fix: 司马懿 Review M1-M3 修复

M1: runs-on ubuntu-latest → macos-arm64（匹配 act-runner label）
M2: flake8 → ruff（对齐设计文档 §8.4）
M3: ci.yml 排除 main 改为注释说明（main 由 deploy.yml 负责）
S1: deploy.yml 加 coverage report step
S3: pip install -r requirements.txt → -e .[dev]
S4: ci.yml 非 PR 事件 CI 失败改创建 Issue

.gitea/workflows/ci.yml

@@ -1,8 +1,10 @@
 # CI 管道 — moziplus v2.0
 #
 # 触发条件：
-#   - push（非 main 分支）
+#   - push（非 main 分支）→ 快速门控（lint + unit test）
-#   - pull_request（opened, synchronize）
+#   - pull_request（opened, synchronize）→ 同上
+#
+# 注意：main 分支的 CI 由 deploy.yml 负责（完整 CI + 部署）
 #
 # Gitea v1.23.4 限制注意：
 #   - 不支持 failure() 表达式，用 always() + shell 条件判断替代
@@ -23,22 +25,22 @@ on:
 jobs:
   # ── Job 1: Lint ──────────────────────────────────────
   lint:
-    runs-on: ubuntu-latest
+    runs-on: macos-arm64
     steps:
       - uses: actions/checkout@v4
 
       - name: Setup Python
         run: |
           python3 -m venv .venv
-          .venv/bin/pip install --quiet flake8
+          .venv/bin/pip install --quiet ruff
 
-      - name: Lint with flake8
+      - name: Lint with ruff
         run: |
-          .venv/bin/flake8 src/ --max-line-length=120 --extend-ignore=E501
+          .venv/bin/ruff check src/
 
   # ── Job 2: Test ──────────────────────────────────────
   test:
-    runs-on: ubuntu-latest
+    runs-on: macos-arm64
     needs: lint
     steps:
       - uses: actions/checkout@v4
@@ -46,7 +48,7 @@ jobs:
       - name: Setup Python
         run: |
           python3 -m venv .venv
-          .venv/bin/pip install --quiet -r requirements.txt
+          .venv/bin/pip install --quiet -e ".[dev]"
 
       - name: Run tests (exclude E2E)
         run: |
@@ -55,7 +57,7 @@ jobs:
   # ── Job 3: CI 失败通知 ───────────────────────────────
   # v1.23 不支持 failure()，用 always() + shell 检查 commit status 替代
   notify-on-failure:
-    runs-on: ubuntu-latest
+    runs-on: macos-arm64
     needs: [lint, test]
     if: always()
     steps:
@@ -85,7 +87,15 @@ jobs:
                 || echo "Failed to post PR comment"
               echo "PR comment posted."
             else
-              echo "Not a PR event, skipping PR comment."
+              # 非 PR 事件（push 分支），创建 Issue 通知
+              BRANCH="${{ gitea.ref_name }}"
+              curl -sf -X POST \
+                -H "Authorization: token $CI_TOKEN" \
+                -H "Content-Type: application/json" \
+                "${{ gitea.api_url }}/repos/${{ gitea.repository }}/issues" \
+                -d "{\"title\": \"🔴 CI 失败: branch $BRANCH\", \"body\": \"非 main 分支 push CI 失败。\\n\\n触发 commit: \`${{ gitea.sha }}\`\\n分支: $BRANCH\\n\\n请检查 CI 日志并修复。\", \"labels\": [\"bug\"]}" \
+                || echo "Failed to create issue"
+              echo "Issue created for branch push CI failure."
             fi
           else
             echo "CI passed, no notification needed."

.gitea/workflows/deploy.yml

@@ -1,7 +1,9 @@
 # 部署管道 — moziplus v2.0
 #
 # 触发条件：
-#   - push 到 main 分支
+#   - push 到 main 分支 → 完整 CI（lint + test + coverage）+ 部署
+#
+# 注意：非 main 分支的 CI 由 ci.yml 负责（快速门控）
 #
 # Gitea v1.23.4 限制注意：
 #   - 不支持 failure() 表达式
@@ -17,26 +19,30 @@ on:
 jobs:
   # ── Job 1: CI（main 分支跑完整测试）─────────────────
   ci:
-    runs-on: ubuntu-latest
+    runs-on: macos-arm64
     steps:
       - uses: actions/checkout@v4
 
       - name: Setup Python
         run: |
           python3 -m venv .venv
-          .venv/bin/pip install --quiet -r requirements.txt
+          .venv/bin/pip install --quiet -e ".[dev]"
 
       - name: Lint
         run: |
-          .venv/bin/flake8 src/ --max-line-length=120 --extend-ignore=E501
+          .venv/bin/ruff check src/
 
       - name: Unit & Integration Tests
         run: |
           .venv/bin/pytest tests/ -m "not e2e" -x -q
 
