yushanhe
f097f5bc21
designops-gateway / build (push) Failing after 20m0s
- merge openpencil/penpot/excalidraw/style-dictionary/storybook as native monorepo code (upstream .git removed; origins in okf/manifest.md) - add project-level okf/ (manifest + memory/rule/skill/decision/lesson) - add AGENTS.md (OKF annotation standard) + monorepo .gitignore - annotate 9 entry files with @module/@skill/@rule headers - add GitOps deploy bundle (infra/gitops/) + Gitea CI (.gitea/workflows/)
54 lines
1.8 KiB
YAML
54 lines
1.8 KiB
YAML
# DesignOps Gateway CI/CD（Gitea Actions + act_runner）
|
||
# 控制环前半段：build → test → secret-scan → 推镜像（新 tag）
|
||
# 后半段由 Flux image automation 自动提 PR → 评审合并 → reconcile 发布
|
||
name: designops-gateway
|
||
run-name: ${{ gitea.actor }} build gateway
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
tags: ['v*']
|
||
pull_request:
|
||
branches: [main]
|
||
|
||
jobs:
|
||
build:
|
||
# runner 是 host 模式 ubuntu-latest（osc-100.66.1.10），需 node/pnpm 工具链
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Setup Node + pnpm
|
||
uses: actions/setup-node@v4
|
||
with:
|
||
node-version: '24'
|
||
|
||
- name: Install
|
||
run: |
|
||
npm i -g pnpm@12
|
||
pnpm install --frozen-lockfile
|
||
|
||
- name: Typecheck + Lint + Test
|
||
run: |
|
||
pnpm typecheck
|
||
pnpm lint
|
||
pnpm test
|
||
|
||
- name: Secret scan（禁硬编码凭据）
|
||
run: |
|
||
# 扫描 token/key/password 明文；命中即失败（部署不变式 #1）
|
||
if grep -rInE '(PENPOT_TOKEN|apiSecretKey|SECRET_KEY|password)[[:space:]]*[:=][[:space:]]*["'"'"'][^"'"'"']{6,}' \
|
||
--exclude-dir=node_modules --exclude-dir=.git . ; then
|
||
echo "❌ 检出疑似明文凭据，阻断"; exit 1
|
||
fi
|
||
echo "✅ 无明文凭据"
|
||
|
||
- name: Build image + push（Gitea registry）
|
||
if: startsWith(gitea.ref, 'refs/tags/v')
|
||
run: |
|
||
echo "${{ secrets.GITEA_TOKEN }}" | docker login git.osc.life -u yushanhe --password-stdin
|
||
TAG="${{ gitea.ref_name }}"
|
||
docker build -t git.osc.life/yushanhe/designops-gateway:"$TAG" .
|
||
docker push git.osc.life/yushanhe/designops-gateway:"$TAG"
|
||
echo "pushed tag=$TAG → Flux ImagePolicy 将自动提 PR 更新"
|