实现 Registry v1 检查与修复 #86
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| secrets: | |
| name: Full-history secret scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Gitleaks and scan changed commits | |
| uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| GITLEAKS_VERSION: "8.30.1" | |
| GITLEAKS_ENABLE_COMMENTS: "false" | |
| GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false" | |
| - name: Scan all Git history | |
| run: gitleaks git . --config .gitleaks.toml --redact --log-opts=--all | |
| python: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| python-version: ["3.10", "3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Configure git identity | |
| run: | | |
| git config --global user.email "ci@cc-port" | |
| git config --global user.name "cc-port-ci" | |
| - name: Install | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" | |
| - name: Lint | |
| run: ruff check src/cc_port tests | |
| - name: Test (includes Markdown link validation) | |
| run: pytest -q | |
| desktop: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: desktop | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: npm | |
| cache-dependency-path: desktop/package-lock.json | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| - name: Type-check and build | |
| run: npm run build | |
| - name: Test frontend | |
| run: npm test | |
| tauri: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Stage Tauri sidecar placeholder | |
| shell: pwsh | |
| run: | | |
| $sidecarPath = "desktop/src-tauri/binaries/cc-port-desktop-api-x86_64-pc-windows-msvc.exe" | |
| New-Item -ItemType Directory -Path (Split-Path -Parent $sidecarPath) -Force | Out-Null | |
| New-Item -ItemType File -Path $sidecarPath -Force | Out-Null | |
| - name: Verify acknowledged glib advisory is absent from Windows target | |
| shell: pwsh | |
| run: | | |
| $tree = cargo tree --manifest-path desktop/src-tauri/Cargo.toml --locked --target x86_64-pc-windows-msvc | |
| if ($tree | Select-String -SimpleMatch "glib v0.18.5") { | |
| throw "GHSA-wrw7-89jp-8q8g entered the supported Windows target graph." | |
| } | |
| - name: Check Tauri backend | |
| run: cargo check --manifest-path desktop/src-tauri/Cargo.toml |