zcode_mulm
ff3dd6ce12
P1-10 completed the JS-action checkout migration on 2026-08-27 09:39 (est/Est-Infra@57cc9f7) after tn gained a host node runtime (v22). The 12:07 consolidation founded this repo on the P1-7 host-clone fallback lineage instead, deleting the migrated copies at 12:25 — live pipelines have run host git clone with stale 'tn does not install node' headers ever since. v3 restores the JS path in both templates, keeps the fallback's HEAD==SHA assertion as an explicit postcondition step (guard is not downgraded), and deletes reusable/checkout.yml which had zero callers (reusable workflows cannot nest; its guard now lives inline). Verified by a Seabed task-branch probe run before tagging v3 (coordination task M1-423, issue #32).
38 lines
2.5 KiB
Markdown
38 lines
2.5 KiB
Markdown
# mu-ref/ci-workflows
|
||
|
||
公司级 CI 共享资产（est org）——跨项目复用的 reusable workflow 模板与工具。
|
||
架构决策与铁律见 coordination `runbooks/ci-repo-architecture.md`（2026-08-27 用户拍板）。
|
||
|
||
## 内容
|
||
|
||
| 路径 | 用途 |
|
||
|---|---|
|
||
| `.gitea/workflows/reusable/node-quality.yml` | node 质量门（digest helper、持久缓存、rank 源序、actions-checkout checkout） |
|
||
| `.gitea/workflows/reusable/oci-build-push-verify.yml` | 镜像构建+推送+verify-command 校验链 |
|
||
| `tools/ci/source-policy.sh` | 唯一选源实现（公司级 canonical） |
|
||
| `tools/ci/helper/REGISTER.md` | ci-node-* helper 镜像 digest 注册 |
|
||
| `tools/ci/stats.sh` | Gitea Actions 运行统计（REPOS 必填） |
|
||
|
||
## 铁律
|
||
|
||
1. 本仓**不得出现项目专名**（reef/seabed 等）与任何 secrets——项目参数（矩阵、build args、verify 期望值）一律由调用方 `with:`/`secrets: inherit` 传入。
|
||
2. workflow 文件只保留 `workflow_call` 触发（不可直接触发）；`has_actions=false`。
|
||
3. **版本化调用**：调用方一律 `uses: est/ci-workflows/.gitea/workflows/reusable/<name>.yml@vN`；重大变更升新 tag 并逐项目回归。
|
||
4. 可见性：**public（org 级闸门实测）**——跨仓 reusable 读取不按触发用户 token 校验：私有 org（est）内的仓即使 repo 级 public/limited 也被拒（Gitea 1.27.2 实测三档全否）；本仓内容为无秘密的公共资产（同 mu-ref/actions-* 待遇），故由 **public org（mu-ref）** 宿主承载。est org 保持 private。
|
||
|
||
## 调用样例
|
||
|
||
```yaml
|
||
jobs:
|
||
quality:
|
||
uses: https://git.moneywood.site/mu-ref/ci-workflows/.gitea/workflows/reusable/node-quality.yml@v1
|
||
with: { ... }
|
||
secrets: inherit
|
||
```
|
||
|
||
## 迁移与同步
|
||
|
||
- 2026-08-27 定稿：曾按初版决策试建 est/ci-workflows，因 est org 私有闸门不可跨仓调用而删除（用户改批 mu-ref 宿主）；同日自 est/Est-Infra 上移 tools/ci。
|
||
- 2026-08-29 v3：模板 checkout 恢复 mu-ref/actions-checkout@v4（JS action）+ HEAD==SHA postcondition——P1-10 的 JS 迁移（est/Est-Infra@57cc9f7，08-27 09:39）在 08-27 12:07 上移建仓时被回退为 P1-7 host-clone fallback 血统，v3 恢复并经 Seabed 私仓探针验证；无调用方的孤儿模板 `reusable/checkout.yml` 删除（reusable 不可嵌套调用，其守卫已内联进两个模板）。
|
||
- helper Dockerfile 的可复现 bake 与 ops 巡检脚本仍属项目级（Est-Infra / gitea-host-setup）。
|