1981a6be01
增加不可变源码检出、两阶段 finalize/activate、Runtime 同源对象读取与 iframe 安全边界，并用 fail-closed CI 门固定契约。Git 仅提交平台实现、契约、迁移和 SoT，不包含具体游戏源码、素材、bundle 或验收证据。
109 lines
5.1 KiB
YAML
109 lines
5.1 KiB
YAML
# 契约机器门 · 服务端兜底(Gitea Actions,与 GitHub Actions 语法兼容)
|
||
# pre-commit 是自愿门(--no-verify / 新 clone 未配 hooksPath 可绕),本工作流是不可绕的服务端门。
|
||
# 与 docs-gate.yml 平级、各管一摊:docs-gate 管文档治理七检,本工作流管四类契约门。
|
||
# 生效前提:Gitea 实例已配 act_runner;未配时本文件静默不跑,不影响开发。
|
||
# CI 侧全量真跑(不做 pre-commit 的路径条件触发):判例库四段必须装齐 esbuild + pytest，
|
||
# 依赖安装失败或任一整段 SKIP 都判红；本地裸环境仍可由 run.mjs 诚实 SKIP。
|
||
name: contract-gates
|
||
on:
|
||
push:
|
||
branches: ['**']
|
||
pull_request:
|
||
jobs:
|
||
contract-gates:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
with:
|
||
# 段 A 版本升号闸(check_version_bump)要比对 push 前提交,故拉全历史;
|
||
# 其余四门只读工作区、不依赖 git 历史,fetch-depth 变化对它们无影响。
|
||
fetch-depth: 0
|
||
|
||
- uses: actions/setup-java@v4
|
||
with:
|
||
distribution: temurin
|
||
java-version: '17'
|
||
cache: maven
|
||
|
||
- uses: actions/setup-node@v4
|
||
with:
|
||
node-version: '22'
|
||
cache: npm
|
||
cache-dependency-path: |
|
||
game-runtime/package-lock.json
|
||
game-studio/package-lock.json
|
||
|
||
# 服务端门必须真跑全部判例；安装失败立即终止，不能降级成绿色 SKIP。
|
||
- name: 安装完整门依赖
|
||
run: |
|
||
pip3 install --quiet pytest jsonschema
|
||
npm ci --prefix game-runtime
|
||
|
||
- name: 门金标判例库全量回归
|
||
env:
|
||
GATE_FIXTURES_REQUIRE_ALL: '1'
|
||
run: |
|
||
node --test contracts/gate-fixtures/run.test.mjs
|
||
node contracts/gate-fixtures/run.mjs
|
||
|
||
- name: play-loop 契约正负样本套件
|
||
run: |
|
||
python3 contracts/play-loop/validate.py --suite
|
||
python3 contracts/play-loop/test_reference_asset_trusted_consumption_v2.py
|
||
|
||
- name: 游戏内容对象存储契约正负样本套件
|
||
env:
|
||
PYTHONPATH: tier2/gen-worker
|
||
run: >-
|
||
python3 -m pytest -q
|
||
tier2/gen-worker/tests/test_game_artifact_store.py
|
||
tier2/gen-worker/tests/test_game_source_archive.py
|
||
tier2/gen-worker/tests/test_game_artifact_storage_store.py
|
||
tier2/gen-worker/tests/test_game_artifact_storage_ddl.py
|
||
tier2/gen-worker/tests/test_game_content_repository.py
|
||
|
||
- name: 游戏内容控制面与 Runtime 事务边界
|
||
run: |
|
||
mvn -f game-cloud/pom.xml \
|
||
-pl huijing-dependencies,game-module-project/game-module-project-server,game-module-runtime/game-module-runtime-server,game-module-aigc/game-module-aigc-server \
|
||
-am -DskipTests install
|
||
mvn -f game-cloud/game-module-project/game-module-project-server/pom.xml \
|
||
-Dtest=GameVersionServiceImplTest \
|
||
-Dsurefire.failIfNoSpecifiedTests=true test
|
||
mvn -f game-cloud/game-module-runtime/game-module-runtime-server/pom.xml \
|
||
-Dtest=RuntimePackageApiImplDogfoodTest,AppRuntimeControllerTest,RuntimeConvertTest,ArtifactStorageGateTest,RuntimeArtifactContentServiceTest,RuntimeArtifactStoragePropertiesTest,RuntimeOssPackageFinalizeServiceTest,RuntimePackageServiceImplTest,S3ArtifactObjectReaderTest \
|
||
-Dsurefire.failIfNoSpecifiedTests=true test
|
||
mvn -f game-cloud/game-module-aigc/game-module-aigc-server/pom.xml \
|
||
-Dtest=GameContentControlControllerTest,GameContentControlServiceTest,GameContentFinalizeTxServiceTest \
|
||
-Dsurefire.failIfNoSpecifiedTests=true test
|
||
|
||
- name: 宿主同源取包与 iframe 安全边界
|
||
run: |
|
||
npm test --prefix game-runtime
|
||
npm ci --prefix game-studio
|
||
npm run test:host-security --prefix game-studio
|
||
npm run build --prefix game-studio -- --mode staging
|
||
|
||
- name: 品类 rubric fixture↔skill 双写对账
|
||
run: python3 .agents/tools/rubric-sync-gate.py
|
||
|
||
- name: 便宜档插件面三方一致性对账（目录/prompt 白名单/host-config 注入 + PLUGIN_KEY_DIR）
|
||
run: python3 .agents/tools/plugin-surface-gate.py
|
||
|
||
- name: Prompt Registry 版本一致性
|
||
run: python3 contracts/prompts/check_registry.py
|
||
|
||
# 四道闸·闸0(段 A):改了 prompt 正文相对 push 前提交必须升 version。
|
||
# 基线优先取 push 事件的 before;取不到/无效回落 HEAD~1;再取不到(首 push/新分支)则跳过不误拦。
|
||
- name: Prompt 闸0 version 升号（改正文必升版）
|
||
run: |
|
||
BASE="${{ github.event.before }}"
|
||
if [ -z "$BASE" ] || ! git rev-parse --verify --quiet "$BASE^{commit}" >/dev/null 2>&1; then
|
||
BASE="$(git rev-parse --verify --quiet HEAD~1 2>/dev/null || true)"
|
||
fi
|
||
if [ -z "$BASE" ]; then
|
||
echo "无可比基线（首次提交/新分支），版本升号闸跳过（不误拦、不假绿）"
|
||
exit 0
|
||
fi
|
||
python3 contracts/prompts/check_version_bump.py --base "$BASE"
|