feat: deliver first finance preview with setup wizard

2026-08-17 14:08:40 +08:00
parent 47403fd337
commit c8b0151769
558 changed files with 140774 additions and 3 deletions
@@ -0,0 +1,116 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate release tag
+        id: release_meta
+        env:
+          GITEA_REF_NAME: ${{ github.ref_name }}
+          GITEA_SHA: ${{ github.sha }}
+        run: |
+          VERSION=${GITEA_REF_NAME#v}
+          test "$GITEA_REF_NAME" = "v$VERSION"
+          ./scripts/check-semver.sh "$VERSION"
+          test "$(git rev-parse "refs/tags/$GITEA_REF_NAME^{commit}")" = "$GITEA_SHA"
+          test -z "$(git status --porcelain --untracked-files=all)"
+          printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Verify backend
+        env:
+          RELEASE_VERSION: ${{ steps.release_meta.outputs.version }}
+        run: ./backend/mvnw -f backend/pom.xml -Drevision="$RELEASE_VERSION" test
+
+      - name: Verify frontend
+        working-directory: frontend
+        run: |
+          HUSKY=0 npm ci
+          npm run lint -- --no-fix
+          npm run stylelint
+          npm test
+          npm run audit:dependencies
+          npm run build
+          npx playwright install --with-deps chromium
+          npm run test:e2e
+
+      - name: Verify release contracts and scripts
+        run: |
+          ./scripts/check-openapi.sh openapi.yaml
+          ./scripts/test-install-fixture.sh
+          ./scripts/test-git-install-fixture.sh
+          ./scripts/test-update-fixture.sh
+          ./scripts/test-gitea-publish-fixture.sh
+          shellcheck deploy/install.sh deploy/install-from-git.sh deploy/update.sh scripts/check-semver.sh \
+            scripts/package-release.sh scripts/publish-gitea-release.sh \
+            scripts/generate-release-key.sh scripts/test-install-fixture.sh \
+            scripts/test-git-install-fixture.sh \
+            scripts/test-update-fixture.sh scripts/test-gitea-publish-fixture.sh \
+            scripts/verify-release.sh
+
+      - name: Build and sign release assets
+        env:
+          RELEASE_SIGNING_KEY_B64: ${{ secrets.RELEASE_SIGNING_KEY_B64 }}
+          RELEASE_VERSION: ${{ steps.release_meta.outputs.version }}
+          KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256: ${{ vars.KAIDI_RELEASE_PUBLIC_KEY_SHA256 }}
+          KAIDI_RELEASE_NOTES: Kaidi Finance ${{ github.ref_name }}
+          KAIDI_SOURCE_REVISION: ${{ github.sha }}
+          KAIDI_SOURCE_REF: ${{ github.ref_name }}
+          KAIDI_SOURCE_DIRTY: 'false'
+        run: |
+          test -n "$RELEASE_SIGNING_KEY_B64"
+          trap 'shred -u "$RUNNER_TEMP/release-key.pem" 2>/dev/null || rm -f "$RUNNER_TEMP/release-key.pem"' EXIT
+          printf '%s' "$RELEASE_SIGNING_KEY_B64" | base64 --decode > "$RUNNER_TEMP/release-key.pem"
+          chmod 600 "$RUNNER_TEMP/release-key.pem"
+          KAIDI_RELEASE_SIGNING_KEY="$RUNNER_TEMP/release-key.pem" \
+            ./scripts/package-release.sh "$RELEASE_VERSION"
+
+      - name: Verify signed release assets
+        env:
+          KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256: ${{ vars.KAIDI_RELEASE_PUBLIC_KEY_SHA256 }}
+          KAIDI_EXPECTED_SOURCE_REVISION: ${{ github.sha }}
+          KAIDI_EXPECTED_SOURCE_REF: ${{ github.ref_name }}
+          KAIDI_EXPECTED_SOURCE_DIRTY: 'false'
+        run: ./scripts/verify-release.sh dist/release
+
+      - name: Publish Gitea release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_SERVER_URL: ${{ github.server_url }}
+          GITEA_REPOSITORY: ${{ github.repository }}
+          GITEA_REF_NAME: ${{ github.ref_name }}
+          GITEA_SHA: ${{ github.sha }}
+        run: ./scripts/publish-gitea-release.sh
+
+      - name: Upload Playwright report after failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report-${{ github.run_id }}
+          path: frontend/playwright-report
+          if-no-files-found: ignore
+          retention-days: 7