🔧 chore(workflows): migrate to prepare + worktree model and merge checks

- add prepare.yml: install tools + maintain shared bare repo, anchors the workflow_run chain
- add checks.yml: merge lint + full test suite into a single workflow_run consumer job
- remove standards-check.yml and test.yml (superseded by checks.yml)
- convert sync-tsl-playbook and update-thirdparty-skills to worktree-model consumers
- unify workflow/job/step display names and emoji

.gitea/workflows/sync-tsl-playbook.yml

@@ -1,78 +1,130 @@
-name: 📦 Sync TSL Playbook
+name: 📦 发布 TSL Playbook
 
 on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
+  workflow_run:
+    workflows: ["🧰 准备环境"]
+    types:
+      - completed
 
 concurrency:
   group: sync-tsl-playbook-${{ github.repository }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
+# ==========================================
+# 🔧 配置区域
+# ==========================================
 env:
-  WORKSPACE_DIR: "/home/workspace"
+  # Prepare 维护共享仓库并读取代码；此处 token 仅用于推送。
+  ACCESS_TOKEN: ${{ secrets.WORKFLOW }}
+
+  # ===== 工作区配置 =====
+  WORKSPACE_ROOT: "/data/workspace"
+  WORKSPACE_SLOT: "tsl-playbook"
+  SOURCE_BRANCH: ${{ github.event.workflow_run.head_branch }}
+  SOURCE_SHA: ${{ github.event.workflow_run.head_sha }}
+
+  # ===== 分支与构建配置 =====
   TARGET_BRANCH: "tsl-playbook"
+  BUILD_SCRIPT: "scripts/build_tsl_playbook.py"
+
+  # ===== Git 配置 =====
   GIT_USER_NAME: "ci[bot]"
   GIT_USER_EMAIL: "ci[bot]@tinysoft.com.cn"
 
 jobs:
   sync:
-    name: 📦 Build and publish tsl-playbook
-    runs-on: ubuntu-22.04
+    # 仅在 Prepare 于主分支成功后触发。
+    if: ${{ github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'master') }}
+    name: 🔨 构建并发布 tsl-playbook
+    runs-on: standard-ubuntu-22
+    permissions:
+      contents: write
 
     steps:
-      - name: 📥 准备仓库
+      - name: 🔐 验证 Token 配置
         shell: bash
-        env:
-          WORKFLOW: ${{ secrets.WORKFLOW }}
         run: |
           set -euo pipefail
+          if [ -z "$ACCESS_TOKEN" ]; then
+            echo "❌ 未配置 WORKFLOW secret，无法推送 $TARGET_BRANCH" >&2
+            exit 1
+          fi
+          echo "✅ Token 已配置"
+          echo "🌿 上游分支: ${{ env.SOURCE_BRANCH }}"
+          echo "📝 上游提交: ${{ env.SOURCE_SHA }}"
 
-          echo "========================================"
-          echo "📦 准备仓库到 WORKSPACE_DIR"
-          echo "========================================"
+      - name: 📥 对齐 Worktree
+        id: prepare_worktree
+        shell: bash
+        run: |
+          set -euo pipefail
 
           REPO_NAME="${{ github.event.repository.name }}"
-          mkdir -p "$WORKSPACE_DIR"
-          REPO_DIR="$(mktemp -d "$WORKSPACE_DIR/${REPO_NAME}.XXXXXX")"
-          export GIT_TERMINAL_PROMPT=0
-          echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV"
+          HEAD_SHA="${{ env.SOURCE_SHA }}"
+          REPOSITORY_DIR="${WORKSPACE_ROOT}/${REPO_NAME}/repository.git"
+          WORKTREE_DIR="${WORKSPACE_ROOT}/${REPO_NAME}/worktrees/${WORKSPACE_SLOT}"
+          WORKTREE_LOCK="${WORKSPACE_ROOT}/${REPO_NAME}/worktree-admin.lock"
 
