发布候选：整合桌面端界面与发布稳定化里程碑

2026-07-01 10:53:24 +08:00
parent b283cf1e5c
commit b491b6a146
132 changed files with 17337 additions and 2375 deletions
@@ -0,0 +1,159 @@
+name: Client Quality Gates
+
+on:
+  pull_request:
+    paths:
+      - "AGENTS.md"
+      - "frontend/**"
+      - ".github/workflows/client-quality-gates.yml"
+      - "docs/branch-governance.md"
+      - "docs/desktop-project-plan.md"
+      - "docs/desktop-phase-1-design.md"
+      - "docs/desktop-phase-2-design.md"
+      - "docs/audits/desktop-release-stabilization-checklist.md"
+      - "docs/guides/client-release.md"
+      - "docs/guides/branch-maintenance-sop-zh.md"
+  push:
+    branches:
+      - dev
+      - main
+      - release
+    tags:
+      - "v*"
+    paths:
+      - "AGENTS.md"
+      - "frontend/**"
+      - ".github/workflows/client-quality-gates.yml"
+      - "docs/branch-governance.md"
+      - "docs/desktop-project-plan.md"
+      - "docs/desktop-phase-1-design.md"
+      - "docs/desktop-phase-2-design.md"
+      - "docs/audits/desktop-release-stabilization-checklist.md"
+      - "docs/guides/client-release.md"
+      - "docs/guides/branch-maintenance-sop-zh.md"
+
+jobs:
+  web:
+    name: Shared client and Web
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Resolve build metadata
+        id: build-metadata
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            channel="release"
+          elif [[ "${GITHUB_REF_NAME}" == "dev" || "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "release" ]]; then
+            channel="${GITHUB_REF_NAME}"
+          else
+            channel="dev"
+          fi
+          echo "channel=${channel}" >> "${GITHUB_OUTPUT}"
+          echo "commit=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
+
+      - name: Check release build metadata
+        run: npm run release:env:check
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Check synchronized client version
+        run: npm run version:check
+
+      - name: Check runtime boundary
+        run: npm run runtime:check
+
+      - name: Check desktop release and security gate
+        run: npm run desktop:release:check
+
+      - name: Check UI contract
+        run: npm run ui:contract
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Unit tests
+        run: npm run test:unit
+
+      - name: Build Web artifact
+        run: npm run build
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+  desktop:
+    name: macOS Desktop
+    runs-on: macos-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Resolve build metadata
+        id: build-metadata
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            channel="release"
+          elif [[ "${GITHUB_REF_NAME}" == "dev" || "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "release" ]]; then
+            channel="${GITHUB_REF_NAME}"
+          else
+            channel="dev"
+          fi
+          echo "channel=${channel}" >> "${GITHUB_OUTPUT}"
+          echo "commit=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
+
+      - name: Check release build metadata
+        run: npm run release:env:check
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Check synchronized client version
+        run: npm run version:check
+
+      - name: Check runtime boundary
+        run: npm run runtime:check
+
+      - name: Check desktop release and security gate
+        run: npm run desktop:release:check
+
+      - name: Check UI contract
+        run: npm run ui:contract
+
+      - name: Build unsigned macOS application smoke artifact
+        run: npm run desktop:build:app
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}