sunjunzhao
5de73214f8
Guides and constrains eco-app development in independent repos against the TickShield platform contract: listingKey identity, app.manifest.json fields, tickshield-node-runtime base image, guard four-gate authz, tenant_id isolation, portal-sdk host bridge for micro frontends, release-cli publish and store deployment. Ships copy-ready templates (manifest/Dockerfile/server.js/web skeleton/Gitea release workflow/PRD) plus a zero-dependency static checker (scripts/check-app.sh) covering die/warn contract items.
51 lines
2.4 KiB
YAML
51 lines
2.4 KiB
YAML
# Gitea Actions 应用自动上架模板（APPSTORE-RUNTIME）——复制到应用仓库 .gitea/workflows/ 下使用。
|
||
#
|
||
# 链路：推 tag → buildx 构建推送镜像到平台 registry → 经 release-cli（单文件 CLI，
|
||
# node 容器内执行，runner 无需装 node）提交 manifest → 记录镜像 → 自动上架。
|
||
#
|
||
# 前置：
|
||
# 1. 平台商店「新建应用」签发凭证，配到仓库 secrets：APP_KEY / APP_SECRET；
|
||
# 2. 商店应用详情开「auto_publish」（否则 CI 停在记录镜像，等平台管理员手动上架）；
|
||
# 3. registry 推送凭证 secrets：REGISTRY_USER / REGISTRY_TOKEN（推送 livebook:8418 用）。
|
||
name: app-release
|
||
|
||
on:
|
||
push:
|
||
tags: ["v*"]
|
||
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
publish:
|
||
runs-on: self-hosted
|
||
steps:
|
||
- name: Checkout tag source
|
||
run: |
|
||
rm -rf src && git clone --depth 1 --branch "$GITHUB_REF_NAME" . src
|
||
cd src && echo "commit: $(git rev-parse --short HEAD)"
|
||
|
||
- name: Build & push image（多架构）
|
||
run: |
|
||
IMAGE="${{ vars.APP_IMAGE_PREFIX || 'livebook:8418/projects' }}/$(basename $GITHUB_REPOSITORY)"
|
||
TAG="${GITHUB_REF_NAME#v}"
|
||
docker login -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}" livebook:8418
|
||
docker buildx build --platform linux/amd64,linux/arm64 --push \
|
||
-t "$IMAGE:$TAG" -t "$IMAGE:latest" ./src
|
||
echo "IMAGE_REF=$IMAGE:$TAG" >> "$GITHUB_ENV"
|
||
|
||
- name: Submit manifest + record image + auto publish
|
||
run: |
|
||
docker run --rm \
|
||
-e AIGREGO_PORTAL_URL="${{ vars.TICKSHIELD_PORTAL_URL || 'http://gateway:8080' }}" \
|
||
-e APP_KEY="${{ secrets.APP_KEY }}" \
|
||
-e APP_SECRET="${{ secrets.APP_SECRET }}" \
|
||
-v "$PWD/src:/src" node:20-alpine \
|
||
sh -c 'node /src/cli/aigrego-release.mjs publish \
|
||
--manifest /src/app.manifest.json \
|
||
--image "$0" --store --wait 600' "$IMAGE_REF"
|
||
# CLI 单文件获取（仓库内不落盘时）：
|
||
# sh -c 'wget -qO /tmp/cli.mjs https://code.innev.cn/images/tickshield-dist/raw/branch/main/cli/aigrego-release.mjs && node /tmp/cli.mjs ...'
|
||
# micro 应用前端产物（先 bun 构建 web/ 再上传，包根必须直接含 index.html）：
|
||
# sh -c 'cd /src/web && bun build src/main.tsx --outfile dist/app.bundle.js && node /src/cli/aigrego-release.mjs publish --dist dist'
|