release: promote validated develop baseline

.clinerules

@@ -0,0 +1,64 @@
+# OneERP Agent Rules Adapter
+
+This file mirrors the generic rules in `AGENTS.md` for tools that read repository rule files automatically. Do not put tool-specific policy here unless absolutely required.
+
+## Fixed Context
+
+Do not rediscover the whole repository for every task. Start from:
+
+- `AGENTS.md`
+- `docs/README.md`
+- `docs/architecture/ARCHITECTURE.md`
+- `docs/architecture/DEVELOPMENT_WORKFLOW.md`
+- `docs/architecture/STANDARDS.md`
+- `docs/architecture/QUALITY_GATES.md`
+
+## Multi-Agent Task Policy
+
+Use one card per module boundary. Each card must declare:
+
+- goal
+- scope
+- forbidden files
+- required reading
+- acceptance command
+- changed files
+- residual risk
+
+## Conflict Policy
+
+Never assign two agents to edit these files at the same time:
+
+- `apps/api/prisma/schema.prisma`
+- `apps/api/src/app.module.ts`
+- `apps/web/src/lib/ui-schema.ts`
+- `apps/api/src/core/**`
+- `apps/web/src/components/core/**`
+- `package-lock.json`
+
+## Branch Policy
+
+- Daily work: `agent/<scope>/<task>` from `develop`
+- Integration: PR into `develop`
+- Release: PR from `develop` into `main`
+- Do not push directly to `main`
+
+## Validation Policy
+
+Before opening a PR, run the narrowest relevant test plus the full gate:
+
+```bash
+npm run validate
+```
+
+When CI fails, classify the failure first:
+
+- dependency/install
+- Prisma/migration
+- TypeScript
+- ESLint
+- unit test
+- build
+- Docker/deploy
+
+Fix only the first real root cause.

.dockerignore

@@ -61,8 +61,10 @@ apps/desktop
 # Test files
 **/test
 **/__tests__
-**/*.spec.ts
 **/*.test.ts
+**/*.test.tsx
+**/*.spec.ts
+**/*.spec.tsx
 
 # Logs
 *.log

.env.example

@@ -64,3 +64,24 @@ OPENAI_MODEL=gpt-4o-mini
 #   生产环境请根据实际部署地址配置，例如:
 #     NEXT_PUBLIC_API_BASE_URL=https://api.example.com/api
 #     NEXT_PUBLIC_API_BASE_URL=/api/proxy  (搭配 Next.js rewrites 反向代理)
+
+# ============================================================
+#  生产环境专用变量 (仅 docker-compose.prod.yml 使用)
+# ============================================================
+#  以下变量仅在生产部署时需要，在 .env 中按需配置
+#
+# ---- Docker 镜像 ----
+# IMAGE_OWNER  — 必填! GitHub 用户名或组织名，用于拉取 GHCR 镜像
+# IMAGE_TAG    — 镜像标签，默认 latest；回滚时指定 commit SHA
+# REGISTRY     — 镜像仓库地址，默认 ghcr.io
+# IMAGE_OWNER=
+# IMAGE_TAG=latest
+# REGISTRY=ghcr.io
+#
+# ---- CORS ----
+# CORS_ORIGINS — API 的 CORS 白名单 (逗号分隔)，生产环境务必包含前端域名
+# CORS_ORIGINS=https://your-domain.com
+#
+# ---- Nginx (可选) ----
+# HTTP_PORT=80
+# HTTPS_PORT=443

.github/copilot-instructions.md

@@ -16,9 +16,13 @@
 
 ## 必读文档
 
+- `AGENTS.md`
+- `docs/README.md`
+- `docs/architecture/ARCHITECTURE.md`
+- `docs/architecture/DEVELOPMENT_WORKFLOW.md`
 - `docs/architecture/STANDARDS.md`
+- `docs/architecture/QUALITY_GATES.md`
 - `docs/plans/PROJECT_PLAN_AND_STATUS.md`
-- `docs/plans/EXECUTION_PLAN.md`
 - `docs/plans/CORE_MODULES_DEV_PLAN.md`
 
 ## 后端开发规则
@@ -54,18 +58,19 @@
 
 ## 提交前检查
 
-在仓库根目录执行:
+在仓库根目录优先执行:
 
 ```bash
-npm run lint
-npm run test
+npm run validate
 ```
 
-如果某个子应用未配置测试，至少确保可构建:
+定位问题时可拆分执行:
 
 ```bash
-cd apps/api && npm run build
-cd ../web && npm run build
+npm run typecheck
+npm run lint
+npm run test
+npm run build
 ```
 
 ## PR 要求
@@ -74,4 +79,4 @@ cd ../web && npm run build
 2. 列出数据库变更和回滚方式（若有）。
 3. 提供接口变更说明（若有）。
 4. 前端改动附截图（若有）。
-5. 必须通过 CI。
+5. 必须通过 CI。

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+## Summary / 摘要
+
+### 中文
+- 
+
+### English
+- 
+
+## Validation / 验证
+
+### 中文
+- [ ] 已运行相关本地验证：
+- [ ] 如未运行，请说明原因：
+
+### English
+- [ ] Relevant local validation was run:
+- [ ] If not run, explain why:
+
+## Review Notes / Review 备注
+
+### 中文
+- 主要风险：
+- 需要 reviewer 重点查看：
+
+### English
+- Main risks:
+- Areas needing reviewer attention:

.github/workflows/ci.yml

@@ -82,9 +82,8 @@ jobs:
         run: npm ci
         working-directory: apps/web
 
-      - name: Run Prisma migrations
-        run: npx prisma migrate deploy --schema=./prisma/schema.prisma
-        working-directory: apps/api
+      - name: Validate Prisma schema
+        run: npm --prefix apps/api run prisma:validate
 
       # Policy: ``npm run validate`` runs format -> lint -> typecheck -> test -> build.
       # The lint step must NOT use --fix in CI; developers use ``npm run lint:fix`` locally.

