agent-bot
ee1e53b510
Root causes of the remaining 5 CI PG failures (and the hidden flaky set):
1. All PG-integration packages shared ONE database under parallel package
execution - migrations/seeds/truncates raced (nondeterministic failure
sets, locally and in CI).
Fix: RequireTestDatabaseURL/SkipIfNoTestDatabaseURL now derive a
per-package database (<base>_<pkgHash>, advisory-lock-guarded
CREATE); 9 raw-env straggler tests funnelled through the helpers;
db-package tests call it unqualified (no import cycle).
2. Approval-chain fixtures were not production-shaped: freezeReviewSnapshot
only honors head_snapshot_id, fake content hashes never froze a
snapshot, so ApproverApprove rejected with 'approved requires frozen
review_snapshot_id'. Errors were swallowed (_, _ =) hiding this.
Fix (ownership-respecting, arch-enforced):
- docrevision.SeedContentSnapshotForTest seeds the ledger tables it owns
- docgov GovernanceEngine.FreezeHeadSnapshotForTest freezes head/review
pointers on document_records (docgov-owned) and clears engine cache
- all four integration fixtures use the pair; swallowed errors checked
3. Fixed-name fixtures collide once a package shares one DB (projects
uq_projects_name_global): uniquified in projectinstance + server tests.
4. CAS/ctxmgr tests never bootstrapped migrations (relied on other packages
having migrated the shared DB): explicit RunMigrationsOnceForTest.
Verified: full parallel short suite = 75 packages, 0 failures against an
isolated throwaway PG. CI skip list removed - short tests fully required.
125 lines
3.8 KiB
YAML
125 lines
3.8 KiB
YAML
# QA-001: main/test/dev 合并门禁 — go vet、短测、迁移校验、前端测试
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [dev, test, main]
|
|
pull_request:
|
|
branches: [dev, test, main]
|
|
|
|
jobs:
|
|
go-vet:
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: pgvector/pgvector:pg16
|
|
env:
|
|
POSTGRES_USER: app
|
|
POSTGRES_PASSWORD: ci_secret_db_pass
|
|
POSTGRES_DB: agent_system_ci
|
|
options: >-
|
|
--health-cmd "pg_isready -U app -d agent_system_ci"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.27.1"
|
|
cache-dependency-path: go.sum
|
|
|
|
- name: go vet
|
|
run: go vet ./...
|
|
|
|
- name: migration gate
|
|
env:
|
|
TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
|
|
run: go test -count=1 -run TestMigrationGate ./internal/db/...
|
|
|
|
|
|
- name: arch-check (block cleared kinds)
|
|
run: ./scripts/arch-check.sh --mode block
|
|
|
|
- name: go test (short, required)
|
|
env:
|
|
TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
|
|
run: go test -short -timeout 20m ./...
|
|
|
|
- name: secrets scan (tracked files)
|
|
run: |
|
|
bad=$(git ls-files | grep -Ei '(^|/)(\.env|.*\.(pem|key|p12|sqlite|sqlite3))$' || true)
|
|
if [ -n "$bad" ]; then echo "tracked secret-like files:"; echo "$bad"; exit 1; fi
|
|
|
|
|
|
backup-restore-drill:
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: pgvector/pgvector:pg16
|
|
env:
|
|
POSTGRES_USER: app
|
|
POSTGRES_PASSWORD: ci_secret_db_pass
|
|
POSTGRES_DB: agent_system_ci
|
|
options: >-
|
|
--health-cmd "pg_isready -U app -d agent_system_ci"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.27.1"
|
|
cache-dependency-path: go.sum
|
|
|
|
- name: install postgresql client
|
|
run: sudo apt-get update && sudo apt-get install -y postgresql-client
|
|
|
|
- name: migrate and seed schema
|
|
env:
|
|
TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
|
|
run: go test -count=1 -run TestMigrationGate ./internal/db/...
|
|
|
|
- name: pg_dump backup
|
|
env:
|
|
PGPASSWORD: ci_secret_db_pass
|
|
run: |
|
|
pg_dump -h postgres -U app -d agent_system_ci -Fc -f /tmp/system_ci.dump
|
|
pg_restore --list /tmp/system_ci.dump >/dev/null
|
|
|
|
- name: restore to fresh database and re-run migrations
|
|
env:
|
|
PGPASSWORD: ci_secret_db_pass
|
|
TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci_restore?sslmode=disable
|
|
run: |
|
|
psql -h postgres -U app -d postgres -c "DROP DATABASE IF EXISTS agent_system_ci_restore;"
|
|
psql -h postgres -U app -d postgres -c "CREATE DATABASE agent_system_ci_restore;"
|
|
pg_restore -h postgres -U app -d agent_system_ci_restore --no-owner --no-privileges /tmp/system_ci.dump
|
|
go test -count=1 -run 'TestMigrationGate|TestPhase5_BackupRestoreMigration_PG' ./internal/db/... ./internal/server/...
|
|
|
|
web:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: web
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
cache-dependency-path: web/package-lock.json
|
|
|
|
- name: npm ci
|
|
run: npm ci
|
|
|
|
- name: npm test
|
|
run: npm test
|
|
|
|
- name: npm build
|
|
run: npm run build
|