chengcheng
0aa9b3e88f
ci / verify (pull_request) Successful in 11m30s
将 PostgreSQL 16 改为固定 digest 的 Actions service container，并通过专用 Job 网络向 Go migrator 和集成测试提供数据库。 移除 PR Job 对 Docker CLI 的依赖，继续禁止宿主及内层 Docker API 暴露；同步发布工作流、契约测试和镜像代理恢复说明。
115 lines
4.4 KiB
YAML
115 lines
4.4 KiB
YAML
name: release-ci
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
jobs:
|
|
verify-tag:
|
|
runs-on: easyai-gateway-ci-unprivileged-v2
|
|
services:
|
|
postgres:
|
|
image: docker.io/library/postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
|
|
env:
|
|
POSTGRES_USER: easyai_test
|
|
POSTGRES_HOST_AUTH_METHOD: trust
|
|
POSTGRES_DB: easyai_gateway_test
|
|
options: >-
|
|
--health-cmd "pg_isready -U easyai_test -d easyai_gateway_test"
|
|
--health-interval 2s
|
|
--health-timeout 5s
|
|
--health-retries 30
|
|
env:
|
|
TRIVY_DB_REPOSITORY: ghcr.m.daocloud.io/aquasecurity/trivy-db:2
|
|
AI_GATEWAY_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
|
|
AI_GATEWAY_TEST_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
|
|
steps:
|
|
- name: Checkout without external Actions
|
|
env:
|
|
CI_REPOSITORY: ${{ github.repository }}
|
|
CI_SERVER_URL: ${{ github.server_url }}
|
|
CI_SHA: ${{ github.sha }}
|
|
CI_JOB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -eu
|
|
test -n "$CI_JOB_TOKEN"
|
|
authorization=$(printf 'x-access-token:%s' "$CI_JOB_TOKEN" | base64 | tr -d '\n')
|
|
git init .
|
|
git -c "http.extraHeader=AUTHORIZATION: basic $authorization" \
|
|
fetch --no-tags "$CI_SERVER_URL/$CI_REPOSITORY.git" "$CI_SHA"
|
|
unset authorization CI_JOB_TOKEN
|
|
test ! -f .git/shallow
|
|
git checkout --detach FETCH_HEAD
|
|
- name: Verify pinned host toolchains
|
|
run: |
|
|
go version
|
|
node --version
|
|
pnpm --version
|
|
docker-compose version
|
|
shellcheck --version
|
|
trivy --version
|
|
govulncheck -version
|
|
- name: Verify release tag ancestry
|
|
env:
|
|
CI_REPOSITORY: ${{ github.repository }}
|
|
CI_SERVER_URL: ${{ github.server_url }}
|
|
CI_SHA: ${{ github.sha }}
|
|
CI_JOB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -eu
|
|
tag_name=${GITHUB_REF#refs/tags/}
|
|
./scripts/ci-validate-semver.sh "$tag_name"
|
|
authorization=$(printf 'x-access-token:%s' "$CI_JOB_TOKEN" | base64 | tr -d '\n')
|
|
git -c "http.extraHeader=AUTHORIZATION: basic $authorization" \
|
|
fetch --no-tags "$CI_SERVER_URL/$CI_REPOSITORY.git" \
|
|
+refs/heads/main:refs/remotes/origin/main
|
|
unset authorization CI_JOB_TOKEN
|
|
test ! -f .git/shallow
|
|
test "$(git rev-parse HEAD)" = "$CI_SHA"
|
|
git merge-base --is-ancestor "$CI_SHA" refs/remotes/origin/main
|
|
- name: Verify production migration safety
|
|
run: |
|
|
production_base=$(cat deploy/ci/production-migration-base)
|
|
node ./scripts/ci-validate-migrations.mjs "$production_base"
|
|
- name: Verify Go formatting
|
|
run: |
|
|
unformatted=$(gofmt -l apps/api)
|
|
test -z "$unformatted" || {
|
|
printf 'Go files require gofmt:\n%s\n' "$unformatted" >&2
|
|
exit 1
|
|
}
|
|
- name: Migrate PostgreSQL 16 integration database
|
|
working-directory: apps/api
|
|
run: go run ./cmd/migrate
|
|
- name: Verify Go code
|
|
working-directory: apps/api
|
|
env:
|
|
GOFLAGS: "-p=1"
|
|
GOMAXPROCS: "1"
|
|
run: |
|
|
go vet ./...
|
|
go test ./...
|
|
govulncheck ./...
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm lint
|
|
- run: pnpm test
|
|
- run: pnpm build
|
|
- name: Audit JavaScript dependencies
|
|
run: pnpm audit --audit-level high
|
|
- name: Validate deployment configuration
|
|
run: |
|
|
docker-compose -f docker-compose.yml config --quiet
|
|
shellcheck scripts/ci-build-images.sh scripts/ci-validate-semver.sh \
|
|
scripts/provision-ci-runner.sh tests/ci/ci-build-images-test.sh \
|
|
tests/ci/migrations-test.sh tests/ci/pipeline-test.sh \
|
|
tests/ci/semver-test.sh
|
|
./tests/ci/ci-build-images-test.sh
|
|
./tests/ci/migrations-test.sh
|
|
./tests/ci/pipeline-test.sh
|
|
./tests/ci/semver-test.sh
|
|
- name: Scan repository
|
|
run: |
|
|
trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL \
|
|
--ignore-unfixed --exit-code 1 --timeout 15m --skip-dirs .git \
|
|
--skip-dirs node_modules .
|