elenvind 1.0.1__tar.gz

elenvind-1.0.1/.github/workflows/ci.yml

@@ -0,0 +1,130 @@
+# CI：静态检查 + 全量测试 + 启动冒烟。
+#
+# 只跑 Linux：应用只支持提供 `fcntl.flock` 的 POSIX 系统（跨进程写互斥靠文件锁），
+# 因此在 Windows / macOS runner 上跑测试只会得到"平台不支持"的噪音。
+#
+# 主仓库在 Codeberg；这里同时服务于镜像仓库与发布流水线（见 manual/RELEASE.md）。
+
+name: ci
+
+on:
+  push:
+    branches: [main, master, trunk]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (Python ${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: 安装依赖（含开发工具）
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install ruff trove-classifiers
+
+      - name: 安装 nginx（官方源，验证目标环境的 HTTP/2 写法）
+        run: |
+          set -euo pipefail
+          # runner 自带的是发行版 nginx（Ubuntu 24.04 = 1.24，不认识 `http2 on;`），
+          # 先移除再从官方 mainline 源装，让 CI 与真实生产环境一致。
+          sudo apt-get remove -y --purge nginx nginx-common nginx-core || true
+          sudo systemctl mask nginx 2>/dev/null || true
+          curl -fsSL https://nginx.org/keys/nginx_signing.key \
+            | sudo gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg
+          . /etc/os-release
+          echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/mainline/ubuntu ${UBUNTU_CODENAME:-$VERSION_CODENAME} nginx" \
+            | sudo tee /etc/apt/sources.list.d/nginx.list >/dev/null
+          sudo apt-get update -qq
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nginx
+
+      - name: 确认 nginx 版本（必须支持 `http2 on;`）
+        run: |
+          python3 - <<'PY'
+          import subprocess
+
+          result = subprocess.run(["nginx", "-v"], capture_output=True, text=True)
+          version = (result.stderr + result.stdout).split("nginx/")[1].split()[0]
+          parts = tuple(int(part) for part in version.split("."))
+          print("nginx", version)
+          assert parts >= (1, 25, 1), (
+              f"CI 的 nginx 太旧：{version}；本项目的生成配置面向支持 `http2 on;` 的环境，"
+              "请确认上面那一步从 nginx.org 安装成功")
+          PY
+
+      - name: 静态检查
+        run: ruff check .
+
+      - name: 全量测试
+        run: python -m unittest discover -s tests -t . -v
+
+      - name: 打包元数据可构建
+        run: |
+          pip install build
+          python -m build
+          python - <<'PY'
+          import glob, tarfile, zipfile
+
+          wheel = glob.glob("dist/*.whl")[0]
+          sdist = glob.glob("dist/*.tar.gz")[0]
+          wheel_names = zipfile.ZipFile(wheel).namelist()
+          with tarfile.open(sdist) as archive:
+              sdist_names = archive.getnames()
+
+          leaked = [n for n in wheel_names
+                    if n.endswith("config.toml") or "/articles/" in n
+                    or "/custom/" in n or "/data/" in n]
+          assert not leaked, f"wheel 里混进了站点实例数据：{leaked}"
+
+          leaked = [n for n in sdist_names
+                    if n.endswith("/config.toml") or "/articles/" in n
+                    or "/custom/" in n or "/data/" in n or "/logs/" in n
+                    or "/backups/" in n]
+          assert not leaked, f"sdist 里混进了站点实例数据：{leaked}"
+
+          for need in ("elenvind/templates/base.html", "elenvind/i18n/en.toml",
+                       "elenvind/resources/config.example.toml"):
+              assert any(n.endswith(need) for n in wheel_names), f"wheel 缺少 {need}"
+          print("产物检查通过：无站点数据，包数据齐全")
+          PY
+
+      - name: 启动冒烟（console script + 只监听回环）
+        run: |
+          set -e
+          pip install -e .
+          WORK="$RUNNER_TEMP/instance"
+          mkdir -p "$WORK"/{data,logs,backups,articles,custom}
+          cp elenvind/resources/config.example.toml "$WORK/config.toml"
+          cd "$WORK"
+          nohup elenvind serve --bind 127.0.0.1:6789 --yes > serve.log 2>&1 &
+          for _ in $(seq 1 40); do
+            curl -sf -o /dev/null http://127.0.0.1:6789/ && break
+            sleep 0.5
+          done
+          for path in / /login /robots.txt /sitemap.xml; do
+            code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:6789$path")"
+            echo "$path -> $code"
+            [ "$code" = "200" ]
+          done
+          # 静态路径必须 404：本服务不发出任何静态文件
+          [ "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:6789/css/style.css)" = "404" ]
+          grep -q "TLS is terminated by the reverse proxy" serve.log
+          echo "冒烟通过"

