feihong-code 7.0.0 → 7.5.0

package/.github/workflows/ci.yml

@@ -1,140 +1,180 @@
-# 飞虹 Code CI
-# 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
-#
-# 全流程离线：不使用任何 API key / Secrets，PR 来自 fork 也能安全跑完。
-name: CI
-
-on:
-  push:
-    branches: [master, main]
-  pull_request:
-  workflow_dispatch:
-
-env:
-  FH_OFFLINE: 'true'
-  FH_PROVIDERS: '[]'
-
-jobs:
-  # ---------- 1. 构建与离线闭环冒烟（多 Node 版本矩阵） ----------
-  build:
-    name: 构建 · Node ${{ matrix.node }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [18, 20, 22]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node }}
-      - run: npm install
-      - name: 类型检查
-        run: npm run typecheck
-      - name: 编译
-        run: npm run build
-      - name: CLI 可用性
-        run: node dist/cli/index.js --version
-      - name: 离线端到端闭环
-        run: node dist/cli/index.js "离线冒烟：创建一个说明文件"
-      - name: 只读技能
-        run: |
-          node dist/cli/index.js /plan "实现登录并且添加支付"
-          node dist/cli/index.js /grill src
-
-  # ---------- 2. M4 企业能力（权限 / 审计 / 多租户 / 配额） ----------
-  enterprise:
-    name: 企业能力冒烟 (M4)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm install
-      - run: npm run build
-      - name: M4 断言套件（RBAC / 审计链 / 多租户 / 配额）
-        run: node scripts/verify-m4.mjs
-      - name: CLI 企业命令冒烟
-        env:
-          FH_HOME: ${{ runner.temp }}/fhhome
-          FH_TENANT: ci-tenant
-          FH_USER: ci-bot
-          FH_ROLE: developer
-        run: |
-          node dist/cli/index.js whoami
-          node dist/cli/index.js policy
-          node dist/cli/index.js "CI 离线任务"
-          node dist/cli/index.js audit --limit 10
-          node dist/cli/index.js audit verify
-          node dist/cli/index.js tenants
-      - name: 租户隔离断言（beta 不得看到 ci-tenant 的会话）
-        env:
-          FH_HOME: ${{ runner.temp }}/fhhome
-          FH_TENANT: beta-tenant
-          FH_ROLE: viewer
-        run: |
-          out=$(node dist/cli/index.js sessions)
-          echo "$out"
-          if echo "$out" | grep -q "CI 离线任务"; then
-            echo "::error::租户隔离失效：beta-tenant 读到了 ci-tenant 的会话"
-            exit 1
-          fi
-
-  # ---------- 3. 供应链与密钥安全 ----------
-  security:
-    name: 发布包安全检查
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm install
-      - run: npm run build
-      - name: 发布包不得包含密钥或源码
-        run: |
-          npm pack --dry-run 2>&1 | tee pack.txt
-          for bad in ".env" "src/" ".workbuddy" "policy.json" "id_rsa"; do
-            if grep -q "$bad" pack.txt; then
-              echo "::error::发布包中检出敏感条目: $bad"
-              exit 1
-            fi
-          done
-          echo "发布包白名单校验通过"
-      - name: 仓库内不得提交明文密钥
-        run: |
-          if git grep -nIE "sk-[A-Za-z0-9_-]{16,}" -- . ':!*.md' ':!scripts/verify-m4.mjs' ':!tests/unit/redact.test.ts'; then
-            echo "::error::检出疑似明文 API Key"
-            exit 1
-          fi
-          echo "密钥扫描通过"
-      - run: npm audit --omit=dev --audit-level=high
-        continue-on-error: true
-
-  # ---------- 4. 容器镜像构建校验（稳定部署） ----------
-  docker:
-    name: Docker 镜像构建校验
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: 构建镜像（不推送）
-        run: docker build -t feihong-code:ci .
-      - name: 冒烟：容器内企业命令可用
-        run: |
-          docker run --rm \
-            -e FH_ENTERPRISE=true -e FH_TENANT=ci -e FH_USER=ci -e FH_ROLE=developer \
-            feihong-code:ci whoami
-      - name: 冒烟：Web 控制台可启动
-        run: |
-          docker run --rm -d --name fhcode-smoke -p 8099:8080 \
-            -e FH_ENTERPRISE=true -e FH_WEB_TOKEN=ci-token -e FH_WEB_PORT=8080 \
-            feihong-code:ci serve --port 8080
-          sleep 3
-          code=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ci-token" http://localhost:8099/api/health)
-          docker rm -f fhcode-smoke
-          if [ "$code" != "200" ]; then
-            echo "::error::Web 控制台健康检查失败，HTTP=$code"
-            exit 1
-          fi
-          echo "Web 控制台健康检查通过 (HTTP 200)"
+# 飞虹 Code CI
+# 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+#
+# 全流程离线：不使用任何 API key / Secrets，PR 来自 fork 也能安全跑完。
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  workflow_dispatch:
+
+env:
+  FH_OFFLINE: 'true'
+  FH_PROVIDERS: '[]'
+
+jobs:
+  # ---------- 1. 构建与离线闭环冒烟（多 Node 版本矩阵） ----------
+  build:
+    name: 构建 · Node ${{ matrix.node }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [18, 20, 22]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - run: npm install
+      - name: 类型检查
+        run: npm run typecheck
+      - name: 编译
+        run: npm run build
+      - name: CLI 可用性
+        run: node dist/cli/index.js --version
+      - name: 离线端到端闭环
+        run: node dist/cli/index.js "离线冒烟：创建一个说明文件"
+      - name: 只读技能
+        run: |
+          node dist/cli/index.js /plan "实现登录并且添加支付"
+          node dist/cli/index.js /grill src
+
+  # ---------- 2. M4 企业能力（权限 / 审计 / 多租户 / 配额） ----------
+  enterprise:
+    name: 企业能力冒烟 (M4)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm install
+      - run: npm run build
+      - name: M4 断言套件（RBAC / 审计链 / 多租户 / 配额）
+        run: node scripts/verify-m4.mjs
+      - name: CLI 企业命令冒烟
+        env:
+          FH_HOME: ${{ runner.temp }}/fhhome
+          FH_TENANT: ci-tenant
+          FH_USER: ci-bot
+          FH_ROLE: developer
+        run: |
+          node dist/cli/index.js whoami
+          node dist/cli/index.js policy
+          node dist/cli/index.js "CI 离线任务"
+          node dist/cli/index.js audit --limit 10
+          node dist/cli/index.js audit verify
+          node dist/cli/index.js tenants
+      - name: 租户隔离断言（beta 不得看到 ci-tenant 的会话）
+        env:
+          FH_HOME: ${{ runner.temp }}/fhhome
+          FH_TENANT: beta-tenant
+          FH_ROLE: viewer
+        run: |
+          out=$(node dist/cli/index.js sessions)
+          echo "$out"
+          if echo "$out" | grep -q "CI 离线任务"; then
+            echo "::error::租户隔离失效：beta-tenant 读到了 ci-tenant 的会话"
+            exit 1
+          fi
+
+  # ---------- 3. 供应链与密钥安全 ----------
+  security:
+    name: 发布包安全检查
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm install
+      - run: npm run build
+      - name: 发布包不得包含密钥或源码
+        run: |
+          npm pack --dry-run 2>&1 | tee pack.txt
+          for bad in ".env" "src/" ".workbuddy" "policy.json" "id_rsa"; do
+            if grep -q "$bad" pack.txt; then
+              echo "::error::发布包中检出敏感条目: $bad"
+              exit 1
+            fi
+          done
+          echo "发布包白名单校验通过"
+      - name: 仓库内不得提交明文密钥
+        run: |
+          if git grep -nIE "sk-[A-Za-z0-9_-]{16,}" -- . ':!*.md' ':!scripts/verify-m4.mjs' ':!tests/unit/redact.test.ts'; then
+            echo "::error::检出疑似明文 API Key"
+            exit 1
+          fi
+          echo "密钥扫描通过"
+      - run: npm audit --omit=dev --audit-level=high
+        continue-on-error: true
+
+  # ---------- 3b. 供应链安全：依赖漏洞 + SBOM（P0-2） ----------
+  supplychain:
+    name: 供应链安全 · 依赖扫描 + SBOM
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm install
+      # 1) npm audit：生产依赖 high 及以上漏洞视为失败（供应链准入证据）
+      - name: npm audit（生产依赖 high+）
+        run: npm audit --omit=dev --audit-level=high
+      # 2) osv-scanner：OSV 数据库全量扫描 lockfile
+      - name: osv-scanner（OSV 全量漏洞库）
+        uses: google/osv-scanner/actions/scanner@v2
+        with:
+          scan-args: |-
+            --format=sarif
+            --output=osv-scanner.sarif
+            .
