mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-08-29 04:26:38 +00:00
Chinesezjc
63d9de0eb3
Address ds-review-bot findings on PR #2798: - release-publish.yml: use pnpm run build:official (not build) so the dsh pack step's verifyBuildArtifacts (families.ts:327, readClientBuildRecord with officialClientBuildEnvironment) finds the official client-build record; build would fail Pack release tarballs on a clean runner. - issue-lifecycle.yml: move the previous job-level if to step level on Create project token and Handle repository event, so approved/commented reviews pass (job reported success, no gray segment) without minting a write-capable App token or touching the board — preserving the original least-privilege property. - ci-workflow.spec.ts: lock the step-level gate on the two lifecycle steps, and add a release-workflow invariant test (release.yml/vendor are pack-only; release-publish.yml/vendor-publish.yml are workflow_dispatch-only with the npm-publish environment and Release-publish group) to prevent #2797 recurrence. - Update 2026-08-10-event-directed-pr-review-status and 2026-08-10-npm-release- sequences notes (en/zh/i18n) to the new split and step-level behavior. Verification: ci-workflow.spec.ts 14/14, typecheck clean, all five workflows YAML-parse, verify-translation-pairing consistent, note-format 582.
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
name: Issue lifecycle
|
|
|
|
on:
|
|
issues:
|
|
types:
|
|
- opened
|
|
- edited
|
|
- assigned
|
|
- unassigned
|
|
- labeled
|
|
- unlabeled
|
|
- closed
|
|
- reopened
|
|
- field_added
|
|
- field_removed
|
|
pull_request:
|
|
types:
|
|
- opened
|
|
- edited
|
|
- synchronize
|
|
- reopened
|
|
- labeled
|
|
- unlabeled
|
|
- review_requested
|
|
pull_request_review:
|
|
types:
|
|
- submitted
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: issue-lifecycle-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
lifecycle:
|
|
name: Issue lifecycle
|
|
# Runs on every pull_request_review event so the check reports success rather
|
|
# than a gray "skipped" segment. The token-creating and board-mutating steps
|
|
# are gated at step level (a skipped step does not gray the job): only a
|
|
# changes_requested review drives the Project board; approved/commented
|
|
# reviews never mint a write-capable App token.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out trusted policy
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ github.event.repository.default_branch }}
|
|
persist-credentials: false
|
|
- name: Create project token
|
|
id: app-token
|
|
if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'changes_requested' }}
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
|
|
with:
|
|
client-id: ${{ vars.DSH_ISSUE_APP_CLIENT_ID }}
|
|
private-key: ${{ secrets.DSH_ISSUE_APP_PRIVATE_KEY }}
|
|
owner: deepseek-harness
|
|
repositories: deepseek-harness
|
|
- name: Handle repository event
|
|
if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'changes_requested' }}
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: node .github/issue-management/policy.mjs lifecycle
|