59 lines
2.2 KiB
YAML
59 lines
2.2 KiB
YAML
# CI：每次推送自动运行完整测试套件（本地与云端同一入口：node scripts/ci.mjs）
|
||
# 网络适配（服务器在国内）：
|
||
# 1) 不使用任何远程 action（actions/checkout 会被解析到 github.com 导致挂死），改用内置环境变量手动 clone
|
||
# 2) job 容器镜像走腾讯内网镜像源（runner 标签已指向 mirror.ccs.tencentyun.com）
|
||
# 3) npm/pnpm 走国内 registry
|
||
name: CI
|
||
on:
|
||
push:
|
||
pull_request:
|
||
|
||
jobs:
|
||
test:
|
||
name: 测试套件（协议/用户管理/单测/双设备/实时链路/构建）
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: mirror.ccs.tencentyun.com/library/node:22-bookworm
|
||
steps:
|
||
- name: 检出代码（内网闭环，不访问 github）
|
||
run: |
|
||
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
||
git clone --depth 1 "https://x-access-token:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/root/daywork.git" .
|
||
git checkout "$GITHUB_SHA"
|
||
|
||
- name: 安装 pnpm
|
||
run: npm install -g pnpm@11 --registry=https://registry.npmmirror.com
|
||
|
||
- name: 安装依赖
|
||
working-directory: intern-log
|
||
run: pnpm install --frozen-lockfile --registry=https://registry.npmmirror.com
|
||
|
||
- name: 运行测试与构建
|
||
env:
|
||
NODE_ENV: production
|
||
run: node scripts/ci.mjs
|
||
|
||
audit:
|
||
name: 依赖漏洞扫描（软性检查）
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: mirror.ccs.tencentyun.com/library/node:22-bookworm
|
||
continue-on-error: true
|
||
steps:
|
||
- name: 检出代码（内网闭环，不访问 github）
|
||
run: |
|
||
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
||
git clone --depth 1 "https://x-access-token:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/root/daywork.git" .
|
||
git checkout "$GITHUB_SHA"
|
||
|
||
- name: 安装 pnpm
|
||
run: npm install -g pnpm@11 --registry=https://registry.npmmirror.com
|
||
|
||
- name: 安装依赖
|
||
working-directory: intern-log
|
||
run: pnpm install --frozen-lockfile --registry=https://registry.npmmirror.com
|
||
|
||
- name: pnpm audit（高危及以上）
|
||
working-directory: intern-log
|
||
run: pnpm audit --prod --audit-level=high --registry=https://registry.npmmirror.com
|