Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 George Berkshire
|
8cda1bd7fb |
@@ -1,5 +1,7 @@
|
||||
# Gitea Actions CI（统一离线 lite 门禁）
|
||||
# Runner 无外网且无 pip；这里只运行标准库测试和本地合规检查。
|
||||
# Gitea Actions CI 模板（统一极简合规门禁）
|
||||
# 复制为 <repo>/.gitea/workflows/ci.yml 后即可用；无需调整。
|
||||
# 说明：runner 容器无外网且无 pip（Gitea 实例限制），CI 只做本地可完成的合规检查；
|
||||
# 依赖安装与测试一律在本地运行（开发机上完成）。
|
||||
name: CI
|
||||
|
||||
on:
|
||||
@@ -16,18 +18,13 @@ permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
lite:
|
||||
check:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@524e936cd9e579adf00e308bfdf971aebc7de09e
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/checkout@v4
|
||||
- name: Gitea 合规校验
|
||||
run: |
|
||||
if git ls-tree -r HEAD | awk '$1==160000' | grep -q .; then echo "HEAD 含 gitlink"; exit 1; fi
|
||||
if git ls-files .DS_Store | grep -q .; then echo "跟踪 .DS_Store"; exit 1; fi
|
||||
if git grep -n -I -E 'sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|xox[baprs]-[A-Za-z0-9-]{10,}' HEAD | grep -q .; then echo "检出疑似凭证"; exit 1; fi
|
||||
echo "Gitea 合规校验通过"
|
||||
- name: 规则契约测试
|
||||
run: python3 -m unittest discover -s tests -v
|
||||
|
||||
@@ -1,120 +0,0 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"module_id": "vpn-rules",
|
||||
"authority": {
|
||||
"scope": "module_metadata",
|
||||
"subject": "vpn-rules",
|
||||
"owner": "vpn-rules-owner",
|
||||
"source": "MODULE_SPEC.yaml",
|
||||
"revision": 1,
|
||||
"effective_from": "2026-08-20T00:00:00+08:00"
|
||||
},
|
||||
"repository": {
|
||||
"name": "vpn-rules",
|
||||
"workspace_id": null,
|
||||
"type": "infrastructure",
|
||||
"maturity": "operational"
|
||||
},
|
||||
"bounded_context": {
|
||||
"domain": "network-routing-policy",
|
||||
"responsibility": "Own the single source of truth for direct-routing rules and deterministic projections for supported clients.",
|
||||
"prohibited_responsibilities": [
|
||||
"Applying rules to production clients, routers, VPN services, or proxy runtimes",
|
||||
"Owning or exposing proxy subscription credentials, provider tokens, or device secrets",
|
||||
"Claiming generated or checked-in artifacts are active production configuration"
|
||||
]
|
||||
},
|
||||
"capabilities": [
|
||||
{
|
||||
"id": "direct-routing-rule-authoring",
|
||||
"summary": "Maintain provider-neutral direct-routing entries in the authoritative mihomo rule-provider source.",
|
||||
"status": "operational"
|
||||
},
|
||||
{
|
||||
"id": "clash-verge-script-generation",
|
||||
"summary": "Render source entries as idempotent DIRECT rules for Clash Verge Script.js.",
|
||||
"status": "operational"
|
||||
},
|
||||
{
|
||||
"id": "router-rule-projection",
|
||||
"summary": "Generate policy-bearing YAML and policy-free plain-text projections for router consumers.",
|
||||
"status": "operational"
|
||||
}
|
||||
],
|
||||
"data": {
|
||||
"owns": [
|
||||
{
|
||||
"asset_id": "direct-routing-rule-source",
|
||||
"kind": "reference",
|
||||
"classification": "restricted"
|
||||
},
|
||||
{
|
||||
"asset_id": "generated-router-rule-projections",
|
||||
"kind": "artifact",
|
||||
"classification": "restricted"
|
||||
}
|
||||
]
|
||||
},
|
||||
"contracts": {
|
||||
"provides": [
|
||||
{
|
||||
"contract_id": "mihomo-direct-rule-provider",
|
||||
"kind": "artifact",
|
||||
"version": "1.0.0",
|
||||
"path": "direct.yaml",
|
||||
"compatibility": "backward"
|
||||
},
|
||||
{
|
||||
"contract_id": "router-direct-rules",
|
||||
"kind": "artifact",
|
||||
"version": "1.0.0",
|
||||
"path": "router/direct-rules.yaml",
|
||||
"compatibility": "exact"
|
||||
},
|
||||
{
|
||||
"contract_id": "router-direct-plain-list",
|
||||
"kind": "artifact",
|
||||
"version": "1.0.0",
|
||||
"path": "router/direct-plain.txt",
|
||||
"compatibility": "exact"
|
||||
}
|
||||
],
|
||||
"consumes": []
|
||||
},
|
||||
"dependencies": [],
|
||||
"agent_context": {
|
||||
"default_entrypoints": [
|
||||
{
|
||||
"path": "README.md",
|
||||
"purpose": "Repository purpose, supported consumers, generation commands, and maintenance flow."
