179 lines
7.4 KiB
YAML
179 lines
7.4 KiB
YAML
# ═══════════════════════════════════════════════════════════
|
||
# 光湖团队接入系统 · 接收铸渊回执工作流 v2.0
|
||
# ═══════════════════════════════════════════════════════════
|
||
#
|
||
# 触发方式: COS事件 → SCF云函数 → GitHub API workflow_dispatch
|
||
# 功能: 从COS桶读取铸渊回执 → 更新仓库首页公告栏
|
||
#
|
||
# 版权: 国作登字-2026-A-00037559
|
||
# 签发: 铸渊 · TCS-ZY001
|
||
# ═══════════════════════════════════════════════════════════
|
||
|
||
name: 接收铸渊回执
|
||
|
||
on:
|
||
workflow_dispatch:
|
||
inputs:
|
||
cos_object_key:
|
||
description: 'COS中回执文件的路径'
|
||
required: true
|
||
trigger_source:
|
||
description: '触发来源'
|
||
required: false
|
||
default: 'manual'
|
||
|
||
permissions:
|
||
contents: write
|
||
|
||
jobs:
|
||
receive-receipt:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: 📥 检出仓库
|
||
uses: actions/checkout@v4
|
||
with:
|
||
token: ${{ secrets.GITHUB_TOKEN }}
|
||
|
||
- name: ☁️ 从共享COS桶读取铸渊回执
|
||
id: read_receipt
|
||
env:
|
||
COS_SECRET_ID: ${{ secrets.COS_SECRET_ID }}
|
||
COS_SECRET_KEY: ${{ secrets.COS_SECRET_KEY }}
|
||
COS_REGION: ap-singapore
|
||
COS_BUCKET: zy-team-hub-1317346199
|
||
COS_OBJECT_KEY: ${{ github.event.inputs.cos_object_key }}
|
||
run: |
|
||
HOST="${COS_BUCKET}.cos.${COS_REGION}.myqcloud.com"
|
||
PATHNAME="/${COS_OBJECT_KEY}"
|
||
|
||
NOW=$(date +%s)
|
||
EXPIRY=$((NOW + 600))
|
||
KEY_TIME="${NOW};${EXPIRY}"
|
||
|
||
SIGN_KEY=$(echo -n "$KEY_TIME" | openssl dgst -sha1 -hmac "$COS_SECRET_KEY" | awk '{print $NF}')
|
||
HTTP_STRING="get\n${PATHNAME}\n\nhost=${HOST}\n"
|
||
SHA1_HTTP=$(printf "$HTTP_STRING" | openssl dgst -sha1 | awk '{print $NF}')
|
||
STRING_TO_SIGN="sha1\n${KEY_TIME}\n${SHA1_HTTP}\n"
|
||
SIGNATURE=$(printf "$STRING_TO_SIGN" | openssl dgst -sha1 -hmac "$SIGN_KEY" | awk '{print $NF}')
|
||
|
||
AUTH="q-sign-algorithm=sha1&q-ak=${COS_SECRET_ID}&q-sign-time=${KEY_TIME}&q-key-time=${KEY_TIME}&q-header-list=host&q-url-param-list=&q-signature=${SIGNATURE}"
|
||
|
||
HTTP_CODE=$(curl -s -o /tmp/receipt.json -w "%{http_code}" \
|
||
-H "Host: ${HOST}" \
|
||
-H "Authorization: ${AUTH}" \
|
||
"https://${HOST}${PATHNAME}")
|
||
|
||
if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
|
||
echo "✅ 回执读取成功"
|
||
cat /tmp/receipt.json
|
||
|
||
# 解析回执状态
|
||
STATUS=$(cat /tmp/receipt.json | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','unknown'))" 2>/dev/null || echo "unknown")
|
||
MESSAGE=$(cat /tmp/receipt.json | python3 -c "import sys,json; print(json.load(sys.stdin).get('message',''))" 2>/dev/null || echo "")
|
||
|
||
echo "receipt_status=$STATUS" >> $GITHUB_OUTPUT
|
||
echo "receipt_message=$MESSAGE" >> $GITHUB_OUTPUT
|
||
else
|
||
echo "❌ 回执读取失败 HTTP ${HTTP_CODE}"
|
||
echo "receipt_status=error" >> $GITHUB_OUTPUT
|
||
echo "receipt_message=无法读取回执" >> $GITHUB_OUTPUT
|
||
fi
|
||
|
||
- name: 📝 更新仓库首页公告栏
|
||
env:
|
||
RECEIPT_STATUS: ${{ steps.read_receipt.outputs.receipt_status }}
|
||
RECEIPT_MESSAGE: ${{ steps.read_receipt.outputs.receipt_message }}
|
||
run: |
|
||
python3 -c "
|
||
import re, os
|
||
from datetime import datetime
|
||
