226 lines
9.0 KiB
YAML
226 lines
9.0 KiB
YAML
# ============================================================
|
||
# APS 构建矩阵 CI（矩阵 118 · CI 构建矩阵门禁）
|
||
# push / PR 触发：lint（ruff，基线有存量告警，informational）
|
||
# × Windows + Ubuntu 后端黄金测试（隔离 APS_KNOWLEDGE_PATH）
|
||
# × Windows + Ubuntu 前端 type+build
|
||
# × E2E（preview 生产构建 + Chromium，JMS 登录依赖外网）
|
||
# × SBOM（npm run sbom，CycloneDX 1.6）
|
||
# × node-tests（Ubuntu + Windows）：updater/sidecar/packaging-smoke（node --test，npm run test:node）
|
||
# Windows 额外：sidecar 本地冒烟 + offline install verify（产物存在时）+ Defender best-effort
|
||
# 签名等外部项不在本工作流（需签名证书，见 docs/development/e2e.md）；Defender 无 MpCmdRun 时跳过（退出码 2）
|
||
# ============================================================
|
||
name: CI
|
||
|
||
on:
|
||
push:
|
||
pull_request:
|
||
|
||
concurrency:
|
||
group: ci-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
env:
|
||
PYTHONUTF8: '1'
|
||
NODE_VERSION: '22'
|
||
PYTHON_VERSION: '3.13'
|
||
|
||
jobs:
|
||
lint:
|
||
name: lint (ruff)
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: actions/setup-python@v5
|
||
with:
|
||
python-version: ${{ env.PYTHON_VERSION }}
|
||
- name: install ruff
|
||
run: python -m pip install --upgrade pip ruff
|
||
# 基线：server/tests/scripts 存量 55 项 ruff 告警（round-41 记录）。
|
||
# 本步 informational（continue-on-error），不阻断构建；清零后改回硬门禁。
|
||
- name: ruff check（informational，不阻断）
|
||
continue-on-error: true
|
||
run: ruff check --output-format=github server/ tests/ scripts/ || true
|
||
|
||
frontend-build:
|
||
name: frontend build (tsc + vite) · ${{ matrix.os }}
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
os: [ubuntu-latest, windows-latest]
|
||
runs-on: ${{ matrix.os }}
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: actions/setup-node@v4
|
||
with:
|
||
node-version: ${{ env.NODE_VERSION }}
|
||
- name: npm ci
|
||
working-directory: apps/web
|
||
run: npm ci
|
||
- name: build（tsc -b && vite build）
|
||
working-directory: apps/web
|
||
run: npm run build
|
||
|
||
backend-tests:
|
||
name: backend golden tests · ${{ matrix.os }}
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
os: [ubuntu-latest, windows-latest]
|
||
runs-on: ${{ matrix.os }}
|
||
env:
|
||
# 隔离运行数据：绝不触碰仓库 server/data 或开发者 ~/.aps
|
||
APS_HOME: ${{ runner.temp }}/aps-ci/home
|
||
APS_DB_PATH: ${{ runner.temp }}/aps-ci/master.db
|
||
APS_KNOWLEDGE_PATH: ${{ runner.temp }}/aps-ci/knowledge
|
||
APS_APPROVAL_PATH: ${{ runner.temp }}/aps-ci/approval
|
||
APS_WORLD_PATH: ${{ runner.temp }}/aps-ci/world.json
|
||
APS_AUTH_PROVIDER: unconfigured
|
||
APS_LICENSE_PROVIDER: unconfigured
|
||
LLM_PROVIDER: ''
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: actions/setup-python@v5
|
||
with:
|
||
python-version: ${{ env.PYTHON_VERSION }}
|
||
- name: install deps
|
||
run: python -m pip install -r requirements.txt pytest pytest-asyncio
|
||
- name: golden tests（隔离 APS_KNOWLEDGE_PATH）
|
||
run: python -m pytest tests/golden -q -p no:cacheprovider
|
||
|
||
e2e:
|
||
name: frontend E2E smoke (preview + Chromium)
|
||
runs-on: ubuntu-latest
|
||
env:
|
||
E2E_MODE: preview
|
||
E2E_FRONTEND_PORT: '43117'
|
||
E2E_BASE_URL: http://localhost:43117
|
||
E2E_API_TARGET: http://127.0.0.1:8100
|
||
E2E_OUTPUT_DIR: ${{ runner.temp }}/aps-e2e-artifacts
|
||
APS_HOME: ${{ runner.temp }}/aps-e2e/home
|
||
APS_DB_PATH: ${{ runner.temp }}/aps-e2e/master.db
|
||
APS_KNOWLEDGE_PATH: ${{ runner.temp }}/aps-e2e/knowledge
|
||
APS_APPROVAL_PATH: ${{ runner.temp }}/aps-e2e/approval
|
||
APS_WORLD_PATH: ${{ runner.temp }}/aps-e2e/world.json
|
||
APS_AUTH_PROVIDER: jms
|
||
APS_AUTH_COOKIE_SECURE: '0'
|
||
APS_AUTH_TTL_SECONDS: '28800'
|
||
APS_APPROVAL_BACKEND: file
|
||
APS_CORS_ORIGINS: http://localhost:43117,http://127.0.0.1:43117
|
||
JMS_AUTH_BASE_URL: ${{ vars.APS_E2E_JMS_BASE_URL }}
|
||
JMS_AUTH_SESSION_SECRET: ${{ secrets.APS_JMS_SESSION_SECRET }}
|
||
JMS_AUTH_TIMEOUT_SECONDS: '15'
|
||
LLM_PROVIDER: ''
|
||
# 若 GitHub 运行器无法访问 JMS（外网受限），设置仓库变量 APS_E2E_SKIP_JMS=1 只跑离线访客冒烟
|
||
APS_E2E_SKIP_JMS: ${{ vars.APS_E2E_SKIP_JMS }}
