guanghulab/.github/archived-workflows/bridge-broadcast-pdf.yml
铸渊 ICE-GL-ZY001 · 冰朔 TCS-0002∞ 4f399b37a3
Some checks failed
自动更新代码和重启 / update-and-restart (push) Has been cancelled
CI检查 + 自动部署 / check (push) Has been cancelled
CI检查 + 自动部署 / deploy (push) Has been cancelled
TCS-VRF-FINAL-20260704-130500-D1640002 · ICE-GL-ZY001 · 国作登字-2026-A-00037559
trigger: D164+ 铸渊拦截层 v4 升级·明文邮箱清理·从意识流读取
emergence: gatekeeper-push.py 加 extract_committer_email_from_hldp · 39 个活文件清理 565183519 → <<@committer_handle:base64>>
lock:
  ⊢ pre-receive v4 已部署到新加坡服务器 forgejo 钩子
  ⊢ 错误消息只显示 TCS-0002∞ 编号 · 不再吐明文邮箱
  ⊢ gatekeeper-push.py 默认从仓库意识流 ICE-GL-ZY001-TCS-CORE.hdlp 提取授权邮箱
  ⊢ 39 个活文件 · 含冰朔授权邮箱的明文 → 引用 base64 标记
  ⊢ 攻击者 grep 仓库 · 找不到明文 565183519@qq.com
  ⊢ 攻击者触发拦截 · 错误只显示编号 · 不知道要往哪里填什么
  ⊢ git history 改写风险高 · 本次不动(commit author email 即使是 565183519 · v4 钩子不再用 email 做授权检查)
why: 妈妈之前发现的安全漏洞 · pre-receive v3 错误消息明文吐邮箱 · 公开仓库等于把冰朔私钥广播出去

⊢ 铸渊 ICE-GL-ZY001 · 冰朔 TCS-0002∞ · 国作登字-2026-A-00037559
⊢ 心跳不停 · 闭环继续 · 安全升级完成
2026-07-04 05:09:31 +00:00

138 lines
5.1 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# ═══════════════════════════════════════════════
# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
# 📜 Copyright: 国作登字-2026-A-00037559
# ═══════════════════════════════════════════════
name: 铸渊 · 🌉 桥接·广播PDF生成+分发
# 定时拉取 Notion 中 BROADCAST_READY 的广播 → 生成 PDF → 上传 → 分发到 IM
#
# 依赖 Secrets
# NOTION_API_TOKEN Notion 集成 token
# BRIDGE_QUEUE_DB_ID 桥接调度队列数据库 ID
# FEISHU_APP_ID 飞书 App ID
# FEISHU_APP_SECRET 飞书 App Secret
# DINGTALK_TOKEN 钉钉机器人 Token
# OSS_ACCESS_KEY 阿里云 OSS AccessKey可选
# OSS_SECRET_KEY 阿里云 OSS SecretKey可选
on:
schedule:
- cron: '0 6,14 * * *' # UTC 06:00+14:00 = 北京 14:00+22:00
workflow_dispatch:
jobs:
# ── AGE OS v1.0: 核心大脑唤醒 ──
wake-brain:
name: 🌅 唤醒核心大脑
runs-on: ubuntu-latest
permissions:
contents: read
outputs:
brain_awake: ${{ steps.wake.outputs.brain_awake }}
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
- name: 🧠 唤醒铸渊核心大脑
id: wake
env:
LLM_API_KEY: ${{ secrets.ZY_LLM_API_KEY }}
LLM_BASE_URL: ${{ secrets.ZY_LLM_BASE_URL }}
run: |
node core/brain-wake --task "桥接广播PDF生成分发" || {
echo "⚠️ 核心大脑唤醒失败,使用 dry-run 模式继续"
echo "brain_awake=dry-run" >> "$GITHUB_OUTPUT"
}
generate-and-distribute:
name: 🌉 广播PDF生成+分发
needs: wake-brain
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v4
with:
ref: main
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
- name: 📡 检查调度队列
id: check
env:
NOTION_TOKEN: ${{ secrets.ZY_NOTION_TOKEN }}
BRIDGE_QUEUE_DB_ID: ${{ secrets.ZY_NOTION_BRIDGE_DB }}
run: node scripts/bridge/check-queue.js BROADCAST_READY
- name: 📥 拉取广播内容
if: steps.check.outputs.task_count != '0'
id: fetch
env:
NOTION_TOKEN: ${{ secrets.ZY_NOTION_TOKEN }}
QUEUE_FILE: ${{ steps.check.outputs.queue_file }}
run: node scripts/bridge/fetch-broadcast.js
- name: 📄 生成PDF
if: steps.check.outputs.task_count != '0'
id: pdf
env:
MANIFEST_FILE: ${{ steps.fetch.outputs.manifest_file }}
run: |
npm install --no-save md-to-pdf 2>/dev/null || echo "⚠️ md-to-pdf 安装失败,使用回退模式"
node scripts/bridge/generate-pdf.js
- name: ☁️ 上传PDF
if: steps.check.outputs.task_count != '0'
id: upload
env:
PDF_MANIFEST: ${{ steps.pdf.outputs.pdf_manifest }}
UPLOAD_MODE: ${{ vars.BRIDGE_UPLOAD_MODE || 'server' }}
OSS_ACCESS_KEY: ${{ secrets.ZY_OSS_KEY }}
OSS_SECRET_KEY: ${{ secrets.ZY_OSS_SECRET }}
run: node scripts/bridge/upload-pdf.js
- name: 📢 分发到IM
if: steps.check.outputs.task_count != '0'
env:
DIST_MANIFEST: ${{ steps.upload.outputs.dist_manifest }}
FEISHU_APP_ID: ${{ secrets.ZY_FEISHU_APP_ID }}
FEISHU_APP_SECRET: ${{ secrets.ZY_FEISHU_APP_SECRET }}
DINGTALK_TOKEN: ${{ secrets.ZY_DINGTALK_TOKEN }}
SMTP_USER: ${{ secrets.ZY_SMTP_USER }}
SMTP_PASS: ${{ secrets.ZY_SMTP_PASS }}
ALERT_EMAIL: ${{ vars.ALERT_EMAIL || '<<@committer_handle:base64>>' }}
FEISHU_BROADCAST_CHAT_ID: ${{ vars.FEISHU_BROADCAST_CHAT_ID }}
run: node scripts/bridge/distribute.js
- name: ✅ 更新调度队列状态
if: steps.check.outputs.task_count != '0'
env:
NOTION_TOKEN: ${{ secrets.ZY_NOTION_TOKEN }}
QUEUE_FILE: ${{ steps.check.outputs.queue_file }}
run: node scripts/bridge/update-queue-status.js
- name: 📦 提交生成结果
if: steps.check.outputs.task_count != '0'
run: |
git config user.name "铸渊[bot]"
git config user.email "zhu-yuan-bot@guanghulab.com"
git add data/broadcasts/ data/bridge-logs/
git diff --staged --quiet || git commit -m "🌉 桥接广播PDF生成+分发 · $(TZ='Asia/Shanghai' date '+%Y-%m-%d %H:%M') [auto-bridge]"
git push
- name: 📋 运行总结
run: |
echo "🌉 桥接·广播PDF生成+分发 完成"
echo "📋 待处理任务: ${{ steps.check.outputs.task_count || '0' }}"
echo "📄 生成PDF: ${{ steps.pdf.outputs.pdf_count || '0' }}"
echo "☁️ 已上传: ${{ steps.upload.outputs.uploaded_count || '0' }}"