feat: 实现 Agent Query Sink (#111) #204
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish runtime artifact | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: publish-runtime-artifact | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: Publish exact main image | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: >- | |
| pgvector/pgvector:pg17@sha256:d2ef61f42ef767baa5a1475393303cc235bcd92febd9d7014eddb48b41f3bad0 | |
| env: | |
| POSTGRES_DB: inkcre | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U postgres -d inkcre" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 12 | |
| env: | |
| CORE_DATABASE_PASSWORD: release-core-database-password-at-least-32-bytes | |
| IMAGE_TAG: inkcre-core-release:${{ github.sha }} | |
| POSTGREST_DATABASE_PASSWORD: release-postgrest-database-password-at-least-32-bytes | |
| steps: | |
| - name: Checkout exact verified source | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - name: Verify source is current main | |
| env: | |
| HEAD_SHA: ${{ github.sha }} | |
| run: bash scripts/automation/runtime_artifact.sh verify-main-source | |
| - name: Build the release schema source | |
| env: | |
| HEAD_SHA: ${{ github.sha }} | |
| run: bash scripts/automation/runtime_artifact.sh build-schema-source | |
| - name: Export and stage the release schema | |
| env: | |
| HEAD_SHA: ${{ github.sha }} | |
| SOURCE_REVISION: ${{ github.sha }} | |
| run: | | |
| bash scripts/automation/runtime_contract.sh export | |
| bash scripts/automation/runtime_artifact.sh stage-schema-evidence | |
| - name: Restore the staged release schema | |
| run: bash scripts/automation/runtime_contract.sh restore | |
| - name: Build and publish immutable runtime | |
| id: image | |
| env: | |
| GHCR_TOKEN: ${{ github.token }} | |
| HEAD_SHA: ${{ github.sha }} | |
| run: bash scripts/automation/runtime_artifact.sh publish-immutable | |
| - name: Promote mutable main image | |
| id: promote | |
| env: | |
| COMMIT_REF: ${{ steps.image.outputs.commit_ref }} | |
| DIGEST_REF: ${{ steps.image.outputs.digest_ref }} | |
| IMAGE: ${{ steps.image.outputs.image }} | |
| run: bash scripts/automation/runtime_artifact.sh promote-main | |
| - name: Record runtime delivery identity | |
| if: always() && steps.image.outcome == 'success' | |
| env: | |
| HEAD_SHA: ${{ github.sha }} | |
| IMAGE_DIGEST: ${{ steps.image.outputs.digest_ref }} | |
| MAIN_PROMOTION: ${{ steps.promote.outcome }} | |
| run: bash scripts/automation/runtime_artifact.sh summarize-runtime |