ci(gitea): validate development builds before GitHub promotion

2026-10-27 15:41:47 +08:00
1 parent e6e787c278
commit d99cdd75b6
@@ -0,0 +1,132 @@
+name: Development CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rawmark-development
+  cancel-in-progress: false
+
+jobs:
+  check-and-package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 55
+    env:
+      CGO_ENABLED: '0'
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: https://github.com/actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Install frontend dependencies
+        run: |
+          corepack enable
+          corepack prepare [email protected] --activate
+          pnpm -C web install --frozen-lockfile --registry=https://registry.npmjs.org
+      - name: Check and build frontend
+        run: |
+          pnpm -C web lint:check
+          pnpm -C web typecheck
+          pnpm -C web test
+          pnpm -C web build
+          pnpm -C web build:demo
+      - name: Check backend
+        run: |
+          go vet -tags dev ./...
+          go test ./internal/...
+          go test -tags dev ./web ./cmd/rawmark
+          go vet ./...
+          go test ./web ./cmd/rawmark
+      - name: Test filesystem permissions as an unprivileged user
+        run: |
+          for package in vault watch; do
+            go test -c -o "/tmp/rawmark-$package.test" "./internal/$package"
+            (cd "internal/$package" && runuser -u node -- "/tmp/rawmark-$package.test" -test.v)
+          done
+      - name: Build platform packages and smoke-test Linux amd64
+        run: |
+          mkdir -p package/licenses downloads
+          cp LICENSE package/
+          cp web/LICENSE package/licenses/vue3-starter-MIT.txt
+          cp web/src/common/appearance/fonts/*-OFL.txt package/licenses/
+          cp web/src/common/appearance/fonts/maple/LICENSE.txt package/licenses/Maple-Mono-OFL.txt
+          for target in linux/amd64 linux/arm64 windows/amd64 darwin/arm64 darwin/amd64; do
+            export GOOS="${target%/*}" GOARCH="${target#*/}"
+            extension=''
+            if [ "$GOOS" = windows ]; then extension='.exe'; fi
+            rm -f package/rawmark package/rawmark.exe
+            go vet ./...
+            go build -trimpath -ldflags="-s -w -X main.releaseVersion=$(cat VERSION)" -o "package/rawmark$extension" ./cmd/rawmark
+            if [ "$target" = linux/amd64 ]; then
+              python3 scripts/smoke-release.py package/rawmark
+            fi
+            python3 scripts/package-release.py "$GOOS" "$GOARCH"
+          done
+      - name: Check upload sizes and generate checksums
+        run: |
+          python3 - <<'PY'
+          import hashlib
+          from pathlib import Path
+
+          archives = sorted(Path('downloads').glob('rawmark_*'))
+          if len(archives) != 5:
+              raise SystemExit(f'Expected five platform packages, found {len(archives)}')
+          checksums = []
+          for archive in archives:
+              size = archive.stat().st_size
+              print(f'{archive.name}: {size:,} bytes')
+              if size >= 90_000_000:
+                  raise SystemExit(f'{archive.name} exceeds the 90 MB upload budget (Cloudflare limit: 100 MB)')
+              checksums.append(f'{hashlib.file_digest(archive.open("rb"), "sha256").hexdigest()}  {archive.name}\n')
+          Path('downloads/SHA256SUMS').write_text(''.join(checksums))
+          PY
+      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: linux-amd64
+          path: downloads/*_linux_amd64.tar.gz
+          compression-level: 0
+          if-no-files-found: error
+          retention-days: 7
+      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: linux-arm64
+          path: downloads/*_linux_arm64.tar.gz
+          compression-level: 0
+          if-no-files-found: error
+          retention-days: 7
+      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: windows-amd64
+          path: downloads/*_windows_amd64.zip
+          compression-level: 0
+          if-no-files-found: error
+          retention-days: 7
+      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: darwin-arm64
+          path: downloads/*_darwin_arm64.tar.gz
+          compression-level: 0
+          if-no-files-found: error
+          retention-days: 7
+      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: darwin-amd64
+          path: downloads/*_darwin_amd64.tar.gz
+          compression-level: 0
+          if-no-files-found: error
+          retention-days: 7
+      - uses: https://github.com/actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: checksums
+          path: downloads/SHA256SUMS
+          if-no-files-found: error
+          retention-days: 7