🔧 chore(workflows): migrate to prepare + worktree model and merge checks

- add prepare.yml: install tools + maintain shared bare repo, anchors the workflow_run chain
- add checks.yml: merge lint + full test suite into a single workflow_run consumer job
- remove standards-check.yml and test.yml (superseded by checks.yml)
- convert sync-tsl-playbook and update-thirdparty-skills to worktree-model consumers
- unify workflow/job/step display names and emoji

.gitea/workflows/update-thirdparty-skills.yml

@@ -1,19 +1,22 @@
-name: 🪄 Update Third-Party Skills
+name: ♻️ 更新第三方 Skills
 
 on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-  schedule:
-    - cron: "@daily"
+  workflow_run:
+    workflows: ["🧰 准备环境"]
+    types:
+      - completed
 
 concurrency:
   group: update-thirdparty-${{ github.repository }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 env:
-  WORKSPACE_DIR: "/home/workspace"
+  # Prepare 维护共享仓库并读取代码；此处 token 用于 worktree 内的 fetch/push。
+  ACCESS_TOKEN: ${{ secrets.WORKFLOW }}
+  WORKSPACE_ROOT: "/data/workspace"
+  WORKSPACE_SLOT: "thirdparty"
+  SOURCE_BRANCH: ${{ github.event.workflow_run.head_branch }}
+  SOURCE_SHA: ${{ github.event.workflow_run.head_sha }}
   THIRDPARTY_BRANCH: "thirdparty/skill"
   MANIFEST_PATH: ".gitea/ci/thirdparty_skills.json"
   GIT_USER_NAME: "ci[bot]"
@@ -21,39 +24,107 @@ env:
 
 jobs:
   update_and_sync:
-    name: ♻️ Update thirdparty and sync main
-    runs-on: ubuntu-22.04
+    # 仅在 Prepare 于主分支成功后触发（含每日 schedule 触发的 Prepare）。
+    if: ${{ github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'master') }}
+    name: 📥 更新快照并同步 main
+    runs-on: standard-ubuntu-22
+    permissions:
+      contents: write
 
     steps:
-      - name: 🧰 Prepare repo
+      - name: 🔐 验证 Token 配置
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "$ACCESS_TOKEN" ]; then
+            echo "❌ 未配置 WORKFLOW secret，无法 fetch/push" >&2
+            exit 1
+          fi
+          echo "✅ Token 已配置"
+          echo "🌿 上游分支: ${{ env.SOURCE_BRANCH }}"
+          echo "📝 上游提交: ${{ env.SOURCE_SHA }}"
+
+      - name: 📥 对齐 Worktree
+        id: prepare_worktree
         shell: bash
         run: |
           set -euo pipefail
 
-          echo "========================================"
-          echo "📦 Prepare repo in WORKSPACE_DIR"
-          echo "========================================"
-
           REPO_NAME="${{ github.event.repository.name }}"
-          TOKEN="${{ secrets.WORKFLOW }}"
-          mkdir -p "${{ env.WORKSPACE_DIR }}"
-          REPO_DIR="$(mktemp -d "${{ env.WORKSPACE_DIR }}/${REPO_NAME}.XXXXXX")"
-          if [ -n "$TOKEN" ]; then
-            REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${{ github.repository }}.git"
-          else
-            REPO_URL="${GITHUB_SERVER_URL}/${{ github.repository }}.git"
+          HEAD_SHA="${{ env.SOURCE_SHA }}"
+          REPOSITORY_DIR="${WORKSPACE_ROOT}/${REPO_NAME}/repository.git"
+          WORKTREE_DIR="${WORKSPACE_ROOT}/${REPO_NAME}/worktrees/${WORKSPACE_SLOT}"
+          WORKTREE_LOCK="${WORKSPACE_ROOT}/${REPO_NAME}/worktree-admin.lock"
+
+          case "$HEAD_SHA" in
+            ''|*[!0-9a-fA-F]*)
+              echo "无效的上游提交 SHA: $HEAD_SHA" >&2
+              exit 1
+              ;;
+          esac
+          if [ ! -d "$REPOSITORY_DIR" ] || \
+             [ "$(git --git-dir="$REPOSITORY_DIR" rev-parse --is-bare-repository 2>/dev/null)" != "true" ]; then
+            echo "Prepare 未创建有效共享 bare 仓库: $REPOSITORY_DIR" >&2
+            exit 1
+          fi
+          if ! git --git-dir="$REPOSITORY_DIR" cat-file -e "${HEAD_SHA}^{commit}"; then
+            echo "共享仓库中不存在上游提交: $HEAD_SHA" >&2
+            exit 1
           fi
 
