chore: update actions workflow yamls (#6835)

* chore: update actions workflow yamls * fix: allow pro workflows on fork pull requests * chore: update turbo.json * fix: split admin preview image workflows * chore: bump pro submodule for admin typecheck * chore: update pro submodule
2026-05-08 01:08:43 +08:00 · 2026-04-28 16:25:48 +08:00
parent 18a35bfcdc
commit a08edc422a
8 changed files with 180 additions and 73 deletions
@@ -1,15 +1,25 @@
-name: 'FastGPT-Pro-Test'
+name: "FastGPT-Pro-Test"
 on:
-  pull_request:
+  pull_request_target:
+    types: [ opened, synchronize, reopened ]
+    paths:
+      - "pro"
+      - "pro/**"
+      - "packages/**"
+      - "sdk/**"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - ".gitmodules"
+      - ".github/workflows/fastgpt-pro-test.yaml"
  workflow_dispatch:

 concurrency:
-  group: 'fastgpt-pro-test-${{ github.event.pull_request.number || github.ref }}'
+  group: "fastgpt-pro-test-${{ github.event.pull_request.number || github.ref }}"
  cancel-in-progress: true

 jobs:
  test:
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || secrets.PRO_SUBMODULE_TOKEN != '' }}
    runs-on: ubuntu-latest

    permissions:
@@ -19,17 +29,24 @@ jobs:
    steps:
      - uses: actions/checkout@v4
        with:
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
-          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event_name == 'pull_request_target' &&
+            github.event.pull_request.head.sha || github.ref }}
+          repository: ${{ github.event_name == 'pull_request_target' &&
+            github.event.pull_request.head.repo.full_name || github.repository
+            }}
      - name: Update submodules
        env:
          PRO_SUBMODULE_TOKEN: ${{ secrets.PRO_SUBMODULE_TOKEN }}
        run: |
          if [ -f .gitmodules ]; then
+            if [ -z "${PRO_SUBMODULE_TOKEN}" ]; then
+              echo "::error::PRO_SUBMODULE_TOKEN is required to clone the private pro submodule. Add it to this repository's Actions secrets, or run this workflow from a repository that has the secret configured."
+              exit 1
+            fi
            if [ -n "${PRO_SUBMODULE_TOKEN}" ]; then
              git config --global url."https://x-access-token:${PRO_SUBMODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
            fi
-            git submodule update --init --recursive
+            git submodule update --init --recursive --jobs 8
          fi
      - name: Install system deps for node-canvas
        run: |
@@ -40,8 +57,8 @@ jobs:
          version: 10.33.2
      - uses: actions/setup-node@v4
        with:
-          node-version: '20'
-          cache: 'pnpm'
+          node-version: "24"
+          cache: "pnpm"
      - name: Install Deps
        run: pnpm install --frozen-lockfile
      - name: Test
@@ -1,37 +1,49 @@
-name: Preview Admin Image - Build & Push
+name: Preview Admin Image - Build

 on:
  pull_request_target:
    types: [opened, synchronize, reopened]
+    paths:
+      - 'pro'
+      - 'pro/**'
+      - 'packages/**'
+      - 'sdk/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'turbo.json'
+      - '.gitmodules'
+      - '.github/workflows/preview-admin-build.yml'
+      - '.github/workflows/preview-admin-push.yml'
  workflow_dispatch:

 concurrency:
-  group: 'preview-admin-build-${{ github.head_ref }}'
+  group: 'preview-admin-build-${{ github.event.pull_request.number || github.ref }}'
  cancel-in-progress: true

 permissions:
  contents: read
-  packages: write
-  pull-requests: write
-  issues: write

 jobs:
-  build-and-push:
-    if: ${{ github.event.pull_request.head.repo.full_name == github.repository || secrets.PRO_SUBMODULE_TOKEN != '' }}
+  build:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout PR code
        uses: actions/checkout@v4
        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/head
-          fetch-depth: 0
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
+          repository: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name || github.repository }}
+          fetch-depth: 1

      - name: Update submodules
        env:
          PRO_SUBMODULE_TOKEN: ${{ secrets.PRO_SUBMODULE_TOKEN }}
        run: |
          if [ -f .gitmodules ]; then
+            if [ -z "${PRO_SUBMODULE_TOKEN}" ]; then
+              echo "::error::PRO_SUBMODULE_TOKEN is required to clone the private pro submodule. Add it to this repository's Actions secrets, or run this workflow from a repository that has the secret configured."
+              exit 1
+            fi
            if [ -n "${PRO_SUBMODULE_TOKEN}" ]; then
              git config --global url."https://x-access-token:${PRO_SUBMODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
            fi
@@ -41,63 +53,33 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

