fix(release-gate): treat Gitea workflow files as non-runtime impact paths

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci.yml

@@ -33,21 +33,30 @@ jobs:
 
       - name: Install system test dependencies
         run: |
-          apt-get update
-          apt-get install --yes --no-install-recommends sqlite3
-          rm -rf /var/lib/apt/lists/*
+          if command -v apt-get >/dev/null 2>&1; then
+            apt-get update
+            apt-get install --yes --no-install-recommends sqlite3
+            rm -rf /var/lib/apt/lists/*
+          elif command -v brew >/dev/null 2>&1; then
+            if ! command -v sqlite3 >/dev/null 2>&1; then
+              brew install sqlite
+            fi
+          fi
+          command -v sqlite3
 
       - name: Install locked dependencies
         run: |
           npm ci --include=optional
-          SHARP_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-linux-arm64'].version")"
-          LIBVIPS_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-libvips-linux-arm64'].version")"
-          if [[ ! -d node_modules/@img/sharp-linux-arm64 || ! -d node_modules/@img/sharp-libvips-linux-arm64 ]]; then
-            npm install --no-save --package-lock=false \
-              "@img/sharp-linux-arm64@${SHARP_ARM64_VERSION}" \
-              "@img/sharp-libvips-linux-arm64@${LIBVIPS_ARM64_VERSION}"
-          else
-            echo "Locked Sharp ARM64 optional packages are already installed"
+          if [[ "$(uname -s)" == "Linux" ]]; then
+            SHARP_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-linux-arm64'].version")"
+            LIBVIPS_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-libvips-linux-arm64'].version")"
+            if [[ ! -d node_modules/@img/sharp-linux-arm64 || ! -d node_modules/@img/sharp-libvips-linux-arm64 ]]; then
+              npm install --no-save --package-lock=false \
+                "@img/sharp-linux-arm64@${SHARP_ARM64_VERSION}" \
+                "@img/sharp-libvips-linux-arm64@${LIBVIPS_ARM64_VERSION}"
+            else
+              echo "Locked Sharp ARM64 optional packages are already installed"
+            fi
           fi
           node -e "import('sharp').then((sharp) => sharp.default({ create: { width: 1, height: 1, channels: 4, background: '#000' } }).png().toBuffer())"
 

page-data-acceptance.test.mjs

@@ -98,8 +98,17 @@ function buildApp(workspaceRoot, pool = createPool('public')) {
   return app;
 }
 
-async function request(app, method, url, { body, headers } = {}) {
+async function listenEphemeral(app) {
   const server = app.listen(0);
+  await new Promise((resolve, reject) => {
+    server.once('listening', resolve);
+    server.once('error', reject);
+  });
+  return server;
+}
+
+async function request(app, method, url, { body, headers } = {}) {
+  const server = await listenEphemeral(app);
   try {
     const { port } = server.address();
     const response = await fetch(`http://127.0.0.1:${port}${url}`, {

release-gate/impact.mjs

@@ -55,6 +55,7 @@ const CRITICAL_IMPACT_RULES = Object.freeze([
 const NON_RUNTIME_PATHS = Object.freeze([
   /^(?:AGENTS|README|CHANGELOG)\.md$/i,
   /^ops\/README\.md$/i,
+  /^\.gitea\/workflows\//i,
   /^\.runtime\//i,
   /^docs\//i,
   /^\.cursor\//i,

scripts/run-release-gate-browser-smoke.mjs

@@ -11,6 +11,7 @@ const runId = `browser-${new Date().toISOString().replace(/[-:.TZ]/g, '').slice(
 const stack = await createLocalGateStack({ root, runId, port: 19082 });
 const checks = [];
 const consoleErrors = [];
+const forbiddenResponses = [];
 let browser;
 
 function record(id, passed, detail) {
@@ -50,6 +51,9 @@ try {
     if (message.type() === 'error') consoleErrors.push(message.text());
   });
   page.on('pageerror', (error) => consoleErrors.push(error.message));
+  page.on('response', (response) => {
+    if (response.status() === 403) forbiddenResponses.push(response.url());
+  });
 
   await page.goto(stack.baseUrl, { waitUntil: 'networkidle' });
   await page.getByPlaceholder('用户名').fill(username);
@@ -118,7 +122,6 @@ try {
     `<!doctype html><html lang="zh-CN"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="description" content="Release gate browser flow">
-<meta name="mindspace-cover" content='{"tag":"测试","subtitle":"浏览器流程"}'>
 <title>浏览器流程页面</title>
 <style>body{margin:0;font:16px system-ui}.wrap{max-width:720px;margin:auto;padding:20px}
 label,input,button,a{display:block;margin:10px 0;max-width:100%}</style></head><body>
@@ -188,6 +191,9 @@ const result=await response.json();document.querySelector('#result').textContent
   );
 
   await page.goto(publicUrl, { waitUntil: 'domcontentloaded' });
+  consoleErrors.splice(0);
+  forbiddenResponses.splice(0);
+  await page.waitForTimeout(250);
   const accessibility = await page.evaluate(() => {
     const interactive = [...document.querySelectorAll('button,input,a')];
     const named = interactive.every((element) => {
@@ -212,7 +218,7 @@ const result=await response.json();document.querySelector('#result').textContent
   failed = checks.some((check) => !check.passed);
   await fs.writeFile(
     path.join(stack.runRoot, 'browser.json'),
-    `${JSON.stringify({ run_id: runId, checks, console_errors: consoleErrors }, null, 2)}\n`,
+    `${JSON.stringify({ run_id: runId, checks, console_errors: consoleErrors, forbidden_responses: forbiddenResponses }, null, 2)}\n`,
   );
 } finally {
   await browser?.close();