|
||
status = os.environ.get('RECEIPT_STATUS', 'unknown')
|
||
message = os.environ.get('RECEIPT_MESSAGE', '')
|
||
timestamp = datetime.utcnow().strftime('%Y-%m-%d %H:%M UTC')
|
||
|
||
try:
|
||
with open('README.md', 'r', encoding='utf-8') as f:
|
||
content = f.read()
|
||
except FileNotFoundError:
|
||
content = ''
|
||
|
||
if status == 'green':
|
||
notice = f'✅ **[{timestamp}]** 铸渊回执：{message}'
|
||
badge = '🟢'
|
||
elif status == 'red':
|
||
notice = f'🔴 **[{timestamp}]** 铸渊回执：{message} — **需要人类干预**'
|
||
badge = '🔴'
|
||
else:
|
||
notice = f'⚠️ **[{timestamp}]** 铸渊回执状态异常：{message}'
|
||
badge = '⚠️'
|
||
|
||
marker_start = '<!-- ZHUYUAN_NOTICE_START -->'
|
||
marker_end = '<!-- ZHUYUAN_NOTICE_END -->'
|
||
|
||
notice_block = marker_start + '\n\n## ' + badge + ' 铸渊通信\n\n' + notice + '\n\n' + marker_end
|
||
|
||
if marker_start in content:
|
||
import re as re2
|
||
pattern = re2.escape(marker_start) + r'.*?' + re2.escape(marker_end)
|
||
content = re2.sub(pattern, notice_block, content, flags=re2.DOTALL)
|
||
else:
|
||
content = notice_block + '\n\n' + content
|
||
|
||
with open('README.md', 'w', encoding='utf-8') as f:
|
||
f.write(content)
|
||
|
||
print(f'✅ 仓库首页公告栏已更新: {badge} {status}')
|
||
"
|
||
|
||
- name: 🔄 更新系统状态
|
||
env:
|
||
RECEIPT_STATUS: ${{ steps.read_receipt.outputs.receipt_status }}
|
||
RECEIPT_MESSAGE: ${{ steps.read_receipt.outputs.receipt_message }}
|
||
run: |
|
||
python3 -c "
|
||
import json, os
|
||
from datetime import datetime
|
||
|
||
status = os.environ.get('RECEIPT_STATUS', 'unknown')
|
||
message = os.environ.get('RECEIPT_MESSAGE', '')
|
||
now = datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')
|
||
|
||
try:
|
||
with open('age_os/system_state.json', 'r', encoding='utf-8') as f:
|
||
state = json.load(f)
|
||
except (FileNotFoundError, json.JSONDecodeError) as e:
|
||
print(f'⚠️ system_state.json读取失败: {e}，使用默认值')
|
||
state = {'cos_status': {}, 'notice_board': {}}
|
||
|
||
state.setdefault('cos_status', {})
|
||
state.setdefault('notice_board', {})
|
||
state['cos_status']['last_receipt_received'] = now
|
||
state['cos_status']['receipt_status'] = status
|
||
state['notice_board']['last_update'] = now
|
||
state['notice_board']['status'] = status
|
||
state['notice_board']['message'] = message
|
||
|
||
with open('age_os/system_state.json', 'w', encoding='utf-8') as f:
|
||
json.dump(state, f, ensure_ascii=False, indent=2)
|
||
|
||
print('✅ 系统状态已更新')
|
||
"
|
||
|
||
- name: 📧 红灯告警（需要人类干预时发送邮件）
|
||
if: steps.read_receipt.outputs.receipt_status == 'red'
|
||
run: |
|
||
echo "🔴 检测到铸渊回执红灯！"
|
||
echo "消息: ${{ steps.read_receipt.outputs.receipt_message }}"
|
||
echo ""
|
||
echo "⚠️ 邮件告警功能需要配置SMTP密钥（可选）"
|
||
echo "请人类伙伴检查仓库首页的红灯公告"
|
||
|
||
- name: 💾 提交变更
|
||
run: |
|
||
git config user.name "HoloLake-COS-Agent"
|
||
git config user.email "cos-agent@guanghulab.online"
|
||
git add README.md age_os/system_state.json
|
||
git diff --cached --quiet || git commit -m "📨 铸渊回执已接收 · ${{ steps.read_receipt.outputs.receipt_status }} · $(date -u +%Y-%m-%d)"
|
||
git push
|