212 lines
11 KiB
YAML
212 lines
11 KiB
YAML
name: CI/CD
|
|
# 三机流水线(NAS 分层验证 + VPS 单独 dispatch):
|
|
# push master → test → nas-deploy(推 NAS 后端+前端+restart) → nas-verify(API健康+数据可读)
|
|
# VPS 部署走单独 vps-deploy.yml(workflow_dispatch 人工 UI 点 / agent API dispatch),不再这里自动推。
|
|
# Runner: 复用 online mac-mini-arm64 (label macos-arm64), host executor 跑 Mac shell。
|
|
# 关键: ①不用 actions/checkout(国内 EOF),改 git fetch Gitea ②HOME=/Users/chufeng ③git config --local http.proxy ""
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: macos-arm64
|
|
env:
|
|
HOME: /Users/chufeng
|
|
steps:
|
|
- name: checkout (直连 Gitea, git fetch 绕过 github action)
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git init .
|
|
git config --local http.proxy ""
|
|
git config --local https.proxy ""
|
|
git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout FETCH_HEAD
|
|
- name: enforce commit label ([vps]/[nas] 必打, merge 豁免)
|
|
if: github.event_name == 'push'
|
|
run: |
|
|
set -e
|
|
BEFORE=${{ github.event.before }}
|
|
AFTER=${{ github.event.after }}
|
|
if [[ "$BEFORE" =~ ^0+$ ]]; then
|
|
git fetch origin "$AFTER" --depth 20
|
|
RANGE="HEAD~20..HEAD"
|
|
else
|
|
git fetch origin "$BEFORE" "$AFTER" --depth 50
|
|
RANGE="${BEFORE}..${AFTER}"
|
|
fi
|
|
# 缺标签 = 既无 [vps]/[nas] 且非 Merge 开头
|
|
MISSING=$(git log --format=%s "$RANGE" | grep -vE '\[(vps|nas)\]|^Merge' || true)
|
|
if [ -n "$MISSING" ]; then
|
|
echo "❌ 以下 commit 缺 [vps]/[nas] 环境标签:"
|
|
echo "$MISSING"
|
|
echo ""
|
|
echo "规范: <type>(<scope>): <desc> [vps] # VPS 也中招, 要推 prod"
|
|
echo " <type>(<scope>): <desc> [nas] # NAS/docker 专属, VPS 不中招"
|
|
echo "详见 docs/three-env-code-promote.md §12"
|
|
exit 1
|
|
fi
|
|
echo "✅ 本次 push commit 标签齐全"
|
|
- name: "enforce design-doc sync (三线唯一活文档: 域内改动须同 push 更档, [no-doc] 声明豁免)"
|
|
if: github.event_name == 'push'
|
|
run: |
|
|
BEFORE=${{ github.event.before }}
|
|
AFTER=${{ github.event.after }}
|
|
if [[ "$BEFORE" =~ ^0+$ ]]; then
|
|
git fetch origin "$AFTER" --depth 20
|
|
RANGE="HEAD~20..HEAD"
|
|
else
|
|
git fetch origin "$BEFORE" "$AFTER" --depth 50
|
|
RANGE="${BEFORE}..${AFTER}"
|
|
fi
|
|
# fail-open: range 解析异常一律放行,绝不因闸门自身 bug 卡全团队 push
|
|
FILES=$(git diff --name-only "$RANGE" 2>/dev/null | sort -u || true)
|
|
if [ -z "$FILES" ]; then echo "✅ 设计档同步: 无差异可查(跳过)"; exit 0; fi
|
|
# 声明式豁免: push 内任一 commit 标题结尾带 [no-doc] = 本次改动不改设计(显式可审计)
|
|
# (锚定行尾: 防止标题里"提到"[no-doc]字样[如描述豁免机制本身]造成误豁免,09-14 实锤)
|
|
if git log --format=%s "$RANGE" 2>/dev/null | grep -qE '\[no-doc\][[:space:]]*$'; then
|
|
echo "✅ 设计档同步: 声明 [no-doc] 豁免"; exit 0
