION_TOKEN is required for first registration' "$provision"
|
|
|
|
grep -Fq 'docker buildx build --builder "$builder"' "$build_images"
|
|
grep -q -- '--target api' "$build_images"
|
|
grep -q -- '--target web' "$build_images"
|
|
grep -Fq 'docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit"' "$build_images"
|
|
grep -Fq 'trivy image' "$build_images"
|
|
|
|
if rg -n '(password|secret|token):[[:space:]]+[^$<{]' "$workflow"; then
|
|
echo 'workflow contains a literal credential' >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo 'gateway_ci_pipeline_tests=PASS'
|