ci: trigger internal CI from PR comments

Add the internal CI workflow behind an explicit PR comment command and allow PR authors to trigger both internal CI and Claude review.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Zachary-wW

.github/workflows/claude-review.yml

@@ -22,7 +22,10 @@ jobs:
         github.event_name == 'issue_comment' &&
         github.event.issue.pull_request &&
         github.event.comment.body == '/claude-review' &&
-        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR","CONTRIBUTOR"]'), github.event.comment.author_association)
+        (
+          contains(fromJSON('["OWNER","MEMBER","COLLABORATOR","CONTRIBUTOR"]'), github.event.comment.author_association) ||
+          github.event.comment.user.login == github.event.issue.user.login
+        )
       )
     runs-on: [self-hosted, macOS, ARM64]
     timeout-minutes: 15

.github/workflows/internal-ci.yml

@@ -0,0 +1,245 @@
+name: LoongForge Internal CI
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number (for manual trigger)'
+        required: false
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: internal-ci-pr-${{ github.event.issue.number || inputs.pr_number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-notify:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request &&
+        github.event.comment.body == '/loongforge-ci' &&
+        (
+          contains(fromJSON('["OWNER","MEMBER","COLLABORATOR","CONTRIBUTOR"]'), github.event.comment.author_association) ||
+          github.event.comment.user.login == github.event.issue.user.login
+        )
+      )
+    runs-on: [self-hosted, Linux, X64]
+    steps:
+      - name: Load config
+        run: |
+          set -euo pipefail
+
+          CONFIG_FILE=/home/users/weizhihao/loongforge-ci/.env
+          if [ ! -f "$CONFIG_FILE" ]; then
+            echo "配置文件不存在: $CONFIG_FILE"
+            echo "请先在 017 上创建该文件"
+            exit 1
+          fi
+
+          while IFS= read -r line || [ -n "$line" ]; do
+            case "$line" in
+              ''|'#'*) continue ;;
+            esac
+
+            key="${line%%=*}"
+            value="${line#*=}"
+            if ! printf '%s' "$key" | grep -Eq '^[A-Za-z_][A-Za-z0-9_]*$'; then
+              echo "配置项名称非法: $key"
+              exit 1
+            fi
+
+            echo "::add-mask::$value"
+            printf '%s=%s\n' "$key" "$value" >> "$GITHUB_ENV"
+          done < "$CONFIG_FILE"
+
+          echo "配置已加载"
+
+      - name: Get PR info
+        id: pr-info
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          if [ "${{ github.event_name }}" = "issue_comment" ]; then
+            PR_NUM="${{ github.event.issue.number }}"
+          elif [ -n "${{ inputs.pr_number }}" ]; then
+            PR_NUM="${{ inputs.pr_number }}"
+          else
+            echo "No PR number found"
+            exit 1
+          fi
+
+          PR_DATA=$(gh pr view "$PR_NUM" --json headRefOid,headRefName --repo "$GITHUB_REPOSITORY")
+          BRANCH=$(printf '%s' "$PR_DATA" | jq -r '.headRefName')
+          HEAD_SHA=$(printf '%s' "$PR_DATA" | jq -r '.headRefOid')
+
+          if ! printf '%s' "$PR_NUM" | grep -Eq '^[0-9]+$'; then
+            echo "Invalid PR number: $PR_NUM"
+            exit 1
+          fi
+
+          SHA7=$(printf '%s' "$HEAD_SHA" | cut -c1-7)
+          TIMESTAMP=$(date +%s)
+          SAFE_BRANCH=$(printf '%s' "$BRANCH" | sed 's#[^A-Za-z0-9._-]#_#g' | cut -c1-120)
+
+          echo "pr_num=$PR_NUM" >> "$GITHUB_OUTPUT"
+          echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+          echo "safe_branch=$SAFE_BRANCH" >> "$GITHUB_OUTPUT"
+          echo "head_sha=$HEAD_SHA" >> "$GITHUB_OUTPUT"
+          echo "sha7=$SHA7" >> "$GITHUB_OUTPUT"
+          echo "timestamp=$TIMESTAMP" >> "$GITHUB_OUTPUT"
+          echo "PR #$PR_NUM, branch=$BRANCH, sha7=$SHA7"
+
+      - name: Checkout PR code
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUM: ${{ steps.pr-info.outputs.pr_num }}
+        run: |
+          set -euo pipefail
+
+          mkdir -p "$GITHUB_WORKSPACE"
+          find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+
+          git init "$GITHUB_WORKSPACE"
+          git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/$GITHUB_REPOSITORY.git"
+          git -C "$GITHUB_WORKSPACE" config --local gc.auto 0
+
+          AUTH_HEADER=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')
+          git -C "$GITHUB_WORKSPACE" \
+            -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $AUTH_HEADER" \
+            fetch --no-tags origin "+refs/pull/${PR_NUM}/head:refs/remotes/origin/pr/${PR_NUM}"
+          git -C "$GITHUB_WORKSPACE" checkout --force "refs/remotes/origin/pr/${PR_NUM}"
