est/ci-workflows v1：公司级 reusable 模板（checkout/node-quality/oci-build-push-verify）与 tools/ci 上移

迁移自 mu-ref/est-ci-reusable（模板三修复版：est-bundle CA、verify 解释器无关、build-arg 无内嵌引号、revision-arg-name、install+quality 单容器、 verdaccio add-host）+ Est-Infra 的 source-policy/REGISTER/ci-stats 上移；全部去项目专名。架构依据 coordination runbooks/ci-repo-architecture.md。
2026-08-27 12:07:51 +08:00
commit b3b4e2b391
7 changed files with 516 additions and 0 deletions
@@ -0,0 +1,100 @@
+# Reusable quality gate for est CI (node toolchain in digest-pinned helper image).
+#
+# P1-7 verification status (2026-08-27, Gitea 1.27.2):
+#   - reusable workflow calls verified working (1.27.2 probe + this workflow's
+#     selftest caller: .gitea/workflows/selftest.yml)
+#   - checkout uses host git clone (NOT mu-ref/actions-checkout): act_runner
+#     runs JS actions with a host node runtime, which tn does not install —
+#     the JS-action path is unavailable for host jobs until node is installed
+#     on the runner host (coordination review fallback decision)
+#   - no actions/cache layer for the same reason; the persistent /data/cache/ci
+#     directory is the primary (and only) cache layer
+#
+# Conventions proven on the business-repo pipelines:
+#   - runs-on: build-docker (host job, root) + docker run for the toolchain
+#   - CA: GIT_SSL_CAINFO (host git) + SSL_CERT_FILE/NODE_EXTRA_CA_CERTS (container;
+#     helper images have their apt/apk sources baked in, so replacing the public
+#     trust store is safe here — see playbook pitfall 13)
+#   - workspace mounted at ${inputs.workspace} (legacy CNB scripts expect /workspace)
+#   - cache dirs: 0777 on the DIRECTORY ONLY; never chmod -R (selection files stay 0600)
+
+name: reusable-node-quality
+
+on:
+  workflow_call:
+    inputs:
+      node-image:
+        required: true
+        type: string
+        description: "Digest-pinned est helper image, e.g. est/ci-node-bookworm@sha256:78c01b0be47ebc60c0fa940110d66c60ca4e57f0fa57178bb88788e4ea131b61"
+      workspace:
+        required: false
+        type: string
+        default: /workspace
+        description: "Mount point for the workspace inside the helper container"
+      install-command:
+        required: true
+        type: string
+        description: "Shell command executed inside the helper container (frozen lockfile install)"
+      quality-command:
+        required: true
+        type: string
+        description: "Shell command executed inside the helper container (lint/typecheck/test/build)"
+      cache-dir:
+        required: false
+        type: string
+        default: /data/cache/ci/quality
+        description: "Persistent host-side cache dir (pnpm store, tools, browsers)"
+    secrets:
+      REGISTRY_PASSWORD:
+        required: false
+
+jobs:
+  quality:
+    runs-on: build-docker
+    steps:
+      - name: checkout (host git; JS actions need a host node runtime)
+        env:
+          CI_ACTOR: ${{ github.actor }}
+          CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -eu
+          export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt
+          git config --global credential.helper \
+            '!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f'
+          git config --global --add safe.directory '*'
+          timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://git.moneywood.site/${GITHUB_REPOSITORY}.git" .
+          test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
+
+      - name: authenticate to gitea registry (private helper image pulls)
+        env:
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -eu
+          if [ -n "${REGISTRY_PASSWORD:-}" ]; then
+            printf '%s' "${REGISTRY_PASSWORD}" \
+              | docker login git.moneywood.site -u "${{ github.actor }}" --password-stdin
+          fi
+
+      - name: prepare cache dir (dirs 0777, files untouched)
+        run: |
+          set -eu
+          mkdir -p "${{ inputs.cache-dir }}"
+          chmod 0777 "${{ inputs.cache-dir }}"
+          find "${{ inputs.cache-dir }}" -mindepth 1 -maxdepth 1 -type d -exec chmod 0777 {} + 2>/dev/null || true
+
+      # install and quality run in ONE container: toolchains installed by the
+      # install command (global pnpm, local bins) must still be on PATH for the
+      # quality command — two `docker run --rm` invocations would not share
+      # anything but the workspace and /cache mounts.
+      - name: install and quality (containerized toolchain)
+        run: |
+          set -eu
+          docker run --rm --add-host npm.cache.est:172.17.0.1 \
+            -v "$PWD:${{ inputs.workspace }}" -w "${{ inputs.workspace }}" \
+            -v "${{ inputs.cache-dir }}:/cache" -e TMPDIR=/cache \
+            -v /usr/local/share/ca-certificates/est-bundle.crt:/ca/est-bundle.crt:ro \
+            -e SSL_CERT_FILE=/ca/est-bundle.crt \
+            -e NODE_EXTRA_CA_CERTS=/ca/est-bundle.crt \
+            "${{ inputs.node-image }}" sh -euxc '${{ inputs.install-command }} && ${{ inputs.quality-command }}'