230 lines
9.9 KiB
YAML
230 lines
9.9 KiB
YAML
name: '📦 国内搬家·打包'
|
|
|
|
# ════════════════════════════════════════════════════════════════
|
|
# 国内搬家·打包工作流 · migrate-to-cn-build
|
|
# 编号: ZY-WF-MIGRATE-TO-CN-BUILD
|
|
# Sovereign: TCS-0002∞ · 国作登字-2026-A-00037559
|
|
# 守护: 铸渊 · ICE-GL-ZY001
|
|
#
|
|
# 触发场景:
|
|
# 冰朔在 GitHub 上点 Run workflow + 填「打包搬家包」, 工作流自动:
|
|
# 1. 误触锁校验
|
|
# 2. checkout 整仓
|
|
# 3. git archive 整工作树 (不带 .git/objects 历史 · cc-001 涌现洁净)
|
|
# 4. 排除 node_modules / checkpoints / *.bin / *.safetensors / secrets/
|
|
# 5. 跑 build-manifest.js 生成中文 MIGRATION-MANIFEST.md + sha256 + manifest.json
|
|
# 6. 上传成 GH Actions Artifact (90 天保留)
|
|
# 7. 中文回执 → Step Summary 告诉冰朔下一步去 COS 桶哪个路径上传
|
|
#
|
|
# 这个 workflow 不接触任何服务器 secrets, 也不接触 ZY_CN_SERVER_*,
|
|
# 因此**不必加入 cn-isolation-allowlist** (扫描器只关心引用 ZY_CN_SERVER_* 的).
|
|
#
|
|
# 误触锁: confirm_phrase = 「打包搬家包」
|
|
# 因果链: cc-001 (涌现洁净 · 不带 GitHub remote tracking) +
|
|
# cc-004 (中文一次性 · 操作流程写到回执里)
|
|
# ════════════════════════════════════════════════════════════════
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
confirm_phrase:
|
|
description: '误触锁 · 必须输入「打包搬家包」才会真打包, 其他值降级 dry-run (只列内容不上传 Artifact)'
|
|
required: false
|
|
default: ''
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: migrate-to-cn-build
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
build:
|
|
name: 打包工作树 → Artifact
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- name: Checkout 整仓
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: 误触锁 · 必须输入「打包搬家包」
|
|
id: misclick
|
|
env:
|
|
PHRASE: ${{ inputs.confirm_phrase }}
|
|
run: |
|
|
set -e
|
|
REQUIRED="打包搬家包"
|
|
if [ "$PHRASE" != "$REQUIRED" ]; then
|
|
echo "═══════════════════════════════════════════════"
|
|
echo " ⚠️ 误触保护"
|
|
echo " 要真打包并上传 Artifact, 必须在 confirm_phrase"
|
|
echo " 字段精确输入: 「$REQUIRED」"
|
|
echo " 当前值=「$PHRASE」 → 自动切到 dry-run."
|
|
echo "═══════════════════════════════════════════════"
|
|
echo "effective_dry_run=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "✅ 已显式确认 (phrase=「$PHRASE」), 即将真打包"
|
|
echo "effective_dry_run=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: 装 jq (build-manifest 不需要,但保险)
|
|
run: |
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y -qq jq
|
|
|
|
- name: 计算 tag (YYYYMMDD-HHMM UTC)
|
|
id: tag
|
|
run: |
|
|
TAG="$(date -u +%Y%m%d-%H%M)"
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "✅ tag=$TAG"
|
|
|
|
- name: git archive 整工作树 (不带 .git 历史)
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /tmp/migration-out
|
|
# git archive 默认就不带 .git/, 这里再用 --worktree-attributes 让 .gitattributes
|
|
# 的 export-ignore 生效, 加双保险.
|
|
# 同时显式 --prefix=guanghulab/ 让解出来的目录名固定 (不跟仓库名 -<sha> 关联),
|
|
# 国内 Forgejo 那边解出来路径稳定.
|
|
git archive \
|
|
--format=tar.gz \
|
|
--worktree-attributes \
|
|
--prefix=guanghulab/ \
|
|
-o /tmp/repo-raw.tar.gz \
|
|
HEAD
|
|
ls -lh /tmp/repo-raw.tar.gz
|
|
|
|
- name: 二次过滤 · 剔除大目录/二进制/敏感目录
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
# git archive 已经按 .gitattributes export-ignore 排除了一部分,
|
|
# 但仓库可能没配 .gitattributes. 这里再过一遍, 保证下面这些一定不在包里:
|
|
# node_modules/ (大量小文件, 服务器恢复后重装)
|
|
# **/checkpoints/ (模型权重, 单 GB 起, 走 COS 单独拉)
|
|
# **/*.bin **/*.safetensors **/*.pt **/*.pth (模型权重)
|
|
# secrets/ (永远不进搬家包)
|
|
# **/__pycache__/ **/*.pyc (Python 缓存)
|
|
# **/.DS_Store
|
|
mkdir -p /tmp/extract
|
|
tar -xzf /tmp/repo-raw.tar.gz -C /tmp/extract
|
|
|
|
# 删掉应排除的内容
|
|
find /tmp/extract -type d -name node_modules -prune -exec rm -rf {} +
|
|
find /tmp/extract -type d -name checkpoints -prune -exec rm -rf {} +
|
|
find /tmp/extract -type d -name __pycache__ -prune -exec rm -rf {} +
|
|
find /tmp/extract -type d -name 'secrets' -prune -exec rm -rf {} + 2>/dev/null || true
|
|
find /tmp/extract -type f \( -name '*.bin' -o -name '*.safetensors' -o -name '*.pt' -o -name '*.pth' -o -name '*.pyc' -o -name '.DS_Store' \) -delete
|
|
|
|
# 重新打包 (确保固定的 mtime, 让多次跑的 sha256 在内容相同时一致)
|
|
tar --sort=name \
|
|
--owner=0 --group=0 --numeric-owner \
|
|
--mtime='1970-01-01 00:00:00 UTC' \
|
|
-czf /tmp/repo.tar.gz \
|
|
-C /tmp/extract guanghulab
|
|
ls -lh /tmp/repo.tar.gz
|
|
|
|
- name: 跑 build-manifest.js 生成中文清单 + sha256
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
COMMIT: ${{ github.sha }}
|
|
BRANCH: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
node scripts/migration/build-manifest.js \
|
|
--tarball /tmp/repo.tar.gz \
|
|
--out-dir /tmp/migration-out \
|
|
--tag "$TAG" \
|
|
--commit "$COMMIT" \
|
|
--branch "$BRANCH"
|
|
ls -la /tmp/migration-out/
|
|
|
|
- name: 准备中文 Step Summary
|
|
if: always()
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
DRY: ${{ steps.misclick.outputs.effective_dry_run }}
|
|
COMMIT: ${{ github.sha }}
|
|
BRANCH: ${{ github.ref_name }}
|
|
run: |
|
|
set -uo pipefail
|
|
MD=/tmp/migration-out/MIGRATION-MANIFEST.md
|
|
{
|
|
echo "# 📦 国内搬家·打包回执"
|
|
echo ""
|
|
echo "> 给冰朔看的中文回执 · 守护: 铸渊 · ICE-GL-ZY001"
|
|
echo ""
|
|
if [ "$DRY" = "true" ]; then
|
|
echo "## ⚠️ DRY RUN (没真打包/没上传)"
|
|
echo ""
|
|
echo "误触锁口令没填对, 工作流只走完前几步, 未上传 Artifact."
|
|
echo ""
|
|
echo "下次跑要真出包, confirm_phrase 字段精确填: \`打包搬家包\`"
|
|
echo ""
|
|
else
|
|
echo "## ✅ 搬家包已打包, Artifact 已上传"
|
|
echo ""
|
|
if [ -f "$MD" ]; then
|
|
cat "$MD"
|
|
else
|
|
echo "(MIGRATION-MANIFEST.md 没生成, 检查 build-manifest.js 这一步的日志)"
|
|
fi
|
|
echo ""
|
|
echo "---"
|
|
echo ""
|
|
echo "## 🎯 接下来你 3 步操作"
|
|
echo ""
|
|
echo "### 操作 1 · 下载 Artifact"
|
|
echo ""
|
|
echo "拉到本页底部 → \`Artifacts\` 区 → 下载 \`lighthouse-migration-${TAG}\` (zip)"
|
|
echo "解出来里面有:"
|
|
echo "- \`lighthouse-migration-${TAG}.tar.gz\` (主包)"
|
|
echo "- \`lighthouse-migration-${TAG}.sha256\` (校验)"
|
|
echo "- \`MIGRATION-MANIFEST.md\` (中文清单, 这一份)"
|
|
echo "- \`manifest.json\` (机读元数据)"
|
|
echo ""
|
|
echo "### 操作 2 · 上传到 COS"
|
|
echo ""
|
|
echo "腾讯云控制台 → COS → 桶 \`sy-finetune-corpus-1317346199\`"
|
|
echo " → 建文件夹 \`lighthouse-migration/\` (如还没有)"
|
|
echo " → 进 \`lighthouse-migration/\` → 上传 \`.tar.gz\` 和 \`.sha256\` 两个文件"
|
|
echo ""
|
|
echo "### 操作 3 · 跑恢复 workflow"
|
|
echo ""
|
|
echo "GitHub → Actions → 「📥 国内搬家·从COS恢复」"
|
|
echo " → Run workflow → confirm_phrase 填 \`从COS恢复\` → Run"
|
|
echo " → 等约 5-8 分钟, 跑完后回执贴在那次 run 的 Summary 里"
|
|
echo ""
|
|
fi
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: 上传 Artifact (90 天保留)
|
|
if: steps.misclick.outputs.effective_dry_run != 'true'
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: lighthouse-migration-${{ steps.tag.outputs.tag }}
|
|
path: |
|
|
/tmp/migration-out/lighthouse-migration-*.tar.gz
|
|
/tmp/migration-out/lighthouse-migration-*.sha256
|
|
/tmp/migration-out/MIGRATION-MANIFEST.md
|
|
/tmp/migration-out/manifest.json
|
|
retention-days: 90
|
|
if-no-files-found: error
|
|
|
|
- name: Dry-run · 列内容不上传
|
|
if: steps.misclick.outputs.effective_dry_run == 'true'
|
|
run: |
|
|
echo "═══════════════ DRY RUN ═══════════════"
|
|
echo "would upload Artifact: lighthouse-migration-${{ steps.tag.outputs.tag }}"
|
|
echo "would contain:"
|
|
ls -la /tmp/migration-out/ 2>/dev/null || echo "(尚未生成)"
|