ci(alerts): 用固定版本的 promtool 3.15.0 检查告警规则并跑规则单测

.github/workflows/ci.yml

@@ -142,6 +142,25 @@ jobs:
       - run: sh deploy/uninstall_test.sh
       - run: bash deploy/e2e_release_test.sh
 
+  # The shipped alert rules (deploy/alerts): promtool parses them and runs their unit tests,
+  # which pin when each alert fires and that it stays quiet before. internal/metrics'
+  # alerts_test.go pins what promtool cannot see from there: the PrometheusRule twin and the
+  # metric names the rules read.
+  alerts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      # A pinned release, like shellcheck's, so a new Prometheus cannot change what fails.
+      - name: promtool
+        run: |
+          curl -fsSL -o prometheus.tar.gz \
+            https://github.com/prometheus/prometheus/releases/download/v3.15.0/prometheus-3.15.0.linux-amd64.tar.gz
+          echo "2a542df32eac02ee17b9d844fb2aa1de00dafa5476579ba8a3ba862e9d572ea0  prometheus.tar.gz" | sha256sum -c
+          tar -xzf prometheus.tar.gz --strip-components=1 prometheus-3.15.0.linux-amd64/promtool
+          ./promtool check rules deploy/alerts/felis-alerts.yaml
+          ./promtool test rules deploy/alerts/felis-alerts_test.yml
+
   panel:
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yml

@@ -39,9 +39,10 @@ permissions:
 jobs:
   # A tag that ships red is worse than a tag that fails to ship. These are ci.yml's gates,
   # called rather than copied: Go (race, vet, staticcheck), govulncheck, the PostgreSQL
-  # contract suite, shellcheck and the bootstrap tests, the panel, and the Java layer the
+  # contract suite, shellcheck and the bootstrap tests, promtool on the alert rules, the
-  # binary EMBEDS (bootstrap_asset.go ships the plugin sources, so a tag whose plugins do
+  # panel, and the Java layer the binary EMBEDS (bootstrap_asset.go ships the plugin
-  # not compile turns every install of that release into a failed bootstrap).
+  # sources, so a tag whose plugins do not compile turns every install of that release into
+  # a failed bootstrap).
   gates:
     uses: ./.github/workflows/ci.yml