|
||||
},
|
||||
{
|
||||
"path": "direct.yaml",
|
||||
"purpose": "Authoritative direct-routing rule source and provider format."
|
||||
}
|
||||
],
|
||||
"excluded_paths": [
|
||||
"router"
|
||||
],
|
||||
"max_default_tokens": 6000
|
||||
},
|
||||
"verification": {
|
||||
"commands": [
|
||||
{
|
||||
"id": "rule-contract-tests",
|
||||
"argv": [
|
||||
"python3",
|
||||
"-m",
|
||||
"unittest",
|
||||
"discover",
|
||||
"-s",
|
||||
"tests",
|
||||
"-v"
|
||||
],
|
||||
"cwd": ".",
|
||||
"network": false,
|
||||
"required": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,13 +8,8 @@ Clash Verge 和华硕路由器上的 mihomo（Magic Catling2）等消费端同
|
||||
```
|
||||
vpn-rules/
|
||||
├── direct.yaml # 规则真源（mihomo rule-provider 格式）
|
||||
├── router/
|
||||
│ ├── direct-rules.yaml # 路由器手动粘贴版（`- ` 前缀 + DIRECT 策略）
|
||||
│ └── direct-plain.txt # 无 `- ` 前缀纯文本版（规则逐行、无策略）
|
||||
└── scripts/
|
||||
├── gen_clash_verge_script.py # 真源 → Clash Verge Script.js 生成器
|
||||
├── gen_router_paste.py # 真源 → 路由器手动粘贴版生成器
|
||||
└── gen_plain_list.py # 真源 → 纯文本版生成器
|
||||
└── gen_clash_verge_script.py # 真源 → Clash Verge Script.js 生成器
|
||||
```
|
||||
|
||||
## 为什么需要它
|
||||
@@ -56,7 +51,7 @@ rules:
|
||||
|
||||
> 路由器内网自建 Gitea（192.168.50.2:3000）也可直连：`http://192.168.50.2:3000/ageorge156/vpn-rules/raw/branch/main/direct.yaml`。
|
||||
|
||||
**拉不到 URL 时（手动粘贴版）**：打开 `router/direct-rules.yaml`，把里面的规则行粘贴到路由器现有规则列表最前面即可，无需联网（生成命令 `python3 scripts/gen_router_paste.py`）。若工具不支持 `- ` 前缀，用 `router/direct-plain.txt`（生成命令 `python3 scripts/gen_plain_list.py`）。
|
||||
**拉不到 URL 时（手动粘贴版）**：打开 `router/direct-rules.yaml`，把里面的规则行粘贴到路由器现有规则列表最前面即可，无需联网（生成命令 `python3 scripts/gen_router_paste.py`）。
|
||||
|
||||
## 维护流程
|
||||
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
DOMAIN,frp.puyuanfh.cn
|
||||
IP-CIDR,8.133.177.3/32,no-resolve
|
||||
DOMAIN-SUFFIX,bilibili.com
|
||||
DOMAIN-SUFFIX,bilibili.cn
|
||||
DOMAIN-SUFFIX,bilivideo.com
|
||||
DOMAIN-SUFFIX,bili2233.cn
|
||||
DOMAIN-SUFFIX,hdslb.com
|
||||
GEOIP,CN,no-resolve
|
||||
DOMAIN-SUFFIX,deepseek.com
|
||||
DOMAIN-SUFFIX,minimaxi.com
|
||||
DOMAIN-SUFFIX,minimax.chat
|
||||
DOMAIN-SUFFIX,hailuoai.com
|
||||
DOMAIN,minimax-public-cdn.oss-cn-wulanchabu.aliyuncs.com
|
||||
DOMAIN-SUFFIX,hf-mirror.com
|
||||
DOMAIN-SUFFIX,cdn.hf.co
|
||||
DOMAIN-SUFFIX,lmstudio.ai
|
||||
IP-CIDR,127.0.0.0/8,no-resolve
|
||||
IP-CIDR,10.0.0.0/8,no-resolve
|
||||
IP-CIDR,172.16.0.0/12,no-resolve
|
||||
IP-CIDR,192.168.0.0/16,no-resolve
|
||||
IP-CIDR,100.64.0.0/10,no-resolve
|
||||
DOMAIN-SUFFIX,.local
|
||||
DOMAIN-SUFFIX,icloud.com.cn
|
||||
DOMAIN-SUFFIX,ug.link
|
||||
DOMAIN-SUFFIX,ugreen.com
|
||||
DOMAIN-SUFFIX,ugnas.cloud
|
||||
DOMAIN-SUFFIX,ugos.cn
|
||||
DOMAIN-KEYWORD,ugreen
|
||||
DOMAIN-KEYWORD,ugnas
|
||||
DOMAIN-KEYWORD,ugreengroup
|
||||
DOMAIN-SUFFIX,syncthing.net
|
||||
IP-CIDR,110.42.0.0/16,no-resolve
|
||||
IP-CIDR,43.248.128.0/17,no-resolve
|
||||
IP-CIDR,111.170.0.0/16,no-resolve
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""从 direct.yaml（真源）生成无 `- ` 前缀的纯文本规则列表。
|
||||
|
