AskaEth
95e8a5ca42
file-size job 原先只扫 *.rs/*.md/*.slint/*.yml/*.yaml/*.toml/*.json， packaging/ 下的构建辅助脚本（make_artifacts.py、check_screenshot.py、 linux-smoke-docker.sh）完全没有任何行数保护。 - 在 git ls-files 的 pathspec 末尾加 '*.py' '*.sh'，语义不变（>400 行即硬失败） - 保留 LICENSE*/CHANGELOG* 排除；Cargo.lock 等机器生成文件刻意不入列 - 阈值、失败方式（::error + exit 1）均未改动
84 lines
3.2 KiB
YAML
84 lines
3.2 KiB
YAML
name: Guards
|
||
|
||
# 架构与合规守门（与 fmt/clippy 同级，不允许 continue-on-error）：
|
||
# 1. core-no-ui —— crates/core 零 UI 依赖（D3 铁律），依赖表 + cargo tree 双查
|
||
# 2. file-size —— 全仓代码/文档单文件 ≤400 行（用户硬约束）
|
||
# 3. licenses —— cargo-deny：许可证白名单 + GPL 依赖拦截 + 供应链来源校验
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
pull_request:
|
||
workflow_dispatch:
|
||
|
||
env:
|
||
CARGO_TERM_COLOR: always
|
||
|
||
jobs:
|
||
core-no-ui:
|
||
name: core 零 UI 守门
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: dtolnay/rust-toolchain@stable
|
||
- name: 依赖表直查（crates/core/Cargo.toml 不得出现 UI 框架）
|
||
run: |
|
||
set -uo pipefail
|
||
forbidden='slint|egui|eframe|iced|winit|gtk|javafx|tauri|fltk|druid|relm'
|
||
# 只看非注释行：manifest 里说明「不许出现 slint」的注释本身不该触发守门
|
||
if grep -vE '^[[:space:]]*#' crates/core/Cargo.toml | grep -nEi "$forbidden"; then
|
||
echo "::error file=crates/core/Cargo.toml::core 不得依赖 UI 框架（见 AGENTS.md 硬约束）"
|
||
exit 1
|
||
fi
|
||
echo "OK: crates/core/Cargo.toml 无 UI 依赖"
|
||
- name: 依赖树泄漏检查（cargo tree -p unlucky-core，排除自身行）
|
||
run: |
|
||
set -uo pipefail
|
||
forbidden='slint|egui|eframe|iced|winit|gtk|javafx|tauri|fltk|druid|relm'
|
||
tree=$(cargo tree -p unlucky-core --edges normal --prefix none)
|
||
echo "$tree"
|
||
if echo "$tree" | grep -vE '^unlucky-core v' | grep -qiE "$forbidden"; then
|
||
echo "::error::core 的依赖树出现 UI 框架 —— 传递依赖也不允许"
|
||
exit 1
|
||
fi
|
||
echo "OK: unlucky-core 依赖树零 UI"
|
||
|
||
file-size:
|
||
name: 文件行数 ≤400 守门
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- name: 检查单文件行数
|
||
run: |
|
||
set -uo pipefail
|
||
LIMIT=400
|
||
failed=0
|
||
while IFS= read -r f; do
|
||
case "$f" in
|
||
LICENSE|*/LICENSE|LICENSE-*|*/LICENSE-*) continue ;;
|
||
CHANGELOG*|*/CHANGELOG*) continue ;;
|
||
esac
|
||
n=$(wc -l < "$f")
|
||
if [ "$n" -gt "$LIMIT" ]; then
|
||
echo "::error file=$f::$f 有 $n 行，超过 $LIMIT 行上限，请按模块拆分"
|
||
failed=$((failed + 1))
|
||
fi
|
||
# 覆盖范围含脚本（*.py/*.sh）：packaging/ 下的构建辅助脚本同样受 400 行约束；
|
||
# Cargo.lock 等机器生成文件刻意不在列（否则一生成就超限）
|
||
done < <(git ls-files '*.rs' '*.md' '*.slint' '*.yml' '*.yaml' '*.toml' '*.json' '*.py' '*.sh')
|
||
if [ "$failed" -ne 0 ]; then
|
||
echo "共 $failed 个文件超限"
|
||
exit 1
|
||
fi
|
||
echo "OK: 全部受检文件 ≤$LIMIT 行"
|
||
|
||
licenses:
|
||
name: 依赖许可与来源（cargo-deny）
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: EmbarkStudios/cargo-deny-action@v2
|
||
with:
|
||
# 只跑许可/禁用/来源三类，advisories 由后续安全轮次单独接管
|
||
command: check licenses bans sources
|