|
|
fi
|
|
fail=0
|
|
check() { # $1=线名 $2=域grep $3..=候选档(任一更新即过)
|
|
local name="$1" domain="$2"; shift 2
|
|
local hit; hit=$(echo "$FILES" | grep -E "$domain" || true)
|
|
[ -n "$hit" ] || return 0
|
|
local ok=0 doc
|
|
for doc in "$@"; do echo "$FILES" | grep -qx "$doc" && ok=1; done
|
|
if [ "$ok" != "1" ]; then
|
|
echo "❌ [$name] 本次 push 触及该线代码但未更新其唯一设计文档: $*"
|
|
echo "$hit" | sed 's/^/ /'
|
|
fail=1
|
|
fi
|
|
}
|
|
check 因子 '^sanguo_factor/|^frontend/src/views/factor/|^sanguo_portfolio/strategies/factor_topn\.py$' \
|
|
'docs/factor_research/factor-system-design.md'
|
|
check 数据 '^sanguo_data/' \
|
|
'docs/superpowers/specs/2026-07-21-data-source-fusion-design.md'
|
|
check 基建 '^scripts/nas_sync/|^scripts/qmt_relogin/|^scripts/bridge_switch_ops\.py$|^\.gitea/workflows/|^docker/|^Dockerfile$' \
|
|
'docs/three-env-code-promote.md' 'docs/deployment/vps-production-runbook.md'
|
|
# 反 proliferate: 因子线禁新增独立 md(唯一活文档铁律,收编/日期节追加;mockup.html 不限)
|
|
added=$(git diff --name-only --diff-filter=A "$RANGE" 2>/dev/null \
|
|
| grep -E '^docs/factor_research/[^/]+\.md$' || true)
|
|
if [ -n "$added" ]; then
|
|
echo "❌ [因子] 新增了独立 md 文档: $added"
|
|
echo " 铁律: 因子线设计只维护 factor-system-design.md, 新内容收编/日期节追加"
|
|
fail=1
|
|
fi
|
|
if [ "$fail" != "0" ]; then
|
|
echo ""
|
|
echo "规范: 设计/架构/流程有变 → 同一 push 更新对应唯一设计文档"
|
|
echo " 纯实现/bug修复不改设计 → commit 标题打 [no-doc] 声明豁免"
|
|
echo "映射与细则: docs/three-env-code-promote.md §12.1"
|
|
exit 1
|
|
fi
|
|
echo "✅ 三线设计档同步检查通过"
|
|
- name: pytest 冒烟 (venv310 数据层+组合引擎+因子评估)
|
|
run: |
|
|
PY=/Users/chufeng/.openclaw/sanguo_projects/sanguo_vnpy_v2/venv310/bin/python
|
|
# 2026-08-22 起扩跑 tests/portfolio(issue#35 方案 B):原 13 个 Mac 环境失败
|
|
# 已被依赖治理顺带清零(实测 440 绿 1.74s);组合引擎 440 题进 CI 门禁
|
|
# 2026-08-25 起加 tests/factor(因子评估层纯逻辑小测,本地62绿)
|
|
PYTHONPATH="$GITHUB_WORKSPACE" $PY -m pytest tests/data_platform tests/portfolio tests/factor -q
|
|
|
|
# ---------- NAS 部署(后端代码 + 前端 dist + restart 容器) ----------
|
|
nas-deploy:
|
|
needs: test
|
|
runs-on: macos-arm64
|
|
env:
|
|
HOME: /Users/chufeng
|
|
steps:
|
|
- name: checkout
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git init .
|
|
git config --local http.proxy ""
|
|
git config --local https.proxy ""
|
|
git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout FETCH_HEAD
|
|
- name: 推后端代码到 NAS (promote --target nas, 不推 VPS)
|
|
run: bash scripts/nas_sync/promote.sh --target nas
|
|
- name: build 前端 + 部署 dist 到 NAS
|
|
run: |
|
|
export PATH="/opt/homebrew/bin:$PATH"
|
|
cd frontend
|
|
npm ci
|
|
npm run build
|
|
cd ..
