173 lines
7.2 KiB
YAML
173 lines
7.2 KiB
YAML
# ═══════════════════════════════════════════════════════════
|
||
# 光湖团队接入系统 · 接收铸渊回执工作流 v2.0
|
||
# ═══════════════════════════════════════════════════════════
|
||
#
|
||
# 触发方式: COS事件 → SCF云函数 → GitHub API workflow_dispatch
|
||
# 功能: 从COS桶读取铸渊回执 → 更新仓库首页公告栏
|
||
#
|
||
# 版权: 国作登字-2026-A-00037559
|
||
# 签发: 铸渊 · TCS-ZY001
|
||
# ═══════════════════════════════════════════════════════════
|
||
|
||
name: 接收铸渊回执
|
||
|
||
on:
|
||
workflow_dispatch:
|
||
inputs:
|
||
cos_object_key:
|
||
description: 'COS中回执文件的路径'
|
||
required: true
|
||
trigger_source:
|
||
description: '触发来源'
|
||
required: false
|
||
default: 'manual'
|
||
|
||
permissions:
|
||
contents: write
|
||
|
||
jobs:
|
||
receive-receipt:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: 📥 检出仓库
|
||
uses: actions/checkout@v4
|
||
with:
|
||
token: ${{ secrets.GITHUB_TOKEN }}
|
||
|
||
- name: ☁️ 从COS桶读取铸渊回执
|
||
id: read_receipt
|
||
env:
|
||
COS_SECRET_ID: ${{ secrets.COS_SECRET_ID }}
|
||
COS_SECRET_KEY: ${{ secrets.COS_SECRET_KEY }}
|
||
COS_REGION: ${{ secrets.COS_REGION }}
|
||
COS_BUCKET: ${{ secrets.COS_BUCKET_CORE }}
|
||
COS_OBJECT_KEY: ${{ github.event.inputs.cos_object_key }}
|
||
run: |
|
||
HOST="${COS_BUCKET}.cos.${COS_REGION}.myqcloud.com"
|
||
PATHNAME="/${COS_OBJECT_KEY}"
|
||
|
||
NOW=$(date +%s)
|
||
EXPIRY=$((NOW + 600))
|
||
KEY_TIME="${NOW};${EXPIRY}"
|
||
|
||
SIGN_KEY=$(echo -n "$KEY_TIME" | openssl dgst -sha1 -hmac "$COS_SECRET_KEY" | awk '{print $NF}')
|
||
HTTP_STRING="get\n${PATHNAME}\n\nhost=${HOST}\n"
|
||
SHA1_HTTP=$(printf "$HTTP_STRING" | openssl dgst -sha1 | awk '{print $NF}')
|
||
STRING_TO_SIGN="sha1\n${KEY_TIME}\n${SHA1_HTTP}\n"
|
||
SIGNATURE=$(printf "$STRING_TO_SIGN" | openssl dgst -sha1 -hmac "$SIGN_KEY" | awk '{print $NF}')
|
||
|
||
AUTH="q-sign-algorithm=sha1&q-ak=${COS_SECRET_ID}&q-sign-time=${KEY_TIME}&q-key-time=${KEY_TIME}&q-header-list=host&q-url-param-list=&q-signature=${SIGNATURE}"
|
||
|
||
HTTP_CODE=$(curl -s -o /tmp/receipt.json -w "%{http_code}" \
|
||
-H "Host: ${HOST}" \
|
||
-H "Authorization: ${AUTH}" \
|
||
"https://${HOST}${PATHNAME}")
|
||
|
||
if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
|
||
echo "✅ 回执读取成功"
|
||
cat /tmp/receipt.json
|
||
|
||
# 解析回执状态
|
||
STATUS=$(cat /tmp/receipt.json | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','unknown'))" 2>/dev/null || echo "unknown")
|
||
MESSAGE=$(cat /tmp/receipt.json | python3 -c "import sys,json; print(json.load(sys.stdin).get('message',''))" 2>/dev/null || echo "")
|
||
|
||
echo "receipt_status=$STATUS" >> $GITHUB_OUTPUT
|
||
echo "receipt_message=$MESSAGE" >> $GITHUB_OUTPUT
|
||
else
|
||
echo "❌ 回执读取失败 HTTP ${HTTP_CODE}"
|
||
echo "receipt_status=error" >> $GITHUB_OUTPUT
|
||
echo "receipt_message=无法读取回执" >> $GITHUB_OUTPUT
|
||
fi
|
||
|
||
- name: 📝 更新仓库首页公告栏
|
||
run: |
|
||