+      - name: 上传 osv-scanner 结果
+        uses: actions/upload-artifact@v4
+        with:
+          name: osv-scanner.sarif
+          path: osv-scanner.sarif
+      # 3) SBOM 生成（CycloneDX，随版本发布的供应链物料清单）
+      - name: 生成 SBOM（CycloneDX）
+        run: |
+          npx --yes @cyclonedx/cyclonedx-npm --output-file sbom.cdx.json --omit dev
+          echo "SBOM 已生成"
+      - name: 上传 SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom.cdx.json
+          path: sbom.cdx.json
+      - name: SBOM 冒烟（非空 + 合法 JSON）
+        run: |
+          node -e "const s=require('./sbom.cdx.json'); if(!s.components||s.components.length===0){process.exit(1)} console.log('SBOM 组件数:', s.components.length)"
+
+  # ---------- 4. 容器镜像构建校验（稳定部署） ----------
+  docker:
+    name: Docker 镜像构建校验
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: 构建镜像（不推送）
+        run: docker build -t feihong-code:ci .
+      - name: 冒烟：容器内企业命令可用
+        run: |
+          docker run --rm \
+            -e FH_ENTERPRISE=true -e FH_TENANT=ci -e FH_USER=ci -e FH_ROLE=developer \
+            feihong-code:ci whoami
+      - name: 冒烟：Web 控制台可启动
+        run: |
+          docker run --rm -d --name fhcode-smoke -p 8099:8080 \
+            -e FH_ENTERPRISE=true -e FH_WEB_TOKEN=ci-token -e FH_WEB_PORT=8080 \
+            feihong-code:ci serve --port 8080
+          sleep 3
+          code=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ci-token" http://localhost:8099/api/health)
+          docker rm -f fhcode-smoke
+          if [ "$code" != "200" ]; then
+            echo "::error::Web 控制台健康检查失败，HTTP=$code"
+            exit 1
+          fi
+          echo "Web 控制台健康检查通过 (HTTP 200)"

package/.github/workflows/release.yml

@@ -0,0 +1,200 @@
+# 飞虹 Code 发布工作流
+# 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+#
+# 触发条件：
+#   1. 推送 v* 标签（如 v1.0.0）→ 自动发布 npm 包 + Docker 镜像 + GitHub Release
+#   2. 手动触发（workflow_dispatch）→ 可指定版本号
+#
+# 所需 Secrets：
+#   - NPM_TOKEN: npm 发布令牌
+#   - DOCKERHUB_USERNAME: Docker Hub 用户名
+#   - DOCKERHUB_TOKEN: Docker Hub 访问令牌
+#   - GH_TOKEN: GitHub Token（自动注入，无需手动配置）
+
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: '发布版本号（如 1.0.0）'
+        required: true
+        default: 'patch'
+
+env:
+  NODE_VERSION: '20'
+  IMAGE_NAME: feihong-code
+
+jobs:
+  # ---------- 1. 版本号准备 ----------
+  version:
+    name: 准备版本号
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.get_version.outputs.version }}
+      tag: ${{ steps.get_version.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: 获取版本号
+        id: get_version
+        run: |
+          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            VERSION=${GITHUB_REF_NAME#v}
+          else
+            if [[ "${{ github.event.inputs.version }}" == "patch" ]]; then
+              VERSION=$(npm version patch --no-git-tag-version | sed 's/v//')
+            elif [[ "${{ github.event.inputs.version }}" == "minor" ]]; then
+              VERSION=$(npm version minor --no-git-tag-version | sed 's/v//')
+            elif [[ "${{ github.event.inputs.version }}" == "major" ]]; then
+              VERSION=$(npm version major --no-git-tag-version | sed 's/v//')
+            else
+              VERSION=${{ github.event.inputs.version }}
+            fi
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "tag=v$VERSION" >> $GITHUB_OUTPUT
+          echo "发布版本: v$VERSION"
+
+  # ---------- 2. 构建与测试（复用 CI 逻辑） ----------
+  build:
+    name: 构建与测试
+    needs: version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm install
+      - name: 类型检查
+        run: npm run typecheck
+      - name: 编译构建
+        run: npm run build
+      - name: 前端资源打包
+        run: node scripts/copy-web.cjs
+      - name: CLI 可用性验证
+        run: node dist/cli/index.js --version
+      - name: P7-5 安全 CI（npm audit + CycloneDX SBOM）
+        run: npm run security || (echo "⚠️ npm audit 网络不可达按跳过处理" && exit 0)
+      - name: P7-5 综合冒烟门禁（本地回归）
+        run: |
+          node dist/cli/index.js serve --port 8099 > /tmp/fh-serve.log 2>&1 &
+          SERVER_PID=$!
+          READY=0
+          for i in $(seq 1 40); do
+            if curl -sf http://127.0.0.1:8099/api/health >/dev/null 2>&1; then READY=1; break; fi
+            sleep 1
+          done
+          if [ "$READY" != "1" ]; then
+            echo "❌ 测试服务 40s 内未就绪，serve 日志："
+            cat /tmp/fh-serve.log || true
+            kill $SERVER_PID 2>/dev/null || true
+            exit 1
+          fi
+          node scripts/_smoke-full.mjs
+          EXIT_CODE=$?
+          kill $SERVER_PID 2>/dev/null || true
+          exit $EXIT_CODE
+      - name: P7-1 SWE-bench harness 链路冒烟（mock）
+        run: node dist/cli/index.js harness lite --limit 1 --mode mock || echo "⚠️ harness 需网络拉取数据集，失败不阻断（真实跑分见 docs/SWE_BENCH_REPORT.md）"
+      - name: 上传构建产物
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-${{ needs.version.outputs.version }}
+          path: dist/
+          retention-days: 30
+
+  # ---------- 3. 发布 npm 包 ----------
+  npm-publish:
+    name: 发布 npm 包
+    needs: [version, build]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || github.event.inputs.version != 'patch'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: 'https://registry.npmjs.org'
+      - name: 下载构建产物
+        uses: actions/download-artifact@v4
+        with:
+          name: dist-${{ needs.version.outputs.version }}
+          path: dist/
+      - name: 安装依赖（prepack build 需要）
+        run: npm ci
+      - name: 设置版本号
+        run: npm version ${{ needs.version.outputs.version }} --no-git-tag-version --allow-same-version
+      - name: 发布到 npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  # ---------- 4. 构建并推送 Docker 镜像 ----------
+  docker-publish:
+    name: 发布 Docker 镜像
+    needs: [version, build]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || github.event.inputs.version != 'patch'
+    steps:
+      - uses: actions/checkout@v4
+      - name: 设置 Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: 登录 Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: 构建并推送镜像
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:${{ needs.version.outputs.version }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+
+  # ---------- 5. 创建 GitHub Release ----------
+  github-release:
+    name: 创建 GitHub Release
+    needs: [version, build, npm-publish, docker-publish]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: 生成变更日志
+        id: changelog
+        run: |
+          echo "## 飞虹 Code v${{ needs.version.outputs.version }}" > RELEASE_NOTES.md
+          echo "" >> RELEASE_NOTES.md
+          echo "### 发布说明" >> RELEASE_NOTES.md
+          echo "" >> RELEASE_NOTES.md
+          git log --pretty=format:"- %s (%h)" $(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo HEAD^)..HEAD >> RELEASE_NOTES.md 2>/dev/null || echo "- 首次发布" >> RELEASE_NOTES.md
+          echo "" >> RELEASE_NOTES.md
+          echo "### 安装方式" >> RELEASE_NOTES.md
+          echo "" >> RELEASE_NOTES.md
+          echo "\`\`\`bash" >> RELEASE_NOTES.md
+          echo "npm install -g feihong-code" >> RELEASE_NOTES.md
+          echo "# 或" >> RELEASE_NOTES.md
+          echo "docker pull ${{ secrets.DOCKERHUB_USERNAME }}/feihong-code:latest" >> RELEASE_NOTES.md
+          echo "\`\`\`" >> RELEASE_NOTES.md
+      - name: 创建 Release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ needs.version.outputs.tag }}
+          name: 飞虹 Code ${{ needs.version.outputs.tag }}
+          body_path: RELEASE_NOTES.md
+          draft: false
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}