catlass仓上gitcode action-catlass-AtomGit

A.gitcode/scripts/arm_compile.sh+17-0

@@ -0,0 +1,17 @@
	1	+#!/bin/bash
	2	+set -ex
	3	+
	4	+cd "${WORKSPACE}"
	5	+pip3 install ml_dtypes expecttest pybind11-stubgen pytest pytest-xdist
	6	+source /home/jenkins/Ascend/ascend-toolkit/set_env.sh
	7	+export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${ASCEND_HOME_PATH}/$(uname -i)-linux/devlib
	8	+export LD_LIBRARY_PATH=/usr/local/Ascend/driver/lib64/driver/:$LD_LIBRARY_PATH
	9	+
	10	+bash -x tests/test_compile.sh
	11	+ret=$?
	12	+if [ $ret -ne 0 ]; then
	13	+ echo "compile catlass fail"
	14	+ exit 1
	atomgit-bot8月4日 🟡 Medium Priority `arm_compile.sh` 第 2 行设置了 `set -e`，这意味着任何非零退出的命令会导致脚本立即终止。第 10 行 `bash -x tests/test_compile.sh` 是一个独立的简单命令，不在 `if`/`while`/`&&`/`\|\|` 等抑制 `-e` 的上下文中。因此当 `tests/test_compile.sh` 失败（退出码非零）时，`set -e` 会使脚本在第 10 行立即退出，永远执行不到第 11 行 `ret=$?` 和第 12-14 行的错误处理逻辑。第 13 行的自定义错误消息 `"build catlass_examples fail"` 永远不会被打印。当 `tests/test_compile.sh` 成功（退出码 0）时，`ret=0`，跳过 `if` 块，执行 `exit 0`。所以第 11-15 行的代码只在成功路径上有意义（纯属冗余），在失败路径上完全是死代码。同样的问题也存在于 `pre_smoke.sh` 第 8-13 行。证据链：新增第 2 行 `set -e` + 第 10 行 `bash -x tests/test_compile.sh` → 失败时 `-e` 立即终止 → 第 11-14 行错误处理永远不可达 → 自定义错误消息不会输出。建议：将 `bash -x tests/test_compile.sh` 和后续的 `ret=$?` + `if` 块合并为一行：`bash -x tests/test_compile.sh \|\| { echo "build catlass_examples fail"; exit 1; }`。或者移除 `set -e` 中对简单命令的退出行为（改用 `set -e` 仅配合显式错误处理），让 `ret=$?` 能够被捕获。
	15	+fi
	16	+
	17	+exit $ret

A.gitcode/scripts/pre_smoke.sh+15-0

@@ -0,0 +1,15 @@
	1	+#!/bin/bash
	2	+set -ex
	3	+
	4	+pip3 install ml_dtypes expecttest pybind11-stubgen pytest pytest-xdist
	5	+source /usr/local/Ascend/ascend-toolkit/set_env.sh
	6	+export LD_LIBRARY_PATH=/usr/local/Ascend/driver/lib64/driver/:/usr/local/Ascend/driver/lib64/common:/usr/local/Ascend/driver/lib64/driver:$LD_LIBRARY_PATH
	7	+
	8	+bash -x tests/run_all_test.sh
	9	+ret=$?
	10	+if [ $ret -ne 0 ]; then
	11	+ echo "run catlass_testcase fail"
	12	+ exit 1
	13	+fi
	atomgit-bot8月4日 🟡 Medium Priority 与 `arm_compile.sh` 完全相同的问题：`pre_smoke.sh` 第 2 行 `set -e` 使得第 8 行 `bash -x tests/run_all_test.sh` 失败时脚本立即退出，第 9-13 行的 `ret=$?` 捕获和错误处理逻辑永远不可达。此外，第 11 行的错误消息 `"build catlass_examples fail"` 与脚本实际行为不匹配——这是从 `arm_compile.sh` 原样复制过来的。`pre_smoke.sh` 执行的是 `tests/run_all_test.sh`（冒烟测试），不是编译。错误消息应该反映实际失败的步骤。证据链：新增第 2 行 `set -e` + 第 8 行 `bash -x tests/run_all_test.sh` → 失败时 `-e` 立即终止 → 第 9-13 行错误处理永远不可达 + 第 11 行错误消息内容不匹配。建议：将错误处理改为 `bash -x tests/run_all_test.sh \|\| { echo "run_all_test fail"; exit 1; }`，同时修正错误消息以匹配实际执行的测试脚本。
	14	+
	15	+exit $ret

