R30-1 R30-9: 建立零人工发布门禁并补齐高频回归

.github/workflows/ci-release-gate.yml

@@ -0,0 +1,95 @@
+name: ci-release-gate
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release-gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: hyb_oa
+          POSTGRES_USER: hyboa_user
+          POSTGRES_PASSWORD: hyboa_password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U hyboa_user -d hyb_oa"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+
+    env:
+      QA_DB_HOST: 127.0.0.1
+      QA_DB_PORT: 5432
+      QA_DB_USER: hyboa_user
+      QA_DB_PASSWORD: hyboa_password
+      QA_DB_ADMIN_DB: postgres
+      QA_PORT: 3000
+      QA_HOST: 127.0.0.1
+      DEPLOY_SERVER: ${{ secrets.RELEASE_DEPLOY_SERVER }}
+      REMOTE_DIR: ${{ secrets.RELEASE_REMOTE_DIR }}
+      REMOTE_ENV_FILE: ${{ secrets.RELEASE_REMOTE_ENV_FILE }}
+      LIVE_SMOKE_BASE_URL: ${{ secrets.LIVE_SMOKE_BASE_URL }}
+      LIVE_SMOKE_ADMIN_IDENTIFIER: ${{ secrets.LIVE_SMOKE_ADMIN_IDENTIFIER }}
+      LIVE_SMOKE_ADMIN_PASSWORD: ${{ secrets.LIVE_SMOKE_ADMIN_PASSWORD }}
+      LIVE_SMOKE_EMPLOYEE_IDENTIFIER: ${{ secrets.LIVE_SMOKE_EMPLOYEE_IDENTIFIER }}
+      LIVE_SMOKE_EMPLOYEE_PASSWORD: ${{ secrets.LIVE_SMOKE_EMPLOYEE_PASSWORD }}
+      LIVE_EXPECT_WECOM_STATUS: ${{ secrets.LIVE_EXPECT_WECOM_STATUS }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: |
+            server/package-lock.json
+            client/package-lock.json
+
+      - name: Install server dependencies
+        working-directory: server
+        run: npm ci
+
+      - name: Install client dependencies
+        working-directory: client
+        run: npm ci
+
+      - name: Install PostgreSQL client
+        run: sudo apt-get update && sudo apt-get install -y postgresql-client
+
+      - name: Install Playwright browsers
+        working-directory: client
+        run: npx playwright install --with-deps
+
+      - name: Setup SSH agent
+        uses: webfactory/[email protected]
+        with:
+          ssh-private-key: ${{ secrets.RELEASE_DEPLOY_SSH_KEY }}
+
+      - name: Trust deploy host
+        run: |
+          mkdir -p ~/.ssh
+          host_part="${DEPLOY_SERVER#*@}"
+          ssh-keyscan -H "$host_part" >> ~/.ssh/known_hosts
+
+      - name: Run release gate
+        run: bash scripts/qa/run-release-gate.sh ci-release
+
+      - name: Upload release gate artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-gate-artifacts-${{ github.run_id }}
+          path: |
+            artifacts/release-gate
+            client/playwright-report
+            client/test-results
+          if-no-files-found: ignore