Merge Master

.coveragerc

@@ -0,0 +1,17 @@
+[run]
+source = .
+
+[report]
+omit =
+    */tests/*
+    */migrations/*
+    */__init__.py
+    */settings.py
+    */urls.py
+    */wsgi.py
+    */asgi.py
+    manage.py
+    */.venv/*
+    data_migration/*
+    packages/*
+    weixin/*

.cursor/.cli.json

@@ -0,0 +1,9 @@
+{
+    "permissions": {
+      "deny": [
+        "Shell(git push)",
+        "Shell(gh pr create)",
+        "Write(**)"
+      ]
+    }
+  }

.github/workflows/code_review.yml

@@ -0,0 +1,152 @@
+name: Cursor 代码评审
+
+on:
+  # 使用 pull_request_target 以访问 secrets
+  # 但添加安全检查，只对可信任的贡献者自动运行
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+jobs:
+  # 第一步：安全检查
+  security-check:
+    name: 安全检查
+    runs-on: ubuntu-latest
+    outputs:
+      is_safe: ${{ steps.check.outputs.is_safe }}
+      author_association: ${{ steps.check.outputs.author_association }}
+    steps:
+      - name: 检查贡献者身份
+        id: check
+        run: |
+          echo "作者关联: ${{ github.event.pull_request.author_association }}"
+
+          # 允许的身份：OWNER（所有者）、MEMBER（成员）、COLLABORATOR（协作者）
+          if [[ "${{ github.event.pull_request.author_association }}" == "OWNER" ]] || \
+             [[ "${{ github.event.pull_request.author_association }}" == "MEMBER" ]] || \
+             [[ "${{ github.event.pull_request.author_association }}" == "COLLABORATOR" ]]; then
+            echo "✅ 可信任的贡献者，允许自动审查"
+            echo "is_safe=true" >> $GITHUB_OUTPUT
+          else
+            echo "⚠️ 外部贡献者，需要手动批准"
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+          fi
+          echo "author_association=${{ github.event.pull_request.author_association }}" >> $GITHUB_OUTPUT
+
+  # 第二步：代码审查（只对可信贡献者自动运行）
+  code-review:
+    name: 自动代码审查
+    needs: security-check
+    # 只对可信贡献者自动运行
+    if: needs.security-check.outputs.is_safe == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: 检出仓库
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          # 关键：检出 PR 的代码，而不是默认分支
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: 安装 Cursor CLI
+        run: |
+          curl https://cursor.com/install -fsS | bash
+          echo "$HOME/.cursor/bin" >> $GITHUB_PATH
+
+      - name: 配置 Cursor 认证
+        env:
+          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+        run: |
+          # 创建 Cursor 配置目录
+          mkdir -p "$HOME/.cursor"
+
+          # 验证 API Key 是否存在
+          if [ -z "$CURSOR_API_KEY" ]; then
+            echo "❌ 错误: CURSOR_API_KEY 未设置"
+            echo "请在 GitHub 仓库的 Settings -> Secrets and variables -> Actions 中添加 CURSOR_API_KEY"
+            exit 1
+          fi
+
+          echo "✅ Cursor API Key 已配置"
+
+      - name: 执行代码审查
+        env:
+          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+          GH_TOKEN: ${{ github.token }}
+          MODEL: "claude-4.5-sonnet"
+          # 禁用交互式提示
+          CI: true
+          CURSOR_NO_INTERACTIVE: 1
+        run: |
+          echo "🚀 开始执行 Cursor 代码审查..."
+          echo "📦 Model: $MODEL"
+
+          # 检查 cursor-agent 是否可用
+          if ! command -v cursor-agent &> /dev/null; then
+            echo "❌ cursor-agent 命令未找到"
+            exit 1
+          fi
+
+          # 执行代码审查，捕获输出和错误
+          set +e  # 允许命令失败，不立即退出
+          REVIEW_OUTPUT=$(cursor-agent --force --model "$MODEL" --output-format=text --print "你当前在 GitHub Actions runner 中执行自动化代码审查。gh CLI 可用并已通过 GH_TOKEN 认证。你可以在拉取请求上发表评论。
+
+          上下文：
+          - 仓库：${{ github.repository }}
+          - PR 编号：${{ github.event.pull_request.number }}
+          - PR Head SHA：${{ github.event.pull_request.head.sha }}
+          - PR Base SHA：${{ github.event.pull_request.base.sha }}
+
+          目标：
+          1) 复核已有审查评论，若已处理则回复：已解决
+          2) 审查当前 PR diff，仅标注明确且高严重度的问题
+          3) 只在变更的行留下非常简短的行内评论（1-2 句），并在末尾给出简要总结
+
+          流程：
+          - 获取已有评论：gh pr view --json comments
+          - 获取 diff：gh pr diff
+          - 若先前报告的问题似乎已被附近的更改修复，回复：✅ 此问题似乎已被最近的更改解决
+          - 避免重复：如果同类反馈已在相同行或附近存在，则跳过
+
+          评论规则：
+          - 最多 10 条行内评论；优先处理最关键的问题
+          - 每条评论只包含一个问题；放在准确的变更行
+          - 语气自然，具体且可执行；不要提及自动化或高置信度
+          - 使用表情：🚨 严重 🔒 安全 ⚡ 性能 ⚠️ 逻辑 ✅ 已解决 ✨ 改进
+
+          提交：
+          - 提交一次审查，包含行内评论与简明总结
+          - 仅使用：gh pr review --comment
+          - 不要使用：gh pr review --approve 或 --request-changes" 2>&1)
+          EXIT_CODE=$?
+          set -e  # 恢复错误处理
+
+          # 检查是否遇到 resource_exhausted 错误
+          if [ $EXIT_CODE -ne 0 ]; then
+            # 检查错误输出中是否包含 resource_exhausted 相关错误
+            if echo "$REVIEW_OUTPUT" | grep -qiE "(ConnectError|Error).*resource_exhausted|resource_exhausted.*(Error|ConnectError)"; then
+              echo "⚠️ 检测到 Cursor API 资源耗尽错误 (resource_exhausted)"
+              echo "📋 错误详情："
+              echo "$REVIEW_OUTPUT" | grep -iE "resource_exhausted|ConnectError" | head -5
+              echo ""
+              echo "⏭️ 跳过本次代码审查，等待后续重试"
+              echo "💡 提示：这通常是由于 API 配额限制或临时服务负载过高导致的"
+              exit 0  # 优雅退出，不标记为失败
+            else
+              # 其他错误，正常报错
+              echo "❌ Cursor 代码审查执行失败"
+              echo "📋 错误输出："
+              echo "$REVIEW_OUTPUT"
+              exit $EXIT_CODE
+            fi
+          else
+            # 执行成功，输出结果
+            echo "✅ Cursor 代码审查执行成功"
+            if [ -n "$REVIEW_OUTPUT" ]; then
+              echo "📋 审查结果："
+              echo "$REVIEW_OUTPUT"
+            fi
+          fi

