ci: 修复三阶段效率改造合并后审计问题

.github/workflows/ci-bootstrap-validation.yml

@@ -14,6 +14,7 @@ on:
       - "docs/development-efficiency-phase3.md"
       - "backend/tests/test_ci_plan.py"
       - "backend/tests/test_required_gate.py"
+      - "backend/docker-bake.ci.hcl"
       - "scripts/build_skill_evaluation.py"
       - "scripts/ci_plan.py"
       - "scripts/ci_summary.py"
@@ -23,6 +24,10 @@ on:
 # Governance changes cannot pass the normal Required Gate. This separate,
 # PR-triggered full suite supplies eligible checks for maintainer Bootstrap.
 # It never publishes the Required Gate status or changes the branch ruleset.
+concurrency:
+  group: ci-bootstrap-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/compose-ci.yml

@@ -249,7 +249,7 @@ jobs:
             flowtest-backend flowtest-worker flowtest-worker-data flowtest-worker-ai flowtest-beat \
             flowtest-frontend flowtest-worker-performance flowtest-worker-environment \
             flowtest-environment-docker \
-            flowtest-mock-target flowtest-grpc-target flowtest-postgres-walg:17.6-v3.0.8; do
+            flowtest-mock-target flowtest-grpc-target flowtest-postgres-walg:17.11-v3.0.9-patched; do
             test "$(docker image inspect "${image}" --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}')" = "${BUILD_SHA}"
             test "$(docker image inspect "${image}" --format '{{.Os}}/{{.Architecture}}')" = 'linux/amd64'
             docker image inspect "${image}" --format '{{.RepoTags}} {{.Id}} {{.Os}}/{{.Architecture}}'

.github/workflows/pr-validation.yml

@@ -5,9 +5,10 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled, edited]
 
-# Label runs have their own group: an unrelated label event must not cancel a valid run.
+# Only ignored metadata events use a separate group. Effective label changes and
+# new heads replace the active run for the same PR.
 concurrency:
-  group: pr-validation-${{ github.event.pull_request.number }}-${{ (github.event.action == 'labeled' || github.event.action == 'unlabeled' || github.event.action == 'edited') && github.run_id || 'head' }}
+  group: pr-validation-${{ github.event.pull_request.number }}-${{ (((github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.event.label.name != 'ci:light' && github.event.label.name != 'ci:milestone') || (github.event.action == 'edited' && !github.event.changes.base)) && 'ignored' || 'active' }}
   cancel-in-progress: true
 
 permissions:
@@ -41,11 +42,11 @@ jobs:
 
   quick:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'quick') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'quick') }}
     uses: ./.github/workflows/quick-ci.yml
   backend-standard:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'backend-standard') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'backend-standard') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -82,11 +83,11 @@ jobs:
 
   backend-full:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'backend-full') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'backend-full') }}
     uses: ./.github/workflows/backend-ci.yml
   frontend-standard:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'frontend-standard') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'frontend-standard') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -120,33 +121,67 @@ jobs:
 
   frontend-full:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'frontend-full') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'frontend-full') }}
     uses: ./.github/workflows/frontend-ci.yml
   compose:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'compose') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'compose') }}
     uses: ./.github/workflows/compose-ci.yml
   security:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'security') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'security') }}
     uses: ./.github/workflows/security-ci.yml
   windows:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'windows') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'windows') }}
     uses: ./.github/workflows/standalone-windows.yml
   upgrade:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'upgrade') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'upgrade') }}
     uses: ./.github/workflows/upgrade-ci.yml
   skills:
     needs: plan
-    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'skills') }}
+    if: ${{ !fromJSON(needs.plan.outputs.plan).governance_change && contains(fromJSON(needs.plan.outputs.plan).required, 'skills') }}
     uses: ./.github/workflows/skills-ci.yml
 