A.gitcode/workflows/arm_compile_action.yml+62-0

@@ -0,0 +1,62 @@
	1	+name: arm_compile_action
	2	+
	3	+on:
	4	+ workflow_call:
	5	+ inputs:
	6	+ task_name:
	7	+ required: true
	8	+ type: string
	9	+ image_version:
	10	+ required: true
	11	+ type: string
	12	+
	13	+jobs:
	14	+ JOB_compile:
	15	+ name: compile
	16	+ steps:
	17	+ -
	18	+ name: Checkout
	19	+ identifier: process_checkout
	20	+ uses: checkout
	21	+ with:
	22	+ ref: ${{ atomgit.event.pull_request.merge_commit_sha \|\| atomgit.sha }}
	23	+ token: ${{secrets.GIT_TOKEN}}
	24	+ -
	25	+ name: download
	26	+ uses: obs-download
	27	+ with:
	28	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	29	+ bucket: "ascend-cann-open"
	30	+ access-key: ${{ secrets.AK }}
	31	+ secret-key: ${{ secrets.SK }}
	32	+ key: \|
	33	+ ${{ env.obs_path }}/pr_filelist.txt
	34	+ ${{ env.obs_path }}/pr_filelist_mod.txt
	35	+ ${{ env.obs_path }}/update_file_detail.txt
	36	+ ${{ env.obs_path }}/arm_compile.sh
	37	+ path: ${{ steps.process_checkout.outputs.path }}
	38	+ -
	39	+ name: arm_compile_acc
	40	+ identifier: compile
	41	+ uses: build-accelerate
	42	+ with:
	43	+ command: \|
	44	+ export WORKSPACE=${{ steps.process_checkout.outputs.path }}
	45	+ cd ${{ steps.process_checkout.outputs.path }}
	46	+ export task_name=${{ inputs.task_name }}
	47	+ export target_branch=${{ env.TARGET_BRANCH }}
	48	+ BuildAccelerate bash arm_compile.sh
	49	+ AC_SERVER_IP: ${{ vars.AC_SERVER_IP }}
	50	+ - name: upload
	51	+ uses: obs-upload
	52	+ with:
	53	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	54	+ bucket: "ascend-cann-open"
	55	+ access-key: ${{ secrets.AK }}
	56	+ secret-key: ${{ secrets.SK }}
	57	+ artifact-path: "${{ steps.process_checkout.outputs.path }}/output/*"
	58	+ object-prefix: ${{ env.obs_path }}/
	59	+ if: "${{ default() }}"
	60	+ runs-on: [dedicate-hosted, arm64, xlarge]
	61	+ container:
	62	+ image: swr.cn-north-4.myhuaweicloud.com/hw-ascend/${{ inputs.image_version }}

