lixi
66f983d680
CI / flutter-gates (push) Successful in 2m21s
- 新增 scripts/check-secrets.sh 与 scripts/hooks/pre-commit（三仓同构，规则单一来源） - ci.yml 在 checkout 后新增 Secret scan step（同一脚本 --all），既有 step 未动 - 验收：全仓 234 个已跟踪文件扫描零误报；假凭证自测 9 类命中全拦截 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
59 lines
2.6 KiB
YAML
59 lines
2.6 KiB
YAML
# Gitea Actions 门禁：与 docs/development/git-workflow.md 的本地门禁同一套命令。
|
||
# 零外部 action / 零 GitHub 依赖（原因见 patbond-api 的 ci.yml 头注释）。
|
||
# Flutter SDK 从中国镜像（flutter-io.cn）下载并缓存在 runner 的 toolcache 卷中，
|
||
# 首跑约需下载 ~900MB，之后复用缓存秒级就绪。
|
||
# 前提：runner config.yaml 的 container.options 挂载了 toolcache 卷：
|
||
# options: "-v /var/run/docker.sock:/var/run/docker.sock -v gitea_toolcache:/opt/hostedtoolcache"
|
||
name: CI
|
||
|
||
on:
|
||
push:
|
||
branches: [dev]
|
||
pull_request:
|
||
|
||
concurrency:
|
||
group: ci-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
jobs:
|
||
flutter-gates:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout (manual)
|
||
run: |
|
||
git init -q .
|
||
AUTH_URL=$(echo "${{ github.server_url }}" | sed "s#https://#https://oauth2:${{ github.token }}@#")
|
||
git remote add origin "$AUTH_URL/${{ github.repository }}.git"
|
||
git fetch -q --depth 1 origin "+${{ github.ref }}:refs/ci-head"
|
||
git checkout -q refs/ci-head
|
||
# 凭证防泄漏兜底（ADR-021）：与本地 pre-commit 同一脚本、同一规则表，
|
||
# 扫全部已跟踪文件（覆盖本次 push 变更的超集），纯 shell 零外部依赖。
|
||
- name: Secret scan
|
||
run: sh scripts/check-secrets.sh --all
|
||
- name: Install Flutter (flutter-io.cn mirror, toolcache reuse)
|
||
run: |
|
||
FLUTTER_VERSION=3.44.6
|
||
FLUTTER_HOME=/opt/hostedtoolcache/flutter-$FLUTTER_VERSION
|
||
if [ ! -x "$FLUTTER_HOME/bin/flutter" ]; then
|
||
echo "Downloading Flutter $FLUTTER_VERSION from flutter-io.cn ..."
|
||
curl -fsSL -o /tmp/flutter.tar.xz \
|
||
"https://storage.flutter-io.cn/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
|
||
mkdir -p /opt/hostedtoolcache
|
||
tar -xf /tmp/flutter.tar.xz -C /tmp
|
||
mv /tmp/flutter "$FLUTTER_HOME"
|
||
else
|
||
echo "Reusing cached Flutter at $FLUTTER_HOME"
|
||
fi
|
||
git config --global --add safe.directory "$FLUTTER_HOME"
|
||
echo "$FLUTTER_HOME/bin" >> "$GITHUB_PATH"
|
||
echo "PUB_HOSTED_URL=https://pub.flutter-io.cn" >> "$GITHUB_ENV"
|
||
echo "FLUTTER_STORAGE_BASE_URL=https://storage.flutter-io.cn" >> "$GITHUB_ENV"
|
||
# 与本地门禁同一套命令（git-workflow.md）
|
||
- name: Gates
|
||
run: |
|
||
flutter --version
|
||
flutter pub get
|
||
dart format --output=none --set-exit-if-changed lib test
|
||
flutter analyze
|
||
flutter test
|