elenvind-1.0.1/.github/workflows/publish.yml

@@ -0,0 +1,127 @@
+# 发布：打 tag 后自动构建、校验、发布到 PyPI，并在 GitHub 建 Release。
+#
+# 认证用 PyPI 的 **Trusted Publishing**（OIDC）：不需要在仓库里存任何 token。
+# 首次发布前必须在 PyPI 上登记 pending trusted publisher（见 manual/RELEASE.md）：
+#   Owner: ortzikantu   Repository: elenvind
+#   Workflow: publish.yml   Environment: pypi
+#
+# 触发方式是**只认 tag**（如 `v1.0.0`）：tag 名去掉前缀必须与 pyproject.toml 的
+# version 完全一致，否则第一步就失败 —— 避免"发出去的包和 tag 对不上"。
+
+name: publish
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "v[0-9]+.[0-9]+.[0-9]+*"      # 预发布：v1.0.1rc1 / v1.1.0.dev1 …
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: 校验版本与产物
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: 安装依赖
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install ruff build trove-classifiers
+
+      - name: tag 必须与 pyproject 的版本一致
+        run: |
+          python - <<'PY'
+          import os, pathlib, tomllib
+
+          version = tomllib.loads(
+              pathlib.Path("pyproject.toml").read_text(encoding="utf-8")
+          )["project"]["version"]
+          tag = os.environ["GITHUB_REF_NAME"].lstrip("v")
+          assert tag == version, f"tag {tag!r} 与 pyproject 的 version {version!r} 不一致"
+          print(f"版本一致：{version}")
+          PY
+
+      - name: 静态检查与全量测试
+        run: |
+          ruff check .
+          python -m unittest discover -s tests -t . -v
+
+      - name: 构建
+        run: |
+          rm -rf dist build ./*.egg-info
+          python -m build
+          ls -l dist/
+
+      - name: 产物自检（元数据 + 不含站点实例数据）
+        run: |
+          set -e
+          pip install twine
+          twine check dist/*
+          python - <<'PY'
+          import glob, tarfile, zipfile
+
+          wheel = glob.glob("dist/*.whl")[0]
+          sdist = glob.glob("dist/*.tar.gz")[0]
+          wheel_names = zipfile.ZipFile(wheel).namelist()
+          with tarfile.open(sdist) as archive:
+              sdist_names = archive.getnames()
+
+          for names, label in ((wheel_names, "wheel"), (sdist_names, "sdist")):
+              leaked = [n for n in names
+                        if n.endswith("config.toml") or "/articles/" in n
+                        or "/custom/" in n or "/data/" in n]
+              assert not leaked, f"{label} 混进了站点实例数据：{leaked}"
+          print("产物检查通过")
+          PY
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: 发布到 PyPI
+    needs: verify
+    runs-on: ubuntu-latest
+    environment: pypi                   # 与 PyPI 上登记的 environment 一致
+    permissions:
+      id-token: write                   # Trusted Publishing 必需；不需要任何 secret
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: 发布
+        uses: pypa/gh-action-pypi-publish@release/v1
+        # 默认目标 https://upload.pypi.org/legacy/，凭据由 OIDC 换取。
+
+  release:
+    name: 建 GitHub Release
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write                   # 建 Release 需要
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: 创建 Release 并附上产物
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" dist/* \
+             --repo "$GITHUB_REPOSITORY" \
+             --title "$GITHUB_REF_NAME" \
+             --generate-notes