|
|
rsync -az --delete frontend/dist/ sanguo-nas:/volume1/homes/admin/.sanguo_projects/sanguo_vnpy_v2/frontend/dist/
|
|
- name: restart NAS 容器(加载新后端代码) + 等 web 就绪
|
|
run: |
|
|
ssh -o ConnectTimeout=20 sanguo-nas '/var/packages/Docker/target/usr/bin/docker restart sanguo_vnpy_v2'
|
|
for i in $(seq 1 30); do
|
|
curl -sf http://192.168.2.154:8000/ -o /dev/null && { echo "web ready"; exit 0; }
|
|
sleep 2
|
|
done
|
|
echo "web 未就绪超时"; exit 1
|
|
|
|
# ---------- NAS 验证(API 健康 + 数据可读,秒级 gate) ----------
|
|
nas-verify:
|
|
needs: nas-deploy
|
|
runs-on: macos-arm64
|
|
env:
|
|
HOME: /Users/chufeng
|
|
steps:
|
|
- name: checkout (check-vps-needed 需 git log + scripts/ci 脚本)
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git init .
|
|
git config --local http.proxy ""
|
|
git config --local https.proxy ""
|
|
git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout FETCH_HEAD
|
|
- name: NAS web API 健康(login + strategy/list 200 非空)
|
|
run: |
|
|
BASE=http://192.168.2.154:8000
|
|
token=$(curl -s -X POST $BASE/api/v1/auth/login -H "Content-Type: application/json" \
|
|
-d '{"username":"admin","password":"Ccf7561523*"}' \
|
|
| python3 -c "import json,sys;print(json.load(sys.stdin).get('token',''))")
|
|
[ -n "$token" ] || { echo "❌ login 失败"; exit 1; }
|
|
echo "✅ login OK"
|
|
code=$(curl -s -o /tmp/sl.json -w "%{http_code}" $BASE/api/v1/strategy/list -H "Authorization: Bearer $token")
|
|
[ "$code" = "200" ] || { echo "❌ strategy/list HTTP $code"; exit 1; }
|
|
[ -s /tmp/sl.json ] || { echo "❌ strategy/list 空响应"; exit 1; }
|
|
echo "✅ strategy/list 200 非空, 后端路由通"
|
|
# /health 存活探针(Docker HEALTHCHECK 依赖;漏部署→容器恒unhealthy,本次回归即此)
|
|
code=$(curl -s -o /dev/null -w "%{http_code}" $BASE/health)
|
|
[ "$code" = "200" ] || { echo "❌ /health HTTP $code (容器会unhealthy)"; exit 1; }
|
|
echo "✅ /health 200, 存活探针通"
|
|
- name: NAS 副本数据可读(dbbardata)
|
|
run: |
|
|
ssh -o ConnectTimeout=20 sanguo-nas "python3 -c 'import sqlite3
|
|
c=sqlite3.connect(\"/volume1/stock/sanguo_vnpy_v2/data_backup/quant_trading.db\")
|
|
n=c.execute(\"SELECT COUNT(*) FROM dbbardata WHERE symbol=?\",(\"600519\",)).fetchone()[0]
|
|
print(\"dbbardata 600519 rows:\", n)
|
|
exit(0 if n>0 else 1)'"
|
|
- name: check-vps-needed (vps-deployed tag 对比 + 待推 issue 信号)
|
|
env:
|
|
GTOKEN: ${{ github.token }}
|
|
run: |
|
|
set -e
|
|
git fetch origin "$GITHUB_SHA" --depth 100 2>/dev/null || true
|
|
git fetch origin refs/tags/vps-deployed:refs/tags/vps-deployed 2>/dev/null || true
|
|
if git rev-parse --verify vps-deployed >/dev/null 2>&1; then
|
|
RANGE="$(git rev-parse vps-deployed)..HEAD"
|
|
else
|
|
RANGE="HEAD~50..HEAD"
|
|
echo "⚠️ vps-deployed tag 不存在(首次/未推过 VPS), 查最近 50 commit"
|
|
fi
|
|
# gap 按 subject 算(与 enforce-label 同定义): 不能用 --grep='\[vps\]'——它匹配整个
|
|
# message, commit body 里引用的命令文本会误命中(曾误开 issue#7)。与 vps_finalize.sh 同款。
|
|
export VPS_LOG="$(git log --format='%h %s' "$RANGE" | grep -E '\[vps\]' || true)"
|
|
echo "::notice::NAS 验证通过 ✅ 。含 [vps] 则开 [待推VPS] issue(人工/agent 推 vps-deploy.yml)"
|
|
python3 scripts/ci/vps_pending_check.py
|
|
|
|
# 注: VPS 部署已拆到 .gitea/workflows/vps-deploy.yml (workflow_dispatch 人工/agent 触发)
|