dsh-mulm
ff92951038
Merge pull request 'fix(digest): digest 暂存改 mktemp（PLAT-014 二段，v5 前置）' ( #3 ) from task/PLAT-014-digest-mktemp into main
2026-08-31 13:41:00 +00:00
zcode-mulm
4d9a785ec5
fix(digest): digest 汇总文件改 mktemp（PLAT-014 二段：宿主非 root 撞容器 chown 后的 workspace）
...
run 924 build 红根因：容器 install chown -R node:node workspace → 宿主 digest 步
mkdir -p .tmp-ci EACCES（897 时代 runner 为 root 故绿；治理后必红）。
修法：digest/manifest 暂存文件改宿主 mktemp 目录（runner 自建 tmp 可写），
两处 digest 步（verify/script 路径）同修。合并后打 v5。
2026-08-31 21:35:12 +08:00
dsh-mulm
973ed6cb99
Merge pull request 'fix(cleanup): per-run 缓存清理改容器 root 执行（PLAT-014，升 v4 前置）' ( #2 ) from task/PLAT-014-per-run-cleanup-root into main
2026-08-31 13:05:17 +00:00
zcode-mulm
e2b81e7ee6
fix(cleanup): per-run 缓存清理改容器 root 执行（PLAT-014，坑 #18 同族）
...
宿主 08-30 治理后为非 root gitea-runner，rm 容器 root 属主缓存文件必 EACCES
（Seabed run 917 两 attempt 测试全绿、清理步必死）。复用 job 已拉的 node-image
find -mindepth 1 -delete + 宿主 rmdir 自建目录。v3 不动；合并后打 v4，
per-run 调用方（Seabed）升 @v4，fixed 调用方（Reef）可留 @v3。
2026-08-31 20:52:23 +08:00
钱木
0e132f63af
runner contract: TN-only tn-build-runner v3.3.1 (non-root, capacity=1); templates note non-root user
2026-08-30 22:00:15 +08:00
zcode-mulm
12b01c6cc5
Merge pull request 'templates v3: checkout back on actions-checkout@v4 + drop orphan reusable/checkout.yml' ( #1 ) from task/v3-checkout-actions-checkout into main
2026-08-29 13:38:20 +00:00
zcode-mulm
ff3dd6ce12
templates v3: checkout back on mu-ref/actions-checkout@v4 + drop orphan reusable/checkout.yml
...
P1-10 completed the JS-action checkout migration on 2026-08-27 09:39
(est/Est-Infra@57cc9f7 ) after tn gained a host node runtime (v22).
The 12:07 consolidation founded this repo on the P1-7 host-clone
fallback lineage instead, deleting the migrated copies at 12:25 —
live pipelines have run host git clone with stale 'tn does not
install node' headers ever since.
v3 restores the JS path in both templates, keeps the fallback's
HEAD==SHA assertion as an explicit postcondition step (guard is not
downgraded), and deletes reusable/checkout.yml which had zero
callers (reusable workflows cannot nest; its guard now lives inline).
Verified by a Seabed task-branch probe run before tagging v3
(coordination task M1-423, issue #32 ).
2026-08-29 21:31:41 +08:00
zcode-mulm
1be2f0f072
templates: boolean inputs are not passed reliably through workflow_call with: — switch toggles to string form (mount-docker-socket / verify-sha)
2026-08-27 12:51:10 +08:00
zcode-mulm
7d8d9d8a2a
模板 v2：script 模式与通用件
...
- oci：build-command 脚本模式（install+build 同容器；全套挂载
sock/docker-config/buildx/CA/cache；commit-env-name 注入；extra-env；
digest summary 复用 image-matrix；image-matrix 改可选）
- 两模板：cache-mode fixed|per-run（per-run = mktemp 子目录 + always()
清理，满足 from-zero 工具缓存契约）、mount-docker-socket、commit-env-name
- 呼应 P1-9：中性变量注入由模板承担（EST_GIT_COMMIT 等）
2026-08-27 12:47:39 +08:00
zcode-mulm
4601528dde
更名迁移：mu-ref/est-ci-reusable -> mu-ref/ci-workflows（内容不变，README 口径更新）
2026-08-27 12:20:46 +08:00
zcode-mulm
a242eeb195
升格为公司级 CI 资产完整版：+reusable/checkout.yml、+tools/ci（source-policy/REGISTER/stats）、去项目专名、版本化 v1
...
架构依据 coordination runbooks/ci-repo-architecture.md；宿主由
est/ci-workflows（私有 org 闸门实测不可跨仓调用，已删）改定为
mu-ref/est-ci-reusable（public org，同 actions 镜像待遇，内容无秘密）。
2026-08-27 12:18:07 +08:00
zcode-mulm
b3b4e2b391
est/ci-workflows v1：公司级 reusable 模板（checkout/node-quality/oci-build-push-verify）与 tools/ci 上移
...
迁移自 mu-ref/est-ci-reusable（模板三修复版：est-bundle CA、verify 解释器
无关、build-arg 无内嵌引号、revision-arg-name、install+quality 单容器、
verdaccio add-host）+ Est-Infra 的 source-policy/REGISTER/ci-stats 上移；
全部去项目专名。架构依据 coordination runbooks/ci-repo-architecture.md。
2026-08-27 12:07:51 +08:00
dsh-mulm
zcode-mulm
钱木