A.gitcode/workflows/arm_pre_smoke.yml+95-0

@@ -0,0 +1,95 @@
	1	+name: arm_pre_smoke
	2	+
	3	+on:
	4	+ workflow_call:
	5	+ inputs:
	6	+ task_name:
	7	+ required: true
	8	+ type: string
	9	+ image_version:
	10	+ required: true
	11	+ type: string
	12	+
	13	+jobs:
	14	+ JOB_pre_smoke:
	15	+ name: pre_smoke_catlass
	16	+ steps:
	17	+ -
	18	+ name: Checkout
	19	+ identifier: process_checkout
	20	+ uses: checkout
	21	+ with:
	22	+ ref: ${{ atomgit.event.pull_request.merge_commit_sha \|\| atomgit.sha }}
	23	+ token: ${{secrets.GIT_TOKEN}}
	24	+ -
	25	+ name: Checkout gitcode
	26	+ identifier: process_checkout_gitcode
	27	+ uses: checkout
	28	+ with:
	29	+ repository: "https://gitcode.com/cann/.gitcode.git"
	30	+ ref: master
	31	+ path: "./ci"
	32	+ -
	33	+ name: download
	34	+ uses: obs-download
	35	+ with:
	36	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	37	+ bucket: "ascend-cann-open"
	38	+ access-key: ${{ secrets.AK }}
	39	+ secret-key: ${{ secrets.SK }}
	40	+ key: \|
	41	+ ${{ env.obs_path }}/pr_filelist.txt
	42	+ ${{ env.obs_path }}/pr_filelist_mod.txt
	43	+ ${{ env.obs_path }}/pre_smoke.sh
	44	+ path: ${{ steps.process_checkout.outputs.path }}
	45	+ -
	46	+ name: tar businesscode
	47	+ run: \|
	48	+ cd ${{ steps.process_checkout.outputs.path }}
	49	+ tar -zcf ../pre_smoke_data.tar.gz .
	50	+ mv ../pre_smoke_data.tar.gz ./
	51	+ -
	52	+ name: upload
	53	+ identifier: process_upload
	54	+ uses: obs-upload
	55	+ with:
	56	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	57	+ bucket: "ascend-cann-open"
	58	+ access-key: ${{secrets.AK}}
	59	+ secret-key: ${{secrets.SK}}
	60	+ artifact-path: \|
	61	+ ${{ steps.process_checkout.outputs.path }}/pre_smoke_data.tar.gz
	62	+ object-prefix: ${{ env.obs_pre_smoke_path }}/
	63	+ -
	64	+ name: pre_smoke_catlass
	65	+ uses: manifest-management-plugin
	66	+ with:
	67	+ action: DEPLOY
	68	+ repo: ${{ steps.process_checkout.outputs.path }}
	69	+ file_path: ${{ steps.process_checkout.outputs.path }}/ci/smoke-conf/smoke-A2.yaml
	70	+ manifest_image: swr.cn-north-4.myhuaweicloud.com/hw-ascend/${{ inputs.image_version }}
	71	+ custom_shell_script: \|-
	72	+ set -e
	73	+ # set env
	74	+ export repo_name=${{env.repo_name}}
	75	+ export pr_id=${{ env.MERGE_ID }}
	76	+ export AK=${{secrets.AK}}
	77	+ export SK=${{secrets.SK}}
	78	+ export obs_smoke_path=${{ env.obs_smoke_path_A2 }}
	79	+ export obs_path=${{ env.obs_path }}
	80	+ whoami
	81	+ pwd
	82	+ mkdir -p ~/taskspace && cd ~/taskspace
	83	+ wget -nv ${{ steps.process_upload.outputs.primary-url }}
	84	+ tar -zxf $(basename "${{ steps.process_upload.outputs.primary-url }}")
	85	+ sudo bash ~/taskspace/pre_smoke.sh
	86	+ -
	87	+ name: pre_smoke resource clean
	88	+ uses: manifest-management-plugin
	89	+ with:
	90	+ action: CRUSH
	91	+ repo: ${{ steps.process_checkout.outputs.path }}
	92	+ file_path: ${{ steps.process_checkout.outputs.path }}/ci/smoke-conf/smoke-A2.yaml
	93	+ if: "${{ default() }}"
	94	+ runs-on: ['self-hosted','arch=arm','smoke=204']
	95	+

A.gitcode/workflows/catlass_action.yml+166-0

@@ -0,0 +1,166 @@
	1	+name: catlass_action
	2	+
	3	+concurrency:
	4	+ max: 5
	5	+ exceed-action: QUEUE
	6	+ enable: true
	7	+ preemption:
	8	+ enable: true
	9	+ events: [mr_id]
	10	+
	11	+on:
	12	+ pull_request_comment:
	13	+ types: [created]
	14	+ branches: [ '*' ]
	15	+ comments: [ '^(?:\/)?compile*' ]
	16	+ pr_comment:
	17	+ types: [ created ]
	18	+ keyword: '^(?:\/)?compile*'
	19	+
	20	+env:
	21	+ org_name: "cann"
	22	+ repo_name: "catlass"
	23	+ MERGE_ID: ${{atomgit.event.pull_request.number}}
	24	+ TARGET_BRANCH: ${{atomgit.ref_name}}
	25	+ SOURCE_BRANCH: ${{atomgit.head_ref}}
	26	+ obs_path: "${{ vars.OBS_PATH }}/${{ env.MERGE_ID }}"
	27	+ obs_ut_path: "${{ env.obs_path }}/ut"
	28	+ obs_pre_smoke_path: "${{ env.obs_path }}/pre_smoke"
	29	+
	30	+stages:
	31	+ stage1:
	32	+ name: image
	33	+ jobs:
	34	+ JOB_image:
	35	+ name: image
	36	+ steps:
	37	+ - name: revise_image
	38	+ identifier: revise_image
	39	+ uses: cann/.gitcode/actions/revise-img@master
	40	+ with:
	41	+ repo_name: "catlass"
	42	+ target_branch: ${{ env.TARGET_BRANCH }}
	43	+ repo_url: ${{ vars.CI_PATH }}
	44	+ -
	45	+ name: show_output
	46	+ run: \|
	47	+ echo "image: ${{ steps.revise_image.outputs.Compile_Ascend_X86 }}"
	48	+ if: "${{ default() }}"
	49	+ runs-on: ["dedicate-hosted", "x64", "small"]
	50	+ container:
	51	+ image: swr.cn-north-4.myhuaweicloud.com/ci_cann/ubuntu20.04.05_x86:k8s_v1.1006
	52	+ JOB_pr:
	53	+ name: get_pr_files
	54	+ steps:
	55	+ -
	56	+ name: Checkout
	57	+ identifier: process_checkout
	58	+ uses: checkout
	59	+ with:
	60	+ ref: ${{ atomgit.event.pull_request.merge_commit_sha \|\| atomgit.sha }}
	61	+ token: ${{secrets.GIT_TOKEN}}
	62	+ -
	63	+ name: get_pr
	64	+ identifier: get_pr
	65	+ uses: cann/.gitcode/actions/get-pr@master
	66	+ with:
	67	+ workspace: ${{ steps.process_checkout.outputs.path }}
	68	+ target_branch: ${{ env.TARGET_BRANCH }}
	69	+ git_token: ${{secrets.GIT_TOKEN}}
	70	+ -
	71	+ name: upload
	72	+ uses: obs-upload
	73	+ with:
	74	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	75	+ bucket: "ascend-cann-open"
	76	+ access-key: ${{secrets.AK}}
	77	+ secret-key: ${{secrets.SK}}
	78	+ artifact-path: \|
	79	+ ${{ steps.process_checkout.outputs.path }}/pr_filelist.txt
	80	+ ${{ steps.process_checkout.outputs.path }}/pr_filelist_mod.txt
	81	+ ${{ steps.process_checkout.outputs.path }}/pr_filelist_precommit.txt
	82	+ ${{ steps.process_checkout.outputs.path }}/update_file_detail.txt
	83	+ object-prefix: ${{ env.obs_path }}/
	84	+ runs-on:
	85	+ - default
	86	+ JOB_shell:
	87	+ name: get_shell_files
	88	+ steps:
	89	+ -
	90	+ name: Checkout
	91	+ identifier: process_checkout
	92	+ uses: checkout
	93	+ with:
	94	+ ref: master
	95	+ token: ${{secrets.GIT_TOKEN}}
	96	+ -
	97	+ name: upload
	98	+ uses: obs-upload
	99	+ with:
	100	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	101	+ bucket: "ascend-cann-open"
	102	+ access-key: ${{secrets.AK}}
	103	+ secret-key: ${{secrets.SK}}
	104	+ artifact-path: \|
	105	+ ${{ steps.process_checkout.outputs.path }}/.gitcode/scripts/*
	106	+ object-prefix: ${{ env.obs_path }}/
	107	+ if: "${{ default() }}"
	108	+ runs-on:
	109	+ - default
	110	+ pre:
	111	+ - type: auto
	112	+ fail-fast: true
	113	+ stage2:
	114	+ name: compile
	115	+ jobs:
	116	+ JOB_codecheck_action:
	117	+ name: codecheck_action
	118	+ uses: .gitcode/workflows/codecheck_action.yml
	119	+ with:
	120	+ precommit_image_version: ${{ jobs.JOB_image.outputs.precommit }}
	121	+ codecheck_image_version: ${{ jobs.JOB_image.outputs.codecheck }}
	122	+ JOB_arm_compile:
	123	+ name: arm_compile
	124	+ uses: .gitcode/workflows/arm_compile_action.yml
	125	+ with:
	126	+ task_name: 'arm_compile'
	127	+ image_version: ${{ jobs.JOB_image.outputs.Compile_Ascend_ARM }}
	128	+ JOB_arm_pre_smoke:
	129	+ name: arm_pre_smoke
	130	+ uses: .gitcode/workflows/arm_pre_smoke.yml
	131	+ with:
	132	+ task_name: 'arm_pre_smoke'
	133	+ image_version: ${{ jobs.JOB_image.outputs.PreSmoke }}
	134	+ JOB_staticcheck_markdown:
	135	+ name: staticcheck_markdown
	136	+ uses: .gitcode/workflows/staticcheck_action.yml
	137	+ with:
	138	+ check_type: 'markdown'
	139	+ image_version: ${{ jobs.JOB_image.outputs.staticcheck }}
	140	+ JOB_staticcheck_codespell_check:
	141	+ name: staticcheck_codespell_check
	142	+ uses: .gitcode/workflows/staticcheck_action.yml
	143	+ with:
	144	+ check_type: 'codespell_check'
	145	+ image_version: ${{ jobs.JOB_image.outputs.staticcheck }}
	146	+ JOB_staticcheck_tag_closed_check:
	147	+ name: staticcheck_tag_closed_check
	148	+ uses: .gitcode/workflows/staticcheck_action.yml
	149	+ with:
	150	+ check_type: 'tag_closed_check'
	151	+ image_version: ${{ jobs.JOB_image.outputs.staticcheck }}
	152	+ JOB_staticcheck_resource_existence_check:
	153	+ name: staticcheck_resource_existence_check
	154	+ uses: .gitcode/workflows/staticcheck_action.yml
	155	+ with:
	156	+ check_type: 'resource_existence_check'
	157	+ image_version: ${{ jobs.JOB_image.outputs.staticcheck }}
	158	+ JOB_staticcheck_link_validity_check:
	159	+ name: staticcheck_link_validity_check
	160	+ uses: .gitcode/workflows/staticcheck_action.yml
	161	+ with:
	162	+ check_type: 'link_validity_check'
	163	+ image_version: ${{ jobs.JOB_image.outputs.staticcheck }}
	164	+ pre:
	165	+ - type: auto
	166	+ fail-fast: true

A.gitcode/workflows/codecheck_action.yml+167-0

@@ -0,0 +1,167 @@

1 +name: codecheck_action

2 +

3 +on:

4 + workflow_call:

5 + inputs:

6 + precommit_image_version:

7 + required: true

8 + type: string

9 + codecheck_image_version:

10 + required: true

11 + type: string

12 +

13 +jobs:

14 + JOB_precommit:

15 + name: precommit

16 + steps:

17 + -

18 + name: Checkout

19 + identifier: process_checkout

20 + uses: checkout

21 + with:

22 + ref: ${{ atomgit.event.pull_request.merge_commit_sha || atomgit.sha }}

23 + token: ${{secrets.GIT_TOKEN}}

24 + -

25 + name: download

26 + uses: obs-download

27 + with:

28 + endpoint: "https://obs.cn-north-4.myhuaweicloud.com"

29 + bucket: "ascend-cann-open"

30 + key: "${{ env.obs_path }}/pr_filelist_precommit.txt"

31 + path: ${{ steps.process_checkout.outputs.path }}

atomgit-bot8月4日

🟠 High Priority

codecheck_action.yml 中 JOB_precommit 的 obs-download 步骤（第 25-31 行）和 JOB_check_pr 的 obs-download 步骤（第 65-73 行）缺少 access-key 和 secret-key 参数。

与此形成对比：同一文件中的 obs-upload 步骤（第 41-49 行）以及所有其他 workflow 文件（arm_compile_action.yml 第 35-36 行、arm_pre_smoke.yml 第 43-44 行、staticcheck_action.yml 第 30-31 行、catlass_action.yml 第 76-77 行）中的每个 obs-download / obs-upload 步骤都明确提供了 access-key 和 secret-key。

缺少凭证会导致从 OBS 下载文件时鉴权失败，JOB_precommit 和 JOB_check_pr 两个 job 将无法获取所需的 pr_filelist_precommit.txt / pr_filelist.txt / pr_filelist_mod.txt 文件。

证据链：新增第 25-31 行和 65-73 行 → 缺少 access-key/secret-key → 与其他所有 OBS 步骤不一致 → OBS 下载鉴权失败 → job 失败。

建议：在 JOB_precommit 和 JOB_check_pr 的 obs-download 步骤中补充 access-key: ${{ secrets.AK }} 和 secret-key: ${{ secrets.SK }}。如果 OBS bucket 是公开读取的可以不需要凭证，但为了与其他步骤保持一致并防止 bucket 策略变更，建议统一加上。

改动建议

+      -
+        name: download
+        uses: obs-download
+        with:
+          endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
+          bucket: "ascend-cann-open"
+          access-key: ${{ secrets.AK }}
+          secret-key: ${{ secrets.SK }}
+          key: "${{ env.obs_path }}/pr_filelist_precommit.txt"
           path: ${{ steps.process_checkout.outputs.path }}

应用建议

32 + -

33 + name: precommit

34 + identifier: precommit

35 + uses: cann/.gitcode/actions/precommit@master

36 + with:

37 + merge_id: ${{ env.MERGE_ID }}

38 + repo_name: ${{ env.repo_name }}

39 + workspace: ${{ steps.process_checkout.outputs.path }}

40 + -

41 + name: upload

42 + uses: obs-upload

43 + with:

44 + endpoint: "https://obs.cn-north-4.myhuaweicloud.com"

45 + bucket: "ascend-cann-open"

46 + access-key: ${{secrets.AK}}

47 + secret-key: ${{secrets.SK}}

48 + artifact-path: "${{ steps.process_checkout.outputs.path }}/pre-commit*.txt"

49 + object-prefix: ${{ env.obs_path }}/

50 + if: "${{ default() }}"

51 + runs-on: [dedicate-hosted, x64, small]

52 + container:

53 + image: swr.cn-north-4.myhuaweicloud.com/ci_cann/${{ inputs.precommit_image_version }}

54 + JOB_check_pr:

55 + name: check_pr

56 + steps:

57 + -

58 + name: Checkout

59 + identifier: process_checkout

60 + uses: checkout

61 + with:

62 + ref: ${{ atomgit.event.pull_request.merge_commit_sha || atomgit.sha }}

63 + token: ${{secrets.GIT_TOKEN}}

64 + -

65 + name: download

66 + uses: obs-download

67 + with:

68 + endpoint: "https://obs.cn-north-4.myhuaweicloud.com"

69 + bucket: "ascend-cann-open"

70 + key: |

71 + ${{ env.obs_path }}/pr_filelist.txt

72 + ${{ env.obs_path }}/pr_filelist_mod.txt

73 + path: ${{ steps.process_checkout.outputs.path }}

atomgit-bot8月4日

🟠 High Priority

codecheck_action.yml 中 JOB_check_pr 的 obs-download 步骤（第 65-73 行）同样缺少 access-key 和 secret-key 参数。这是同一文件中第二个有此问题的 obs-download 步骤（第一个在 JOB_precommit 第 25-31 行）。其他所有 workflow 文件中的每个 OBS 操作都明确提供了凭证。

证据链：新增第 65-73 行 → 缺少 access-key/secret-key → OBS 下载鉴权失败 → check-pr 无法获取 pr_filelist.txt 和 pr_filelist_mod.txt → job 失败。

建议：在 JOB_check_pr 的 obs-download 步骤中补充 access-key: ${{ secrets.AK }} 和 secret-key: ${{ secrets.SK }}。

改动建议

+      -
+        name: download
+        uses: obs-download
+        with:
+          endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
+          bucket: "ascend-cann-open"
+          access-key: ${{ secrets.AK }}
+          secret-key: ${{ secrets.SK }}
+          key: |
+            ${{ env.obs_path }}/pr_filelist.txt
+            ${{ env.obs_path }}/pr_filelist_mod.txt
           path: ${{ steps.process_checkout.outputs.path }}

应用建议

74 + -

75 + name: check-pr

76 + identifier: check-pr

77 + uses: cann/.gitcode/actions/check-pr@master

78 + with:

79 + repo_name: ${{ env.repo_name }}

80 + workspace: ${{ steps.process_checkout.outputs.path }}

81 + runs-on: [dedicate-hosted, x64, small]

82 + container:

83 + image: swr.cn-north-4.myhuaweicloud.com/ci_cann/${{ inputs.codecheck_image_version }}

84 + JOB_sca:

85 + name: sca

86 + steps:

87 + -

88 + name: Checkout

89 + identifier: process_checkout

90 + uses: checkout

91 + with:

92 + ref: ${{ atomgit.event.pull_request.merge_commit_sha || atomgit.sha }}

93 + token: ${{secrets.GIT_TOKEN}}

94 + path: "./runner"

95 + -

96 + name: Checkout

97 + uses: checkout

98 + with:

99 + repository: ${{ vars.CI_PATH }}

100 + ref: refs/heads/master

101 + path: "./runner/CI"

102 + -

103 + name: sca

104 + run: |

105 + cd ${{ steps.process_checkout.outputs.path }}

106 + cd CI/scripts

107 + python3 codescan_gitcode.py --access_key ${{secrets.SCA_AK}} --secret_access_key ${{secrets.SCA_SK}} --access_key_get ${{secrets.SCA_AK_GET}} --secret_access_key_get ${{secrets.SCA_SK_GET}} --org_name ${org_name} --pr_id ${MERGE_ID} --repo ${repo_name} --commit_id ${{ atomgit.event.pull_request.merge_commit_sha }}

108 + if: "${{ default() }}"

109 + runs-on: [dedicate-hosted, x64, small]

110 + container:

111 + image: swr.cn-north-4.myhuaweicloud.com/ci_cann/${{ inputs.codecheck_image_version }}

112 + JOB_antiposion:

113 + name: antiposion

114 + steps:

115 + -

116 + name: Checkout

117 + identifier: process_checkout

118 + uses: checkout

119 + with:

120 + ref: ${{ atomgit.event.pull_request.merge_commit_sha || atomgit.sha }}

121 + token: ${{secrets.GIT_TOKEN}}

122 + path: "./runner"

123 + -

124 + name: Checkout

125 + uses: checkout

126 + with:

127 + repository: ${{ vars.CI_PATH }}

128 + ref: refs/heads/master

129 + path: "./runner/CI"

130 + -

131 + name: antiposion

132 + run: |

133 + cd ${{ steps.process_checkout.outputs.path }}

134 + cd CI/scripts

135 + python3 anti_virus_gitcode.py --access_key ${{secrets.ANTI_AK}} --secret_access_key ${{secrets.ANTI_SK}} --access_key_get ${{secrets.ANTI_AK_GET}} --secret_access_key_get ${{secrets.ANTI_SK_GET}} --org_name ${org_name} --pr_id ${MERGE_ID} --repo ${repo_name} --commit_id ${{ atomgit.event.pull_request.merge_commit_sha }}

136 + if: "${{ default() }}"

137 + runs-on: [dedicate-hosted, x64, small]

138 + container:

139 + image: swr.cn-north-4.myhuaweicloud.com/ci_cann/${{ inputs.codecheck_image_version }}

140 + JOB_codecheck:

141 + name: codecheck

142 + steps:

143 + -

144 + name: Checkout

145 + identifier: process_checkout

146 + uses: checkout

147 + with:

148 + ref: ${{ atomgit.event.pull_request.merge_commit_sha || atomgit.sha }}

149 + token: ${{secrets.GIT_TOKEN}}

150 + path: "./runner"

151 + -

152 + name: Checkout

153 + uses: checkout

154 + with:

155 + repository: ${{ vars.CI_PATH }}

156 + ref: refs/heads/master

157 + path: "./runner/CI"

158 + -

159 + name: codecheck

160 + run: |

161 + cd ${{ steps.process_checkout.outputs.path }}

162 + cd CI/scripts

163 + python3 codecheck_gitcode.py --access_key ${{secrets.CODECHECK_AK}} --secret_access_key ${{secrets.CODECHECK_SK}} --access_key_get ${{secrets.CODECHECK_AK_GET}} --secret_access_key_get ${{secrets.CODECHECK_SK_GET}} --org_name ${org_name} --pr_id ${MERGE_ID} --repo ${repo_name} --commit_id ${{ atomgit.event.pull_request.merge_commit_sha }}

164 + if: "${{ default() }}"

165 + runs-on: [dedicate-hosted, x64, small]

166 + container:

167 + image: swr.cn-north-4.myhuaweicloud.com/ci_cann/${{ inputs.codecheck_image_version }}

A.gitcode/workflows/staticcheck_action.yml+63-0

@@ -0,0 +1,63 @@
	1	+name: staticheck_action
	2	+
	3	+on:
	4	+ workflow_call:
	5	+ inputs:
	6	+ check_type:
	7	+ required: true
	8	+ type: string
	9	+ image_version:
	10	+ required: true
	11	+ type: string
	12	+
	13	+jobs:
	14	+ JOB_staticcheck:
	15	+ name: staticcheck
	16	+ steps:
	17	+ -
	18	+ name: Checkout
	19	+ identifier: process_checkout
	20	+ uses: checkout
	21	+ with:
	22	+ ref: ${{ atomgit.event.pull_request.merge_commit_sha \|\| atomgit.sha }}
	23	+ token: ${{secrets.GIT_TOKEN}}
	24	+ -
	25	+ name: download
	26	+ uses: obs-download
	27	+ with:
	28	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	29	+ bucket: "ascend-cann-open"
	30	+ access-key: ${{ secrets.AK }}
	31	+ secret-key: ${{ secrets.SK }}
	32	+ key: \|
	33	+ ${{ env.obs_path }}/pr_filelist.txt
	34	+ ${{ env.obs_path }}/pr_filelist_mod.txt
	35	+ ${{ env.obs_path }}/update_file_detail.txt
	36	+ path: ${{ steps.process_checkout.outputs.path }}
	37	+ -
	38	+ name: staticcheck
	39	+ identifier: staticcheck
	40	+ uses: cann/.gitcode/actions/staticcheck@master
	41	+ with:
	42	+ check_type: ${{ inputs.check_type }}
	43	+ target_branch: ${{ env.TARGET_BRANCH }}
	44	+ repo_name: ${{ env.repo_name }}
	45	+ merge_id: ${{ env.MERGE_ID }}
	46	+ commit_id: '0'
	atomgit-bot8月4日 🟡 Medium Priority `staticcheck_action.yml` 第 46 行将 `commit_id` 硬编码为字符串 `'0'`： commit_id: '0' 而该 workflow 在第 22 行已经 checkout 了正确的 commit（`${{ atomgit.event.pull_request.merge_commit_sha \|\| atomgit.sha }}`），表明实际 commit SHA 是可获取的。`commit_id: '0'` 看起来是一个未完成的占位符。`cann/.gitcode/actions/staticcheck@master` 这个 action 如果使用 `commit_id` 做基线对比或追踪，传 `'0'` 会导致检查结果不可靠（例如无法正确确定变更范围，或将所有文件标记为新增）。证据链：新增第 46 行 → `commit_id: '0'` 硬编码 → 未使用实际的 merge_commit_sha → staticcheck action 可能产生错误的检查结果。建议：将 `commit_id: '0'` 替换为实际的 commit SHA：`${{ atomgit.event.pull_request.merge_commit_sha \|\| atomgit.sha }}`，与同文件中 checkout 步骤（第 22 行）使用的 ref 保持一致。如果 `'0'` 在该 action 中确实有特殊语义（如表示"不使用基线"），请添加注释说明。
	47	+ workspace: ${{ steps.process_checkout.outputs.path }}
	48	+ -
	49	+ name: upload
	50	+ uses: obs-upload
	51	+ with:
	52	+ endpoint: "https://obs.cn-north-4.myhuaweicloud.com"
	53	+ bucket: "ascend-cann-open"
	54	+ access-key: ${{secrets.AK}}
	55	+ secret-key: ${{secrets.SK}}
	56	+ artifact-path: \|
	57	+ ${{ steps.process_checkout.outputs.path }}/*.csv
	58	+ ${{ steps.process_checkout.outputs.path }}/StaticCheck_*.json
	59	+ object-prefix: ${{ env.obs_path }}/
	60	+ if: "${{ default() }}"
	61	+ runs-on: [dedicate-hosted, x64, small]
	62	+ container:
	63	+ image: swr.cn-north-4.myhuaweicloud.com/static_check/${{ inputs.image_version }}