mirror of
https://github.com/tiennm99/thptqg.git
synced 2026-10-14 02:16:27 +00:00
tiennm99
0eb174721d
Adds go-parser/, a Go reimplementation of the xlsxread parser, verified byte-for-byte against the Rust original before any cutover. Reader fidelity is exact across all 299 input files: the canonical cell dump of every sheet matches calamine's, locked in as a test against a committed hash oracle. Reaching that required replacing extrame/xls, which corrupted 69% of cells and dropped a further 28% on the BIFF corpus, with pbnjay/grate; correcting excelize's number-format application and trailing-cell trimming; restoring carriage returns that XML line-ending normalisation strips from 2,233 ten_cum_thi values; and gating numeric re-rendering on cell type so shared strings that merely look numeric keep their leading zeros. The differential gate compares both parsers over all four datasets: 3,265,641 rows with identical full-table SHA-256, identical per-column non-NULL counts, identical schema metadata and identical stdout. Config moves from TOML to YAML for both parsers, so they keep reading the same files and the gate stays meaningful. Verified by rebuilding 2016 and 2017-old2 with Rust under the new configs and matching the recorded counts. build-db.js now refuses to publish a database whose row count does not match the known figure, closing a path where an under-producing parser could ship a truncated public dataset with green CI. The deploy workflow gains a pull_request trigger and guards deploy to main, so branch verification can no longer publish to production.
91 lines
2.9 KiB
YAML
91 lines
2.9 KiB
YAML
name: Deploy to GitHub Pages
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# Pull requests run the build job only. Before this, the workflow triggered on
|
|
# main-push and workflow_dispatch alone, so "verify on a branch first" was not
|
|
# actually possible: pushing to a branch ran nothing, and dispatching from one
|
|
# published that branch straight to the live site.
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
pages: write
|
|
id-token: write
|
|
|
|
concurrency:
|
|
group: pages
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# The parser is pure Go — grate, excelize, yaml.v3 and modernc.org/sqlite
|
|
# are all cgo-free — so no C toolchain is needed. Set explicitly rather
|
|
# than relying on the default.
|
|
CGO_ENABLED: '0'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: go-parser/go.sum
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
cache: 'npm'
|
|
cache-dependency-path: package-lock.json
|
|
|
|
- run: npm ci
|
|
|
|
# The reader-fidelity suite compares all 299 real input files against a
|
|
# committed hash oracle, so it is the regression guard for the whole
|
|
# reader. Runs before anything is built.
|
|
- name: Test parser
|
|
run: npm run test:go
|
|
|
|
# excelize carries an open advisory, and the 2017 refresh runbook feeds
|
|
# network-downloaded spreadsheets straight into the parser.
|
|
- name: Vulnerability scan
|
|
working-directory: go-parser
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
"$(go env GOPATH)/bin/govulncheck" ./...
|
|
|
|
# One parser binary builds every dataset; build-db.js reads the dataset
|
|
# list from src/datasets.js, verifies each database against its known row
|
|
# count, then gzips it in place leaving no uncompressed file behind.
|
|
- name: Build databases
|
|
run: |
|
|
npm run build:go
|
|
npm run build:db
|
|
|
|
# One Vite build produces every page. scripts/assemble-site.js copies the
|
|
# emitted index.html to each dataset path (and the legacy nested URLs),
|
|
# then fails the job if any uncompressed database reached the artifact.
|
|
- name: Build and assemble site
|
|
run: npm run build:site
|
|
|
|
- uses: actions/upload-pages-artifact@v3
|
|
with:
|
|
path: _site
|
|
|
|
deploy:
|
|
# Guarded to main. Without this, a workflow_dispatch from any branch would
|
|
# publish that branch's output to the live site, and concurrency
|
|
# cancel-in-progress would kill an in-flight good deploy on the way.
|
|
if: github.ref == 'refs/heads/main'
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
environment:
|
|
name: github-pages
|
|
url: ${{ steps.deployment.outputs.page_url }}
|
|
steps:
|
|
- id: deployment
|
|
uses: actions/deploy-pages@v4
|