加固部署隔离与备份来源契约（07-26-internal-ops-recovery-baseline）

deploy/trialrun/deploy.sh

@@ -8,6 +8,7 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 DEPLOY_SERVER="${DEPLOY_SERVER:-}"
 REMOTE_DIR="${REMOTE_DIR:-/opt/hyb-oa-trialrun}"
 REMOTE_ENV_FILE="${REMOTE_ENV_FILE:-${REMOTE_DIR}/deploy/trialrun/.env}"
+COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-hyb-oa-trialrun}"
 ENABLE_WORKER="${ENABLE_WORKER:-0}"
 ENABLE_MINIO="${ENABLE_MINIO:-0}"
 SYNC_ENV="${SYNC_ENV:-0}"
@@ -47,6 +48,11 @@ if [[ -z "$DEPLOY_SERVER" ]]; then
   exit 1
 fi
 
+if [[ ! "$COMPOSE_PROJECT_NAME" =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then
+  echo "[ERROR] COMPOSE_PROJECT_NAME 只能包含小写字母、数字、下划线和连字符" >&2
+  exit 1
+fi
+
 if [[ ! -f "${ROOT_DIR}/${PROVENANCE_SCRIPT}" ]]; then
   echo "[ERROR] 缺少 ${PROVENANCE_SCRIPT}" >&2
   exit 1
@@ -137,7 +143,7 @@ fi
 
 echo ">>> 6. 在服务器执行部署与 smoke"
 ssh "${DEPLOY_SERVER}" \
-  "REMOTE_DIR='${REMOTE_DIR}' REMOTE_ENV_FILE='${REMOTE_ENV_FILE}' COMPOSE_FILE='${COMPOSE_FILE}' ENABLE_WORKER='${ENABLE_WORKER}' ENABLE_MINIO='${ENABLE_MINIO}' BUILD_SHA='${SOURCE_COMMIT}' VITE_BUILD_SHA='${SOURCE_SHORT_COMMIT}' bash -s" <<'REMOTE'
+  "REMOTE_DIR='${REMOTE_DIR}' REMOTE_ENV_FILE='${REMOTE_ENV_FILE}' COMPOSE_FILE='${COMPOSE_FILE}' COMPOSE_PROJECT_NAME='${COMPOSE_PROJECT_NAME}' ENABLE_WORKER='${ENABLE_WORKER}' ENABLE_MINIO='${ENABLE_MINIO}' BUILD_SHA='${SOURCE_COMMIT}' VITE_BUILD_SHA='${SOURCE_SHORT_COMMIT}' bash -s" <<'REMOTE'
 set -euo pipefail
 cd "$REMOTE_DIR"
 mkdir -p deploy/trialrun/data/postgres deploy/trialrun/data/storage deploy/trialrun/data/minio
@@ -148,9 +154,9 @@ if [[ ! -f "$REMOTE_ENV_FILE" ]]; then
 fi
 
 if docker compose version >/dev/null 2>&1; then
-  compose_cmd=(docker compose -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE")
+  compose_cmd=(docker compose -p "$COMPOSE_PROJECT_NAME" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE")
 elif command -v docker-compose >/dev/null 2>&1; then
-  compose_cmd=(docker-compose -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE")
+  compose_cmd=(docker-compose -p "$COMPOSE_PROJECT_NAME" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE")
 else
   echo "[ERROR] 远端既没有 docker compose，也没有 docker-compose" >&2
   exit 1
@@ -202,8 +208,10 @@ fi
 ready_ok=0
 for i in $(seq 1 60); do
   if ready_payload="$(curl -fsS "http://127.0.0.1:${server_host_port}/ready" 2>/dev/null)"; then
-    if READY_PAYLOAD="$ready_payload" EXPECTED_BUILD_SHA="${BUILD_SHA:0:12}" node -e '
-      const payload = JSON.parse(process.env.READY_PAYLOAD || "{}");
+    if printf '%s' "$ready_payload" | "${compose_cmd[@]}" exec -T \
+      -e EXPECTED_BUILD_SHA="${BUILD_SHA:0:12}" server node -e '
+      const fs = require("node:fs");
+      const payload = JSON.parse(fs.readFileSync(0, "utf8") || "{}");
       if (payload?.data?.buildSha !== process.env.EXPECTED_BUILD_SHA) process.exit(1);
     '; then
       ready_ok=1