ci: streamline release checks and protect contribution rules

Reuse test binaries and frontend builds, reduce redundant cache writes, and overlap release preparation with quality checks. Protect skills, contribution rules, and GitHub configuration, and simplify workflow names. Co-authored-by: Codex <noreply@openai.com>
2026-11-06 08:06:19 +00:00 · 2026-09-28 16:54:13 +08:00
parent a1fc368474
commit 8fb42300c1
8 changed files with 155 additions and 73 deletions
@@ -1,4 +1,4 @@
-name: Reusable Container
+name: Container

 on:
  workflow_call:
@@ -31,17 +31,26 @@ jobs:
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Cache Cargo mounts
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        id: cargo-cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/container-cargo
-          key: container-cargo-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/**/Cargo.toml', 'deploy/Dockerfile') }}-${{ inputs.ref }}
+          # 同一平台和依赖复用快照，源码变化由 Cargo 指纹判定是否重编译
+          key: container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', 'deploy/Dockerfile') }}
          restore-keys: |
-            container-cargo-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/**/Cargo.toml', 'deploy/Dockerfile') }}-
-            container-cargo-v1-${{ runner.os }}-${{ runner.arch }}-
+            container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-

-      # The GHA layer exporter does not persist RUN --mount=type=cache contents.
-      # Extraction runs before actions/cache saves its directories in post steps.
+      - name: Restore Cargo mounts for pull requests
+        if: github.event_name != 'push' || github.ref != 'refs/heads/main'
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ runner.temp }}/container-cargo
+          key: container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', 'deploy/Dockerfile') }}
+          restore-keys: |
+            container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-
+
+      # GHA 层缓存不含 cache mount，只有主分支缺少当前快照时才回收并保存
      - name: Restore Cargo mounts to BuildKit
        uses: reproducible-containers/buildkit-cache-dance@5422eac04292c961a382e0f584ea0f03ad9da723 # v3.4.0
        with:
@@ -53,7 +62,7 @@ jobs:
              "${{ runner.temp }}/container-cargo/git": "/usr/local/cargo/git",
              "${{ runner.temp }}/container-cargo/target": "/app/backend/target"
            }
-          skip-extraction: ${{ steps.cargo-cache.outputs.cache-hit }}
+          skip-extraction: ${{ github.event_name != 'push' || github.ref != 'refs/heads/main' || steps.cargo-cache.outputs.cache-hit == 'true' }}

      - name: Build runtime image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
@@ -67,7 +76,7 @@ jobs:
            runtime-base
            runtime
          cache-from: type=gha,scope=runtime-ci
-          cache-to: type=gha,mode=max,scope=runtime-ci
+          cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'type=gha,mode=max,scope=runtime-ci' || '' }}

      - name: Verify runtime image
        uses: ./.github/actions/verify-container
@@ -1,4 +1,4 @@
-name: Reusable Quality
+name: Quality

 on:
  workflow_call:
@@ -7,11 +7,6 @@ on:
        description: Exact commit SHA to validate
        required: true
        type: string
-      upload_frontend:
-        description: Upload the built frontend for release jobs
-        required: false
-        default: false
-        type: boolean
      run_backend:
        description: Run backend quality checks
        required: false
@@ -111,6 +106,7 @@ jobs:
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          workspaces: backend -> target
+          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

      - name: Rust format
        working-directory: backend
@@ -120,6 +116,19 @@ jobs:
        working-directory: backend
        run: cargo clippy --all-targets --all-features --locked -- -D warnings

+      - name: Setup nextest
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
+        with:
+          tool: cargo-nextest@0.9.143
+          fallback: none
+
+      - name: Build Rust tests once
+        working-directory: backend
+        run: |
+          cargo metadata --format-version 1 --locked > "$RUNNER_TEMP/nextest-cargo-metadata.json"
+          cargo nextest list --test main --locked --list-type binaries-only --message-format json \
+            > "$RUNNER_TEMP/nextest-binaries.json"
+
      - name: Configure PostgreSQL and Redis test authentication
        shell: bash
        run: |
@@ -144,7 +153,11 @@ jobs:

      - name: Rust tests
        working-directory: backend
-        run: cargo test --test main --locked
+        run: |
+          cargo nextest run \
+            --cargo-metadata "$RUNNER_TEMP/nextest-cargo-metadata.json" \
+            --binaries-metadata "$RUNNER_TEMP/nextest-binaries.json" \
+            --no-tests fail