-          if [ -n "${WORKFLOW:-}" ]; then
-            ASKPASS_SCRIPT="$(mktemp "$WORKSPACE_DIR/git-askpass.XXXXXX")"
-            cat > "$ASKPASS_SCRIPT" <<'EOF'
-          #!/usr/bin/env sh
-          case "$1" in
-            *Username*) printf '%s\n' oauth2 ;;
-            *Password*) printf '%s\n' "$WORKFLOW" ;;
-            *) printf '\n' ;;
+          case "$HEAD_SHA" in
+            ''|*[!0-9a-fA-F]*)
+              echo "无效的上游提交 SHA: $HEAD_SHA" >&2
+              exit 1
+              ;;
           esac
-          EOF
-            chmod 700 "$ASKPASS_SCRIPT"
-            export GIT_ASKPASS="$ASKPASS_SCRIPT"
-            echo "GIT_ASKPASS=$ASKPASS_SCRIPT" >> "$GITHUB_ENV"
+          if [ ! -d "$REPOSITORY_DIR" ] || \
+             [ "$(git --git-dir="$REPOSITORY_DIR" rev-parse --is-bare-repository 2>/dev/null)" != "true" ]; then
+            echo "Prepare 未创建有效共享 bare 仓库: $REPOSITORY_DIR" >&2
+            exit 1
+          fi
+          if ! git --git-dir="$REPOSITORY_DIR" cat-file -e "${HEAD_SHA}^{commit}"; then
+            echo "共享仓库中不存在上游提交: $HEAD_SHA" >&2
+            exit 1
           fi
 
-          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          if [ ! -f "$WORKTREE_DIR/.git" ]; then
+            exec 9>"$WORKTREE_LOCK"
+            flock 9
 
-          git clone "$REPO_URL" "$REPO_DIR"
+            if [ ! -f "$WORKTREE_DIR/.git" ]; then
+              if [ -e "$WORKTREE_DIR" ]; then
+                echo "发布 Worktree 路径已存在但不是 linked worktree: $WORKTREE_DIR" >&2
+                exit 1
+              fi
+              mkdir -p "$(dirname "$WORKTREE_DIR")"
+              git --git-dir="$REPOSITORY_DIR" worktree add --detach "$WORKTREE_DIR" "$HEAD_SHA"
+            fi
 
-          git -C "$REPO_DIR" fetch origin main
-          git -C "$REPO_DIR" checkout -B main origin/main
+            flock -u 9
+          fi
 
-          git config --global --add safe.directory "$REPO_DIR"
-          echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"
-          echo "✅ 仓库准备完成"
+          common_dir=$(git -C "$WORKTREE_DIR" rev-parse --path-format=absolute --git-common-dir)
+          if [ "$common_dir" != "$(realpath "$REPOSITORY_DIR")" ]; then
+            echo "发布 Worktree 不属于共享仓库: $WORKTREE_DIR" >&2
+            exit 1
+          fi
 
-      - name: 📦 Build and publish tsl-playbook
+          git -C "$WORKTREE_DIR" checkout --detach --force "$HEAD_SHA"
+          git -C "$WORKTREE_DIR" reset --hard "$HEAD_SHA"
+          git -C "$WORKTREE_DIR" clean -ffdx
+
+          actual_sha=$(git -C "$WORKTREE_DIR" rev-parse HEAD)
+          if [ "$actual_sha" != "$HEAD_SHA" ]; then
+            echo "发布 Worktree 提交不匹配: 期望 $HEAD_SHA，实际 $actual_sha" >&2
+            exit 1
+          fi
+
+          echo "REPOSITORY_DIR=$REPOSITORY_DIR" >> "$GITHUB_ENV"
+          echo "REPO_DIR=$WORKTREE_DIR" >> "$GITHUB_ENV"
+          echo "REPO_NAME=$REPO_NAME" >> "$GITHUB_ENV"
+          echo "发布 Worktree: $WORKTREE_DIR @ $actual_sha"
+
+      - name: 📦 构建并发布 tsl-playbook
         shell: bash
-        env:
-          WORKFLOW: ${{ secrets.WORKFLOW }}
         run: |
           set -euo pipefail
 
