Repository navigation
sync: taiji 定制版同步最新基线 8d810b99e（LegionCard 样式统一 + 群聊 P0 修复） #5053
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - '**/*.md' | |
| - 'png/**' | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - '**/*.md' | |
| - 'png/**' | |
| # Cancel previous runs on same branch/PR | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| # ── Shell deploy assets: LF endings + syntax ─────────────────────── | |
| # Relay one-click deploy embeds these scripts into the Desktop binary and | |
| # uploads them verbatim to a Linux host, where a single CR aborts the deploy | |
| # with `$'\r': command not found`. .gitattributes pins LF; this is the guard. | |
| shell-scripts: | |
| name: Shell Deploy Scripts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version-file: package.json | |
| package-manager-cache: false | |
| - name: Reject CRLF in shell and deploy assets | |
| run: | | |
| bad=$(git ls-files -z \ | |
| '*.sh' '*.bash' 'Dockerfile' 'Dockerfile.*' '*.Dockerfile' 'Caddyfile' \ | |
| 'docker-compose.yml' 'docker-compose.*.yml' \ | |
| | xargs -0 -r grep -lU $'\r' || true) | |
| if [ -n "$bad" ]; then | |
| echo "::error::CRLF line endings found; these must stay LF (see .gitattributes):" | |
| echo "$bad" | |
| exit 1 | |
| fi | |
| echo "All shell and deploy assets are LF-only." | |
| - name: bash -n every tracked shell script | |
| run: | | |
| rc=0 | |
| while IFS= read -r -d '' f; do | |
| bash -n "$f" || { echo "::error file=$f::bash syntax error"; rc=1; } | |
| done < <(git ls-files -z '*.sh' '*.bash') | |
| exit "$rc" | |
| - name: Verify release and version-generation contracts | |
| run: node --test scripts/tauri-release-manifest.test.mjs scripts/linux-binaries-manifest.test.mjs scripts/version-generation.test.mjs | |
| - name: Verify minisign download fallback | |
| run: | | |
| set -euo pipefail | |
| test_root="$(mktemp -d)" | |
| trap 'rm -rf "$test_root"' EXIT | |
| mkdir -p "$test_root/stubs" | |
| printf '#!/usr/bin/env bash\nexit 1\n' >"$test_root/stubs/sudo" | |
| chmod +x "$test_root/stubs/sudo" | |
| PATH="$test_root/stubs:/usr/bin:/bin" \ | |
| RUNNER_TEMP="$test_root" \ | |
| BITFUN_SIGNING_KEY="YQ==" \ | |
| bash scripts/sign-release-assets.sh "$test_root/missing-asset" | |
| "$test_root/bitfun-minisign-0.12/bin/minisign" -v | |
| # ── CLI: independent tests ───────────────────────────────────────── | |
| cli-test: | |
| name: CLI Tests (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| env: | |
| # Same warning gate as rust-build-check. | |
| RUSTFLAGS: "-D warnings" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| cache_key: ubuntu | |
| - os: macos-15 | |
| cache_key: macos | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Install Linux system dependencies | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| pkg-config \ | |
| build-essential \ | |
| libssl-dev \ | |
| libxcb1-dev \ | |
| libxcb-render0-dev \ | |
| libxcb-shape0-dev \ | |
| libxcb-xfixes0-dev | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "cli-ci-v2-${{ matrix.cache_key }}" | |
| cache-bin: false | |
| # PRs restore trusted caches but never publish merge-ref artifacts. | |
| save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| - name: Run CLI and ACP tests on macOS | |
| if: runner.os == 'macOS' | |
| run: cargo test --locked -p bitfun-cli -p bitfun-acp | |
| - name: Run CLI, ACP, and agent runtime tests | |
| if: runner.os == 'Linux' | |
| run: cargo test --locked -p bitfun-cli -p bitfun-acp -p bitfun-agent-runtime | |
| - name: Run SDK Host tests | |
| if: runner.os == 'Linux' | |
| run: cargo test --locked -p bitfun-sdk-host -p bitfun-sdk-host-app | |
| - name: Run SDK Host terminal cleanup regressions | |
| if: runner.os == 'Linux' | |
| run: | | |
| cargo test --locked -p terminal-core shutdown_returns_only_after_process_exit_is_confirmed -- --test-threads=1 | |
| cargo test --locked -p terminal-core shutdown_evicts_a_process_whose_controller_already_confirmed_exit -- --test-threads=1 | |
| cargo test --locked -p terminal-core background_only_binding_is_owned_by_the_session -- --test-threads=1 | |
| # ── Rust: build check ───────────────────────────────────────────── | |
| # Cargo-deny gate: advisories + licenses + sources (+ bans at warn level). | |
| # Kept on Linux only - the license/source graph is OS-independent, so a | |