      - name: Store tests with Redis ACL authentication
        working-directory: backend
@@ -159,7 +172,11 @@ jobs:
          docker exec --env REDISCLI_AUTH="$redis_acl_password" "${{ job.services.redis.id }}" \
            redis-cli -e --user cpr_acl ACL SETUSER default off >/dev/null
          export CPR_TEST_REDIS_URL="redis://cpr_acl:${redis_acl_password}@127.0.0.1:6379"
-          cargo test -p gateway-store --test main --locked
+          # 从同一份构建清单选择 Redis 测试，保留 workspace 特性图且不重复运行 PostgreSQL
+          cargo nextest run \
+            --cargo-metadata "$RUNNER_TEMP/nextest-cargo-metadata.json" \
+            --binaries-metadata "$RUNNER_TEMP/nextest-binaries.json" \
+            --no-tests fail -E 'package(=gateway-store) & test(/^redis::/)'

  frontend:
    if: inputs.run_frontend
@@ -173,35 +190,8 @@ jobs:
        with:
          ref: ${{ inputs.ref }}

-      - name: Setup pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          package_json_file: frontend/package.json
-
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: frontend/pnpm-lock.yaml
-
-      - name: Install frontend dependencies
-        run: pnpm --dir frontend install --frozen-lockfile
-
-      - name: Frontend format
-        run: pnpm --dir frontend format:check
-
-      - name: Frontend build
-        run: pnpm --dir frontend build
-
-      - name: Upload frontend artifact
-        if: inputs.upload_frontend
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-dist
-          path: frontend/dist
-          if-no-files-found: error
-          retention-days: 1
+      - name: Validate and build frontend
+        uses: ./.github/actions/build-frontend

  workflow-lint:
    runs-on: ubuntu-latest
@@ -38,14 +38,19 @@ jobs:
        id: filter
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        with:
+          # 目录规则取并集，再统一排除说明文档，保留隐藏配置与子模块指针
+          predicate-quantifier: some-with-excludes
          filters: |
            backend:
              - 'backend/**'
              - 'release/version.yaml'
              - '.github/workflows/**'
+              - '!**/*.md'
            frontend:
              - 'frontend/**'
+              - '.github/actions/build-frontend/**'
              - '.github/workflows/**'
+              - '!**/*.md'
            source:
              - '.gitmodules'
              - 'modules/ui'
@@ -53,6 +58,7 @@ jobs:
              - 'frontend/**'
              - 'backend/crates/gateway-plugin/sdk/**'
              - '.github/workflows/ci.yml'
+              - '!**/*.md'
            container:
              - 'backend/**'
              - 'frontend/**'
@@ -62,6 +68,7 @@ jobs:
              - '.github/actions/**'
              - '.github/workflows/_container.yml'
              - '.github/workflows/ci.yml'
+              - '!**/*.md'

  quality:
    needs: changes
@@ -170,7 +170,24 @@ jobs:
    uses: ./.github/workflows/_quality.yml
    with:
      ref: ${{ needs.release-info.outputs.git_sha }}
-      upload_frontend: true
+      run_frontend: false
+
+  frontend:
+    needs: release-info
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CI: 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.release-info.outputs.git_sha }}
+
+      - name: Validate and build frontend
+        uses: ./.github/actions/build-frontend
+        with:
+          upload-artifact: 'true'

  build-docker-binary:
    name: build-docker-binary (${{ matrix.os }}-${{ matrix.arch }})
@@ -194,10 +211,10 @@ jobs:
            ~/.cargo/registry
            ~/.cargo/git
            backend/target
-          key: cargo-v2-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml') }}-${{ needs.release-info.outputs.git_sha }}
+          # 按目标、工具链和依赖保存，不为每个发行提交复制整个 target
+          key: cargo-v3-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', '.github/workflows/release.yml') }}
          restore-keys: |
-            cargo-v2-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml') }}
-            cargo-v2-${{ runner.os }}-${{ matrix.target }}-
+            cargo-v3-${{ runner.os }}-${{ matrix.target }}-

      - name: Build binary
        shell: bash
@@ -260,10 +277,9 @@ jobs:
            ~/.cargo/registry
            ~/.cargo/git
            backend/target
-          key: cargo-v2-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml') }}-${{ needs.release-info.outputs.git_sha }}
+          key: cargo-v3-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', '.github/workflows/release.yml') }}
          restore-keys: |
-            cargo-v2-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml') }}
-            cargo-v2-${{ runner.os }}-${{ matrix.target }}-
+            cargo-v3-${{ runner.os }}-${{ matrix.target }}-

