From 6cf67e39e0586905948bff124bc5acd6e0b76430 Mon Sep 17 00:00:00 2001 From: zayJu Date: Thu, 12 Nov 2026 13:45:27 +0800 Subject: [PATCH 1/2] =?UTF-8?q?chore(ci):=20=E5=90=88=E5=B9=B6=E5=90=8E?= =?UTF-8?q?=E4=B8=8D=E5=86=8D=E9=87=8D=E8=B7=91=E6=B5=8B=E8=AF=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit main 只接受 PR 合并，strict 策略保证 PR 头包含最新 main，合并提交的树就是 刚刚通过检查的树；push 到 main 再跑一遍不设任何门槛。nightly 与 release tag 仍是完整门槛。 Co-Authored-By: Claude Code --- .github/workflows/engine.yml | 18 ++++-------------- .github/workflows/examples.yml | 9 ++------- .github/workflows/git-read.yml | 11 ++--------- .github/workflows/readiness.yml | 8 ++------ .github/workflows/windows.yml | 14 +++++--------- 5 files changed, 15 insertions(+), 45 deletions(-) diff --git a/.github/workflows/engine.yml b/.github/workflows/engine.yml index c4c2e720..88fbe200 100644 --- a/.github/workflows/engine.yml +++ b/.github/workflows/engine.yml @@ -5,23 +5,13 @@ on: # build, vet, unit tests and the fast helper suites on both supported engine # platforms. Core race tests and real service scenarios stay on manual # dispatch and on the tag-driven release workflow. + # The pull request is the only automatic trigger: `main` accepts pull + # requests only, so a push cannot skip this check, and the merge commit + # carries the tree that just passed. Nightly and release tags run the full + # gate instead of a second copy on every merge. # No path filter here: a skipped path-filtered workflow leaves a required # check pending and blocks the PR. pull_request: - push: - branches: [main] - paths: - - 'engine/**' - - 'docs/cli.md' - - 'docs/cli.zh.md' - - 'magefiles/**' - - 'scripts/**' - - 'install.sh' - - 'install.ps1' - - 'uninstall.sh' - - 'uninstall.ps1' - - '.github/workflows/engine.yml' - - '.github/workflows/release.yml' workflow_dispatch: permissions: diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index 411a8097..d69a9d45 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -1,15 +1,10 @@ name: Checked-in examples on: + # The pull request is the only automatic trigger: `main` accepts pull + # requests only, so a push cannot skip this check. # No path filter on pull_request: a skipped required workflow leaves its # check pending and blocks the PR. pull_request: - push: - branches: [main] - paths: - - 'examples/**' - - 'engine/**' - - 'scripts/smoke.py' - - '.github/workflows/examples.yml' workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/git-read.yml b/.github/workflows/git-read.yml index 5f2bea4e..ea4fc896 100644 --- a/.github/workflows/git-read.yml +++ b/.github/workflows/git-read.yml @@ -1,18 +1,11 @@ name: Git read verification on: + # The pull request is the only automatic trigger: `main` accepts pull + # requests only, so a push cannot skip this check. # No path filter on pull_request: a skipped required workflow leaves its # check pending and blocks the PR. pull_request: - push: - branches: [main] - paths: - - 'engine/internal/git/**' - - 'engine/internal/groups/**' - - 'engine/internal/scanner/**' - - 'engine/go.mod' - - 'engine/go.sum' - - '.github/workflows/git-read.yml' workflow_dispatch: permissions: diff --git a/.github/workflows/readiness.yml b/.github/workflows/readiness.yml index beef1928..599bc612 100644 --- a/.github/workflows/readiness.yml +++ b/.github/workflows/readiness.yml @@ -1,14 +1,10 @@ name: Reused service readiness on: + # The pull request is the only automatic trigger: `main` accepts pull + # requests only, so a push cannot skip this check. # No path filter on pull_request: a skipped required workflow leaves its # check pending and blocks the PR. pull_request: - push: - branches: [main] - paths: - - 'engine/**' - - 'scripts/verify-reused-readiness.py' - - '.github/workflows/readiness.yml' workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 46f470be..4151789c 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -1,17 +1,13 @@ name: Windows build verification on: # The PR gate must run the native Windows path, not only the PowerShell - # parse job in the engine workflow. No path filter on pull_request: a - # skipped required workflow leaves its check pending and blocks the PR. + # parse job in the engine workflow. The pull request is the only automatic + # trigger: `main` accepts pull requests only, so a push cannot skip this + # check. Release tags call this workflow and run it again. + # No path filter on pull_request: a skipped required workflow leaves its + # check pending and blocks the PR. workflow_call: pull_request: - push: - branches: [main] - paths: - - 'engine/**' - - 'install.ps1' - - 'uninstall.ps1' - - '.github/workflows/windows.yml' workflow_dispatch: permissions: contents: read From a8319c6d11fcbbdd962ba6cff0e7190d1aa868fb Mon Sep 17 00:00:00 2001 From: zayJu Date: Thu, 12 Nov 2026 13:45:27 +0800 Subject: [PATCH 2/2] =?UTF-8?q?docs(validation):=20=E8=AE=B0=E5=BD=95?= =?UTF-8?q?=E4=B8=BB=E5=88=86=E6=94=AF=E5=8F=AA=E6=8E=A5=E5=8F=97=20PR=20?= =?UTF-8?q?=E7=9A=84=E9=AA=8C=E8=AF=81=E6=A8=A1=E5=9E=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 补充合并提交复用 PR 结果的依据，并说明 CI configuration 为什么保留 push 触发。 Co-Authored-By: Claude Code --- docs/agent/develop.md | 6 +++--- docs/agent/releasing.md | 4 ++-- docs/agent/validation.md | 33 +++++++++++++++++---------------- 3 files changed, 22 insertions(+), 21 deletions(-) diff --git a/docs/agent/develop.md b/docs/agent/develop.md index 826e2cfb..74a4ff31 100644 --- a/docs/agent/develop.md +++ b/docs/agent/develop.md @@ -54,9 +54,9 @@ go vet ./... go test -count=1 -timeout=8m ./... ``` -PRs and pushes to `main` run these three on macOS/Linux automatically, along with the Mage and Python -helper tests, plus a native build and script parsing on Windows; the Linux job also cross-builds six -release targets with `CGO_ENABLED=0`. The full gates — core race tests, real service scenarios — still +PRs run these three on macOS/Linux automatically, along with the Mage and Python helper tests, plus +a native build and script parsing on Windows; the Linux job also cross-builds six release targets +with `CGO_ENABLED=0`. The full gates — core race tests, real service scenarios — still run per [validation.md](validation.md) on the daily, manual or release paths. CI-configuration changes also run actionlint and the required-checks consistency check; the list is in `.github/quality-gate-checks.json`. diff --git a/docs/agent/releasing.md b/docs/agent/releasing.md index 443aad6b..a1eda8b1 100644 --- a/docs/agent/releasing.md +++ b/docs/agent/releasing.md @@ -183,8 +183,8 @@ scenario, or native execution on Windows arm64. ## Preflight before tagging The automated release CI runs `Verified release` (verify, package, publish) only when a **`v*` annotated -tag** matching `VERSION` is pushed; the automatic gates on PRs and `main` pushes cover build, vet, unit -tests and helper-script tests, as described in [validation.md](validation.md). The daily +tag** matching `VERSION` is pushed; the automatic gates on pull requests cover build, vet, unit tests +and helper-script tests, as described in [validation.md](validation.md). The daily `Nightly full verification` runs the release-equivalent full gate set on the default branch; confirm it passes before tagging so problems that only surface there are not left for after the release. To rerun locally, use `python3 scripts/release.py --verify-only`; it reads only the currently checked-out commit. diff --git a/docs/agent/validation.md b/docs/agent/validation.md index 36361d2b..71d8acac 100644 --- a/docs/agent/validation.md +++ b/docs/agent/validation.md @@ -2,28 +2,29 @@ All current workflows record the actual source identity; a check's conclusion applies only to the commit that was run, and never reuses historical results from an old repository or this machine. -The automated gates have two layers. `Engine verification` runs on macOS / Ubuntu on PRs and pushes -to `main`: native build, vet, full engine unit tests, Mage workflow regression, and the Python +The automated gates have two layers. `Engine verification` runs on macOS / Ubuntu on every pull +request: native build, vet, full engine unit tests, Mage workflow regression, and the Python helper tests, and parses `install.ps1` / `uninstall.ps1` on Windows with Windows PowerShell 5.1. -`Windows build verification` runs on PRs and engine-related pushes to `main`: Windows x64 native -build, CLI smoke, script parsing, service lifecycle, and fact/persistence checks, plus a Windows -arm64 cross build on Ubuntu. Core race and real-service scenarios run only under a manual -`workflow_dispatch`, in the daily `Nightly full verification`, and in `Verified release` when an -annotated `v*` tag is pushed. Site changes are verified by `.github/workflows/site.yml` on PRs and -pushes to `main`. To run one check on its own, manually `workflow_dispatch` the corresponding -workflow in Actions; to re-run locally before a release, use `python3 scripts/release.py ---verify-only`. +`Windows build verification` runs on every pull request: Windows x64 native build, CLI smoke, +script parsing, service lifecycle, and fact/persistence checks, plus a Windows arm64 cross build on +Ubuntu. `main` accepts pull requests only, so a push cannot skip these checks, and the merge commit +carries the tree that just passed; the gates do not run a second time on the merge. Core race and +real-service scenarios run only under a manual `workflow_dispatch`, in the daily `Nightly full +verification`, and in `Verified release` when an annotated `v*` tag is pushed. Site changes are +verified by `.github/workflows/site.yml` on PRs and pushes to `main`. To run one check on its own, +manually `workflow_dispatch` the corresponding workflow in Actions; to re-run locally before a +release, use `python3 scripts/release.py --verify-only`. | Workflow | Trigger | Platforms and contents | |---|---|---| -| Engine verification | PRs, engine-related pushes to `main`, manual | Automated: macOS / Ubuntu native build, vet, full engine unit tests, Mage workflow regression, Python helper tests, cross builds for the six release targets on Ubuntu, a checkout of `option-berth-skill` on Linux to verify agent contract coverage, and parsing of the install/uninstall scripts with Windows PowerShell 5.1. Manual runs additionally execute core race and real-service scenarios. | +| Engine verification | PRs, manual | Automated: macOS / Ubuntu native build, vet, full engine unit tests, Mage workflow regression, Python helper tests, cross builds for the six release targets on Ubuntu, a checkout of `option-berth-skill` on Linux to verify agent contract coverage, and parsing of the install/uninstall scripts with Windows PowerShell 5.1. Manual runs additionally execute core race and real-service scenarios. | | Nightly full verification | Daily 18:23 UTC, manual | macOS / Ubuntu: the same full gate as `scripts/release.py --verify-only`, including core race and real-service scenarios. | -| Git read verification | PRs, related pushes to `main`, manual | macOS / Ubuntu: repeated tests and race for Git, worktree, attribution, and observation. | -| Checked-in examples | PRs, engine-related pushes to `main`, manual | macOS / Ubuntu: the minimal sample `hello-worktree` across two worktrees (distinct ports, a portless worker, stopping one side). No Docker, no benchmark. The complex sample `stack-workshop` is not part of this check; it is the input of the manual benchmark, which runs on Linux with Docker. | -| Reused service readiness | PRs, engine-related pushes to `main`, manual | macOS / Ubuntu: reuse checks against real healthy and unhealthy services. | -| Windows build verification | PRs, engine-related pushes to `main`, release tags, manual | Windows x64: native build, vet, CLI/Jev build, version JSON/help page, facts/persistence, and start, repeated start, collector recovery, and scoped stop for an isolated API / portless worker; Ubuntu: Windows arm64 cross build. | +| Git read verification | PRs, manual | macOS / Ubuntu: repeated tests and race for Git, worktree, attribution, and observation. | +| Checked-in examples | PRs, manual | macOS / Ubuntu: the minimal sample `hello-worktree` across two worktrees (distinct ports, a portless worker, stopping one side). No Docker, no benchmark. The complex sample `stack-workshop` is not part of this check; it is the input of the manual benchmark, which runs on Linux with Docker. | +| Reused service readiness | PRs, manual | macOS / Ubuntu: reuse checks against real healthy and unhealthy services. | +| Windows build verification | PRs, release tags, manual | Windows x64: native build, vet, CLI/Jev build, version JSON/help page, facts/persistence, and start, repeated start, collector recovery, and scoped stop for an isolated API / portless worker; Ubuntu: Windows arm64 cross build. | | Gate integrity | PR (`pull_request_target`) | Requires the PR author to be a repository maintainer when `.github/workflows/`, CODEOWNERS, the race list, release scripts, or quality-gate check scripts are modified. | -| CI configuration | PRs, CI-related pushes to `main`, manual | Ubuntu: actionlint checks every workflow and verifies that the required checks match the workflow job names. | +| CI configuration | PRs, CI-related pushes to `main`, manual | Ubuntu: actionlint checks every workflow and verifies that the required checks match the workflow job names. The push trigger stays because this check also compares the live ruleset after a settings change outside a pull request. | | Bounded ancestry comparison | Manual (evidence) | Ubuntu: compare a branch against a specified baseline with a bounded benchmark on the same runner; not a merge gate. | The single list of required checks is `.github/quality-gate-checks.json`; workflow job names are