+      - name: Coverage Report
+        run: |
+          .venv/bin/pytest tests/ -m "not e2e" --cov=src --cov-report=term-missing -q
+
   # ── Job 2: 部署 ─────────────────────────────────────
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: macos-arm64
     needs: ci
     steps:
       - uses: actions/checkout@v4
@@ -56,13 +62,17 @@ jobs:
           # TODO: 实际部署脚本
           # bash scripts/deploy.sh --source="$GITHUB_WORKSPACE" --target="$HOME/.sanguo_projects/sanguo_moziplus_v2" --health-check
           echo "Deploy placeholder completed."
+          # placeholder: 后续替换为实际部署脚本
+          true
 
       - name: Health check
         run: |
-          echo "=== Health check ==="
+          echo "=== Health check (placeholder) ==="
           # TODO: 等服务启动后做健康检查
           # curl -sf http://localhost:8083/api/health || exit 1
           echo "Health check placeholder passed."
+          # placeholder: 后续替换为实际健康检查
+          true
 
       # ── 失败时回滚 ────────────────────────────────
       # v1.23 不支持 if: failure()
@@ -71,7 +81,7 @@ jobs:
 
   # ── Job 3: 部署失败通知 ──────────────────────────────
   notify-deploy-failure:
-    runs-on: ubuntu-latest
+    runs-on: macos-arm64
     needs: [ci, deploy]
     if: always()
     steps:

.gitea/workflows/e2e.yml

@@ -0,0 +1,106 @@
+# E2E 测试 — moziplus v2.0
+#
+# 触发条件：
+#   - workflow_dispatch（手动触发）
+#
+# 注意：E2E 在 CI 隔离环境中运行（独立 venv + 临时 SQLite + 临时端口 8084），
+#       不污染生产环境。
+#       Agent spawn 走生产 openclaw（全局单例，无法隔离），
+#       测试 case 用 UUID 前缀标识。
+#
+# Gitea v1.23.4 限制注意：
+#   - 不支持 workflow_run 触发器（无法直接 needs 另一个 workflow 的 job）
+#   - 此 workflow 需手动触发或在 deploy.yml 中以 needs 方式调用
+#   - 实际使用时可能需要合并到 deploy.yml 作为同一个 workflow 的 job
+#   - 或依赖 daemon Webhook 监听 deploy 完成事件后通过 API 触发
+
+name: E2E Tests
+
+on:
+  workflow_dispatch:
+    # 手动触发，可选参数
+    inputs:
+      test_filter:
+        description: 'Test filter (e.g. tests/e2e/test_api.py)'
+        required: false
+        default: 'tests/e2e/'
+
+jobs:
+  e2e:
+    runs-on: macos-arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup isolated environment
+        run: |
+          # 创建独立 venv
+          python3 -m venv /tmp/e2e-venv
+          /tmp/e2e-venv/bin/pip install --quiet -e ".[dev]"
+
+          # 创建临时数据目录
+          mkdir -p /tmp/e2e-test-projects
+          mkdir -p /tmp/e2e-test-data
+
+          echo "Isolated environment ready:"
+          echo "  venv: /tmp/e2e-venv"
+          echo "  projects dir: /tmp/e2e-test-projects"
+          echo "  data dir: /tmp/e2e-test-data"
+          echo "  port: 8084 (avoid conflict with production 8083)"
+
+      - name: Start test service
+        env:
+          SANGUO_PROJECTS_DIR: /tmp/e2e-test-projects
+          BLACKBOARD_ROOT: /tmp/e2e-test-data
+          PORT: "8084"
+        run: |
+          # 启动 FastAPI 服务在临时端口
+          /tmp/e2e-venv/bin/python -m uvicorn src.main:app --host 0.0.0.0 --port 8084 &
+          SERVER_PID=$!
+
+          # 等待服务就绪（最多 30 秒）
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:8084/api/health > /dev/null 2>&1; then
+              echo "Test service ready (PID: $SERVER_PID)"
+              break
+            fi
+            if [ $i -eq 30 ]; then
+              echo "ERROR: Test service failed to start within 30 seconds"
+              kill $SERVER_PID 2>/dev/null
+              exit 1
+            fi
+            sleep 1
+          done
+
+          echo "SERVER_PID=$SERVER_PID" >> $GITHUB_ENV
+
+      - name: Run E2E tests
+        env:
+          SANGUO_PROJECTS_DIR: /tmp/e2e-test-projects
+          BLACKBOARD_ROOT: /tmp/e2e-test-data
+          RUN_INTEGRATION: "1"
+          BASE_URL: "http://localhost:8084"
+        run: |
+          TEST_PATH="${{ gitea.event.inputs.test_filter }}"
+          if [ -z "$TEST_PATH" ]; then
+            TEST_PATH="tests/e2e/"
+          fi
+
+          /tmp/e2e-venv/bin/pytest "$TEST_PATH" -x -q \
+            --tb=short \
+            -p no:randomly
+
+      - name: Stop test service
+        if: always()
+        run: |
+          if [ -n "$SERVER_PID" ]; then
+            kill $SERVER_PID 2>/dev/null || true
+            echo "Test service stopped."
+          fi
+
+      - name: Cleanup
+        if: always()
+        run: |
+          rm -rf /tmp/e2e-venv
+          rm -rf /tmp/e2e-test-projects
+          rm -rf /tmp/e2e-test-data
+          echo "Isolated environment cleaned up."