ci(deps): bump docker/build-push-action from 6 to 7 - #4
Closed
dependabot[bot] wants to merge 77 commits into
Closed
Conversation
…env separation - Add Dockerfile: multi-stage pnpm build with standalone Next.js output, non-root user - Add docker-compose.prod.yml: MySQL + Redis + app service with health checks - Add .env.production.example: production env template (CORS to specific domain, DEBUG_DB=false) - Add .dockerignore: reduce build context size - Enable output: 'standalone' in next.config.ts for optimized Docker images
…points - register: 5 requests / 15min / IP (prevent mass registration) - change-password: 10 requests / 15min / IP (prevent brute-force password change) - Extract getClientIP to rate-limit.ts for reuse across auth endpoints - login already had rate limiting; now all 3 sensitive auth endpoints protected - Returns 429 with Retry-After header when limit exceeded
- schema.ts: pg-core -> mysql-core (mysqlTable, datetime, decimal, int, json)
- Fix defaultNow() incompatibility -> default('CURRENT_TIMESTAMP')
- Add drizzle.config.ts: MySQL dialect, env-based credentials
- Add db:generate/push/migrate scripts in package.json (replace prisma studio)
- Generate initial migration: drizzle/0000_chilly_retro_girl.sql (27 tables)
- schema.ts is now usable for type-safe queries and future migration workflow
…ueries
- Add invInboundOrders/invInboundItems tables to schema.ts (real table names)
- Export drizzleDb instance in db/index.ts (wraps mysql2 pool with schema)
- Create DrizzleInboundOrderRepository implementing IInboundOrderRepository
* findById: query API + inArray items (replace raw SELECT *)
* findByStatus: select + where(and) + orderBy + limit/offset + count
* save: transaction with conn.execute (placeholder, full Drizzle tx in future)
* updateStatus: update().set().where(and(eq, eq)) optimistic lock
* softDelete: update().set({deleted:true}).where(eq)
- Generate migration 0001_ordinary_valkyrie.sql (2 new tables)
- Original MysqlInboundOrderRepository kept for comparison/rollback
- TypeScript diagnostics: 0 errors; runtime: inbound API still 200 (Total: 5)
- 从 git 索引移除 coverage/ 与 tsconfig.tsbuildinfo（保留本地文件） - .gitignore 显式排除 IDE/Agent 目录（.cursor/.continue/.venv/.VS 等） - 排除 Trae IDE 自动化脚本与文档 - 排除 coverage/、*.tsbuildinfo、i18n-missing.json 等生成产物
事件总线（Outbox 模式）改造：
- EventBus.publish 改用 Promise.allSettled，保留多 handler 容错执行的同时传播首个错误以触发重试与死信
- DomainEventOutbox 实现完整错误栈记录与死信标记（max_attempts 后标记 dead）
- OutboxPoller 指数退避重试（1s/3s/9s），防重入并发控制
- 新增 DomainEventOutboxFactory/MemoryDomainEventOutbox，支持 EVENT_BUS_TYPE 环境变量切换 memory/db
- AppInitializer 实现 OutboxPoller 自动启动（仅 db 模式）
- ApplicationService 改用工厂模式调用 Outbox，解除对具体实现的直接依赖
- system/outbox API 路由同步使用工厂模式