.github/workflows/commitlint.yml

@@ -3,7 +3,7 @@ on: [pull_request]
 
 jobs:
   commitlint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
         with:

.github/workflows/eslint.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   eslint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions/checkout@v2

.github/workflows/flake8_and_black.yml

@@ -12,21 +12,29 @@ on:
 jobs:
   build:
 
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python 3.6
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.6
-    - name: Install dependencies
+    - uses: actions/checkout@v4
+    - name: Install system dependencies (clang)
       run: |
-        python -m pip install --upgrade pip
-        pip install flake8 black
+          sudo apt-get update
+          sudo apt-get install -y clang libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev libffi-dev
+    - name: Install pyenv
+      run: |
+          curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
+    - name: Install system dependencies (python)
+      run: |
+          export PYENV_ROOT="$HOME/.pyenv"
+          export PATH="$PYENV_ROOT/bin:$PATH"
+          eval "$(pyenv init --path)"
+          CC=clang pyenv install 3.6.12 -v
+          sudo ln -sf $PYENV_ROOT/versions/3.6.12/bin/python3.6 /usr/local/bin/python3.6
+          python3.6 -m pip install --upgrade pip
+          python3.6 -m pip install flake8==3.9.2 black==21.12b0
     - name: Lint with flake8
       run: |
-        flake8
+        python3.6 -m flake8
     - name: Format with black
       run: |
-        black .
+        python3.6 -m black .

.github/workflows/unittest.yml

@@ -9,22 +9,32 @@ on:
 jobs:
   build:
 
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       max-parallel: 4
       matrix:
-        python-version: [3.6]
+        python-version: [3.6.12]
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install Dependencies
+    - uses: actions/checkout@v4
+    - name: Install system dependencies (clang)
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y clang libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev libffi-dev
+    - name: Install pyenv
+      run: |
+        curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
+    - name: Install system dependencies (python)
       run: |
-        python -m pip install --upgrade pip
-        pip install -r requirements.txt
+        export PYENV_ROOT="$HOME/.pyenv"
+        export PATH="$PYENV_ROOT/bin:$PATH"
+        eval "$(pyenv init --path)"
+        CC=clang pyenv install 3.6.12 -v
+        sudo ln -sf $PYENV_ROOT/versions/3.6.12/bin/python3.6 /usr/local/bin/python3.6
+    - name: Install modules
+      run: |
+        python3.6 -m pip install --upgrade pip
+        python3.6 -m pip install -r requirements.txt -i https://mirrors.tencent.com/pypi/simple/
     - name: Run Tests
       run: |
         # prepare env
@@ -55,4 +65,14 @@ jobs:
         # rm pipeline tests, we will not longer need it after integrate with bamboo-engine
         rm -rf pipeline/tests
         # run unittest
-        python manage.py test
+        python3.6 -m coverage run manage.py test
+    - name: Coverage export
+      run: |
+        # export xml
+        python3.6 -m coverage xml
+        # print report
+        python3.6 -m coverage report
+    - name: Upload coverage reports to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}

