ci: 并行化测试检查、缓存 Next.js 与 Electron 构建并精简 standalone 追踪

Author: margrop

.github/workflows/ci.yml

@@ -58,7 +58,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --no-audit --no-fund
 
       - name: Lint
         run: npm run lint
@@ -69,7 +69,8 @@ jobs:
   integration-test:
     runs-on: ubuntu-latest
     name: Integration Tests
-    needs: unit-test
+    needs: publication-check
+    if: "!startsWith(github.ref, 'refs/tags/')"
     steps:
       - name: Checkout repository
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -81,7 +82,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --no-audit --no-fund
 
       - name: Generate Prisma Client
         run: npx prisma generate
@@ -92,7 +93,8 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     name: Test Coverage
-    needs: unit-test
+    needs: publication-check
+    if: "!startsWith(github.ref, 'refs/tags/')"
     steps:
       - name: Checkout repository
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -104,7 +106,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --no-audit --no-fund
 
       - name: Generate Prisma Client
         run: npx prisma generate
@@ -135,7 +137,8 @@ jobs:
   build-check:
     runs-on: ubuntu-latest
     name: Build Check
-    needs: integration-test
+    needs: publication-check
+    if: "!startsWith(github.ref, 'refs/tags/')"
     steps:
       - name: Checkout repository
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -146,8 +149,17 @@ jobs:
           node-version: '24'
           cache: 'npm'
 
+      - name: Cache Next.js build
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ github.workspace }}/.next/cache
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
+            nextjs-${{ runner.os }}-
+
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --no-audit --no-fund
 
       - name: Generate Prisma Client
         run: npx prisma generate
@@ -158,7 +170,7 @@ jobs:
   e2e-test:
     runs-on: ubuntu-latest
     name: E2E Tests
-    needs: build-check
+    needs: [unit-test, integration-test, build-check]
     timeout-minutes: 60
     env:
       DATABASE_URL: "file:./e2e.db"
@@ -174,11 +186,20 @@ jobs:
           node-version: '24'
           cache: 'npm'
 
+      - name: Cache Next.js build
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ github.workspace }}/.next/cache
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
+            nextjs-${{ runner.os }}-
+
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --no-audit --no-fund
 
       - name: Install Playwright Browsers
-        run: npx playwright install --with-deps
+        run: npx playwright install --with-deps chromium
 
       - name: Setup Database
         run: |

.github/workflows/packages.yml

@@ -37,7 +37,16 @@ jobs:
             echo "PACKAGE_VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
           fi
 
-      - run: npm ci
+      - name: Cache Next.js build
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ github.workspace }}/.next/cache
+          key: nextjs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ runner.arch }}-
+
+      - run: npm ci --no-audit --no-fund
 
       - name: Build bundle and npm package
         run: |
@@ -152,7 +161,23 @@ jobs:
           sudo gem install --no-document fpm
           echo "USE_SYSTEM_FPM=true" >> "$GITHUB_ENV"
 
-      - run: npm ci
+      - name: Cache Next.js and Electron binaries
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ${{ github.workspace }}/.next/cache
+            ~/.cache/electron
+            ~/.cache/electron-builder
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/AppData/Local/electron/Cache
+            ~/AppData/Local/electron-builder/Cache
+          key: desktop-${{ matrix.name }}-${{ hashFiles('package-lock.json', 'packaging/desktop/package.json') }}-${{ github.sha }}
+          restore-keys: |
+            desktop-${{ matrix.name }}-${{ hashFiles('package-lock.json', 'packaging/desktop/package.json') }}-
+            desktop-${{ matrix.name }}-
+
+      - run: npm ci --no-audit --no-fund
 
       - name: Build bundle
         run: node scripts/package/build.mjs bundle
@@ -270,7 +295,16 @@ jobs:
           echo "${{ matrix.sha256 }}  /usr/local/bin/fnpack" | sha256sum -c -
           chmod +x /usr/local/bin/fnpack
 
-      - run: npm ci
+      - name: Cache Next.js build
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ github.workspace }}/.next/cache
+          key: nextjs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ runner.arch }}-
+
+      - run: npm ci --no-audit --no-fund
 
       - name: Build fpk
         run: |
@@ -314,7 +348,16 @@ jobs:
             echo "PACKAGE_VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
           fi
 
-      - run: npm ci
+      - name: Cache Next.js build
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ github.workspace }}/.next/cache
+          key: nextjs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-
+            nextjs-${{ runner.os }}-${{ runner.arch }}-
+
+      - run: npm ci --no-audit --no-fund
 
       # 单机版内置的服务端与其他安装包相同
       - name: Build bundle

Dockerfile

@@ -12,7 +12,7 @@ WORKDIR /app
 COPY package.json package-lock.json ./
 COPY prisma/schema.prisma ./prisma/schema.prisma
 RUN --mount=type=cache,target=/root/.npm \
-    npm ci && npx prisma generate
+    npm ci --no-audit --no-fund && npx prisma generate
 
 # Pre-compile runtime scripts and initialize seed database in an isolated stage
 # so code-only changes reuse the cached database layer and BuildKit can run it in parallel.

next.config.ts

@@ -17,6 +17,22 @@ export const securityHeaders = [
 const nextConfig: NextConfig = {
   output: 'standalone',
   serverExternalPackages: ['@prisma/client', 'bcryptjs'],
+  // 排除因 process.cwd() 动态路径被文件追踪误扫入 standalone 的开发、测试与打包目录
+  outputFileTracingExcludes: {
+    '*': [
+      './src/**/*',
+      './e2e/**/*',
+      './tests/**/*',
+      './coverage/**/*',
+      './packaging/**/*',
+      './dist/**/*',
+      './dist-scripts/**/*',
+      './doc/**/*',
+      './perf/**/*',
+      './scripts/**/*',
+      './.git/**/*',
+    ],
+  },
   // 禁止 next dev 自动向 AGENTS.md / CLAUDE.md 写入 agent-rules 段落
   agentRules: false,
   poweredByHeader: false,

scripts/package/build.mjs

@@ -192,11 +192,11 @@ function buildBundle() {
     log('组装 dist/bundle');
     rm(BUNDLE);
     copy(standalone, BUNDLE);
-    // standalone 可能带入本机的 .env、配置文件和数据库，全部移除，避免把密钥打进安装包
+    // standalone 仅保留运行时必需的顶层项，移除可能带入的本机配置、数据库及开发目录
+    const allowedTopLevel = new Set(['server.js', 'package.json', '.next', 'node_modules']);
     for (const entry of fs.readdirSync(BUNDLE)) {
-        if (entry.startsWith('.env') || /\.(db|db-journal|sqlite)$/.test(entry)) rm(path.join(BUNDLE, entry));
+        if (!allowedTopLevel.has(entry)) rm(path.join(BUNDLE, entry));
     }
-    for (const dir of ['config', 'data', 'prisma', 'certs', 'dist-scripts']) rm(path.join(BUNDLE, dir));
     // 外部包别名链接由 launcher.js 在运行时解析（见 installExternalAliasResolver）
     rm(path.join(BUNDLE, '.next', 'node_modules'));