Drizzle isServer undefined 修复：
- drizzle() 调用由 { pool } 改为 { client }，避免 drizzle-orm 0.45.x 忽略 pool 后走 createPool(undefined) 抛错
- 修复 /warehouse/stocktaking 页面 500 错误
测试覆盖（领域层 + 基础设施层 + API 集成）： - tests/unit/ 领域聚合根、值对象、状态机、事件总线单元测试 - tests/integration/ 入库/出库/工单核心 API 集成测试（正常流程、参数异常、权限异常、事务异常） - tests/concurrency/ 并发场景测试 - src/lib/__tests__/ cost-calculation、error-handler、inventory-alert、role-permission-inherit - src/tests/utils/auth.test.ts、src/tests/i18n/ - vitest.config.ts 覆盖率阈值配置（lines/functions 80、branches 70） 新增业务 API 路由： - finance：aging、expense、invoice - orders/bom/expand、purchase/return - system：announcement、data-scope、dict、log、monitor、profile - warehouse：alert-push、batch、cost、freeze、inventory/export、stocktaking/diff-process、unit-conversion - health 健康检查 新增页面与组件： - [locale] 下 purchase/return、settings（announcement/profile/scheduler）、warehouse（batch/cost）、error/loading - IntlProvider、advanced-search、batch-toolbar、FileUploadCell 新增 lib 工具与 mock 数据： - bom-expansion、error-handler、i18n-server、mock-data、mock-hr-data 文档与配置： - DEPLOYMENT.md、design.md、docs/API.md、docs/database/、docs/testing.md、docs/openapi.json、docs/i18n-eslint-rule.md - database/migrations/、eslint-rules/、menu_data.json - scripts/ i18n 与分析工具脚本（不含 Trae IDE 自动化脚本）
- ci.yml: 测试命令从 test:unit:run 改为 test:coverage，启用覆盖率收集 - vitest.config.ts: thresholds 从 80% 调整为渐进式基线（lines/statements 45%、branches 35%、functions 70%），防止覆盖率退化 - 目标：随补测试逐步提升至 lines/functions/statements 80、branches 70 注意：当前 77 个测试失败为既存问题（mock 配置不匹配），需单独修复
统一 mockConn.query/execute 返回格式为 [rows, fields] 元组；修正状态机与状态码断言对齐源码实现；补全 login route 部门查询与 last_login_ip mock 队列；修正 over-issue secureLog 异常路径期望；新增 inventory-sync.test.ts 与 warehouse-core.test.ts（覆盖率 98.4%/98.9%）。单元测试 968/988 通过，0 断言失败。
删除根目录临时数据文件(warehouse_*.json)、历史备份与测试截图；新增 playwright-report/、scripts/i18n-check/、test-results.json 等测试产物的忽略规则
在 inventory-sync.ts 的 adjustInventory/lockInventory/unlockInventory 中引入 version 字段实现乐观锁；stock-adjust 状态变更接口基于 expectedStatus 做 WHERE 条件判断 affectedRows 返回 409；前端处理并发冲突并刷新数据；补充 inventory-sync/material-requisition 单测与测试 setup 配置
修复 sales-outbound/production-inbound/setup/stock-adjust 分页控件与状态徽章硬编码；修正 vi.json 的 prevPage/nextPage 误用中文；4 语言补齐 Common.previousPage/active/inactive；新增 scan-warehouse-i18n.js 与 check-i18n.py 检查脚本；附仓库分析文档与前端 mock 数据
- 清理冗余资产：124 个 .bak、docs/baseline、21 个临时脚本（167 文件 87K 行） - .gitignore 补全：*.bak/docs/baseline/scripts/temp/*.pem 等规则 - 版本管理门禁：husky + commitlint + lint-staged hooks - CI 修复：chromatic.yml pnpm v4 对齐 + frozen-lockfile - CLI 脚本：setup-db.mjs 逐语句容错 + SQL 兼容预处理 - 测试修复：setup.ts window 守卫、fifo-allocation TS2345 类型修复 - auth-fetch.ts：日志改英文，消除 9 个 i18n warnings