      - name: Build binary
        shell: bash
@@ -287,7 +303,7 @@ jobs:
          retention-days: 1

  package-assets:
-    needs: [release-info, quality, build-docker-binary, build-binary]
+    needs: [release-info, frontend, build-docker-binary, build-binary]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
@@ -443,7 +459,7 @@ jobs:

  build-docker-image:
    name: build-docker-image (${{ matrix.dockerPlatform }})
-    needs: [release-info, quality, build-docker-binary, package-assets]
+    needs: [release-info, build-docker-binary, package-assets]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.release-info.outputs.docker_matrix) }}
@@ -601,7 +617,8 @@ jobs:
          retention-days: 1

  publish:
-    needs: [release-info, package-assets, build-docker-image]
+    # 产物准备可与测试重叠，版本标签和 GitHub Release 必须等全部质量与镜像验证通过
+    needs: [release-info, quality, package-assets, build-docker-image]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
@@ -1,4 +1,4 @@
-name: Agent Instructions Guard
+name: Rules Guard

 on:
  pull_request_target:
@@ -13,7 +13,7 @@ permissions:
  pull-requests: write

 concurrency:
-  group: agents-md-guard-${{ github.event.pull_request.number }}
+  group: rules-${{ github.event.pull_request.number }}
  cancel-in-progress: false

 jobs:
@@ -22,7 +22,7 @@ jobs:
    timeout-minutes: 5
    steps:
      # 只查询 PR 元数据，禁止检出或执行贡献分支中的代码。
-      - name: Enforce agent instructions policy
+      - name: Check protected files
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
@@ -33,12 +33,15 @@ jobs:
              ...params,
              per_page: 100,
            });
-            const isInstructions = path => typeof path === 'string'
-              && (path === 'AGENTS.md' || path.endsWith('/AGENTS.md'));
+            const isProtectedRule = path => typeof path === 'string'
+              && (path === 'AGENTS.md' || path.endsWith('/AGENTS.md')
+                || path === 'CONTRIBUTING.md'
+                || path === '.agents/skills' || path.startsWith('.agents/skills/')
+                || path === '.github' || path.startsWith('.github/'));

            // 同时检查重命名前后的路径，避免通过移走规则文件绕过检查。
-            if (!files.some(file => isInstructions(file.filename) || isInstructions(file.previous_filename))) {
-              core.info('No agent instruction changes detected.');
+            if (!files.some(file => isProtectedRule(file.filename) || isProtectedRule(file.previous_filename))) {
+              core.info('No protected contribution rule changes detected.');
              return;
            }

@@ -49,27 +52,31 @@ jobs:
              return;
            }

+            // 通知标记保持稳定，以便复用机器人已有评论，避免重复提醒
            const marker = '<!-- agents-md-guard -->';
            const body = [
              marker,
-              '此 PR 修改了 `AGENTS.md`，已按贡献规则关闭。',
+              '佬友，我看到这个 PR 涉及受保护的协作规则文件，按仓库约定需要先关闭',
              '',
-              'PR 不接受根目录或子目录中 `AGENTS.md` 的新增、修改、删除或重命名。',
-              '请撤销相关变更后重新打开 PR；如需调整协作规则，请先提交 Issue 说明原因和建议，由维护者处理。',
+              '保护范围包括根目录或子目录的 `AGENTS.md`、根目录的 `CONTRIBUTING.md`，以及 `.agents/skills/` 和 `.github/` 中的所有文件，涵盖新增、修改、删除和重命名',
+              '',
+              '麻烦先撤销这些变更，再重新打开 PR；如果希望调整协作规则，可以先提个 Issue 说明原因和建议，交由维护者处理，感谢理解',
            ].join('\n');

            try {
              const comments = await github.paginate(github.rest.issues.listComments, {
                owner, repo, issue_number: pr.number, per_page: 100,
              });
-              const notified = comments.some(comment => comment.user?.login === 'github-actions[bot]'
+              const notification = comments.find(comment => comment.user?.login === 'github-actions[bot]'
                && comment.body?.includes(marker));
-              if (!notified) {
+              if (!notification) {
                await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body });
+              } else if (notification.body !== body) {
+                await github.rest.issues.updateComment({ owner, repo, comment_id: notification.id, body });
              }
            } catch (error) {
              core.warning(`Unable to post policy explanation: ${error.message}`);
            }

            await github.rest.pulls.update({ ...params, state: 'closed' });
-            core.setFailed('Pull requests must not change AGENTS.md.');
+            core.setFailed('Pull requests must not change protected contribution rules (AGENTS.md, CONTRIBUTING.md, .agents/skills/, .github/).');
@@ -1,4 +1,4 @@
-name: Security Scan
+name: Security

 on:
  push:
@@ -14,7 +14,7 @@ permissions:
  contents: read

 concurrency:
-  group: security-scan-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
+  group: security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

 jobs: