Build PR #613
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================= | |
| # PR 构建工作流 | |
| # ============================================================================= | |
| # 安全模型： | |
| # 1. pull_request_target / issue_comment 入口只读取元数据、检查权限、更新评论并触发构建。 | |
| # 2. 真正执行 PR 代码的构建流程只在 workflow_dispatch 中运行。 | |
| # 3. 构建流程不具备写仓库/写评论/读 secrets 权限，显式清空 GITHUB_TOKEN，不持久化 checkout 凭据。 | |
| # 4. 版本号在 Action 中提前生成，通过 NAPCAT_VERSION 传给 Vite 插件，插件无需 GitHub token。 | |
| # 5. 发布 Release、触发 Docker 等可信操作只消费构建 artifact，不执行 PR artifact 中的代码。 | |
| # ============================================================================= | |
| name: Build PR | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| issue_comment: | |
| types: [created] | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: PR 编号 | |
| required: true | |
| type: string | |
| pr_sha: | |
| description: PR HEAD SHA | |
| required: true | |
| type: string | |
| pr_head_repo: | |
| description: PR 源仓库 | |
| required: true | |
| type: string | |
| pr_head_ref: | |
| description: PR 源分支 | |
| required: false | |
| type: string | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: pr-build-${{ github.event_name == 'workflow_dispatch' && inputs.pr_number || github.event_name == 'pull_request_target' && github.event.pull_request.number || github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '/build') && github.event.issue.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # 特权入口：只检查条件、写入“构建中”评论、触发无权限构建 | |
| # --------------------------------------------------------------------------- | |
| check-build: | |
| if: github.event_name != 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: write | |
| outputs: | |
| should_build: ${{ steps.check.outputs.should_build }} | |
| pr_number: ${{ steps.check.outputs.pr_number }} | |
| pr_sha: ${{ steps.check.outputs.pr_sha }} | |
| pr_head_repo: ${{ steps.check.outputs.pr_head_repo }} | |
| pr_head_ref: ${{ steps.check.outputs.pr_head_ref }} | |
| steps: | |
| - name: Checkout scripts | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Check trigger condition | |
| id: check | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: node --experimental-strip-types .github/scripts/pr-build-check.ts | |
| update-comment-building: | |
| needs: check-build | |
| if: needs.check-build.outputs.should_build == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| steps: | |
| - name: Checkout scripts | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Update building comment | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ needs.check-build.outputs.pr_number }} | |
| PR_SHA: ${{ needs.check-build.outputs.pr_sha }} | |
| run: node --experimental-strip-types .github/scripts/pr-build-building.ts | |
| dispatch-build: | |
| needs: [check-build, update-comment-building] | |
| if: needs.check-build.outputs.should_build == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: write | |
| steps: | |
| - name: Checkout scripts | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Dispatch untrusted build | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ needs.check-build.outputs.pr_number }} | |
| PR_SHA: ${{ needs.check-build.outputs.pr_sha }} | |
| PR_HEAD_REPO: ${{ needs.check-build.outputs.pr_head_repo }} | |
| PR_HEAD_REF: ${{ needs.check-build.outputs.pr_head_ref }} | |
| WORKFLOW_FILE: build-pr.yml | |
| DISPATCH_REF: ${{ github.event.repository.default_branch }} | |
| run: node --experimental-strip-types .github/scripts/pr-build-dispatch.ts | |
| # --------------------------------------------------------------------------- | |
| # 无权限构建：只由 workflow_dispatch 执行 PR 代码 | |
| # --------------------------------------------------------------------------- | |
| build-framework: | |
| if: github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| status: ${{ steps.build.outcome }} | |
| error: ${{ steps.build.outputs.error }} | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - name: Checkout scripts from base | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| path: _scripts | |
| persist-credentials: false | |
| - name: Checkout PR code | |
| uses: actions/checkout@v5 | |
| with: | |
| repository: ${{ inputs.pr_head_repo }} | |
| ref: ${{ inputs.pr_sha }} | |
| path: workspace | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| run_install: false | |
| - name: Generate Version | |
| id: version | |
| working-directory: workspace | |
| run: | | |
| LATEST_TAG=$(git describe --tags --abbrev=0 --match "v[0-9]*.[0-9]*.[0-9]*" 2>/dev/null || echo "v0.0.0") | |
| BASE_VERSION="${LATEST_TAG#v}" | |
| SHORT_SHA="${{ inputs.pr_sha }}" | |
| SHORT_SHA="${SHORT_SHA::7}" | |
| VERSION="${BASE_VERSION}-pr.${{ inputs.pr_number }}.${{ github.run_number }}+${SHORT_SHA}" | |
| echo "NAPCAT_VERSION=${VERSION}" >> $GITHUB_ENV | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| echo "Latest tag: ${LATEST_TAG}" | |
| echo "Build version: ${VERSION}" | |
| - name: Build | |
| id: build | |
| working-directory: workspace | |
| env: | |
| GITHUB_TOKEN: '' | |
| NAPCAT_VERSION: ${{ env.NAPCAT_VERSION }} | |
| run: node --experimental-strip-types ../_scripts/.github/scripts/pr-build-run.ts framework | |
| continue-on-error: true | |
| - name: Upload Artifact | |
| if: steps.build.outcome == 'success' | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: NapCat.Framework | |
| path: workspace/framework-dist | |
| retention-days: 5 | |
| build-shell: | |
| if: github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| status: ${{ steps.build.outcome }} | |
| error: ${{ steps.build.outputs.error }} | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - name: Checkout scripts from base | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| path: _scripts | |
| persist-credentials: false | |
| - name: Checkout PR code | |
| uses: actions/checkout@v5 | |
| with: | |
| repository: ${{ inputs.pr_head_repo }} | |
| ref: ${{ inputs.pr_sha }} | |
| path: workspace | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| run_install: false | |
| - name: Generate Version | |
| id: version | |
| working-directory: workspace | |
| run: | | |
| LATEST_TAG=$(git describe --tags --abbrev=0 --match "v[0-9]*.[0-9]*.[0-9]*" 2>/dev/null || echo "v0.0.0") | |
| BASE_VERSION="${LATEST_TAG#v}" | |
| SHORT_SHA="${{ inputs.pr_sha }}" | |
| SHORT_SHA="${SHORT_SHA::7}" | |
| VERSION="${BASE_VERSION}-pr.${{ inputs.pr_number }}.${{ github.run_number }}+${SHORT_SHA}" | |
| echo "NAPCAT_VERSION=${VERSION}" >> $GITHUB_ENV | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| echo "Latest tag: ${LATEST_TAG}" | |
| echo "Build version: ${VERSION}" | |
| - name: Build | |
| id: build | |
| working-directory: workspace | |
| env: | |
| GITHUB_TOKEN: '' | |
| NAPCAT_VERSION: ${{ env.NAPCAT_VERSION }} | |
| run: node --experimental-strip-types ../_scripts/.github/scripts/pr-build-run.ts shell | |
| continue-on-error: true | |
| - name: Upload Artifact | |
| if: steps.build.outcome == 'success' | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: NapCat.Shell | |
| path: workspace/shell-dist | |
| retention-days: 5 | |
| # --------------------------------------------------------------------------- | |
| # 可信后处理：只下载/打包/发布 artifact，不执行 artifact 中的代码 | |
| # --------------------------------------------------------------------------- | |
| publish-pr-release: | |
| needs: [build-framework, build-shell] | |
| if: always() && github.event_name == 'workflow_dispatch' && (needs.build-framework.outputs.status == 'success' || needs.build-shell.outputs.status == 'success') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: read | |
| outputs: | |
| release_url: ${{ steps.publish.outputs.release_url }} | |
| release_tag: ${{ steps.publish.outputs.release_tag }} | |
| install_url: ${{ steps.publish.outputs.install_url }} | |
| publish_status: ${{ steps.publish.outcome }} | |
| steps: | |
| - name: Checkout scripts | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Download Framework artifact | |
| if: needs.build-framework.outputs.status == 'success' | |
| uses: actions/download-artifact@v6 | |
| with: | |
| name: NapCat.Framework | |
| path: ./artifacts/NapCat.Framework | |
| - name: Download Shell artifact | |
| if: needs.build-shell.outputs.status == 'success' | |
| uses: actions/download-artifact@v6 | |
| with: | |
| name: NapCat.Shell | |
| path: ./artifacts/NapCat.Shell | |
| - name: Publish release | |
| id: publish | |
| continue-on-error: true | |
| env: | |
| RELEASE_PAT: ${{ secrets.PR_RELEASE_PAT }} | |
| PR_NUMBER: ${{ inputs.pr_number }} | |
| PR_SHA: ${{ inputs.pr_sha }} | |
| NAPCAT_VERSION: ${{ needs.build-framework.outputs.version || needs.build-shell.outputs.version || '' }} | |
| ARTIFACTS_DIR: ./artifacts | |
| run: | | |
| if [ -z "${RELEASE_PAT}" ]; then | |
| echo "::warning::PR_RELEASE_PAT secret 未配置，跳过 PR Release 发布" | |
| exit 0 | |
| fi | |
| node --experimental-strip-types .github/scripts/pr-publish-release.ts | |
| - name: Upload install script as artifact | |
| if: steps.publish.outcome == 'success' | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: install-script | |
| path: ./release-assets/install.sh | |
| retention-days: 5 | |
| if-no-files-found: ignore | |
| update-comment-result: | |
| needs: [build-framework, build-shell, publish-pr-release] | |
| if: always() && github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: read | |
| pull-requests: write | |
| issues: write | |
| steps: | |
| - name: Checkout scripts | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Update result comment | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ inputs.pr_number }} | |
| PR_SHA: ${{ inputs.pr_sha }} | |
| RUN_ID: ${{ github.run_id }} | |
| NAPCAT_VERSION: ${{ needs.build-framework.outputs.version || needs.build-shell.outputs.version || '' }} | |
| FRAMEWORK_STATUS: ${{ needs.build-framework.outputs.status || 'cancelled' }} | |
| FRAMEWORK_ERROR: ${{ needs.build-framework.outputs.error }} | |
| SHELL_STATUS: ${{ needs.build-shell.outputs.status || 'cancelled' }} | |
| SHELL_ERROR: ${{ needs.build-shell.outputs.error }} | |
| INSTALL_URL: ${{ needs.publish-pr-release.outputs.install_url || '' }} | |
| RELEASE_URL: ${{ needs.publish-pr-release.outputs.release_url || '' }} | |
| PUBLISH_STATUS: ${{ needs.publish-pr-release.outputs.publish_status || '' }} | |
| run: node --experimental-strip-types .github/scripts/pr-build-result.ts | |
| trigger-docker: | |
| needs: [build-shell, publish-pr-release] | |
| if: github.event_name == 'workflow_dispatch' && needs.build-shell.outputs.status == 'success' && needs.publish-pr-release.outputs.release_tag != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| steps: | |
| - name: Checkout scripts | |
| uses: actions/checkout@v5 | |
| with: | |
| sparse-checkout: .github/scripts | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Dispatch docker build | |
| continue-on-error: true | |
| env: | |
| DISPATCH_PAT: ${{ secrets.PR_RELEASE_PAT }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ inputs.pr_number }} | |
| PR_SHA: ${{ inputs.pr_sha }} | |
| PR_HEAD_REPO: ${{ inputs.pr_head_repo }} | |
| SOURCE_REPO: ${{ github.repository }} | |
| RELEASE_REPO: NapNeko/napcat-pr-release | |
| run: | | |
| if [ -z "${DISPATCH_PAT}" ]; then | |
| echo "::warning::PR_RELEASE_PAT secret 未配置，跳过 Docker 测试镜像构建" | |
| exit 0 | |
| fi | |
| node --experimental-strip-types .github/scripts/pr-docker-dispatch.ts |