| # single check covers the whole workspace without triplicating the run. | |
| cargo-deny: | |
| name: Cargo Deny (advisories + licenses) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "cargo-deny-v1" | |
| cache-bin: false | |
| - name: Install cargo-deny | |
| run: cargo install cargo-deny --locked --version 0.20.2 | |
| - name: Deny advisories | |
| run: cargo deny check advisories | |
| - name: Deny licenses | |
| # -A no-license-field silences the diagnostic for crates that declare | |
| # `license-file` instead of the SPDX `license` expression field | |
| # (display-info 0.4.8 via screenshots); the actual LICENSE text is | |
| # still parsed and gated by the allow list below. | |
| run: cargo deny check licenses -A no-license-field | |
| - name: Deny sources | |
| run: cargo deny check sources | |
| rust-build-check: | |
| name: Rust Build Check (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| # Rust workspace check + 6 test groups across 3 OS; generous but bounded | |
| # so a wedged dependency/network cannot burn the full 6h default. | |
| timeout-minutes: 60 | |
| env: | |
| # Keep the workspace check plus desktop test profiles within hosted-runner disk limits. | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_PROFILE_DEV_DEBUG: "0" | |
| CARGO_PROFILE_TEST_DEBUG: "0" | |
| # Warning gate: any rustc warning (dead code, unused imports, ...) fails | |
| # the build, so a warning regression cannot re-enter silently. The | |
| # linker_messages lint intentionally ignores -D warnings (see workspace | |
| # lints), so MSVC link noise stays non-fatal. | |
| RUSTFLAGS: "-D warnings" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-15 | |
| - windows-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| # Tauri code generation only requires its configured resource roots to | |
| # exist during check/test; distributable assets remain frontend-build's owner. | |
| - name: Create Tauri resource directories | |
| shell: bash | |
| run: mkdir -p dist src/mobile-web/dist | |
| - name: Install Linux system dependencies (Tauri) | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| sudo apt-get update | |
| if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then | |
| WEBKIT_PKG=libwebkit2gtk-4.1-dev | |
| else | |
| WEBKIT_PKG=libwebkit2gtk-4.0-dev | |
| fi | |
| if apt-cache show libappindicator3-dev >/dev/null 2>&1; then | |
| APPINDICATOR_PKG=libappindicator3-dev | |
| else | |
| APPINDICATOR_PKG=libayatana-appindicator3-dev | |
| fi | |
| sudo apt-get install -y --no-install-recommends \ | |
| pkg-config \ | |
| libglib2.0-dev \ | |
| libgtk-3-dev \ | |
| libxdo-dev \ | |
| "$WEBKIT_PKG" \ | |
| "$APPINDICATOR_PKG" \ | |
| librsvg2-dev \ | |
| patchelf \ | |
| libleptonica-dev \ | |
| libtesseract-dev \ | |
| tesseract-ocr \ | |
| tesseract-ocr-eng | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: swatinem/rust-cache@v2 | |
| with: | |
| shared-key: "ci-check-v5-${{ runner.os }}-no-cargo-bin-v1" | |
| cache-bin: false | |
| # PR caches are scoped to merge refs; trusted main pushes own shared | |
| # refreshes and retain completed dependency builds after late test failures. | |
| save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| # sherpa-onnx-sys downloads its native static libraries from GitHub | |
| # Releases at build time. Hosted runners intermittently fail that | |
| # download (network/rate limits), so pre-fetch and extract the archive | |
| # here, then point SHERPA_ONNX_LIB_DIR at the extracted lib directory. | |
| # The build script uses that variable directly without any cache/rerun | |
| # logic, so both `cargo check` and `cargo test` link against the same | |
| # pre-fetched libraries. Windows is skipped: its archive is already | |
| # cached in the rust-cache path and the previous failures were Linux and | |
| # macOS only. | |
| - name: Pre-download sherpa-onnx native libraries | |
| if: runner.os != 'Windows' | |
| shell: bash | |
| env: | |
| SHERPA_VERSION: "1.13.4" | |
| run: | | |
| set -euo pipefail | |
| case "${{ runner.os }}" in | |
| Linux) | |
| archive="sherpa-onnx-v${SHERPA_VERSION}-linux-x64-static-lib.tar.bz2" | |
| ;; | |
| macOS) | |
| archive="sherpa-onnx-v${SHERPA_VERSION}-osx-arm64-static-lib.tar.bz2" | |
| ;; | |
| *) | |
| exit 0 | |
| ;; | |
| esac | |
| mkdir -p "$RUNNER_TEMP/sherpa-onnx-libs" | |
