feat: 完成 TaskBridge 0.1.8 全端体验与可靠性升级 #58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: TaskBridge CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - master | |
| pull_request: | |
| branches: | |
| - main | |
| - master | |
| permissions: | |
| contents: read | |
| security-events: write | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| name: Backend tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| cache-dependency-path: | | |
| backend/requirements.txt | |
| backend/requirements-dev.txt | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements-dev.txt | |
| - name: Audit Python dependencies | |
| run: python -m pip_audit -r requirements-dev.txt | |
| - name: Run tests | |
| run: python -m pytest tests -q | |
| - name: Verify database migrations | |
| run: python -m pytest tests/test_migrations.py -q | |
| - name: Compile check | |
| run: python -m compileall -q app tests tools | |
| - name: Verify OpenAPI contract | |
| run: python -m tools.openapi_contract --check | |
| - name: Lint backend | |
| run: python -m ruff check app tests tools | |
| docker: | |
| name: Backend Docker build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Validate compose config | |
| run: | | |
| cp backend/.env.docker.example backend/.env | |
| docker compose -f backend/docker-compose.yml config | |
| - name: Build backend image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./backend | |
| file: ./backend/Dockerfile | |
| push: false | |
| load: true | |
| tags: taskbridge:ci | |
| - name: Scan backend image | |
| uses: aquasecurity/trivy-action@0.35.0 | |
| with: | |
| image-ref: taskbridge:ci | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: 'CRITICAL,HIGH' | |
| ignore-unfixed: true | |
| exit-code: '0' | |
| - name: Upload Trivy SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| security: | |
| name: Security governance | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| security-events: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Dependency review | |
| if: ${{ github.event_name == 'pull_request' }} | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: high | |
| - name: Run OpenSSF Scorecard | |
| continue-on-error: true | |
| uses: ossf/scorecard-action@v2.4.2 | |
| with: | |
| results_file: scorecard-results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload Scorecard SARIF | |
| if: ${{ always() && hashFiles('scorecard-results.sarif') != '' }} | |
| continue-on-error: true | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: scorecard-results.sarif | |
| desktop: | |
| name: Desktop build | |
| runs-on: windows-latest | |
| defaults: | |
| run: | |
| working-directory: desktop | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: desktop/package-lock.json | |
| - name: Verify version source | |
| run: node ..\scripts\check-version-source.mjs | |
| - name: Verify desktop lockfile registry metadata | |
| run: npm run check:lockfile-registry | |
| - name: Install dependencies | |
| run: npm ci | |
| env: | |
| TASKBRIDGE_SKIP_NATIVE_REBUILD: "1" | |
| - name: Audit npm dependencies | |
| run: npm audit --audit-level=high | |
| - name: Rebuild Electron native dependencies | |
| run: npm run rebuild:native | |
| - name: Verify desktop endpoint config | |
| run: npm run check:desktop-endpoint-config | |
| - name: Verify security-sensitive config | |
| run: npm run check:security-config | |
| - name: Verify auth session governance | |
| run: npm run check:auth-session-config | |
| - name: Verify backend observability config | |
| run: npm run check:backend-observability | |
| - name: Verify desktop package size config | |
| run: npm run check:package-size-config | |
| - name: Run desktop unit tests | |
| run: npm run test:unit | |
| - name: Verify quick-add parser behavior | |
| run: npm run check:quick-add-parser | |
| - name: Verify task ordering behavior | |
| run: npm run check:task-order | |
| - name: Verify sync push handling | |
| run: npm run check:sync-push | |
| - name: Verify sync diagnostics | |
| run: npm run check:sync-diagnostics | |
| - name: Verify sync recovery center | |
| run: npm run check:sync-recovery-center | |
| - name: Verify desktop backup handling | |
| run: npm run check:desktop-backup | |
| - name: Verify desktop theme config | |
| run: npm run check:desktop-theme | |
| - name: Verify desktop efficiency config | |
| run: npm run check:desktop-efficiency | |
| - name: Verify desktop docs consistency | |
| run: npm run check:desktop-docs | |
| - name: Verify local bootstrap guidance | |
| run: npm run check:local-bootstrap | |
| - name: Verify release readiness config | |
| run: npm run check:release-readiness | |
| - name: Verify release artifact config | |
| run: npm run check:release-artifacts | |
| - name: Verify production hardening config | |
| run: npm run check:production-hardening | |
| - name: Verify desktop task list completeness | |
| run: npm run check:desktop-task-list-completeness | |
| - name: Verify Android localization config | |
| run: npm run check:android-localization | |
| - name: Verify Android task delete confirmation | |
| run: npm run check:android-task-delete-confirmation | |
| - name: Verify refresh token singleflight config | |
| run: npm run check:refresh-singleflight | |
| - name: Verify registration governance config | |
| run: npm run check:registration-governance | |
| - name: Verify sync retry preservation | |
| run: npm run check:sync-retry-preservation | |
| - name: Verify Android list and realtime config | |
| run: npm run check:android-list-realtime | |
| - name: Verify release endpoint defaults | |
| run: npm run check:release-endpoint-defaults | |
| - name: Verify Android sync status message config | |
| run: npm run check:android-sync-status-message | |
| - name: Verify Android sync recovery config | |
| run: npm run check:android-sync-recovery | |
| - name: Verify CI workflow desktop coverage | |
| run: npm run check:ci-workflows | |
| - name: Verify cross-client contract drift | |
| run: npm run check:contract-drift | |
| - name: Verify source test visibility | |
| run: npm run check:source-tests-visible | |
| - name: Verify supply chain config | |
| run: npm run check:supply-chain | |
| - name: Verify desktop auto-update config | |
| run: npm run check:desktop-auto-update | |
| - name: Verify Android data extraction config | |
| run: npm run check:android-data-extraction | |
| - name: Verify security governance config | |
| run: npm run check:security-governance | |
| - name: Verify priority UX polish | |
| run: npm run check:ux-priority-polish | |
| - name: Verify cross-client user experience | |
| run: npm run check:user-experience | |
| - name: Verify Web client shell | |
| run: node ..\scripts\check-web-client.mjs | |
| - name: Run Web unit tests | |
| run: npm --prefix .. run test:web | |
| - name: Verify Web offline-first behavior | |
| run: node ..\scripts\check-web-offline-first.mjs | |
| - name: Verify Web offline core behavior | |
| run: node ..\scripts\check-web-offline-core.mjs | |
| - name: Smoke test Web client shell | |
| run: node ..\scripts\smoke-web-client.mjs | |
| - name: Build desktop app | |
| run: npm run build | |
| android: | |
| name: Android build | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: android | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Set up Gradle | |
| uses: gradle/actions/setup-gradle@v4 | |
| with: | |
| gradle-home-cache-cleanup: true | |
| - name: Make Gradle wrapper executable | |
| run: chmod +x gradlew | |
| - name: Run unit tests | |
| run: ./gradlew testDebugUnitTest -PTASKBRIDGE_USE_CHINA_MIRRORS=false --stacktrace | |
| - name: Build debug APK | |
| run: ./gradlew :app:assembleDebug -PTASKBRIDGE_USE_CHINA_MIRRORS=false --stacktrace |