||||
格式：每条规则一行，无 YAML 列表前缀、无注释、无策略字段
|
||||
（同 rule-provider payload 内容，只是去掉 `- `）。
|
||||
|
||||
适用于把规则直接粘贴进不支持 YAML 列表 / 不需要策略前缀的工具。
|
||||
"""
|
||||
from pathlib import Path
|
||||
|
||||
from gen_clash_verge_script import load_payload
|
||||
|
||||
REPO_ROOT = Path(__file__).resolve().parent.parent
|
||||
OUT = REPO_ROOT / "router" / "direct-plain.txt"
|
||||
|
||||
|
||||
def main() -> None:
|
||||
payload = load_payload(REPO_ROOT / "direct.yaml")
|
||||
OUT.parent.mkdir(parents=True, exist_ok=True)
|
||||
OUT.write_text("\n".join(payload) + "\n", encoding="utf-8")
|
||||
print(f"✅ 已生成 {OUT}（{len(payload)} 条规则，无 - 前缀）")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,41 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import re
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
|
||||
|
||||
class CiContractTests(unittest.TestCase):
|
||||
def test_ci_publishes_one_offline_lite_gate(self) -> None:
|
||||
workflow = (ROOT / ".gitea/workflows/ci.yml").read_text(encoding="utf-8")
|
||||
job_block = workflow.split("jobs:", 1)[1]
|
||||
|
||||
self.assertEqual(
|
||||
re.findall(r"(?m)^ ([a-z][a-z0-9_-]*):\s*$", job_block),
|
||||
["lite"],
|
||||
)
|
||||
self.assertIn(
|
||||
"actions/checkout@524e936cd9e579adf00e308bfdf971aebc7de09e",
|
||||
workflow,
|
||||
)
|
||||
self.assertIn("persist-credentials: false", workflow)
|
||||
self.assertIn(
|
||||
"python3 -m unittest discover -s tests -v",
|
||||
workflow,
|
||||
)
|
||||
for forbidden in (
|
||||
"actions/checkout@v",
|
||||
"apt ",
|
||||
"pip ",
|
||||
"curl ",
|
||||
"wget ",
|
||||
"docker pull",
|
||||
):
|
||||
self.assertNotIn(forbidden, workflow)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -1,146 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import sys
|
||||
import unittest
|
||||
from pathlib import Path, PurePosixPath
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
SPEC_PATH = ROOT / "MODULE_SPEC.yaml"
|
||||
sys.path.insert(0, str(ROOT / "scripts"))
|
||||
|
||||
from gen_clash_verge_script import load_payload, to_rule # noqa: E402
|
||||
|
||||
|
||||
class ModuleSpecTests(unittest.TestCase):
|
||||
def test_module_spec_declares_rule_authority_and_safe_context(self) -> None:
|
||||
spec = json.loads(SPEC_PATH.read_text(encoding="utf-8"))
|
||||
|
||||
self.assertEqual(
|
||||
set(spec),
|
||||
{
|
||||
"schema_version",
|
||||
"module_id",
|
||||
"authority",
|
||||
"repository",
|
||||
"bounded_context",
|
||||
"capabilities",
|
||||
"data",
|
||||
"contracts",
|
||||
"dependencies",
|
||||
"agent_context",
|
||||
"verification",
|
||||
},
|
||||
)
|
||||
self.assertEqual(spec["schema_version"], 1)
|
||||
self.assertEqual(spec["module_id"], "vpn-rules")
|
||||
self.assertEqual(
|
||||
spec["authority"],
|
||||
{
|
||||
"scope": "module_metadata",
|
||||
"subject": "vpn-rules",
|
||||
"owner": "vpn-rules-owner",
|
||||
"source": "MODULE_SPEC.yaml",
|
||||
"revision": 1,
|
||||
"effective_from": "2026-08-20T00:00:00+08:00",
|
||||
},
|
||||
)
|
||||
self.assertEqual(
|
||||
spec["repository"],
|
||||