+  compact:
+    needs: plan
+    if: ${{ contains(fromJSON(needs.plan.outputs.plan).required, 'compact') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Start six-service Compact stack
+        run: ./deploy/compact/start.sh
+      - name: Verify Compact business flow on this PR revision
+        run: |
+          set -a
+          source deploy/compact/.env
+          set +a
+          FLOWTEST_SMOKE_API_URL=http://127.0.0.1:3000/api/v1 \
+          FLOWTEST_SMOKE_ADMIN_EMAIL="${FLOWTEST_BOOTSTRAP_ADMIN_EMAIL}" \
+          FLOWTEST_SMOKE_ADMIN_PASSWORD="${FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD}" \
+          FLOWTEST_SMOKE_TARGET_URL=http://backend:8000/api/v1 \
+            python3 scripts/smoke_s32.py
+      - name: Print Compact logs on failure
+        if: failure()
+        run: |
+          if [[ -f deploy/compact/.env ]]; then
+            docker compose --env-file deploy/compact/.env -f deploy/compact/compose.yaml logs --no-color --tail=300
+          fi
+      - name: Stop Compact stack
+        if: always()
+        run: |
+          if [[ -f deploy/compact/.env ]]; then
+            docker compose --env-file deploy/compact/.env -f deploy/compact/compose.yaml down --volumes
+          fi
+
   shadow:
     name: PR Validation Shadow ${{ github.sha }} ${{ needs.plan.outputs.fingerprint }}
     if: ${{ always() && (github.event.action != 'labeled' && github.event.action != 'unlabeled' && github.event.action != 'edited' || github.event.label.name == 'ci:light' || github.event.label.name == 'ci:milestone' || github.event.changes.base) }}
-    needs: [plan, quick, backend-standard, backend-full, frontend-standard, frontend-full, compose, security, windows, upgrade, skills]
+    needs: [plan, quick, backend-standard, backend-full, frontend-standard, frontend-full, compose, security, windows, upgrade, skills, compact]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/required-gate.yml

@@ -5,6 +5,15 @@ on:
     workflows: [PR Validation]
     types: [requested, in_progress, completed]
 
+# Serialize all wakeups for a candidate Head. Keep completed wakeups queued so
+# a late pending handler cannot replace the terminal result.
+# GitHub documents queue: max for workflow-level concurrency:
+# https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency
+concurrency:
+  group: required-gate-${{ github.event.workflow_run.head_sha }}
+  queue: max
+  cancel-in-progress: false
+
 permissions:
   actions: read
   contents: read

.github/workflows/security-ci.yml

@@ -75,7 +75,7 @@ jobs:
           for image in \
             flowtest-backend:ci flowtest-frontend:ci flowtest-performance:ci \
             flowtest-environment:ci flowtest-environment-daemon:ci \
-            flowtest-runner:ci flowtest-mock-target:ci; do
+            flowtest-runner:ci flowtest-mock-target:ci flowtest-postgres-walg:17.11-v3.0.9-patched; do
             test "$(docker image inspect "${image}" --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}')" = "${BUILD_SHA}"
             test "$(docker image inspect "${image}" --format '{{.Os}}/{{.Architecture}}')" = 'linux/amd64'
             docker image inspect "${image}" --format '{{.RepoTags}} {{.Id}} {{.Os}}/{{.Architecture}}'
@@ -156,3 +156,12 @@ jobs:
           output-format: table
           grype-version: v0.116.1
           config: .grype.yaml
+      - name: Scan Postgres WALG image
+        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        with:
+          image: flowtest-postgres-walg:17.11-v3.0.9-patched
+          severity-cutoff: high
+          only-fixed: true
+          output-format: table
+          grype-version: v0.116.1
+          config: .grype.yaml

backend/docker-bake.ci.hcl

@@ -73,7 +73,7 @@ target "postgres" {
 }
 
 group "ci-security" {
-  targets = ["backend", "frontend", "worker-performance", "worker-environment", "environment-docker", "runner-agent-a", "mock-target"]
+  targets = ["backend", "frontend", "worker-performance", "worker-environment", "environment-docker", "runner-agent-a", "mock-target", "postgres"]
 }
 
 group "ci-compose" {