-          git clone "$REPO_URL" "$REPO_DIR"
+          # 在共享仓库上配置读取 ACCESS_TOKEN 的凭证助手，供 worktree 内后续
+          # fetch/push 透明鉴权。token 不落盘，助手在 git 调用时从环境读取。
+          # 幂等：同一 runner 复用共享仓库时，credential.helper 已是多值（空值 +
+          # helper），单值写入会报 "cannot overwrite multiple values"；故先 unset
+          # 再用两个 --add 重建（空值清空继承链，再追加读环境的助手）。
+          git --git-dir="$REPOSITORY_DIR" config credential.interactive never
+          git --git-dir="$REPOSITORY_DIR" config --unset-all credential.helper 2>/dev/null || true
+          git --git-dir="$REPOSITORY_DIR" config --add credential.helper ''
+          git --git-dir="$REPOSITORY_DIR" config --add credential.helper '!f() { test "$1" = get || exit 0; printf "%s\n" username=oauth2; printf "%s\n" "password=${ACCESS_TOKEN}"; }; f'
+          # 固化 origin 到无 token 的 HTTPS URL：区域脚本内保留的历史
+          # `git remote set-url origin https://oauth2:$TOKEN@...` 仅在设置了
+          # WORKFLOW env 时才触发；本 job 严禁设置 WORKFLOW，否则 token 会落盘到
+          # 共享 bare 仓库的 config 并污染所有其它 slot。此处显式重置以固化约束。
+          git --git-dir="$REPOSITORY_DIR" remote set-url origin "${{ github.server_url }}/${{ github.repository }}.git"
 
-          git -C "$REPO_DIR" fetch origin main
-          git -C "$REPO_DIR" checkout -B main origin/main
+          if [ ! -f "$WORKTREE_DIR/.git" ]; then
+            exec 9>"$WORKTREE_LOCK"
+            flock 9
 
-          git config --global --add safe.directory "$REPO_DIR"
-          echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"
-          echo "✅ Repo prepared"
+            if [ ! -f "$WORKTREE_DIR/.git" ]; then
+              if [ -e "$WORKTREE_DIR" ]; then
+                echo "Worktree 路径已存在但不是 linked worktree: $WORKTREE_DIR" >&2
+                exit 1
+              fi
+              mkdir -p "$(dirname "$WORKTREE_DIR")"
+              git --git-dir="$REPOSITORY_DIR" worktree add --detach "$WORKTREE_DIR" "$HEAD_SHA"
+            fi
 
-      - name: ♻️ Update thirdparty and sync main
+            flock -u 9
+          fi
+
+          common_dir=$(git -C "$WORKTREE_DIR" rev-parse --path-format=absolute --git-common-dir)
+          if [ "$common_dir" != "$(realpath "$REPOSITORY_DIR")" ]; then
+            echo "Worktree 不属于共享仓库: $WORKTREE_DIR" >&2
+            exit 1
+          fi
+
+          git -C "$WORKTREE_DIR" checkout --detach --force "$HEAD_SHA"
+          git -C "$WORKTREE_DIR" reset --hard "$HEAD_SHA"
+          git -C "$WORKTREE_DIR" clean -ffdx
+
+          actual_sha=$(git -C "$WORKTREE_DIR" rev-parse HEAD)
+          if [ "$actual_sha" != "$HEAD_SHA" ]; then
+            echo "Worktree 提交不匹配: 期望 $HEAD_SHA，实际 $actual_sha" >&2
+            exit 1
+          fi
+
+          echo "REPOSITORY_DIR=$REPOSITORY_DIR" >> "$GITHUB_ENV"
+          echo "REPO_DIR=$WORKTREE_DIR" >> "$GITHUB_ENV"
+          echo "REPO_NAME=$REPO_NAME" >> "$GITHUB_ENV"
+          echo "Worktree: $WORKTREE_DIR @ $actual_sha"
+
+      - name: 📥 更新快照并同步 main
         shell: bash
         run: |
           set -euo pipefail
@@ -562,7 +633,12 @@ jobs:
 
           echo "✅ Update and sync finished."
 
-      - name: 🧹 Clean temporary repo
+      - name: 🧹 重置 Worktree
         if: always()
+        shell: bash
         run: |
-          rm -rf "$REPO_DIR"
+          # 持久化 worktree 由下次运行前的 detached checkout + reset + clean 复用，
+          # 此处仅在结束时 detach，避免留下已检出的分支阻塞其它 worktree。
+          if [ -n "${REPO_DIR:-}" ] && [ -f "$REPO_DIR/.git" ]; then
+            git -C "$REPO_DIR" checkout --detach --force "${SOURCE_SHA}" 2>/dev/null || true
+          fi