app.yml

@@ -6,7 +6,7 @@ is_use_celery: True
 author: 蓝鲸智云
 introduction: 标准运维是通过一套成熟稳定的任务调度引擎，把在多系统间的工作整合到一个流程，助力运维实现跨系统调度自动化的SaaS应用。
 introduction_en: SOPS is a SaaS application that utilizes a set of mature and stable task scheduling engines to help realize cross-system scheduling automation, and integrates the work among multiple systems into a single process.
-version: 3.32.1-p5
+version: 3.32.8
 category: 运维工具
 language_support: 中文
 desktop:

app_desc.yaml

@@ -1,5 +1,5 @@
 spec_version: 2
-app_version: "3.32.1-p5"
+app_version: "3.32.9"
 app:
     region: default
     bk_app_code: bk_sops
@@ -58,7 +58,7 @@ modules:
                 plan: 4C1G5R
                 replicas: 1
             dworker:
-                command: python manage.py celery worker -Q default -n default@%h -P threads -c 10 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -Q default -n default@%h -P threads -c 20 -l info
                 plan: 4C2G5R
                 replicas: 5
         svc_discovery:
@@ -171,49 +171,52 @@ modules:
             - key: ENABLE_METRICS
               value: 1
               description: 是否启动 metrics server
+            - key: CELERY_RESTART_INTERVAL
+              value: 604800
+              description: Celery worker 基础重启间隔（秒），7天
         processes:
             v1-engine:
-                command: celery worker -A blueapps.core.celery -P threads -Q api_task_queue_pipeline_priority,api_task_queue_service_schedule_priority,periodic_task_queue_pipeline_priority,periodic_task_queue_service_schedule_priority,pipeline,pipeline_priority,service_schedule,service_schedule_priority -n v1_engine@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q api_task_queue_pipeline_priority,api_task_queue_service_schedule_priority,periodic_task_queue_pipeline_priority,periodic_task_queue_service_schedule_priority,pipeline,pipeline_priority,service_schedule,service_schedule_priority -n v1_engine@%h -c 100 -l info
                 plan: 4C1G5R
                 replicas: 2
             api-er-e:
-                command: celery worker -A blueapps.core.celery -P threads -Q er_execute_api -n api_er_e_worker@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q er_execute_api -n api_er_e_worker@%h -c 100 -l info
                 plan: 4C1G5R
                 replicas: 4
             api-er-s:
-                command: celery worker -A blueapps.core.celery -P threads -Q er_schedule_api -n api_er_s_worker@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q er_schedule_api -n api_er_s_worker@%h -c 100 -l info
                 plan: 4C1G5R
                 replicas: 4
             api-task:
-                command: celery worker -A blueapps.core.celery -P threads -Q task_prepare_api -n api_task_worker@%h -c 50 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q task_prepare_api -n api_task_worker@%h -c 50 -l info
                 plan: 4C1G5R
                 replicas: 2
             cworker:
-                command: python manage.py celery worker -Q pipeline_additional_task,pipeline_additional_task_priority,node_auto_retry,timeout_node_execute,timeout_nodes_record,task_callback -n common_worker@%h -P threads -c 6 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q pipeline_additional_task,pipeline_additional_task_priority,node_auto_retry,timeout_node_execute,timeout_nodes_record,task_callback -n common_worker@%h -c 6 -l info
                 plan: 4C1G5R
                 replicas: 2
             er-e:
-                command: celery worker -A blueapps.core.celery -P threads -Q er_execute -n er_e_worker@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q er_execute -n er_e_worker@%h -c 100 -l info
                 plan: 4C2G5R
                 replicas: 2
             er-s:
-                command: celery worker -A blueapps.core.celery -P threads -Q er_schedule -n er_s_worker@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q er_schedule -n er_s_worker@%h -c 100 -l info
                 plan: 4C2G5R
                 replicas: 2
             peri-er-e:
-                command: celery worker -A blueapps.core.celery -P threads -Q er_execute_periodic_task -n peri_er_e_worker@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q er_execute_periodic_task -n peri_er_e_worker@%h -c 100 -l info
                 plan: 4C1G5R
                 replicas: 2
             peri-er-s:
-                command: celery worker -A blueapps.core.celery -P threads -Q er_schedule_periodic_task -n peri_er_s_worker@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q er_schedule_periodic_task -n peri_er_s_worker@%h -c 100 -l info
                 plan: 4C1G5R
                 replicas: 2
             stats-worker:
-                command: celery worker -A blueapps.core.celery -P threads -Q pipeline_statistics_priority -n default@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q pipeline_statistics_priority -n default@%h -c 100 -l info
                 plan: 4C1G5R
                 replicas: 2
             cleaner:
-                command: celery worker -A blueapps.core.celery -P threads -Q task_data_clean -n cleaner_worker@%h -c 100 -l info
+                command: bash bin/celery_auto_restart.sh worker -A blueapps.core.celery -P threads -Q task_data_clean -n cleaner_worker@%h -c 3 -l info
                 plan: 4C1G5R
                 replicas: 2
             web: