dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

2026-10-01 19:21:19 +00:00
commit e6dcef9bf5
@@ -0,0 +1,237 @@
+name: DSH Upstream Update
+
+on:
+  schedule:
+    - cron: "0 4 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: dsh-upstream-update
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  BASE_BRANCH: dev
+  CANDIDATE_BRANCH: automation/dsh-upstream-candidate
+  DSH_PACKAGE: "@deepseek-ai/dsh"
+  SUPPORTED_TARGET: release/supported-target.json
+  ENVIRONMENT_DEFINITION: container/environment/definition.json
+
+jobs:
+  discover:
+    name: Discover and propose upstream DSH
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      changed: ${{ steps.candidate.outputs.changed }}
+      current: ${{ steps.candidate.outputs.current }}
+      upstream: ${{ steps.candidate.outputs.upstream }}
+      environment: ${{ steps.candidate.outputs.environment }}
+      pull_request_url: ${{ steps.propose.outputs.pull_request_url }}
+      pull_request_number: ${{ steps.propose.outputs.pull_request_number }}
+      head_sha: ${{ steps.propose.outputs.head_sha }}
+
+    steps:
+      - name: Checkout protected branch
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.BASE_BRANCH }}
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Resolve latest official DSH
+        id: upstream
+        run: |
+          npm view "${DSH_PACKAGE}@latest" version --json > "$RUNNER_TEMP/dsh-version.json"
+          version="$(jq -er 'if type == "string" then . else error("expected one version") end' "$RUNNER_TEMP/dsh-version.json")"
+          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
+
+      - name: Advance candidate Supported Target
+        id: candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          UPSTREAM_VERSION: ${{ steps.upstream.outputs.version }}
+        run: |
+          base_sha="$(git rev-parse HEAD)"
+          current="$(jq -er '.latestSupportedDsh' "$SUPPORTED_TARGET")"
+          trusted_platform="$RUNNER_TEMP/trusted-platform"
+          mkdir -p "$trusted_platform/tools"
+          cp -R container/platform/lib "$trusted_platform/lib"
+          cp container/platform/tools/supported-target.mjs "$trusted_platform/tools/supported-target.mjs"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          candidate_remote_sha="$(git ls-remote --heads origin "$CANDIDATE_BRANCH" | cut -f 1)"
+          git switch --create "$CANDIDATE_BRANCH" "$base_sha"
+          result="$(node "$trusted_platform/tools/supported-target.mjs" advance \
+            "$SUPPORTED_TARGET" "$ENVIRONMENT_DEFINITION" "$UPSTREAM_VERSION")"
+          changed="$(jq -r 'if (.changed | type) == "boolean" then .changed else error("expected boolean changed") end' <<<"$result")"
+          environment="$(jq -er '.target.environment' <<<"$result")"
+          {
+            printf 'changed=%s\n' "$changed"
+            printf 'current=%s\n' "$current"
+            printf 'upstream=%s\n' "$UPSTREAM_VERSION"
+            printf 'environment=%s\n' "$environment"
+            printf 'candidate_remote_sha=%s\n' "$candidate_remote_sha"
+          } >> "$GITHUB_OUTPUT"
+          # shellcheck disable=SC2016
+          {
+            printf '### DSH upstream discovery\n\n'
+            printf -- '- Latest Supported: `%s`\n' "$current"
+            printf -- '- Latest Official: `%s`\n' "$UPSTREAM_VERSION"
+            printf -- '- Environment: `%s`\n' "$environment"
+            printf -- '- Candidate required: `%s`\n' "$changed"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Create or update candidate pull request
+        id: propose
+        if: steps.candidate.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CURRENT_VERSION: ${{ steps.candidate.outputs.current }}
+          UPSTREAM_VERSION: ${{ steps.candidate.outputs.upstream }}
+          ENVIRONMENT_VERSION: ${{ steps.candidate.outputs.environment }}
+        run: |
+          git add -- "$SUPPORTED_TARGET"
+          git commit -m "chore(dsh): validate ${UPSTREAM_VERSION}"
+
+          candidate_remote_sha="${{ steps.candidate.outputs.candidate_remote_sha }}"
+          if [ -n "$candidate_remote_sha" ]; then
+            git push --force-with-lease="refs/heads/$CANDIDATE_BRANCH:$candidate_remote_sha" \
+              origin "HEAD:refs/heads/$CANDIDATE_BRANCH"
+          else
+            git push origin "HEAD:refs/heads/$CANDIDATE_BRANCH"
+          fi
+
+          body="$RUNNER_TEMP/dsh-candidate-pr.md"
+          # shellcheck disable=SC2016
+          {
+            printf '## DSH candidate validation\n\n'
+            printf '| State | Version |\n|---|---|\n'
+            printf '| Latest Supported | `%s` |\n' "$CURRENT_VERSION"
+            printf '| Latest Official candidate | `%s` |\n' "$UPSTREAM_VERSION"
+            printf '| Current Environment | `%s` |\n\n' "$ENVIRONMENT_VERSION"
+            printf 'This PR changes only the candidate Supported Target. Compatibility CI validates the new DSH with the current Environment. Merge into dev records the validated candidate; promotion from dev to main remains the production publication gate.\n'
+          } > "$body"
+