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: actions/setup-node@v4
|
||
with:
|
||
node-version: ${{ env.NODE_VERSION }}
|
||
- uses: actions/setup-python@v5
|
||
with:
|
||
python-version: ${{ env.PYTHON_VERSION }}
|
||
- name: install backend deps
|
||
run: python -m pip install -r requirements.txt
|
||
- name: frontend deps
|
||
working-directory: apps/web
|
||
run: npm ci
|
||
- name: build frontend（preview 模式依赖 dist）
|
||
working-directory: apps/web
|
||
run: npm run build
|
||
- name: install chromium
|
||
working-directory: apps/web
|
||
run: npx playwright install --with-deps chromium
|
||
- name: start backend（独立端口 8100，隔离数据）
|
||
run: |
|
||
python -m uvicorn server.main:app --host 127.0.0.1 --port 8100 > /tmp/aps-e2e-backend.log 2>&1 &
|
||
for i in $(seq 1 30); do
|
||
if curl -sf http://127.0.0.1:8100/api/health > /dev/null; then break; fi
|
||
sleep 2
|
||
done
|
||
curl -sf http://127.0.0.1:8100/api/health || (echo 'backend failed to start'; tail -200 /tmp/aps-e2e-backend.log; exit 1)
|
||
- name: run E2E smoke
|
||
working-directory: apps/web
|
||
run: npx playwright test --project=chromium
|
||
- name: upload playwright artifacts
|
||
if: failure()
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: playwright-e2e-artifacts
|
||
path: ${{ runner.temp }}/aps-e2e-artifacts
|
||
if-no-files-found: ignore
|
||
|
||
sbom:
|
||
name: SBOM（CycloneDX 1.6 + SHA-256）
|
||
runs-on: ubuntu-latest
|
||
env:
|
||
PYTHONUTF8: '1'
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: actions/setup-node@v4
|
||
with:
|
||
node-version: ${{ env.NODE_VERSION }}
|
||
- uses: actions/setup-python@v5
|
||
with:
|
||
python-version: ${{ env.PYTHON_VERSION }}
|
||
- name: install uv（提供 uvx 供 sidecar-python BOM）
|
||
run: python -m pip install uv
|
||
- name: npm run sbom
|
||
run: npm run sbom
|
||
- name: verify SBOM outputs
|
||
run: |
|
||
ls -la dist/sbom/
|
||
test -s dist/sbom/web-node.cdx.json
|
||
test -s dist/sbom/desktop-node.cdx.json
|
||
test -s dist/sbom/sidecar-python.cdx.json
|
||
test -s dist/sbom/release-manifest.json
|
||
|
||
node-tests:
|
||
name: node tests（updater/sidecar/packaging-smoke + Win 冒烟）· ${{ matrix.os }}
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
os: [ubuntu-latest, windows-latest]
|
||
runs-on: ${{ matrix.os }}
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: actions/setup-node@v4
|
||
with:
|
||
node-version: ${{ env.NODE_VERSION }}
|
||
# 根目录 npm run test:node = node --test apps/desktop/test/*.test.cjs + tests/node/packaging-smoke.test.mjs
|
||
# （updater 22 项 + sidecar 7 项 + packaging-smoke 12 项），纯 node 内置模块，无需 npm install
|
||
- name: node --test（updater + sidecar + packaging-smoke）
|
||
run: npm run test:node
|
||
# Windows 额外门禁：sidecar 本地冒烟（server/sidecar.py 纯 stdlib，~72s）
|
||
- name: setup python（sidecar 冒烟用）
|
||
if: runner.os == 'Windows'
|
||
uses: actions/setup-python@v5
|
||
with:
|
||
python-version: ${{ env.PYTHON_VERSION }}
|
||
- name: sidecar 本地冒烟（20 冷启动/端口冲突/崩溃重启/中文路径）
|
||
if: runner.os == 'Windows'
|
||
run: node scripts/smoke-sidecar-local.mjs
|
||
# offline install verify：本 job 不构建安装包，产物存在时才校验；缺失则跳过
|
||
- name: offline install verify（产物存在时）
|
||
if: runner.os == 'Windows'
|
||
shell: pwsh
|
||
run: |
|
||
if (Test-Path "build/offline-check/offline-install-manifest.json") {
|
||
node scripts/offline-install-check.mjs --verify
|
||
} else {
|
||
Write-Host "offline manifest 不存在（本 job 不构建安装包）— 跳过 verify"
|
||
}
|
||
# Defender 扫描 best-effort：无 MpCmdRun（退出码 2）或无可扫描产物（退出码 3）视为跳过；
|
||
# 检出威胁/扫描失败（退出码 1）才阻断。产物由桌面构建流程生成，本 job 通常跳过。
|
||
- name: Defender 扫描（best-effort，退出码 2/3 跳过）
|
||
if: runner.os == 'Windows'
|
||
shell: pwsh
|
||
run: |
|
||
node scripts/defender-scan.mjs
|
||
$code = $LASTEXITCODE
|
||
if ($code -eq 0) { Write-Host "Defender: PASS"; exit 0 }
|
||
if ($code -eq 2) { Write-Host "Defender: SKIP（MpCmdRun 不可用）"; exit 0 }
|
||
if ($code -eq 3) { Write-Host "Defender: SKIP（无可扫描产物）"; exit 0 }
|
||
Write-Host "Defender: FAIL（exit $code）"
|
||
exit $code
|