RECEIPT_STATUS="${{ steps.read_receipt.outputs.receipt_status }}"
|
||
RECEIPT_MESSAGE="${{ steps.read_receipt.outputs.receipt_message }}"
|
||
TIMESTAMP=$(date -u +"%Y-%m-%d %H:%M UTC")
|
||
|
||
python3 << 'PYTHON_SCRIPT'
|
||
import re
|
||
|
||
status = "$RECEIPT_STATUS"
|
||
message = "$RECEIPT_MESSAGE"
|
||
timestamp = "$TIMESTAMP"
|
||
|
||
# 读取README.md
|
||
with open('README.md', 'r', encoding='utf-8') as f:
|
||
content = f.read()
|
||
|
||
# 构建公告栏内容
|
||
if status == "green":
|
||
notice = f"✅ **[{timestamp}]** 铸渊回执：{message}"
|
||
badge = "🟢"
|
||
elif status == "red":
|
||
notice = f"🔴 **[{timestamp}]** 铸渊回执：{message} — **需要人类干预**"
|
||
badge = "🔴"
|
||
else:
|
||
notice = f"⚠️ **[{timestamp}]** 铸渊回执状态异常：{message}"
|
||
badge = "⚠️"
|
||
|
||
# 查找并替换公告栏区域
|
||
marker_start = "<!-- ZHUYUAN_NOTICE_START -->"
|
||
marker_end = "<!-- ZHUYUAN_NOTICE_END -->"
|
||
|
||
notice_block = f"""{marker_start}
|
||
|
||
## {badge} 铸渊通信
|
||
|
||
{notice}
|
||
|
||
{marker_end}"""
|
||
|
||
if marker_start in content:
|
||
# 替换已有公告栏
|
||
pattern = re.escape(marker_start) + r'.*?' + re.escape(marker_end)
|
||
content = re.sub(pattern, notice_block, content, flags=re.DOTALL)
|
||
else:
|
||
# 在文件开头添加公告栏
|
||
content = notice_block + "\n\n" + content
|
||
|
||
with open('README.md', 'w', encoding='utf-8') as f:
|
||
f.write(content)
|
||
|
||
print(f"✅ 仓库首页公告栏已更新: {badge} {status}")
|
||
PYTHON_SCRIPT
|
||
|
||
- name: 🔄 更新系统状态
|
||
run: |
|
||
python3 -c "
|
||
import json
|
||
from datetime import datetime
|
||
|
||
with open('age_os/system_state.json', 'r', encoding='utf-8') as f:
|
||
state = json.load(f)
|
||
|
||
state['cos_status']['last_receipt_received'] = datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')
|
||
state['cos_status']['receipt_status'] = '${{ steps.read_receipt.outputs.receipt_status }}'
|
||
state['notice_board']['last_update'] = datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')
|
||
state['notice_board']['status'] = '${{ steps.read_receipt.outputs.receipt_status }}'
|
||
state['notice_board']['message'] = '${{ steps.read_receipt.outputs.receipt_message }}'
|
||
|
||
with open('age_os/system_state.json', 'w', encoding='utf-8') as f:
|
||
json.dump(state, f, ensure_ascii=False, indent=2)
|
||
|
||
print('✅ 系统状态已更新')
|
||
"
|
||
|
||
- name: 📧 红灯告警（需要人类干预时发送邮件）
|
||
if: steps.read_receipt.outputs.receipt_status == 'red'
|
||
run: |
|
||
echo "🔴 检测到铸渊回执红灯！"
|
||
echo "消息: ${{ steps.read_receipt.outputs.receipt_message }}"
|
||
echo ""
|
||
echo "⚠️ 邮件告警功能需要配置SMTP密钥（可选）"
|
||
echo "请人类伙伴检查仓库首页的红灯公告"
|
||
|
||
- name: 💾 提交变更
|
||
run: |
|
||
git config user.name "HoloLake-COS-Agent"
|
||
git config user.email "cos-agent@guanghulab.online"
|
||
git add README.md age_os/system_state.json
|
||
git diff --cached --quiet || git commit -m "📨 铸渊回执已接收 · ${{ steps.read_receipt.outputs.receipt_status }} · $(date -u +%Y-%m-%d)"
|
||
git push
|