2cff86b808
独立 Opus 评审发现、并经我核验为真的关键漏洞,本轮整改(JDK21 实跑验证全绿): - P0-1 CI 接上电:maven.yml 触发分支 master→main(此前误配 master、仓库无该分支 → CI 从不运行, 所有门禁形同离线)、checkout/setup-java 升 v4。 - P0-2 BC 门通用化:ArchUnit 改为通用条件,覆盖全部业务 BC 间 .dal 方向(原仅守 AI 单向); 整改 knowledge 同构违例(ContentKnowledgeWorkOwnerFacade 改消费 MuseContentWorkOwnerApi); market→member.dal 写路径违例单点登记待整改(KNOWN_VIOLATION_EXEMPTIONS + bc-boundaries §三)。 - loop 机械牙:新增 AgentsInfraIntegrityTest(每业务 BC 有 .agent、README 索引每篇 .agents 文档、总账在), 把写回/索引同步从自觉变机械。 - P1-1 去魔法数:覆盖门分域计数 28/21/37 改为派生自 APPROVED_*_COMPLETED_OPERATIONS.size()。 - openapi-diff materialize 为独立 workflow(待首跑验证)。 - 文档诚实化:AGENTS/总账/bc-boundaries 订正"已验证绿"等过度声称为与实际相符(BC 门 market 待整改、契约门仅存在性/结构)。 验证:JDK21 mvn -pl muse-server -am 实跑 7 类门禁/单测全绿(BcBoundary 1/0F 且 0 Architecture Violation、 AgentsInfraIntegrity 3/0F、ContractFirst 2/0F、P1rApiCoverageReport 7/0F、knowledge/ai/content 适配器单测全绿),BUILD SUCCESS。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
37 lines
1.5 KiB
YAML
37 lines
1.5 KiB
YAML
# OpenAPI 破坏性变更门禁(契约先行加固)
|
|
# 仅在 PR 改动 docs/api-contracts/** 时触发;逐域用 oasdiff 比对 base 与 PR 的 OpenAPI,发现破坏性差异即失败。
|
|
# 注:独立于主 maven 构建,避免误配影响主门禁。**首次接入后需一次真实 CI 运行验证**(本地无法运行 GitHub Actions/oasdiff)。
|
|
name: OpenAPI Breaking Change Check
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [ main ]
|
|
paths:
|
|
- 'docs/api-contracts/**'
|
|
|
|
jobs:
|
|
openapi-diff:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: 检出 base 分支契约到 /tmp/base
|
|
run: git worktree add /tmp/base "${{ github.event.pull_request.base.sha }}"
|
|
- name: oasdiff 破坏性变更检测(逐业务域)
|
|
run: |
|
|
set -euo pipefail
|
|
fail=0
|
|
for d in account ai content events knowledge market meta; do
|
|
base="/tmp/base/docs/api-contracts/$d/openapi.yaml"
|
|
head="docs/api-contracts/$d/openapi.yaml"
|
|
if [ ! -f "$base" ] || [ ! -f "$head" ]; then
|
|
echo "跳过 $d(base 或 PR 缺该契约文件)"; continue
|
|
fi
|
|
echo "== oasdiff breaking: $d =="
|
|
docker run --rm -v "$PWD:/pr" -v /tmp/base:/base tufin/oasdiff breaking \
|
|
"/base/docs/api-contracts/$d/openapi.yaml" "/pr/docs/api-contracts/$d/openapi.yaml" \
|
|
--fail-on ERR || fail=1
|
|
done
|
|
exit $fail
|