| archive_path="$RUNNER_TEMP/sherpa-onnx-libs/$archive" | |
| if [ ! -f "$archive_path" ]; then | |
| curl -fL --retry 5 --retry-all-errors \ | |
| "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${SHERPA_VERSION}/${archive}" \ | |
| -o "$archive_path" | |
| fi | |
| lib_dir="$RUNNER_TEMP/sherpa-onnx-libs/lib" | |
| if [ ! -d "$lib_dir" ]; then | |
| tar -xjf "$archive_path" -C "$RUNNER_TEMP/sherpa-onnx-libs" | |
| # The archive extracts to a versioned directory; its lib/ is the | |
| # native library directory the build script expects. | |
| lib_dir="$(find "$RUNNER_TEMP/sherpa-onnx-libs" -maxdepth 2 -type d -name lib | head -n 1)" | |
| fi | |
| test -n "$lib_dir" && test -f "$lib_dir/libsherpa-onnx-c-api.a" | |
| echo "SHERPA_ONNX_LIB_DIR=$lib_dir" >> "$GITHUB_ENV" | |
| # rust-cache prunes the workspace target directory before saving it, so | |
| # native libraries stored under target need an independent cache lifecycle. | |
| - name: Restore Sherpa native libraries | |
| id: sherpa-native-cache | |
| uses: actions/cache/restore@v5 | |
| with: | |
| path: target/sherpa-onnx-prebuilt | |
| key: sherpa-onnx-v1-${{ runner.os }}-${{ runner.arch }}-1.13.4-static | |
| - name: Repair missing Sherpa native state | |
| shell: bash | |
| run: | | |
| if ! find target/sherpa-onnx-prebuilt -type f \ | |
| \( -name 'sherpa-onnx-c-api.lib' -o -name 'libsherpa-onnx-c-api.a' \) \ | |
| -print -quit 2>/dev/null | grep -q .; then | |
| rm -rf target/sherpa-onnx-prebuilt | |
| cargo clean -p sherpa-onnx-sys | |
| fi | |
| - name: Check compilation | |
| run: cargo check --locked --workspace | |
| - name: Save Sherpa native libraries | |
| if: >- | |
| github.event_name == 'push' && | |
| github.ref == 'refs/heads/main' && | |
| steps.sherpa-native-cache.outputs.cache-hit != 'true' | |
| uses: actions/cache/save@v5 | |
| with: | |
| path: target/sherpa-onnx-prebuilt | |
| key: sherpa-onnx-v1-${{ runner.os }}-${{ runner.arch }}-1.13.4-static | |
| # The installer is intentionally excluded from the root Cargo workspace, | |
| # so the workspace check above cannot catch drift in its shared Rust APIs. | |
| - name: Check installer compilation | |
| if: runner.os == 'Windows' | |
| run: cargo check --manifest-path BitFun-Installer/src-tauri/Cargo.toml | |
| - name: Run core and desktop library tests | |
| run: cargo test --locked -p bitfun-core -p bitfun-desktop --lib | |
| # These crates own platform-sensitive behavior that is not exercised by | |
| # testing bitfun-core/bitfun-desktop alone. Keep their focused contract | |
| # suites in the OS matrix so Linux success cannot hide Windows/macOS | |
| # regressions in worker interruption, relay storage, or OAuth handling. | |
| - name: Run Page Functions runtime tests | |
| run: cargo test --locked -p bitfun-page-function-runtime | |
| - name: Run Relay service tests | |
| run: cargo test --locked -p bitfun-relay-service | |
| - name: Run subscription authentication tests | |
| run: cargo test --locked -p bitfun-ai-adapters --features subscription-auth --lib subscription_auth | |
| # File watching is backed by a different OS API on every platform | |
| # (ReadDirectoryChangesW / FSEvents / inotify), so watch registration | |
| # regressions surface per-OS. The suite is behind a non-default feature | |
| # and would otherwise never run anywhere. | |
| # | |
| # macOS is excluded: this suite already fails there before any of this | |
| # branch's changes (the debounce/atomic-rename contracts time out under | |
| # FSEvents coalescing), which is worth fixing separately rather than | |
| # blocking unrelated work. | |
| - name: Run file watch contract tests | |
| if: runner.os != 'macOS' | |
| run: cargo test --locked -p bitfun-services-integrations --no-default-features --features file-watch --test file_watch_contracts | |
| # Search tools resolve paths and symlinks directly, which also differs | |
| # across platforms. Scoped to the search module: the glob tests in this | |
| # crate fail on Windows independently of this branch (walk-root | |
| # derivation treats separators differently) and need their own fix. | |
| - name: Run search tool tests | |
| run: "cargo test --locked -p tool-runtime --lib search::" | |
| # ── DeepSeek Harness bridge: profile packaging on Windows ────────── | |
| # `prepare:dsh-profile` runs from `frontend:build-all` / official desktop | |