{
|
||||
"name": "vpn-rules",
|
||||
"workspace_id": None,
|
||||
"type": "infrastructure",
|
||||
"maturity": "operational",
|
||||
},
|
||||
)
|
||||
|
||||
boundary = spec["bounded_context"]
|
||||
self.assertEqual(boundary["domain"], "network-routing-policy")
|
||||
self.assertIn("single source of truth", boundary["responsibility"].lower())
|
||||
prohibited = " ".join(boundary["prohibited_responsibilities"]).lower()
|
||||
self.assertIn("production", prohibited)
|
||||
self.assertIn("credential", prohibited)
|
||||
self.assertIn("proxy subscription", prohibited)
|
||||
|
||||
self.assertEqual(
|
||||
{capability["id"] for capability in spec["capabilities"]},
|
||||
{
|
||||
"direct-routing-rule-authoring",
|
||||
"clash-verge-script-generation",
|
||||
"router-rule-projection",
|
||||
},
|
||||
)
|
||||
self.assertEqual(spec["contracts"]["consumes"], [])
|
||||
self.assertEqual(spec["dependencies"], [])
|
||||
provided = {
|
||||
contract["contract_id"]: contract
|
||||
for contract in spec["contracts"]["provides"]
|
||||
}
|
||||
self.assertEqual(
|
||||
set(provided),
|
||||
{
|
||||
"mihomo-direct-rule-provider",
|
||||
"router-direct-rules",
|
||||
"router-direct-plain-list",
|
||||
},
|
||||
)
|
||||
self.assertEqual(
|
||||
{contract["version"] for contract in provided.values()}, {"1.0.0"}
|
||||
)
|
||||
for contract in provided.values():
|
||||
self.assertTrue((ROOT / contract["path"]).is_file())
|
||||
|
||||
context = spec["agent_context"]
|
||||
self.assertLessEqual(context["max_default_tokens"], 6000)
|
||||
self.assertEqual(
|
||||
{entry["path"] for entry in context["default_entrypoints"]},
|
||||
{"README.md", "direct.yaml"},
|
||||
)
|
||||
for entry in context["default_entrypoints"]:
|
||||
self.assertTrue((ROOT / entry["path"]).is_file())
|
||||
self.assertIn("router", context["excluded_paths"])
|
||||
for value in context["excluded_paths"]:
|
||||
path = PurePosixPath(value)
|
||||
self.assertFalse(path.is_absolute())
|
||||
self.assertNotIn("..", path.parts)
|
||||
|
||||
self.assertEqual(
|
||||
spec["verification"],
|
||||
{
|
||||
"commands": [
|
||||
{
|
||||
"id": "rule-contract-tests",
|
||||
"argv": [
|
||||
"python3",
|
||||
"-m",
|
||||
"unittest",
|
||||
"discover",
|
||||
"-s",
|
||||
"tests",
|
||||
"-v",
|
||||
],
|
||||
"cwd": ".",
|
||||
"network": False,
|
||||
"required": True,
|
||||
}
|
||||
]
|
||||
},
|
||||
)
|
||||
|
||||
def test_checked_in_router_projections_match_the_rule_source(self) -> None:
|
||||
payload = load_payload(ROOT / "direct.yaml")
|
||||
plain = (ROOT / "router/direct-plain.txt").read_text(encoding="utf-8")
|
||||
router = (ROOT / "router/direct-rules.yaml").read_text(encoding="utf-8")
|
||||
|
||||
self.assertEqual(plain, "\n".join(payload) + "\n")
|
||||
self.assertEqual(
|
||||
router.split("rules:\n", 1)[1],
|
||||
"\n".join(f" - {to_rule(entry)}" for entry in payload) + "\n",
|
||||
)
|
||||
self.assertTrue(all(",DIRECT" not in entry for entry in payload))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in New Issue
Block a user