-      - name: Login to Aliyun Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: registry.cn-hangzhou.aliyuncs.com
-          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
-          password: ${{ secrets.FASTGPT_ALI_IMAGE_PSW }}
-
-      - name: Build and push Docker image
+      - name: Build Docker image (no push)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: pro/admin/Dockerfile
          platforms: linux/amd64
-          push: true
-          tags: ${{ secrets.FASTGPT_ALI_IMAGE_PREFIX }}/fastgpt-pro-pr:${{ github.event.pull_request.head.sha }}
+          push: false
+          tags: fastgpt-pro-pr:${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/FastGPT
            org.opencontainers.image.description=fastgpt-pro admin image
+            org.opencontainers.image.revision=${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+          outputs: type=docker,dest=/tmp/fastgpt-pro-image.tar
+          cache-from: type=gha,scope=fastgpt-pro
+          cache-to: type=gha,mode=max,scope=fastgpt-pro

-      - name: Add PR comment on success
-        if: success()
-        uses: actions/github-script@v7
+      - name: Save PR metadata
+        run: |
+          echo "${{ github.event.pull_request.number || '' }}" > /tmp/pr-number.txt
+          echo "${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}" > /tmp/pr-sha.txt
+
+      - name: Upload Docker image artifact
+        uses: actions/upload-artifact@v4
        with:
-          script: |
-            const prNumber = ${{ github.event.pull_request.number }};
-            const marker = '<!-- fastgpt-admin-preview -->';
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: prNumber,
-            });
-
-            const existingComment = comments.find(comment =>
-              comment.body.includes(marker)
-            );
-
-            const commentBody = `${marker}
-            ✅ **Admin Preview Image Ready!**
-
-            \`\`\`
-            ${{ secrets.FASTGPT_ALI_IMAGE_PREFIX }}/fastgpt-pro-pr:${{ github.event.pull_request.head.sha }}
-            \`\`\`
-            `;
-
-            if (existingComment) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existingComment.id,
-                body: commentBody
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                body: commentBody
-              });
-            }
+          name: preview-admin-image
+          path: |
+            /tmp/fastgpt-pro-image.tar
+            /tmp/pr-number.txt
+            /tmp/pr-sha.txt
+          retention-days: 1
@@ -0,0 +1,101 @@
+name: Preview Admin Image - Push
+
+on:
+  workflow_run:
+    workflows: ['Preview Admin Image - Build']
+    types: [completed]
+
+concurrency:
+  group: 'preview-admin-push'
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+  id-token: write
+  pull-requests: write
+  issues: write
+  actions: read
+
+jobs:
+  push:
+    runs-on: ubuntu-24.04
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: preview-admin-image
+          path: /tmp
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read PR metadata
+        id: pr
+        run: |
+          echo "number=$(cat /tmp/pr-number.txt)" >> "$GITHUB_OUTPUT"
+          echo "sha=$(cat /tmp/pr-sha.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Load Docker image
+        run: docker load --input /tmp/fastgpt-pro-image.tar
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Aliyun Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: registry.cn-hangzhou.aliyuncs.com
+          username: ${{ secrets.FASTGPT_ALI_IMAGE_USER }}
+          password: ${{ secrets.FASTGPT_ALI_IMAGE_PSW }}
+
+      - name: Tag and push Docker image
+        run: |
+          SHA="${{ steps.pr.outputs.sha }}"
+          docker tag fastgpt-pro-pr:${SHA} \
+            ${{ secrets.FASTGPT_ALI_IMAGE_PREFIX }}/fastgpt-pro-pr:${SHA}
+          docker push ${{ secrets.FASTGPT_ALI_IMAGE_PREFIX }}/fastgpt-pro-pr:${SHA}
+
+      - name: Add PR comment on success
+        if: success() && steps.pr.outputs.number != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = parseInt('${{ steps.pr.outputs.number }}');
+            const marker = '<!-- fastgpt-admin-preview -->';
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+
+            const existingComment = comments.find(comment =>
+              comment.body.includes(marker)
+            );
+
+            const commentBody = `${marker}
+            ✅ **Admin Preview Image Ready!**
+
+            \`\`\`
+            ${{ secrets.FASTGPT_ALI_IMAGE_PREFIX }}/fastgpt-pro-pr:${{ steps.pr.outputs.sha }}
+            \`\`\`
+            `;
+
+            if (existingComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existingComment.id,
+                body: commentBody
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body: commentBody
+              });
+            }