| # packaging, not from desktop:dev or cargo check. Until this job existed, | |
| # its first Windows execution ever was a release build, and it failed there | |
| # (`spawnSync npm ENOENT`: npm is a `.cmd` shim Node will not spawn without | |
| # a shell). This job is the cheapest thing that exercises the whole | |
| # packaging path — npm install, tsc, `npm pack`, tar, tree copy — on the | |
| # platform whose path and process rules differ. | |
| dsh-profile-windows: | |
| name: DSH Profile Packaging (windows-latest) | |
| runs-on: windows-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version-file: package.json | |
| package-manager-cache: false | |
| - name: Build the bridge profile | |
| run: node scripts/prepare-dsh-profile.mjs | |
| - name: Verify the profile is complete and stamped | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| root=packages/dsh-acp/dist-profile | |
| for path in \ | |
| "$root/.bitfun-bridge.json" \ | |
| "$root/cordis.patch.yml" \ | |
| "$root/package.json" \ | |
| "$root/lib/app.js" \ | |
| "$root/node_modules/@agentclientprotocol/sdk/package.json" \ | |
| "$root/node_modules/@deepseek-ai/dsh-agent-spine-demo/package.json" | |
| do | |
| [ -f "$path" ] || { echo "::error::missing $path"; exit 1; } | |
| done | |
| # A vendored tree copied with a broken separator filter drags | |
| # node_modules along; the profile resolves those from the user's own | |
| # dsh installation and must ship none of its own beyond the two above. | |
| nested=$(find "$root/lib" "$root/presets" -name node_modules -o -name '*.map' || true) | |
| if [ -n "$nested" ]; then | |
| echo "::error::profile carries files it must not ship:" | |
| echo "$nested" | |
| exit 1 | |
| fi | |
| node -e ' | |
| const stamp = require("./packages/dsh-acp/dist-profile/.bitfun-bridge.json"); | |
| if (stamp.profile !== "bitfun-acp") throw new Error("wrong profile name: " + stamp.profile); | |
| if (!/^[0-9a-f]{64}$/.test(stamp.content)) throw new Error("no content digest"); | |
| process.stdout.write(`profile ${stamp.profile} @ ${stamp.bridge}, min dsh ${stamp.minDshVersion}\n`); | |
| ' | |
| # ── Frontend: build ──────────────────────────────────────────────── | |
| frontend-build: | |
| name: Frontend Build | |
| runs-on: ubuntu-latest | |
| # Full web-ui test + build + i18n audits; bounded so a stuck install or | |
| # test cannot burn the full 6h default. | |
| timeout-minutes: 40 | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=6144 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 2 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Check repository hygiene | |
| run: pnpm run check:repo-hygiene | |
| - name: Check core boundaries | |
| run: node --test scripts/check-core-boundaries.test.mjs | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Validate PPT Live generated-file contract | |
| run: pnpm run test:ppt-live | |
| - name: Validate GitHub config | |
| run: pnpm run check:github-config | |
| - name: Select i18n contract profile | |
| shell: bash | |
| run: | | |
| if git rev-parse HEAD^1 >/dev/null 2>&1 && | |
| git diff --name-only HEAD^1 HEAD -- scripts/i18n-audit.mjs scripts/i18n-contract.test.mjs | grep -q .; then | |
| echo "BITFUN_I18N_CONTRACT_TEST_AUDIT_INTEGRATION=1" >> "$GITHUB_ENV" | |
| fi | |
| - name: Validate i18n contract | |
| run: pnpm run i18n:contract:test:ci | |
| - name: Audit i18n resources | |
| run: pnpm run i18n:audit | |
| - name: Validate theme color audit contract | |
| run: pnpm run theme:color-audit:test | |
| - name: Audit theme color governance | |
| run: pnpm run theme:color-audit:all | |
| - name: Validate theme visual governance contract | |
| run: pnpm run theme:visual-contract | |
| - name: Validate WebKit compatibility gate | |
| run: pnpm run verify:webkit-compatibility:test | |
| - name: Lint web UI | |
| # Warning gate: any eslint warning (not just errors) fails the job so | |
| # lint regressions cannot re-enter silently. | |
| run: pnpm --dir src/web-ui exec eslint . --max-warnings=0 | |
| - name: Run web UI tests | |
| run: pnpm --dir src/web-ui run test:run | |
| - name: Build web UI | |
| run: pnpm run build:web | |
| - name: Type-check mobile web | |
| run: pnpm --dir src/mobile-web run type-check | |
| - name: Build mobile web | |
| run: pnpm run build:mobile-web |