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [main, develop]
+  push:
+    branches: [main, develop]
+  schedule:
+    - cron: "24 18 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          build-mode: none
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4

.github/workflows/deploy.yml

@@ -15,6 +15,11 @@ on:
         required: false
         default: "true"
         type: boolean
+      image_tag:
+        description: "镜像标签 (留空=latest, 填 commit SHA=回滚到指定版本)"
+        required: false
+        default: ""
+        type: string
 
 env:
   REGISTRY: ghcr.io
@@ -23,6 +28,8 @@ env:
 jobs:
   # ---- Build & Push API Docker Image ----
   build-api:
+    # 手动触发且未勾选 deploy_api 时跳过
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.deploy_api }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -65,6 +72,8 @@ jobs:
 
   # ---- Build & Push Web Docker Image ----
   build-web:
+    # 手动触发且未勾选 deploy_web 时跳过
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.deploy_web }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -105,11 +114,12 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  # ---- Deploy to Server (placeholder — customize for your infra) ----
+  # ---- Deploy to Production Server ----
   deploy:
     needs: [build-api, build-web]
+    # 仅 main 分支 push 或手动触发时执行部署
+    if: ${{ always() && (github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch') && !failure() && !cancelled() && (needs.build-api.result == 'success' || needs.build-web.result == 'success') }}
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
 
     environment:
       name: production
@@ -126,36 +136,48 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # ---- Option A: Deploy via SSH (uncomment and configure) ----
-      # - name: Deploy to server via SSH
-      #   uses: appleboy/ssh-action@v1
-      #   with:
-      #     host: ${{ secrets.DEPLOY_HOST }}
-      #     username: ${{ secrets.DEPLOY_USER }}
-      #     key: ${{ secrets.DEPLOY_SSH_KEY }}
-      #     script: |
-      #       cd /opt/oneerp
-      #       docker compose pull
-      #       docker compose up -d --remove-orphans
-      #       docker image prune -f
-
-      # ---- Option B: Deploy via Docker Compose on self-hosted runner ----
-      # - name: Deploy with Docker Compose
-      #   run: |
-      #     docker compose -f docker-compose.prod.yml pull
-      #     docker compose -f docker-compose.prod.yml up -d --remove-orphans
-      #     docker image prune -f
-
-      - name: Deployment placeholder
+      - name: Determine image tag
+        id: tag
         run: |
-          echo "::notice::Deploy step is configured as a placeholder."
-          echo "To enable automatic deployment, uncomment one of the options above."
-          echo ""
-          echo "Required secrets for SSH deployment:"
-          echo "  - DEPLOY_HOST: Server IP or hostname"
-          echo "  - DEPLOY_USER: SSH username"
-          echo "  - DEPLOY_SSH_KEY: SSH private key"
-          echo ""
-          echo "Published images:"
-          echo "  - ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-api:latest"
-          echo "  - ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-web:latest"
+          TAG="${{ inputs.image_tag }}"
+          if [ -z "$TAG" ]; then
+            TAG="latest"
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "::notice::Deploying images with tag: $TAG"
+
+      - name: Deploy to server via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            cd /opt/oneerp
+            echo "=== Pulling images (tag: ${{ steps.tag.outputs.tag }}) ==="
+            IMAGE_TAG=${{ steps.tag.outputs.tag }} docker compose -f docker-compose.prod.yml pull
+            echo "=== Starting services ==="
+            IMAGE_TAG=${{ steps.tag.outputs.tag }} docker compose -f docker-compose.prod.yml up -d --remove-orphans
+            echo "=== Waiting for health checks ==="
+            sleep 15
+            IMAGE_TAG=${{ steps.tag.outputs.tag }} docker compose -f docker-compose.prod.yml ps
+            echo "=== Pruning old images ==="
+            docker image prune -f
+
+      - name: Verify deployment
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            cd /opt/oneerp
+            echo "=== Checking container health ==="
+            docker compose -f docker-compose.prod.yml ps --format "table {{.Name}}\t{{.Status}}"
+            # 检查 API 是否可访问
+            if curl -sf http://localhost:${API_PORT:-8000}/api/docs > /dev/null 2>&1; then
+              echo "✅ API health check passed"
+            else
+              echo "❌ API health check failed"
+              exit 1
+            fi

.gitignore

@@ -85,3 +85,9 @@ __pycache__/
 
 
 .git.backup-*
+
+# Playwright
+test-results/
+playwright-report/
+blob-report/
+e2e-dist/