Merge pull request #854 from AAEE86/ci/gateway-test-slim-batch1

ci: fix Nightly scope detection in reusable Rust CI

.github/workflows/rust-ci.yml

@@ -2,11 +2,71 @@ name: Rust CI
 
 on:
   workflow_call:
+    inputs:
+      full_scope:
+        description: "Run all Rust and shell scopes, used by Nightly"
+        required: false
+        type: boolean
+        default: false
   push:
     branches:
       - master
       - main
+    paths:
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - ".cargo/**"
+      - "crates/**"
+      - "apps/**"
+      - "*.sql"
+      - "install.sh"
+      - "deploy.sh"
+      - "update.sh"
+      - "generate_keys.sh"
+      - ".env.example"
+      - "README.md"
+      - "Dockerfile.app"
+      - "docker-compose.yml"
+      - "docker-compose.single-node.yml"
+      - "docker-compose.local.yml"
+      - "docker-compose.release-local.yml"
+      - "tests/compose_database_config_test.py"
+      - "tests/install_*_test.sh"
+      - "tests/deploy_*_test.sh"
+      - "tests/update_*_test.sh"
+      - "tests/release_supply_chain_test.sh"
+      - "tests/tunnel_installer_config_security_test.sh"
+      - ".github/workflows/*.yml"
+      - ".github/workflows/*.yaml"
   pull_request:
+    paths:
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - ".cargo/**"
+      - "crates/**"
+      - "apps/**"
+      - "*.sql"
+      - "install.sh"
+      - "deploy.sh"
+      - "update.sh"
+      - "generate_keys.sh"
+      - ".env.example"
+      - "README.md"
+      - "Dockerfile.app"
+      - "docker-compose.yml"
+      - "docker-compose.single-node.yml"
+      - "docker-compose.local.yml"
+      - "docker-compose.release-local.yml"
+      - "tests/compose_database_config_test.py"
+      - "tests/install_*_test.sh"
+      - "tests/deploy_*_test.sh"
+      - "tests/update_*_test.sh"
+      - "tests/release_supply_chain_test.sh"
+      - "tests/tunnel_installer_config_security_test.sh"
+      - ".github/workflows/*.yml"
+      - ".github/workflows/*.yaml"
 
 concurrency:
   group: rust-ci-${{ github.event_name }}-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -36,24 +96,43 @@ jobs:
       - name: Classify changed paths
         id: scope
         shell: bash
+        env:
+          RUST_CI_FULL_SCOPE: ${{ inputs.full_scope || false }}
         run: |
-          # workflow_call（Nightly）仍须完整执行；普通 push/PR 只按源码和构建
+          # 任何命令失败都必须让本 job 失败，否则 git fetch/diff 出错后仍会写出
+          # rust=false/shell=false，下游会误判为“无需测试”而假绿放行。
+          set -euo pipefail
+
+          # Nightly 通过 workflow_call 显式传入 full_scope；普通 push/PR 只按源码和构建
           # 指纹触发 Rust jobs，安装脚本、Compose、README 等由 shell scope 覆盖。
-          if [ "$GITHUB_EVENT_NAME" = "workflow_call" ]; then
+          if [ "$RUST_CI_FULL_SCOPE" = "true" ]; then
             echo "rust=true" >> "$GITHUB_OUTPUT"
             echo "shell=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] \
+            && [ -n "${GITHUB_BASE_REF:-}" ] \
+            && [ -n "${GITHUB_SHA:-}" ]; then
             git fetch --no-tags origin "$GITHUB_BASE_REF" --depth=1
             changed_paths=$(git diff --name-only "origin/$GITHUB_BASE_REF...$GITHUB_SHA")
-          elif [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$GITHUB_EVENT_BEFORE" != "0000000000000000000000000000000000000000" ]; then
+          elif [ "$GITHUB_EVENT_NAME" = "push" ] \
+            && [ -n "${GITHUB_EVENT_BEFORE:-}" ] \
+            && [ "$GITHUB_EVENT_BEFORE" != "0000000000000000000000000000000000000000" ] \
+            && [ -n "${GITHUB_SHA:-}" ]; then
             changed_paths=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA")
           else
             changed_paths=$(git ls-files)
           fi
 
+          # 防御性兜底：diff 结果为空（异常事件或比较失败）时按全量运行，
+          # 宁可多跑也不能漏测。
+          if [ -z "$changed_paths" ]; then
+            echo "rust=true" >> "$GITHUB_OUTPUT"
+            echo "shell=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           rust=false
           shell=false
           while IFS= read -r path; do
@@ -646,6 +725,10 @@ jobs:
     steps:
       - name: Verify database smoke jobs
         run: |
+          if [ "${{ needs.changes.result }}" != "success" ]; then
+            echo "Scope detection failed"
+            exit 1
+          fi
           if [ "${{ needs.changes.outputs.rust }}" != "true" ]; then
             echo "Rust scope unchanged; database smoke jobs skipped"
             exit 0
@@ -669,6 +752,11 @@ jobs:
     steps:
       - name: Verify required jobs
         run: |
+          # changes 失败或未产出 scope 时不允许直接放行，避免假绿。
+          if [ "${{ needs.changes.result }}" != "success" ]; then
+            echo "Scope detection failed"
+            exit 1
+          fi
           rust="${{ needs.changes.outputs.rust }}"
           shell="${{ needs.changes.outputs.shell }}"