ci: 接入提交规范闸门与自动编译流水线(本机Runner+微信通知+网页预览)

2026-09-28 18:25:50 +08:00
parent 2190c5202d
commit 0749a80106
5 changed files with 342 additions and 90 deletions
@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+"""提交信息规范校验（CI 侧权威闸门）。
+
+规则与本机 ~/.githooks/commit-msg 完全一致，防止 --no-verify 绕过。
+放行：Merge / Revert " / fixup! / squash! / amend! 开头的自动生成提交。
+"""
+import json
+import os
+import re
+import subprocess
+import sys
+
+TYPES = "feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert"
+RE = re.compile(r"^(?:" + TYPES + r")(?:\([a-zA-Z0-9._/-]+\))?!?: .{3,}$")
+ALLOW = re.compile(r'^(?:Merge |Revert "|fixup! |squash! |amend! )')
+
+HELP = """
+\u274c 提交信息不合规，已拦截。
+
+   规范   : <类型>(<范围>): <简短描述>
+   类型   : feat 新功能 | fix 修缺陷 | docs 文档 | style 格式(不改逻辑)
+            refactor 重构 | perf 性能 | test 测试 | build 构建/依赖
+            ci CI 配置 | chore 杂务 | revert 回滚
+   示例   : feat(asset): 新增按歌曲生成应援序列
+            fix(parser): 修复表格解析越界导致的 500
+            docs: 补充 OSS 短签名接口说明
+
+   要点   : 类型小写、冒号后一个空格、描述 \u22653 字符
+            标题 \u226472 字符、结尾不加句号
+            破坏性变更类型后加 !，正文写 BREAKING CHANGE:
+   详见   : docs/提交规范.md
+"""
+
+
+def collect():
+    """优先用 Gitea 事件负载里的本次推送提交，取不到则退回 git log。"""
+    msgs = []
+    ev = os.environ.get("GITHUB_EVENT_PATH") or ""
+    if ev and os.path.exists(ev):
+        try:
+            with open(ev, encoding="utf-8") as fh:
+                d = json.load(fh)
+            for c in (d.get("commits") or []):
+                m = (c.get("message") or "").strip()
+                if m:
+                    msgs.append(m)
+        except Exception as e:
+            print("  事件负载解析失败(%s)，回退到 git log" % e)
+    if not msgs:
+        out = subprocess.run(["git", "log", "-n", "5", "--format=%B%x00"],
+                             capture_output=True, text=True).stdout
+        msgs = [x.strip() for x in out.split("\x00") if x.strip()]
+    return msgs
+
+
+def subject_of(m):
+    for line in m.splitlines():
+        s = line.strip()
+        if not s or s.startswith("#"):
+            continue
+        return s
+    return ""
+
+
+def judge(subj):
+    if not subj:
+        return "空提交信息"
+    if ALLOW.match(subj):
+        return ""
+    if len(subj) > 72:
+        return "标题 %d 字符 > 72" % len(subj)
+    if not RE.match(subj):
+        return "不符合 <类型>(<范围>): <描述>"
+    if subj.endswith(".") or subj.endswith("\u3002"):
+        return "标题结尾不要加句号"
+    return ""
+
+
+def main():
+    msgs = collect()
+    bad = []
+    print("待校验提交 %d 条：" % len(msgs))
+    for m in msgs:
+        subj = subject_of(m)
+        why = judge(subj)
+        if why:
+            bad.append((subj, why))
+            print("  \u274c [%s] %s" % (why, subj))
+        else:
+            print("  \u2705 %s" % subj)
+    try:
+        with open("/tmp/ci-gate-status", "w") as fh:
+            fh.write("failure" if bad else "success")
+    except Exception:
+        pass
+    if bad:
+        print(HELP)
+        return 1
+    print("\u2705 提交信息全部合规")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""把 CI 结果上报给主机侧 ci-bridge（bridge 负责落报告页 + 推微信）。"""
+import json
+import os
+import subprocess
+import urllib.request
+
+
+def rd(path, default=""):
+    try:
+        with open(path, encoding="utf-8") as fh:
+            return fh.read().strip()
+    except Exception:
+        return default
+
+
+def git(*args):
+    try:
+        return subprocess.run(["git"] + list(args), capture_output=True,
+                              text=True).stdout.strip()
+    except Exception:
+        return ""
+
+
+def main():
+    repo = os.environ.get("GITHUB_REPOSITORY", "unknown/unknown")
+    sha = rd("/tmp/ci-sha") or git("rev-parse", "HEAD")
+    branch = os.environ.get("GITHUB_REF_NAME") or \
+        os.environ.get("GITHUB_REF", "").replace("refs/heads/", "")
+    gate = rd("/tmp/ci-gate-status", "skipped")
+    build = rd("/tmp/ci-build-status", "failure")
+    status = "success" if (gate == "success" and build == "success") else "failure"
+
+    log = rd("/tmp/ci-build-tail")
+    if gate != "success":
+        log = "提交信息规范校验未通过\n" + log
+
+    try:
+        count = int(rd("/tmp/ci-commits-count", "1") or 1)
+    except Exception:
+        count = 1
+
+    rep = {
+        "repo": repo,
+        "sha": sha,
+        "branch": branch,
+        "actor": os.environ.get("GITHUB_ACTOR", ""),
+        "status": status,
+        "commit_subject": git("log", "-1", "--format=%s"),
+        "commit_count": count,
+        "duration_s": rd("/tmp/ci-duration", "?"),
+        "preview_url": rd("/tmp/ci-preview-url"),
+        "log": log[-3500:],
+        "steps": [
+            {"name": "提交信息规范校验", "status": gate},
+            {"name": "编译与自检", "status": build},
+        ],
+    }
+    if rep["preview_url"]:
+        print("\U0001F310 网页预览: %s" % rep["preview_url"])
+    print("结果: %s | 构建: %s | 提交闸门: %s | 耗时: %ss"
+          % (status, build, gate, rep["duration_s"]))
+
+    base = os.environ.get("CI_BRIDGE_RESOLVED", "").rstrip("/")
+    if not base:
+        print("跳过上报：未找到可达的 ci-bridge")
+        return 0
+    data = json.dumps(rep, ensure_ascii=False).encode("utf-8")
+    req = urllib.request.Request(
+        base + "/api/ci/report", data=data, method="POST",
+        headers={"Content-Type": "application/json",
+                 "X-CI-Token": os.environ.get("BRIDGE_TOKEN", "")})
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            print("\u2705 已上报 ci-bridge:", resp.read().decode()[:300])
+    except Exception as e:
+        print("\u274c 上报 ci-bridge 失败:", e)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,156 @@
+name: build
+
+# 提交 -> 本机 Runner 编译 -> 微信通知 + 网页预览
+# 实测结论（勿随意改动）:
+#  1. 不用任何第三方 action（作业容器不联网拉 action，全用镜像自带工具）
+#  2. 必须自己 clone —— Runner 不会自动检出代码，工作区初始为空
+#  3. act 以 `bash -e -o pipefail` 执行每步 -> 禁止 `cmd | head` 这种会 SIGPIPE 提前退出的管道
+#  4. 工具链来自主机只读挂载 /opt/citools（go/uv），缓存写 /opt/citools-cache
+#  5. bridge 从容器内走 docker 网关 172.17.0.1:8899（实测可达）
+#  6. 校验/上报逻辑放在 .gitea/scripts/ 下的脚本里，YAML 只负责调用（避免 YAML 里嵌深缩进代码）
+on:
+  push:
+    branches:
+      - "**"
+  workflow_dispatch:
+
+env:
+  BRIDGE_URL: ${{ vars.CI_BRIDGE_URL }}
+  BRIDGE_TOKEN: ${{ secrets.CI_BRIDGE_TOKEN }}
+  GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - name: 检出代码
+        run: |
+          set -uo pipefail
+          SRV="${GITHUB_SERVER_URL:-http://192.168.50.223:3000}"
+          HP="${SRV#*://}"
+          BR="${GITHUB_REF_NAME:-${GITHUB_REF#refs/heads/}}"
+          cd "${GITHUB_WORKSPACE:-$(pwd)}"
+          rm -rf ./* .git 2>/dev/null || true
+          git init -q .
+          git remote add origin "http://x-access-token:${GIT_TOKEN}@${HP}/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 50 origin "$BR"
+          git checkout -q -B "$BR" FETCH_HEAD
+          git rev-parse HEAD > /tmp/ci-sha
+          date +%s > /tmp/ci-start
+          : > /tmp/ci-preview-url
+          echo skipped > /tmp/ci-build-status
+          git rev-list --count FETCH_HEAD > /tmp/ci-commits-count 2>/dev/null || echo 1 > /tmp/ci-commits-count
+          echo "已检出 ${GITHUB_REPOSITORY} 分支 ${BR}"
+          git log -1 --format='   %h  %an  %s'
+
+      - name: 提交信息规范校验
+        run: python3 .gitea/scripts/ci_gate.py
+
+      - name: 编译与自检
+        run: |
+          set +e; set +o pipefail
+          LOG=/tmp/ci-build.log; : > "$LOG"
+          run()  { echo "-- $* --"; "$@" 2>&1 | tee -a "$LOG"; return "${PIPESTATUS[0]}"; }
+          runin(){ local d="$1"; shift; echo "-- ($d) $* --"; ( cd "$d" && "$@" ) 2>&1 | tee -a "$LOG"; return "${PIPESTATUS[0]}"; }
+
+          export PATH=/opt/citools/go/bin:/opt/citools/bin:$PATH
+          export GOCACHE=/opt/citools-cache/gocache GOMODCACHE=/opt/citools-cache/gomod UV_CACHE_DIR=/opt/citools-cache/uv
+          export GOPROXY=https://goproxy.cn,direct GOTOOLCHAIN=local GOFLAGS=-mod=mod GOPATH=/opt/citools-cache/gopath
+          mkdir -p "$GOCACHE" "$GOMODCACHE" "$UV_CACHE_DIR" "$GOPATH" 2>/dev/null
+
+          echo "工具链: $(go version 2>&1) | $(uv --version 2>&1) | $(node -v 2>&1) | $(python3 -V 2>&1)"
+          fail=0; ran=""
+
+          if [ -f go.mod ]; then
+            ran="$ran go"
+            run go build ./... || fail=1
+            run go vet ./...   || fail=1
+            run go test ./...  || fail=1
+          fi
+
+          if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f setup.py ]; then
+            ran="$ran python"
+            if grep -qE '^check:' Makefile 2>/dev/null; then
+              run make UV=uv check || fail=1
+            else
+              run uv sync || fail=1
+              run uv run pytest -q || fail=1
+            fi
+          fi
+
+          WEBPKG=""
+          for p in package.json web/package.json frontend/package.json ui/package.json; do
+            if [ -f "$p" ]; then WEBPKG="$p"; break; fi
+          done
+          if [ -n "$WEBPKG" ]; then
+            ran="$ran node"
+            D="$(dirname "$WEBPKG")"
+            if [ -f "$D/package-lock.json" ]; then
+              runin "$D" npm ci || fail=1
+            else
+              runin "$D" npm install || fail=1
+            fi
+            if grep -q '"build"[[:space:]]*:' "$WEBPKG" 2>/dev/null; then
+              runin "$D" npm run build || fail=1
+            fi
+          fi
+
+          if [ -z "$ran" ] && [ -f Makefile ]; then
+            ran="$ran make"
+            run make || fail=1
+          fi
+          if [ -z "$ran" ]; then
+            echo "未识别到构建入口（go.mod / pyproject.toml / package.json / Makefile 都没有），跳过编译"
+          fi
+
+          if [ "$fail" -eq 0 ]; then echo success > /tmp/ci-build-status; else echo failure > /tmp/ci-build-status; fi
+          tail -c 4000 "$LOG" > /tmp/ci-build-tail
+          echo "构建结果: $(cat /tmp/ci-build-status)（识别:$ran）"
+          [ "$fail" -eq 0 ] || exit 1
+
+      - name: 发布网页预览
+        if: always()
+        run: |
+          set +e; set +o pipefail
+          : > /tmp/ci-preview-url
+          if [ "$(cat /tmp/ci-build-status 2>/dev/null)" != "success" ]; then
+            echo "构建未成功，跳过预览发布"; exit 0
+          fi
+          WEB=""
+          for d in web/dist dist build out public web/build frontend/dist; do
+            if [ -f "$d/index.html" ]; then WEB="$d"; break; fi
+          done
+          if [ -z "$WEB" ]; then echo "未发现静态网页产物目录，跳过预览发布"; exit 0; fi
+          tar -czf /tmp/ci-web.tgz -C "$WEB" . || { echo "打包失败"; exit 0; }
+          B="${BRIDGE_URL:-}"
+          for cand in "$B" "http://172.17.0.1:8899" "http://192.168.50.134:8899" "http://100.92.49.78:8899"; do
+            if [ -n "$cand" ]; then
+              curl -s -m 5 -o /dev/null "$cand/healthz" && { B="$cand"; break; }
+            fi
+          done
+          SHA="$(cat /tmp/ci-sha)"
+          echo "发布预览到 $B（产物目录 $WEB）"
+          curl -sS -m 90 -X POST "$B/api/ci/publish?repo=${GITHUB_REPOSITORY}&sha=${SHA}" -H "X-CI-Token: ${BRIDGE_TOKEN}" -H 'Content-Type: application/gzip' --data-binary @/tmp/ci-web.tgz -o /tmp/ci-pub.json
+          cat /tmp/ci-pub.json; echo
+          URL="$(python3 -c "import json;print(json.load(open('/tmp/ci-pub.json')).get('url',''))" 2>/dev/null)"
+          if [ -n "$URL" ]; then echo "$URL" > /tmp/ci-preview-url; echo "网页预览: $URL"; fi
+
+      - name: 通知微信
+        if: always()
+        run: |
+          set +e; set +o pipefail
+          B="${BRIDGE_URL:-}"
+          for cand in "$B" "http://172.17.0.1:8899" "http://192.168.50.134:8899" "http://100.92.49.78:8899"; do
+            if [ -n "$cand" ]; then
+              curl -s -m 5 -o /dev/null "$cand/healthz" && { B="$cand"; break; }
+            fi
+          done
+          echo "使用 ci-bridge: $B"
+          S=$(date +%s); T=$(cat /tmp/ci-start 2>/dev/null); [ -n "$T" ] || T=$S
+          echo $((S - T)) > /tmp/ci-duration
+          CI_BRIDGE_RESOLVED="$B" python3 .gitea/scripts/ci_report.py
@@ -1,38 +0,0 @@
-name: diag
-# 临时诊断 workflow：摸清作业容器环境，跑通后删除
-on:
-  push:
-  workflow_dispatch:
-
-jobs:
-  diag:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 环境自检
-        run: |
-          echo "=== whoami / uid ==="; id
-          echo "=== pwd ==="; pwd
-          echo "=== 当前目录 ==="; ls -a
-          echo "=== /workspace ==="; ls -a /workspace 2>/dev/null || echo "(无 /workspace)"
-          echo "=== 环境变量名 ==="; env | cut -d= -f1 | sort | tr '\n' ' '; echo
-          echo "=== Gitea 上下文 ==="
-          echo "repo=$GITHUB_REPOSITORY ref=$GITHUB_REF_NAME sha=$GITHUB_SHA"
-          echo "server=$GITHUB_SERVER_URL event=$GITHUB_EVENT_NAME actor=$GITHUB_ACTOR"
-          echo "before=$GITHUB_EVENT_BEFORE"
-          if [ -n "${GITHUB_TOKEN:-}" ]; then echo "GITHUB_TOKEN 注入=YES len=${#GITHUB_TOKEN}"; else echo "GITHUB_TOKEN 注入=NO"; fi
-          echo "=== 工具 ==="
-          for t in git curl python3 pip node npm go uv make docker jq; do printf "%-8s " "$t"; command -v "$t" || echo "(缺失)"; done
-          echo "=== 版本 ==="; git --version; python3 -V || true; node -v 2>/dev/null || true; go version 2>/dev/null || true; uv --version 2>/dev/null || true
-          echo "=== 是否已是 git 仓库 ==="
-          git rev-parse --is-inside-work-tree 2>&1 || true
-          git log --oneline -3 2>&1 || true
-          echo "=== 默认路由 ==="; ip route 2>/dev/null | head -5 || true
-          echo "=== 到 ci-bridge 连通性 ==="
-          for c in "http://172.17.0.1:8899" "http://$(ip route show default 2>/dev/null | awk '{print $3; exit}'):8899" "http://192.168.50.134:8899"; do
-            printf "%-34s -> " "$c"
-            curl -s -m 4 "$c/healthz" | head -c 110
-            echo
-          done
-          echo "=== 到 Gitea 服务端连通性 ==="
-          curl -s -o /dev/null -w "gitea http=%{http_code}\n" -m 6 "$GITHUB_SERVER_URL/api/v1/version" || echo "(fail)"
-          echo "=== 诊断结束 ==="
@@ -1,52 +0,0 @@
-name: diag2
-# 临时诊断 v2：网络出口 / GITHUB_TOKEN / clone 可行性 / 工具链可安装性
-# 注意: act 以 bash -e -o pipefail 执行每步，故全程禁用会提前退出的管道
-on:
-  push:
-  workflow_dispatch:
-
-jobs:
-  diag2:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 网络与令牌自检
-        env:
-          GT: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set +e
-          echo "=== GITHUB_TOKEN(secrets 上下文) ==="
-          if [ -n "${GT}" ]; then echo "  已注入 len=${#GT}"; else echo "  未注入"; fi
-
-          echo "=== 外网出口 ==="
-          for u in https://pypi.org/simple/ https://go.dev/dl/ https://registry.npmjs.org/ https://goproxy.cn/ https://github.com/ http://192.168.50.223:3000/; do
-            c=$(curl -s -o /dev/null -m 8 -w '%{http_code}' "$u")
-            echo "  $u -> ${c:-ERR}"
-          done
-
-          echo "=== DNS ==="
-          getent hosts go.dev || echo "  go.dev 解析失败"
-          getent hosts goproxy.cn || echo "  goproxy.cn 解析失败"
-
-          echo "=== 基础镜像里有没有 ip/ss ==="
-          command -v ip || echo "  ip 缺失"
-          command -v ss || echo "  ss 缺失"
-
-          echo "=== docker.sock 是否挂进容器 ==="
-          ls -la /var/run/docker.sock 2>&1 || echo "  无 docker.sock"
-          docker ps 2>&1 | head -n 3 || true
-
-          echo "=== 尝试用 GITHUB_TOKEN 手动 clone ==="
-          mkdir -p /tmp/ck && cd /tmp/ck
-          if [ -n "${GT}" ]; then
-            git clone --quiet --depth 1 "http://x-access-token:${GT}@192.168.50.223:3000/${GITHUB_REPOSITORY}.git" repo 2>&1 || echo "  token clone 失败"
-          else
-            echo "  跳过(无 token)"
-          fi
-          echo "=== 匿名 clone（公开库）==="
-          git clone --quiet --depth 1 "http://192.168.50.223:3000/${GITHUB_REPOSITORY}.git" repo2 2>&1 || echo "  匿名 clone 失败"
-          ls -a repo repo2 2>&1 | head -n 20 || true
-
-          echo "=== 工具链可安装性 ==="
-          pip download --no-deps -q -d /tmp/pipck uv >/dev/null 2>&1 && echo "  pip 可取 uv: OK" || echo "  pip 取 uv: 失败"
-          curl -s -o /dev/null -m 20 -w '  go tarball http=%{http_code} size=%{size_download}\n' -r 0-1000 https://goproxy.cn/ || true
-          echo "=== 诊断 v2 结束 ==="