ci: add deterministic PR gate (typecheck + unit tests + secret scan) - #12
Merged
Conversation
Folio currently runs no automated checks on pull requests or pushes: release.yml only triggers on v* tags and both eval workflows are workflow_dispatch-only (the old eval PR gate was removed for flakiness). PRs therefore land unreviewed by any machine check. Add a pr.yml gate limited to deterministic checks with no API credits, market data or Electron E2E: - typecheck: bun run typecheck - unit tests: bun test --isolate - secret scan: grep-based scan for high-signal patterns, excluding test fixtures, docs prose and lockfiles Note: until helsome#10 (fixture test skips) merges, the unit-tests job reports the 7 known account-fixture failures on a clean checkout; merge helsome#10 first for a green gate.
Collaborator
Author
|
@helsome 你好，把手上这几条 PR 一起复核了一遍，现在都处于「随时可评审」状态；另外 #12 有一条需要你操作的点，放在下面。 我这 5 条 PR 的现状
共同点：
#12 需要你点一下（不是代码问题）
两个选项：
如果你近期不打算给 PR 加自动门禁，我也可以直接关掉 #12，不在仓库里留一个不会运行的 workflow。 想请你定一下评审方式5 条一起看可能偏长，你偏好哪种我就怎么配合：逐条合并 / 合成更少的 PR / 先看其中某几条。另外如果这几条里哪一条跟你接下来 #13–#39 那批方向不一致，直接说，我按你的方向调整或撤回。 谢谢！ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
当前仓库对 PR 和 push 没有任何自动检查：
release.yml只在v*tag 触发，eval-smoke.yml/eval-nightly.yml都是workflow_dispatch手动触发（旧的 eval PR 门禁因不稳定被移除）。PR 完全靠人工 review，类型错误、测试回归和意外提交的密钥都没有机器兜底。改动
新增
.github/workflows/pr.yml，pull_request+mainpush 触发，只包含确定性检查（无 API 额度、无行情数据、无 Electron E2E）：bun run typecheckbun test --isolateghp_、github_pat_、sk-、AKIA、PEM 私钥头），排除测试 fixture、docs 散文和 lockfile，命中即失败复用了
release.yml的oven-sh/setup-bun@v2与bun install --frozen-lockfile惯例，并按仓库风格加了concurrency取消旧运行。验证
注意（合并顺序）
在 #10（fixture 测试跳过）合并之前，unit-tests job 会在干净环境报告那 7 个已知的 account-fixture 失败。建议先合 #10 再合本 PR，这样新 CI 从第一分钟起就是绿的。