xjxandgd-ops
790046d9a8
## Development lane / 开发通道 - Lane: `direct-to-main` bootstrap - Base branch: `main` - Active train: `n/a` - Owning Agent/session: workflow coordinator ## Change / 改动 - Split authoritative CI into parallel static, contract, Rust lint/test shards, Swift interaction, stress, overlay, bundle, and stable `Required CI` jobs. - Make every ready PR to `main` a complete gate while keeping task PRs to `gd-ops/train/*` path-scoped. - Add direct/train worktree coordination, bounded changelog fragments, protected main/train ruleset automation, and safe same-repository squash auto-merge. - Let GitHub Release promote an exact successful main commit, reuse its source proof, and create a missing release tag only after proof validation. - Keep local pre-push validation bounded to basic syntax, formatting, contracts, and compilation; complete duplicate proof stays in GitHub CI. This is the one bootstrap PR: the auto-merge workflow and required rules do not exist on the base branch yet. After this PR passes and is merged once, the exact `main` push must pass `Required CI`; then the fail-closed applicator can activate both rulesets and all later ready `gd-ops/*` PRs follow the automated path. ## Validation / 验证 - `actionlint .github/workflows/ci.yml .github/workflows/release.yml .github/workflows/auto-merge.yml` - `./script/validate_source_syntax.sh` - `./script/validate_build_scripts_safety.sh --skip-source-syntax` - Exact staged diff was reapplied to a clean detached worktree before the final validation run. - 28 validation-tooling tests, 40 release-distribution tests, macOS build-contract tests, Release shell contracts, and test-isolation validation passed. ## Risk / 风险 - No product runtime or credential access is added. - `pull_request_target` never checks out or executes PR code and only enables auto-merge after API verification of active PR and `Required CI` rules. - Full ruleset activation fails closed until the exact remote main commit has a trusted successful GitHub Actions push run. - Reversible repository settings are already enabled: auto-merge, squash-only, update branch, and delete merged branches. --------- Co-authored-by: gd-ops <gd-ops@xmfunny.com>
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
name: Enable protected PR auto-merge
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, reopened, ready_for_review]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
enable:
|
|
name: Enable squash auto-merge
|
|
if: >-
|
|
!github.event.pull_request.draft &&
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
startsWith(github.head_ref, 'gd-ops/') &&
|
|
(github.base_ref == 'main' || startsWith(github.base_ref, 'gd-ops/train/'))
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
BASE_BRANCH: ${{ github.base_ref }}
|
|
steps:
|
|
- name: Require active PR and Required CI rules before enabling auto-merge
|
|
run: |
|
|
encoded_base="$(jq -rn --arg value "$BASE_BRANCH" '$value|@uri')"
|
|
rules="$(
|
|
gh api \
|
|
-H 'Accept: application/vnd.github+json' \
|
|
-H 'X-GitHub-Api-Version: 2026-03-10' \
|
|
"repos/$GITHUB_REPOSITORY/rules/branches/$encoded_base"
|
|
)"
|
|
jq -e 'any(.[]; .type == "pull_request")' <<<"$rules" >/dev/null
|
|
jq -e '
|
|
any(.[].parameters.required_status_checks[]?;
|
|
.context == "Required CI")
|
|
' <<<"$rules" >/dev/null
|
|
|
|
- name: Enable squash auto-merge after required checks
|
|
run: gh pr merge --repo "$GITHUB_REPOSITORY" --auto --squash "$PR_URL"
|