+          pr_number="$(gh pr list --state open --head "$CANDIDATE_BRANCH" --json number --jq '.[0].number // empty')"
+          if [ -z "$pr_number" ]; then
+            pr_url="$(gh pr create \
+              --base "$BASE_BRANCH" \
+              --head "$CANDIDATE_BRANCH" \
+              --title "chore(dsh): validate ${UPSTREAM_VERSION}" \
+              --body-file "$body")"
+            pr_number="$(gh pr view "$pr_url" --json number --jq .number)"
+          else
+            gh pr edit "$pr_number" \
+              --base "$BASE_BRANCH" \
+              --title "chore(dsh): validate ${UPSTREAM_VERSION}" \
+              --body-file "$body"
+            pr_url="$(gh pr view "$pr_number" --json url --jq .url)"
+          fi
+          {
+            printf 'pull_request_url=%s\n' "$pr_url"
+            printf 'pull_request_number=%s\n' "$pr_number"
+            printf 'head_sha=%s\n' "$(git rev-parse HEAD)"
+          } >> "$GITHUB_OUTPUT"
+          printf 'Candidate PR: %s\n' "$pr_url" >> "$GITHUB_STEP_SUMMARY"
+
+  validate-candidate:
+    name: Validate candidate Runtime
+    needs: discover
+    if: needs.discover.outputs.changed == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/dsh-candidate-validation.yml
+    with:
+      ref: ${{ needs.discover.outputs.head_sha }}
+
+  report-validation:
+    name: Report candidate validation
+    needs: [discover, validate-candidate]
+    if: always() && needs.discover.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    steps:
+      - name: Publish commit status and PR report
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ needs.discover.outputs.head_sha }}
+          PR_NUMBER: ${{ needs.discover.outputs.pull_request_number }}
+          VALIDATION_RESULT: ${{ needs.validate-candidate.result }}
+          UPSTREAM_VERSION: ${{ needs.discover.outputs.upstream }}
+          ENVIRONMENT_VERSION: ${{ needs.discover.outputs.environment }}
+        run: |
+          if [ "$VALIDATION_RESULT" = success ]; then
+            state=success
+            label=passed
+            description="Candidate Runtime validation passed"
+          else
+            state=failure
+            label=failed
+            description="Candidate Runtime validation failed"
+          fi
+          run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+          gh api --method POST "/repos/${GITHUB_REPOSITORY}/statuses/${HEAD_SHA}" \
+            -f state="$state" \
+            -f context='DSH candidate Runtime' \
+            -f description="$description" \
+            -f target_url="$run_url" >/dev/null
+          gh pr comment "$PR_NUMBER" \
+            --repo "$GITHUB_REPOSITORY" \
+            --body "DSH \`${UPSTREAM_VERSION}\` with Environment \`${ENVIRONMENT_VERSION}\` **${label}** compatibility validation. [Open workflow run](${run_url})."
+          printf 'Candidate validation %s: %s\n' "$label" "$run_url" >> "$GITHUB_STEP_SUMMARY"
+
+  notify-discovered:
+    name: Notify upstream discovery
+    needs: discover
+    if: needs.discover.outputs.changed == 'true'
+    uses: yjrszcq/github-workflows/.github/workflows/gotify-notify.yml@c4c7fe9e17854cd4962913ac2792513eab0be988
+    with:
+      title: 发现 DSH 上游新版本 ${{ needs.discover.outputs.upstream }}
+      message: >-
+        当前支持版本：${{ needs.discover.outputs.current }}；上游候选版本：${{ needs.discover.outputs.upstream }}。
+        候选 Environment：${{ needs.discover.outputs.environment }}。
+        候选 PR：${{ needs.discover.outputs.pull_request_url }}
+      priority: 6
+    secrets:
+      gotify_url: ${{ secrets.GOTIFY_URL }}
+      gotify_token: ${{ secrets.GOTIFY_TOKEN }}
+
+  notify-result:
+    name: Notify upstream check result
+    needs: [discover, validate-candidate]
+    if: >-
+      always() &&
+      (needs.discover.result == 'failure' || needs.discover.outputs.changed == 'true')
+    uses: yjrszcq/github-workflows/.github/workflows/gotify-notify.yml@c4c7fe9e17854cd4962913ac2792513eab0be988
+    with:
+      title: >-
+        ${{
+          needs.discover.result == 'failure' && 'DSH 上游检查失败' ||
+          (needs.validate-candidate.result == 'success' &&
+           format('DSH {0} 候选版本验证通过', needs.discover.outputs.upstream) ||
+           format('DSH {0} 候选版本验证失败', needs.discover.outputs.upstream))
+        }}
+      message: >-
+        ${{
+          needs.discover.result == 'failure' &&
+          format('获取或生成 DSH 上游候选版本失败。工作流：{0}/{1}/actions/runs/{2}', github.server_url, github.repository, github.run_id) ||
+          (needs.validate-candidate.result == 'success' &&
+           format('DSH {0} 已通过 Environment {1} 兼容性验证。请审核并合并：{2}', needs.discover.outputs.upstream, needs.discover.outputs.environment, needs.discover.outputs.pull_request_url) ||
+           format('DSH {0} 未通过 Environment {1} 兼容性验证，需要适配 Environment。工作流：{2}/{3}/actions/runs/{4}', needs.discover.outputs.upstream, needs.discover.outputs.environment, github.server_url, github.repository, github.run_id))
+        }}
+      priority: ${{ (needs.discover.result == 'failure' || needs.validate-candidate.result != 'success') && 8 || 7 }}
+    secrets:
+      gotify_url: ${{ secrets.GOTIFY_URL }}
+      gotify_token: ${{ secrets.GOTIFY_TOKEN }}