- ISSUE_TEMPLATE：bug 报告与功能建议模板 - PULL_REQUEST_TEMPLATE：PR 检查清单 - CODEOWNERS：默认代码所有者 - CONTRIBUTING.md：贡献指南（含提交规范与门禁说明）
- 统一 docs/ 为 12 个中文编号目录，消除 3 套并行结构 - 删除冗余文件：Readmioem/TRADE-AUTO/PROJECT_UPLOADER 等 8 个 - 全量重写 70+ 文档，基于代码现状，对齐当前实现 - 新建 docs/README.md 总索引 - 发现并记录 4 类代码级不一致（schema 表名/财务三套表/soft-delete 错配）
- 重写 README.md：对齐当前代码现状（pnpm setup:db、Drizzle、i18n、husky/commitlint、CI 流水线） - 删除根目录冗余 .md：DEPLOYMENT/TEAM_SETUP/design（内容已迁入 docs/） - 保留 README.md 和 CONTRIBUTING.md 作为根目录入口
- 补充默认登录账号 admin/admin123 - 说明 --seed 参数语义与自动建库行为 - 双数据库初始化路径对比表 + schema 表名不一致提示 - 标注旧 /api/setup/create-tables 接口已废弃 - 明确 CI 触发条件（PR 与 main 分支行为差异）
- token-blacklist.ts 扩展黑名单能力，支持登出/改密撤销令牌 - auth/api-auth/auth-fetch 协同处理 401 并发刷新 - login/logout/refresh/password 路由联动 token 生命周期 - setup/create-tables 容错增强 - AuthContext 同步 refreshToken/userId 存储 - 修复 59 处 no-explicit-any 错误，引入 Row interface 泛型查询
- RedisCacheManager.ts 实现 Redis 缓存适配器 - CacheManager.ts 扩展支持 Redis 后端切换 - .env.example 补充 Redis 连接配置
- cost-engine.ts：产品成本核算（物料/人工/制费/外协） - general-ledger.ts：凭证状态管理与期间过账 - mrp-engine-v2.ts：MRP 运算（毛需求/净需求/BOM 展开/工艺路线） - 配套单元测试 3 个文件 - 修复 41 处 no-explicit-any，引入 Row interface 泛型查询
- 根 layout.tsx 承担 html/body 渲染，[locale]/layout.tsx 改为 fragment - 新增 HtmlLangSetter 客户端组件，动态设置 document.documentElement.lang - sidebar.tsx 翻译缺失警告改为模块级 Set 去重，避免重复打印 - 修复 [locale]/layout.tsx 的 any 类型（query 泛型）
- 新增 docker-publish.yml：CI 通过后构建镜像并发布到 GHCR（ghcr.io/snqig/vnerp） - 依赖 CI/CD Pipeline 成功，避免未通过测试的代码被发布 - 支持 tag v* 触发版本发布，支持手动触发 - 利用 GitHub Actions cache 加速构建 - 新增 deploy.yml：镜像发布成功后 SSH 自动部署 - 拉取最新镜像 + docker compose 滚动重启 + 健康检查 - 通过 GitHub Secrets 配置部署凭据（DEPLOY_HOST/USER/SSH_KEY/PATH） - 新增 dependabot.yml：每周自动检查 npm/docker/github-actions 依赖更新
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v6...v7) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/docker/build-push-action-7
branch
August 28, 2026 03:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps docker/build-push-action from 6 to 7.
Release notes
Sourced from docker/build-push-action's releases.
... (truncated)
Commits
f9f3042Merge pull request #1517 from docker/dependabot/npm_and_yarn/docker/actions-t...812d5fdchore: update generated contentb6f6693chore(deps): Bump@docker/actions-toolkitfrom 0.87.0 to 0.90.0c1c626eMerge pull request #1525 from docker/dependabot/npm_and_yarn/actions/core-3.0.151bb284chore: update generated content5f7884dchore(deps): Bump@actions/corefrom 3.0.0 to 3.0.1e01deffMerge pull request #1521 from docker/dependabot/npm_and_yarn/fast-xml-parser-...3804d49chore: update generated content71e8947chore(deps): Bump fast-xml-parser from 5.5.7 to 5.8.04925ad2Merge pull request #1526 from docker/dependabot/npm_and_yarn/postcss-8.5.10Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)