zcode_mulm
b3b4e2b391
迁移自 mu-ref/est-ci-reusable（模板三修复版：est-bundle CA、verify 解释器 无关、build-arg 无内嵌引号、revision-arg-name、install+quality 单容器、 verdaccio add-host）+ Est-Infra 的 source-policy/REGISTER/ci-stats 上移； 全部去项目专名。架构依据 coordination runbooks/ci-repo-architecture.md。
101 lines
4.5 KiB
YAML
101 lines
4.5 KiB
YAML
# Reusable quality gate for est CI (node toolchain in digest-pinned helper image).
|
|
#
|
|
# P1-7 verification status (2026-08-27, Gitea 1.27.2):
|
|
# - reusable workflow calls verified working (1.27.2 probe + this workflow's
|
|
# selftest caller: .gitea/workflows/selftest.yml)
|
|
# - checkout uses host git clone (NOT mu-ref/actions-checkout): act_runner
|
|
# runs JS actions with a host node runtime, which tn does not install —
|
|
# the JS-action path is unavailable for host jobs until node is installed
|
|
# on the runner host (coordination review fallback decision)
|
|
# - no actions/cache layer for the same reason; the persistent /data/cache/ci
|
|
# directory is the primary (and only) cache layer
|
|
#
|
|
# Conventions proven on the business-repo pipelines:
|
|
# - runs-on: build-docker (host job, root) + docker run for the toolchain
|
|
# - CA: GIT_SSL_CAINFO (host git) + SSL_CERT_FILE/NODE_EXTRA_CA_CERTS (container;
|
|
# helper images have their apt/apk sources baked in, so replacing the public
|
|
# trust store is safe here — see playbook pitfall 13)
|
|
# - workspace mounted at ${inputs.workspace} (legacy CNB scripts expect /workspace)
|
|
# - cache dirs: 0777 on the DIRECTORY ONLY; never chmod -R (selection files stay 0600)
|
|
|
|
name: reusable-node-quality
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
node-image:
|
|
required: true
|
|
type: string
|
|
description: "Digest-pinned est helper image, e.g. est/ci-node-bookworm@sha256:78c01b0be47ebc60c0fa940110d66c60ca4e57f0fa57178bb88788e4ea131b61"
|
|
workspace:
|
|
required: false
|
|
type: string
|
|
default: /workspace
|
|
description: "Mount point for the workspace inside the helper container"
|
|
install-command:
|
|
required: true
|
|
type: string
|
|
description: "Shell command executed inside the helper container (frozen lockfile install)"
|
|
quality-command:
|
|
required: true
|
|
type: string
|
|
description: "Shell command executed inside the helper container (lint/typecheck/test/build)"
|
|
cache-dir:
|
|
required: false
|
|
type: string
|
|
default: /data/cache/ci/quality
|
|
description: "Persistent host-side cache dir (pnpm store, tools, browsers)"
|
|
secrets:
|
|
REGISTRY_PASSWORD:
|
|
required: false
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: build-docker
|
|
steps:
|
|
- name: checkout (host git; JS actions need a host node runtime)
|
|
env:
|
|
CI_ACTOR: ${{ github.actor }}
|
|
CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt
|
|
git config --global credential.helper \
|
|
'!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f'
|
|
git config --global --add safe.directory '*'
|
|
timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
|
|
"https://git.moneywood.site/${GITHUB_REPOSITORY}.git" .
|
|
test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
|
|
|
|
- name: authenticate to gitea registry (private helper image pulls)
|
|
env:
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
set -eu
|
|
if [ -n "${REGISTRY_PASSWORD:-}" ]; then
|
|
printf '%s' "${REGISTRY_PASSWORD}" \
|
|
| docker login git.moneywood.site -u "${{ github.actor }}" --password-stdin
|
|
fi
|
|
|
|
- name: prepare cache dir (dirs 0777, files untouched)
|
|
run: |
|
|
set -eu
|
|
mkdir -p "${{ inputs.cache-dir }}"
|
|
chmod 0777 "${{ inputs.cache-dir }}"
|
|
find "${{ inputs.cache-dir }}" -mindepth 1 -maxdepth 1 -type d -exec chmod 0777 {} + 2>/dev/null || true
|
|
|
|
# install and quality run in ONE container: toolchains installed by the
|
|
# install command (global pnpm, local bins) must still be on PATH for the
|
|
# quality command — two `docker run --rm` invocations would not share
|
|
# anything but the workspace and /cache mounts.
|
|
- name: install and quality (containerized toolchain)
|
|
run: |
|
|
set -eu
|
|
docker run --rm --add-host npm.cache.est:172.17.0.1 \
|
|
-v "$PWD:${{ inputs.workspace }}" -w "${{ inputs.workspace }}" \
|
|
-v "${{ inputs.cache-dir }}:/cache" -e TMPDIR=/cache \
|
|
-v /usr/local/share/ca-certificates/est-bundle.crt:/ca/est-bundle.crt:ro \
|
|
-e SSL_CERT_FILE=/ca/est-bundle.crt \
|
|
-e NODE_EXTRA_CA_CERTS=/ca/est-bundle.crt \
|
|
"${{ inputs.node-image }}" sh -euxc '${{ inputs.install-command }} && ${{ inputs.quality-command }}'
|