mirror of
https://github.com/GeWuYou/GFramework.git
synced 2026-03-22 19:03:29 +08:00
2f0a619e81
- 将许可证扫描逻辑提取到独立的 license-compliance.yml 工作流文件 - 在 auto-tag 工作流中添加 license-compliance 作业依赖 - 移除 ci.yml 中的 Feluda 许可证扫描相关步骤 - 移除 publish.yml 中的 Feluda 设置和 SBOM 生成步骤 - 更新工件上传配置以包含 SBOM 验证文件 - 添加工作流输出标记用于许可证合规检查触发
142 lines
4.3 KiB
YAML
142 lines
4.3 KiB
YAML
# CI/CD工作流配置：构建和测试.NET项目
|
||
# 该工作流在push到main/master分支或创建pull request时触发
|
||
name: CI - Build & Test
|
||
|
||
on:
|
||
push:
|
||
branches: [ main, master ]
|
||
pull_request:
|
||
branches: [ main, master ]
|
||
|
||
permissions:
|
||
contents: write
|
||
security-events: write
|
||
|
||
jobs:
|
||
test:
|
||
name: Build and Test
|
||
runs-on: ubuntu-latest
|
||
|
||
steps:
|
||
# 检出源代码，设置fetch-depth为0以获取完整的git历史
|
||
- name: Checkout code
|
||
uses: actions/checkout@v6
|
||
with:
|
||
fetch-depth: 0
|
||
# MegaLinter扫描步骤
|
||
# 执行代码质量检查和安全扫描，生成SARIF格式报告
|
||
- name: MegaLinter
|
||
uses: oxsecurity/megalinter@v9.3.0
|
||
continue-on-error: true
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
FAIL_ON_ERROR: ${{ github.ref == 'refs/heads/main' }}
|
||
# 上传SARIF格式的安全和代码质量问题报告到GitHub安全中心
|
||
- name: Upload SARIF
|
||
uses: github/codeql-action/upload-sarif@v3
|
||
with:
|
||
sarif_file: megalinter-reports/sarif
|
||
|
||
# TruffleHog OSS 扫描步骤
|
||
# 使用 TruffleHog 工具扫描代码库中的敏感信息泄露，如API密钥、密码等
|
||
# 该步骤会比较基础分支和当前提交之间的差异，检测新增内容中是否包含敏感数据
|
||
- name: TruffleHog OSS
|
||
uses: trufflesecurity/trufflehog@v3.92.5
|
||
with:
|
||
# 扫描路径，. 表示扫描整个仓库
|
||
path: .
|
||
# 基础提交哈希，用于与当前提交进行比较
|
||
base: ${{ github.event.before }}
|
||
# 当前提交哈希，作为扫描的目标版本
|
||
head: ${{ github.sha }}
|
||
|
||
# 安装和配置.NET SDK版本
|
||
- name: Setup .NET 8
|
||
uses: actions/setup-dotnet@v5
|
||
with:
|
||
dotnet-version: 8.0.x
|
||
|
||
- name: Setup .NET 9
|
||
uses: actions/setup-dotnet@v5
|
||
with:
|
||
dotnet-version: 9.0.x
|
||
|
||
- name: Setup .NET 10
|
||
uses: actions/setup-dotnet@v5
|
||
with:
|
||
dotnet-version: 10.0.x
|
||
|
||
# 配置NuGet包缓存以加速后续构建
|
||
- name: Cache NuGet packages
|
||
uses: actions/cache@v5
|
||
with:
|
||
path: ~/.nuget/packages
|
||
key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
|
||
|
||
# 执行NuGet包恢复操作
|
||
- name: Restore
|
||
run: dotnet restore
|
||
# 恢复.NET本地工具
|
||
- name: Restore .NET tools
|
||
run: dotnet tool restore
|
||
|
||
# 构建项目，使用Release配置且跳过恢复步骤
|
||
- name: Build
|
||
run: dotnet build -c Release --no-restore
|
||
|
||
# 运行单元测试，输出TRX格式结果到TestResults目录
|
||
- name: Test - Core
|
||
run: |
|
||
dotnet test GFramework.Core.Tests \
|
||
-c Release \
|
||
--no-build \
|
||
--logger "trx;LogFileName=core-$RANDOM.trx" \
|
||
--results-directory TestResults
|
||
|
||
- name: Test - SourceGenerators
|
||
run: |
|
||
dotnet test GFramework.SourceGenerators.Tests \
|
||
-c Release \
|
||
--no-build \
|
||
--logger "trx;LogFileName=sg-$RANDOM.trx" \
|
||
--results-directory TestResults
|
||
- name: Generate CTRF report
|
||
run: |
|
||
mkdir -p ctrf
|
||
|
||
for trx in TestResults/*.trx; do
|
||
name=$(basename "$trx" .trx)
|
||
echo "Processing $trx -> ctrf/$name.json"
|
||
|
||
dotnet tool run DotnetCtrfJsonReporter \
|
||
-p "$trx" \
|
||
-t nunit \
|
||
-d ctrf \
|
||
-f "$name.json"
|
||
done
|
||
|
||
|
||
# 生成并发布测试报告，无论测试成功或失败都会执行
|
||
- name: Test Report
|
||
uses: dorny/test-reporter@v2
|
||
if: always()
|
||
with:
|
||
name: .NET Test Results
|
||
path: TestResults/*.trx
|
||
reporter: dotnet-trx
|
||
- name: Publish Test Report
|
||
uses: ctrf-io/github-test-reporter@v1
|
||
with:
|
||
report-path: './ctrf/*.json'
|
||
github-report: true
|
||
pull-request-report: true
|
||
summary-delta-report: true
|
||
insights-report: true
|
||
flaky-rate-report: true
|
||
fail-rate-report: true
|
||
slowest-report: true
|
||
upload-artifact: true
|
||
fetch-previous-results: true
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
if: always() |