+          git -C "$GITHUB_WORKSPACE" remote set-url origin "https://github.com/$GITHUB_REPOSITORY.git"
+          git -C "$GITHUB_WORKSPACE" \
+            -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $AUTH_HEADER" \
+            submodule update --init --recursive third_party/Loong-Megatron
+
+      - name: Repack code
+        id: repack
+        run: |
+          set -euo pipefail
+
+          PR_NUM="${{ steps.pr-info.outputs.pr_num }}"
+          STAGING_DIR="/tmp/loongforge_ci_${PR_NUM}"
+          OUTPUT_FILE="/tmp/LoongForge_pr${PR_NUM}.tar.gz"
+          MEGATRON_SHA=$(git ls-tree HEAD third_party/Loong-Megatron 2>/dev/null | awk '{print $3}')
+          echo "Loong-Megatron SHA: ${MEGATRON_SHA:-not found}"
+
+          rm -rf "$STAGING_DIR"
+          mkdir -p "$STAGING_DIR/LoongForge"
+
+          rsync -a --exclude='.git' --exclude='third_party/Loong-Megatron' ./ "$STAGING_DIR/LoongForge/"
+
+          TAR_INPUTS="LoongForge/"
+          if [ -d "third_party/Loong-Megatron" ]; then
+            rsync -a --exclude='.git' ./third_party/Loong-Megatron/ "$STAGING_DIR/Loong-Megatron/"
+            TAR_INPUTS="$TAR_INPUTS Loong-Megatron/"
+          else
+            echo "警告：third_party/Loong-Megatron 不存在，跳过"
+          fi
+
+          tar -czf "$OUTPUT_FILE" -C "$STAGING_DIR" $TAR_INPUTS
+
+          SIZE=$(du -h "$OUTPUT_FILE" | cut -f1)
+          echo "Package size: $SIZE"
+          echo "output_file=$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
+
+      - name: Upload to BOS
+        id: upload
+        run: |
+          set -euo pipefail
+
+          : "${BOS_BUCKET:?BOS_BUCKET is required}"
+          : "${BOS_PATH_PREFIX:?BOS_PATH_PREFIX is required}"
+
+          BOS_PREFIX="${BOS_PATH_PREFIX%/}"
+          BOS_PATH="$BOS_PREFIX/${{ steps.pr-info.outputs.safe_branch }}-${{ steps.pr-info.outputs.sha7 }}-${{ steps.pr-info.outputs.timestamp }}/LoongForge.tar.gz"
+          OUTPUT_FILE="${{ steps.repack.outputs.output_file }}"
+
+          bcecmd bos put "$OUTPUT_FILE" "bos:/$BOS_BUCKET/$BOS_PATH"
+
+          BOS_URL="https://$BOS_BUCKET.bj.bcebos.com/$BOS_PATH"
+          echo "bos_url=$BOS_URL" >> "$GITHUB_OUTPUT"
+          echo "Uploaded to: $BOS_URL"
+
+      - name: Write CI trigger signal
+        run: |
+          set -euo pipefail
+
+          : "${BOS_BUCKET:?BOS_BUCKET is required}"
+          : "${BOS_PATH_PREFIX:?BOS_PATH_PREFIX is required}"
+
+          PR_NUM="${{ steps.pr-info.outputs.pr_num }}"
+          BRANCH="${{ steps.pr-info.outputs.branch }}"
+          SHA7="${{ steps.pr-info.outputs.sha7 }}"
+          TIMESTAMP="${{ steps.pr-info.outputs.timestamp }}"
+          BOS_URL="${{ steps.upload.outputs.bos_url }}"
+          BOS_PREFIX="${BOS_PATH_PREFIX%/}"
+
+          jq -n \
+            --argjson pr_number "$PR_NUM" \
+            --arg branch "$BRANCH" \
+            --arg sha7 "$SHA7" \
+            --arg timestamp "$TIMESTAMP" \
+            --arg bos_url "$BOS_URL" \
+            --arg updated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            '{pr_number:$pr_number,branch:$branch,sha7:$sha7,timestamp:$timestamp,bos_url:$bos_url,status:"pending",updated_at:$updated_at}' \
+            > /tmp/ci_trigger.json
+
+          bcecmd bos put /tmp/ci_trigger.json "bos:/$BOS_BUCKET/$BOS_PREFIX/ci_trigger_pr${PR_NUM}.json"
+
+          echo "CI trigger signal uploaded"
+
+      - name: Notify via Ruliu group
+        if: always()
+        run: |
+          PR_NUM="${{ steps.pr-info.outputs.pr_num }}"
+          BRANCH="${{ steps.pr-info.outputs.branch }}"
+          SHA7="${{ steps.pr-info.outputs.sha7 }}"
+          BOS_URL="${{ steps.upload.outputs.bos_url }}"
+          STATUS="打包上传成功"
+
+          if [ -z "$BOS_URL" ]; then
+            STATUS="打包上传失败"
+            BOS_URL="N/A"
+          fi
+
+          if [ -z "${RULIU_WEBHOOK:-}" ]; then
+            echo "RULIU_WEBHOOK 未配置，跳过通知"
+            exit 0
+          fi
+
+          CONTENT=$(cat <<EOF
+          ##### LoongForge CI 通知
+          **PR**: #${PR_NUM:-N/A}
+          **Branch**: ${BRANCH:-N/A}
+          **Commit**: ${SHA7:-N/A}
+          **状态**: ${STATUS}
+          **BOS_URL**: ${BOS_URL}
+
+          dodo 将自动触发内部流水线，请稍候...
+          EOF
+          )
+          PAYLOAD=$(jq -n --arg content "$CONTENT" '{message:{body:[{type:"MD",content:$content}]}}')
+
+          curl -sS -X POST "$RULIU_WEBHOOK" \
+            -H 'Content-Type: application/json' \
+            -d "$PAYLOAD" || echo "如流通知发送失败（不影响主流程）"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          PR_NUM="${{ steps.pr-info.outputs.pr_num }}"
+          if [ -n "$PR_NUM" ]; then
+            rm -rf "/tmp/loongforge_ci_${PR_NUM}"
+            rm -f "/tmp/LoongForge_pr${PR_NUM}.tar.gz"
+          fi
+          rm -f /tmp/ci_trigger.json