-          REPO_DIR="${REPO_DIR:-$(pwd)}"
+          REPO_DIR="${REPO_DIR}"
+          REPOSITORY_DIR="${REPOSITORY_DIR}"
           TARGET_BRANCH="${TARGET_BRANCH:-tsl-playbook}"
           BUILD_SCRIPT="${BUILD_SCRIPT:-scripts/build_tsl_playbook.py}"
 
@@ -85,10 +137,15 @@ jobs:
           git config user.name "$GIT_USER_NAME"
           git config user.email "$GIT_USER_EMAIL"
 
-          source_sha="$(git rev-parse HEAD)"
+          # 校验仍在上游提交，构建的是正确源码。
+          actual_sha="$(git rev-parse HEAD)"
+          if [ "$actual_sha" != "${{ env.SOURCE_SHA }}" ]; then
+            echo "源码 Worktree 不在上游提交: 期望 ${{ env.SOURCE_SHA }}，实际 $actual_sha" >&2
+            exit 1
+          fi
           source_short="$(git rev-parse --short HEAD)"
 
-          # Build the bundle outside the repo so branch checkout cannot clobber it.
+          # 在仓库外构建 bundle，切换分支时不会被清理。
           build_dir="$(mktemp -d)"
           cleanup() {
             rm -rf "$build_dir"
@@ -98,7 +155,7 @@ jobs:
           bundle="$build_dir/tsl-playbook"
           python3 "$BUILD_SCRIPT" --output "$bundle"
 
-          # These are the only paths this workflow owns on the target branch.
+          # 本 workflow 在目标分支上仅拥有以下路径。
           managed_paths=(
             "AGENTS.md"
             "docs/tsl"
@@ -113,11 +170,11 @@ jobs:
             fi
           done
 
-          if git show-ref --verify --quiet "refs/remotes/origin/$TARGET_BRANCH"; then
-            git fetch origin "$TARGET_BRANCH"
-            git checkout -B "$TARGET_BRANCH" "origin/$TARGET_BRANCH"
+          # 目标分支的引用由 Prepare fetch 到共享仓库；此处无需再 fetch。
+          if git --git-dir="$REPOSITORY_DIR" show-ref --verify --quiet "refs/remotes/origin/$TARGET_BRANCH"; then
+            git checkout --force -B "$TARGET_BRANCH" "refs/remotes/origin/$TARGET_BRANCH"
           else
-            # A new orphan branch inherits main's index; clear it without deleting files.
+            # 目标分支尚不存在：创建孤儿分支，清空索引但保留工作树文件。
             git checkout --orphan "$TARGET_BRANCH"
             git rm -rf --cached --quiet . >/dev/null 2>&1 || true
           fi
@@ -137,15 +194,20 @@ jobs:
 
           git commit -m ":package: deps(tsl): sync tsl-playbook from ${source_short}
 
-          Source-Commit: ${source_sha}"
+          Source-Commit: ${{ env.SOURCE_SHA }}"
 
-          git push origin "$TARGET_BRANCH"
+          git -c credential.helper= \
+              -c 'credential.helper=!f() { test "$1" = get || exit 0; printf "%s\n" username=oauth2; printf "%s\n" "password=${ACCESS_TOKEN}"; }; f' \
+              -c credential.interactive=never \
+              push origin "$TARGET_BRANCH"
           echo "✅ Published tsl-playbook @ ${source_short}"
 
-      - name: 🧹 清理临时仓库
+      - name: 🧹 重置 Worktree
         if: always()
+        shell: bash
         run: |
-          if [ -n "${GIT_ASKPASS:-}" ]; then
-            rm -f "$GIT_ASKPASS"
+          # 持久化 worktree 由下次运行前的 detached checkout + reset + clean 复用，
+          # 此处仅在结束时 detach，避免留下已检出的分支阻塞其它 worktree。
+          if [ -n "${REPO_DIR:-}" ] && [ -f "$REPO_DIR/.git" ]; then
+            git -C "$REPO_DIR" checkout --detach --force "${SOURCE_SHA}" 2>/dev/null || true
           fi
-          rm -rf "$REPO_DIR"