From d2e282030be61cd087e3027f99edc7488b2b7ed1 Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 27 May 2026 21:14:52 +0800 Subject: [PATCH] ci: make github actions manual only --- .github/workflows/build.yml | 3 +-- .github/workflows/dependency-audit.yml | 4 ---- .github/workflows/lint.yml | 3 +-- .github/workflows/playwright.yml | 8 +------- README.md | 3 ++- docs/delivery-readiness-audit.md | 2 +- docs/dependency-risk-register.md | 2 +- docs/operations.md | 4 ++-- docs/release-readiness.md | 6 +++--- 9 files changed, 12 insertions(+), 23 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 452178ea7..1db70f80d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,8 +1,7 @@ name: Production Build on: - push: - pull_request: + workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index dbe9b1d81..04d75a82b 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -1,10 +1,6 @@ name: Dependency Audit on: - push: - pull_request: - schedule: - - cron: "17 3 * * 1" workflow_dispatch: permissions: diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index add69f2ad..ec8bc40fc 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -1,8 +1,7 @@ name: Quality Gates on: - push: - pull_request: + workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml index 725c9ea16..eea556392 100644 --- a/.github/workflows/playwright.yml +++ b/.github/workflows/playwright.yml @@ -1,9 +1,6 @@ name: Playwright Tests on: - push: - branches: [main, master] - pull_request: - branches: [main, master] + workflow_dispatch: permissions: contents: read @@ -16,9 +13,6 @@ jobs: test: timeout-minutes: 30 runs-on: ubuntu-22.04 - if: >- - github.event_name == 'push' || - github.event.pull_request.head.repo.full_name == github.repository env: AUTH_SECRET: ${{ secrets.AUTH_SECRET }} POSTGRES_URL: ${{ secrets.POSTGRES_URL }} diff --git a/README.md b/README.md index 55809b878..d86270d6b 100644 --- a/README.md +++ b/README.md @@ -118,7 +118,7 @@ components/home/lovart/ Lovart home focused render sections lib/ DB, AI providers, storage, observability, domain logic docs/ Deployment, operations, architecture and feature notes tests/ Playwright e2e and route-level tests -.github/workflows/ Quality gates, dependency audit and Playwright CI +.github/workflows/ Manual quality gates, dependency audit and Playwright CI ``` ## 部署与运维 @@ -126,6 +126,7 @@ tests/ Playwright e2e and route-level tests - 生产部署建议使用受控反向代理，并只在 Host 头可信时设置 `AUTH_TRUST_HOST=true`。 - 首页公开接口应保持快速返回，慢数据库或外部服务异常时返回缓存或 fallback。 - 生产日志默认通过 `LOG_LEVEL=info` 控制，敏感字段会被 `lib/observability` 脱敏。 +- GitHub Actions workflow 默认只允许手动触发，避免私有仓库免费额度被 push 自动消耗。 - Dependency Audit workflow 独立守住 high/critical 依赖审计基线，避免安全回归只靠人工发现。 - Playwright workflow 独立于基础质量门禁，避免把密钥依赖和 e2e 成本混入每次 lint/typecheck。 diff --git a/docs/delivery-readiness-audit.md b/docs/delivery-readiness-audit.md index a7294b50e..9d71a78ed 100644 --- a/docs/delivery-readiness-audit.md +++ b/docs/delivery-readiness-audit.md @@ -58,7 +58,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm verify:release - Push 当前分支到 GitHub。 - 创建 PR，并在 PR 描述中粘贴本地验证证据。 -- 等待 GitHub Actions：基础质量门禁、Production Build、Dependency Audit、Playwright workflow。 +- 如需远端验证，手动触发 GitHub Actions：基础质量门禁、Production Build、Dependency Audit、Playwright workflow。 - 根据 PR diff 做最后一次人工审查；如 GitHub Actions 与本地结果不一致，以远端 CI 为准处理。 ## 当前不包含的范围 diff --git a/docs/dependency-risk-register.md b/docs/dependency-risk-register.md index 1206228d3..9dbb82017 100644 --- a/docs/dependency-risk-register.md +++ b/docs/dependency-risk-register.md @@ -17,7 +17,7 @@ pnpm --silent audit:security:json > audit-security.json The explicit registry is intentional. Some mirrors do not implement the npm audit endpoint, which makes audit fail for infrastructure reasons rather than project reasons. Use `pnpm --silent audit:security:json` when another script needs machine-readable JSON without pnpm's script header. -GitHub Actions also runs `.github/workflows/dependency-audit.yml` on push, pull request, weekly schedule and manual dispatch. Keep that workflow independent from the fast quality gate so registry or network issues do not hide lint/typecheck feedback. +GitHub Actions can run `.github/workflows/dependency-audit.yml` through manual dispatch. Keep that workflow independent from the fast quality gate so registry or network issues do not hide lint/typecheck feedback. The private repository currently avoids automatic Actions triggers to preserve the free quota. ## Current Snapshot diff --git a/docs/operations.md b/docs/operations.md index b4e6ff60b..628000cca 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -64,7 +64,7 @@ REQUIRE_UP_TO_DATE=true pnpm check:branch CI 和本地提交前检查复用同一个入口，避免规则漂移。 -`.github/workflows/dependency-audit.yml` 独立运行 `pnpm audit:security`，在 push、pull request、每周定时任务和手动触发时守住 high/critical 依赖审计基线。它不依赖任何 secret，避免开源 PR 因环境变量缺失误失败。 +`.github/workflows/dependency-audit.yml` 独立运行 `pnpm audit:security`，通过手动触发守住 high/critical 依赖审计基线。它不依赖任何 secret；当前私有仓库采用手动 CI 策略，避免 push 自动消耗 GitHub Actions 免费额度。 `.github/workflows/build.yml` 独立运行 `pnpm build`，验证生产构建、Next.js route collection 和静态/动态页面边界。该 workflow 使用占位环境变量，不连接真实数据库；数据库迁移仍由部署流程显式执行。 @@ -79,7 +79,7 @@ pnpm audit:security pnpm audit:security:json ``` -`pnpm audit:security` 显式使用官方 npm registry，避免镜像源缺少 audit endpoint 导致误失败。当前依赖安全债务记录在 [dependency-risk-register.md](dependency-risk-register.md)。本命令不嵌入 `pnpm check:quality`，而是由独立 Dependency Audit workflow 持续执行，避免网络型 registry 故障拖垮基础 lint/typecheck 反馈。 +`pnpm audit:security` 显式使用官方 npm registry，避免镜像源缺少 audit endpoint 导致误失败。当前依赖安全债务记录在 [dependency-risk-register.md](dependency-risk-register.md)。本命令不嵌入 `pnpm check:quality`，而是由独立 Dependency Audit workflow 手动执行，避免网络型 registry 故障拖垮基础 lint/typecheck 反馈。 ## 日志治理 diff --git a/docs/release-readiness.md b/docs/release-readiness.md index 423e747d0..2dca18e18 100644 --- a/docs/release-readiness.md +++ b/docs/release-readiness.md @@ -16,7 +16,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm verify:release - `pnpm check:quality` 通过 lint、日志脱敏门禁、公开交付面品牌治理、CI hygiene、环境变量示例卫生、secret hygiene、package metadata、测试门禁卫生、轻量 helper 回归测试、类型检查、diff hygiene 和 tracked 污染物检查。 - `pnpm check:branch` 确认当前分支相对 `github/main` 没有 dry-run merge 冲突；behind main 会提示为 warning，发布前可用 `REQUIRE_UP_TO_DATE=true` 提升为失败。 -- `pnpm audit:security` 输出已审计，Dependency Audit workflow 也应通过；若仍有 critical/high，必须在 [dependency-risk-register.md](dependency-risk-register.md) 中记录 remediation 或风险接受状态。 +- `pnpm audit:security` 输出已审计；如手动运行 Dependency Audit workflow，也应通过。若仍有 critical/high，必须在 [dependency-risk-register.md](dependency-risk-register.md) 中记录 remediation 或风险接受状态。 - `pnpm build` 完成生产构建，验证 Next.js route collection、静态/动态页面边界和构建期 TypeScript。 - `pnpm smoke:routes` 验证 `/` 返回 200。 - `/classic` 和 `/chat/test-id` 重定向到 `/`。 @@ -30,7 +30,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm verify:release - `/settings` 本地 AI 设置已组件化，保存 key、SWR key 和业务 API 保持稳定。 - 首页采用轻量壳优先渲染，个性化和公开数据渐进加载。 - 高风险日志链路已纳入 `pnpm check:logs`，禁止回流裸 `console.*`。 -- CI 基础门禁与本地 `pnpm check:quality` 使用同一套污染物检查脚本；Dependency Audit workflow 独立守住 high/critical 依赖审计基线。 +- CI 基础门禁与本地 `pnpm check:quality` 使用同一套污染物检查脚本；GitHub Actions 当前采用手动触发，避免私有仓库免费额度被自动消耗。 - 安全披露、敏感信息和日志规则以根目录 `SECURITY.md` 为准。 - 分支、提交、PR 和验证要求以根目录 `CONTRIBUTING.md` 为准。 @@ -43,7 +43,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm verify:release ## 已知后续专项 -- 远端 GitHub Actions 实跑结果需要在 push/PR 后确认。 +- 远端 GitHub Actions 实跑结果需要在手动触发 workflow 后确认。 - 当前依赖 audit baseline 已清除 critical/high；moderate/low 和未来 advisories 继续通过 [dependency-risk-register.md](dependency-risk-register.md) 跟踪。 - Enhance、Angle Edit、Prompt Optimizer 等历史接口仍可继续分批纳入日志门禁。 - Canvas/Agent 少数大型历史模块仍可继续领域化拆分，但不阻塞当前交付基线。