wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 8 软件包 项目 发布 百科 活动

feat(08-08-production-deployment-validation): 增加生产目标与迁移只读门禁

浏览代码
这个提交包含在：
wangsli
2026-08-08 11:11:19 +08:00
父节点 6bfa239410
当前提交 5e2d038938
共修改 6 个文件，包含 965 行新增和 3 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件
deploy/trialrun/deploy-existing.sh
+61
查看文件
@@ -5,6 +5,8 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
DEPLOY_SERVER="${DEPLOY_SERVER:-}" DEPLOY_SERVER="${DEPLOY_SERVER:-}"
DEPLOY_REFRESH_SERVER="${DEPLOY_REFRESH_SERVER:-}" DEPLOY_REFRESH_SERVER="${DEPLOY_REFRESH_SERVER:-}"
DEPLOY_CONTRACT_UNIT="${DEPLOY_CONTRACT_UNIT:-hyb-oa-automatic-backup-daily.service}" DEPLOY_CONTRACT_UNIT="${DEPLOY_CONTRACT_UNIT:-hyb-oa-automatic-backup-daily.service}"
PROVENANCE_SCRIPT="deploy/trialrun/check-source-provenance.mjs"
PRODUCTION_PREFLIGHT_SCRIPT="deploy/trialrun/production-preflight.mjs"
# shellcheck source=deployment-contract-lib.sh # shellcheck source=deployment-contract-lib.sh
source "$ROOT_DIR/deploy/trialrun/deployment-contract-lib.sh" source "$ROOT_DIR/deploy/trialrun/deployment-contract-lib.sh"
@@ -21,6 +23,11 @@ deployment_contract_safe_ssh_target "$DEPLOY_REFRESH_SERVER" \
deployment_contract_safe_service "$DEPLOY_CONTRACT_UNIT" \ deployment_contract_safe_service "$DEPLOY_CONTRACT_UNIT" \
|| fail "DEPLOY_CONTRACT_UNIT 格式无效" || fail "DEPLOY_CONTRACT_UNIT 格式无效"
command -v ssh >/dev/null 2>&1 || fail "缺少 ssh" command -v ssh >/dev/null 2>&1 || fail "缺少 ssh"
command -v node >/dev/null 2>&1 || fail "缺少 node"
if [[ "${DEPLOY_ALLOW_UNPUBLISHED_COMMIT:-0}" == "1" || -n "${DEPLOY_UNPUBLISHED_REASON:-}" ]]; then
fail "生产部署验证不接受未进入上游的提交；灾备 override 必须走独立获批流程"
fi
declare -A contract=() declare -A contract=()
echo "[deploy-existing] 开始只读聚合体检" echo "[deploy-existing] 开始只读聚合体检"
@@ -34,6 +41,43 @@ deployment_contract_load "$DEPLOY_SERVER" "$DEPLOY_CONTRACT_UNIT" contract \
|| fail "无法读取完整既有部署合同" || fail "无法读取完整既有部署合同"
echo "[deploy-existing] 已读取受控 unit 合同；路径与标识不回显" echo "[deploy-existing] 已读取受控 unit 合同；路径与标识不回显"
if [[ -z "${EXPECTED_PRODUCTION_ORIGIN+x}" ]]; then
fail "生产部署必须显式提供 EXPECTED_PRODUCTION_ORIGIN（仅进程环境）"
fi
if [[ -z "${EXPECTED_PRODUCTION_DB_NAME+x}" ]]; then
fail "生产部署必须显式提供 EXPECTED_PRODUCTION_DB_NAME（仅进程环境）"
fi
if [[ -z "${EXPECTED_PENDING_MIGRATIONS+x}" ]]; then
fail "生产部署必须显式提供 EXPECTED_PENDING_MIGRATIONS（可为空）"
fi
[[ -f "$ROOT_DIR/$PROVENANCE_SCRIPT" ]] || fail "缺少发布来源校验脚本"
[[ -f "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT" ]] || fail "缺少生产迁移 preflight 脚本"
echo ">>> 0.1 校验已批准发布来源（生产 preflight 前）"
provenance_json="$(node "$ROOT_DIR/$PROVENANCE_SCRIPT" 2>/dev/null)" \
|| fail "发布来源校验未通过"
source_commit="$(node -e 'const value = JSON.parse(process.argv[1]); process.stdout.write(value.commit || "")' "$provenance_json")" \
|| fail "发布来源提交不可用"
[[ "$source_commit" =~ ^[0-9a-f]{40,64}$ ]] || fail "发布来源提交格式无效"
echo ">>> 0.2 生产目标与迁移 preflight（只读，先于 deploy.sh）"
PRODUCTION_PREFLIGHT_REPORT_ROOT="${PRODUCTION_PREFLIGHT_REPORT_ROOT:-artifacts/production-preflight-$(date +%Y%m%d-%H%M%S)}"
EXPECTED_PRODUCTION_ORIGIN="$EXPECTED_PRODUCTION_ORIGIN" \
EXPECTED_PRODUCTION_DB_NAME="$EXPECTED_PRODUCTION_DB_NAME" \
EXPECTED_PENDING_MIGRATIONS="$EXPECTED_PENDING_MIGRATIONS" \
DEPLOY_SERVER="$DEPLOY_SERVER" \
REMOTE_DIR="${contract[REMOTE_DIR]}" \
REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \
COMPOSE_FILE="${contract[COMPOSE_FILE]}" \
COMPOSE_PROJECT_NAME="${contract[COMPOSE_PROJECT_NAME]}" \
POSTGRES_DATA_DIR="${contract[POSTGRES_DATA_DIR]}" \
STORAGE_HOST_DIR="${contract[STORAGE_HOST_DIR]}" \
CANDIDATE_COMMIT="$source_commit" \
PRODUCTION_PREFLIGHT_REPORT_DIR="$PRODUCTION_PREFLIGHT_REPORT_ROOT/pre" \
node "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT" \
|| fail "生产目标或迁移 preflight 未通过；未进入 deploy.sh"
DEPLOY_SERVER="$DEPLOY_SERVER" \ DEPLOY_SERVER="$DEPLOY_SERVER" \
REMOTE_DIR="${contract[REMOTE_DIR]}" \ REMOTE_DIR="${contract[REMOTE_DIR]}" \
REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \ REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \
@@ -43,9 +87,26 @@ POSTGRES_DATA_DIR="${contract[POSTGRES_DATA_DIR]}" \
STORAGE_HOST_DIR="${contract[STORAGE_HOST_DIR]}" \ STORAGE_HOST_DIR="${contract[STORAGE_HOST_DIR]}" \
DEPLOY_DATA_MODE=existing \ DEPLOY_DATA_MODE=existing \
DEPLOY_DEFER_FINAL_SUCCESS=1 \ DEPLOY_DEFER_FINAL_SUCCESS=1 \
DEPLOY_STATUS_OUTPUT_MODE=quiet \
SYNC_ENV=0 \ SYNC_ENV=0 \
bash "$ROOT_DIR/deploy/trialrun/deploy.sh" bash "$ROOT_DIR/deploy/trialrun/deploy.sh"
echo ">>> 6.1 部署后 migration status 与目标只读复核"
EXPECTED_PRODUCTION_ORIGIN="$EXPECTED_PRODUCTION_ORIGIN" \
EXPECTED_PRODUCTION_DB_NAME="$EXPECTED_PRODUCTION_DB_NAME" \
EXPECTED_PENDING_MIGRATIONS="" \
DEPLOY_SERVER="$DEPLOY_SERVER" \
REMOTE_DIR="${contract[REMOTE_DIR]}" \
REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \
COMPOSE_FILE="${contract[COMPOSE_FILE]}" \
COMPOSE_PROJECT_NAME="${contract[COMPOSE_PROJECT_NAME]}" \
POSTGRES_DATA_DIR="${contract[POSTGRES_DATA_DIR]}" \
STORAGE_HOST_DIR="${contract[STORAGE_HOST_DIR]}" \
CANDIDATE_COMMIT="$source_commit" \
PRODUCTION_PREFLIGHT_REPORT_DIR="$PRODUCTION_PREFLIGHT_REPORT_ROOT/post" \
node "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT" \
|| fail "部署后迁移 status/目标复核失败；应用已部署但未进入合同 refresh"
refresh_output="" refresh_output=""
refresh_status=0 refresh_status=0
if refresh_output="$(ssh "$DEPLOY_REFRESH_SERVER" refresh 2>/dev/null)"; then if refresh_output="$(ssh "$DEPLOY_REFRESH_SERVER" refresh 2>/dev/null)"; then
deploy/trialrun/deploy.sh
+13 -2
查看文件
@@ -16,6 +16,7 @@ ENABLE_WORKER="${ENABLE_WORKER:-0}"
ENABLE_MINIO="${ENABLE_MINIO:-0}" ENABLE_MINIO="${ENABLE_MINIO:-0}"
SYNC_ENV="${SYNC_ENV:-0}" SYNC_ENV="${SYNC_ENV:-0}"
DEPLOY_DEFER_FINAL_SUCCESS="${DEPLOY_DEFER_FINAL_SUCCESS:-0}" DEPLOY_DEFER_FINAL_SUCCESS="${DEPLOY_DEFER_FINAL_SUCCESS:-0}"
DEPLOY_STATUS_OUTPUT_MODE="${DEPLOY_STATUS_OUTPUT_MODE:-verbose}"
COMPOSE_FILE="deploy/trialrun/docker-compose.yml" COMPOSE_FILE="deploy/trialrun/docker-compose.yml"
LOCAL_ENV_FILE="deploy/trialrun/.env" LOCAL_ENV_FILE="deploy/trialrun/.env"
ENV_CONTRACT_SCRIPT="deploy/trialrun/validate-env-contract.js" ENV_CONTRACT_SCRIPT="deploy/trialrun/validate-env-contract.js"
@@ -97,6 +98,10 @@ if [[ "$DEPLOY_DEFER_FINAL_SUCCESS" != "0" && "$DEPLOY_DEFER_FINAL_SUCCESS" != "
echo "[ERROR] DEPLOY_DEFER_FINAL_SUCCESS 只能为 0 或 1" >&2 echo "[ERROR] DEPLOY_DEFER_FINAL_SUCCESS 只能为 0 或 1" >&2
exit 1 exit 1
fi fi
if [[ "$DEPLOY_STATUS_OUTPUT_MODE" != "quiet" && "$DEPLOY_STATUS_OUTPUT_MODE" != "verbose" ]]; then
echo "[ERROR] DEPLOY_STATUS_OUTPUT_MODE 只能为 quiet 或 verbose" >&2
exit 1
fi
if paths_overlap "$REMOTE_DIR" "$POSTGRES_DATA_DIR"; then if paths_overlap "$REMOTE_DIR" "$POSTGRES_DATA_DIR"; then
echo "[ERROR] POSTGRES_DATA_DIR 不得与 REMOTE_DIR 同目录或相互嵌套，避免源码同步触碰数据库" >&2 echo "[ERROR] POSTGRES_DATA_DIR 不得与 REMOTE_DIR 同目录或相互嵌套，避免源码同步触碰数据库" >&2
exit 1 exit 1
@@ -216,7 +221,7 @@ fi
echo ">>> 6. 在服务器执行部署与 smoke" echo ">>> 6. 在服务器执行部署与 smoke"
ssh "${DEPLOY_SERVER}" \ ssh "${DEPLOY_SERVER}" \
"REMOTE_DIR='${REMOTE_DIR}' REMOTE_ENV_FILE='${REMOTE_ENV_FILE}' COMPOSE_FILE='${COMPOSE_FILE}' COMPOSE_PROJECT_NAME='${COMPOSE_PROJECT_NAME}' POSTGRES_DATA_DIR='${POSTGRES_DATA_DIR}' STORAGE_HOST_DIR='${STORAGE_HOST_DIR}' DEPLOY_DATA_MODE='${DEPLOY_DATA_MODE}' ENABLE_WORKER='${ENABLE_WORKER}' ENABLE_MINIO='${ENABLE_MINIO}' BUILD_SHA='${SOURCE_COMMIT}' VITE_BUILD_SHA='${SOURCE_SHORT_COMMIT}' bash -s" <<'REMOTE' "REMOTE_DIR='${REMOTE_DIR}' REMOTE_ENV_FILE='${REMOTE_ENV_FILE}' COMPOSE_FILE='${COMPOSE_FILE}' COMPOSE_PROJECT_NAME='${COMPOSE_PROJECT_NAME}' POSTGRES_DATA_DIR='${POSTGRES_DATA_DIR}' STORAGE_HOST_DIR='${STORAGE_HOST_DIR}' DEPLOY_DATA_MODE='${DEPLOY_DATA_MODE}' ENABLE_WORKER='${ENABLE_WORKER}' ENABLE_MINIO='${ENABLE_MINIO}' DEPLOY_STATUS_OUTPUT_MODE='${DEPLOY_STATUS_OUTPUT_MODE}' BUILD_SHA='${SOURCE_COMMIT}' VITE_BUILD_SHA='${SOURCE_SHORT_COMMIT}' bash -s" <<'REMOTE'
set -euo pipefail set -euo pipefail
cd "$REMOTE_DIR" cd "$REMOTE_DIR"
@@ -280,7 +285,13 @@ if [[ "$ENABLE_WORKER" == "1" ]]; then
fi fi
echo ">>> 4.6 校验 Prisma migration status" echo ">>> 4.6 校验 Prisma migration status"
if ! "${compose_cmd[@]}" exec -T server sh -lc 'cd /app/server && npx prisma migrate status' </dev/null; then if [[ "${DEPLOY_STATUS_OUTPUT_MODE:-verbose}" == "quiet" ]]; then
if ! "${compose_cmd[@]}" exec -T server sh -lc 'cd /app/server && npx prisma migrate status' </dev/null >/dev/null 2>&1; then
echo "[ERROR] Prisma migration status 未通过，停止部署（详情留在受控 preflight 现场）" >&2
exit 1
fi
echo "[PASS] Prisma migration status 命令完成（详情留在受控 preflight 现场）"
elif ! "${compose_cmd[@]}" exec -T server sh -lc 'cd /app/server && npx prisma migrate status' </dev/null; then
echo "[ERROR] Prisma migration status 未通过，停止部署" >&2 echo "[ERROR] Prisma migration status 未通过，停止部署" >&2
"${compose_cmd[@]}" logs --tail=200 server || true "${compose_cmd[@]}" logs --tail=200 server || true
exit 1 exit 1
deploy/trialrun/production-preflight-remote.sh
可执行文件
+280
查看文件
@@ -0,0 +1,280 @@
#!/usr/bin/env bash
# Read-only production target and migration gate. This script deliberately
# runs before deploy.sh is allowed to synchronize or execute migrate deploy.
set -euo pipefail
fail() {
printf '[production-preflight][FAIL] code=%s\n' "$1" >&2
exit 1
}
pass() {
printf '[production-preflight][PASS] %s\n' "$1"
}
for key in REMOTE_DIR REMOTE_ENV_FILE COMPOSE_FILE COMPOSE_PROJECT_NAME \
POSTGRES_DATA_DIR STORAGE_HOST_DIR EXPECTED_PRODUCTION_ORIGIN_SHA256 \
EXPECTED_PRODUCTION_DB_NAME_SHA256 CANDIDATE_MIGRATIONS_CSV \
EXPECTED_PENDING_MIGRATIONS_CSV; do
[[ -n "${!key:-}" || "$key" == "EXPECTED_PENDING_MIGRATIONS_CSV" ]] \
|| fail "${key}_MISSING"
done
[[ "$EXPECTED_PRODUCTION_ORIGIN_SHA256" =~ ^[0-9a-f]{64}$ ]] \
|| fail "PROD_TARGET_ORIGIN_HASH_INVALID"
[[ "$EXPECTED_PRODUCTION_DB_NAME_SHA256" =~ ^[0-9a-f]{64}$ ]] \
|| fail "PROD_TARGET_DB_HASH_INVALID"
cd "$REMOTE_DIR"
[[ -f "$REMOTE_ENV_FILE" && ! -L "$REMOTE_ENV_FILE" && -r "$REMOTE_ENV_FILE" ]] \
|| fail "PROD_TARGET_ENV_UNREADABLE"
dotenv_value() {
local key="$1"
local value
value="$(awk -v wanted="$key" '
$0 !~ /^[[:space:]]*#/ && $0 ~ "^[[:space:]]*" wanted "=" {
sub("^[[:space:]]*" wanted "=", "")
print
exit
}
' "$REMOTE_ENV_FILE")" || return 1
value="${value%$'\r'}"
case "$value" in
\"*\") value="${value:1:${#value}-2}" ;;
\'*\') value="${value:1:${#value}-2}" ;;
esac
printf '%s' "$value"
}
hash_text() {
if command -v sha256sum >/dev/null 2>&1; then
printf '%s' "$1" | sha256sum | awk '{print $1}'
return 0
fi
if command -v shasum >/dev/null 2>&1; then
printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
return 0
fi
return 1
}
reject_non_production_identity() {
local value="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
[[ "$value" != *"<"* && "$value" != *">"* ]] || return 1
[[ "$value" != *"localhost"* && "$value" != *"127.0.0.1"* \
&& "$value" != *"::1"* && "$value" != *"hyb_oa_regression"* \
&& "$value" != *"trialrun"* && "$value" != *"staging"* \
&& "$value" != *"stage"* && "$value" != *"regression"* \
&& "$value" != *"shadow"* && "$value" != *"/test"* ]]
}
reject_non_production_host() {
local value="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
case "$value" in
localhost|localhost:*|127.*|0.*|::|::1|::1:*|\[::\]|\[::1\]|*::ffff:*)
return 1
;;
esac
reject_non_production_identity "$value"
}
actual_origin="$(dotenv_value APP_ORIGIN)" || fail "PROD_TARGET_ORIGIN_MISSING"
actual_db_name="$(dotenv_value POSTGRES_DB)" || fail "PROD_TARGET_DB_NAME_MISSING"
node_env="$(dotenv_value NODE_ENV)" || fail "PROD_TARGET_NODE_ENV_MISSING"
cookie_secure="$(dotenv_value COOKIE_SECURE)" || fail "PROD_TARGET_COOKIE_SECURE_MISSING"
[[ "$(hash_text "$actual_origin")" == "$EXPECTED_PRODUCTION_ORIGIN_SHA256" ]] \
|| fail "PROD_TARGET_ORIGIN_MISMATCH"
[[ "$(hash_text "$actual_db_name")" == "$EXPECTED_PRODUCTION_DB_NAME_SHA256" ]] \
|| fail "PROD_TARGET_DB_NAME_MISMATCH"
[[ "$node_env" == "production" ]] || fail "PROD_TARGET_NODE_ENV_NOT_PRODUCTION"
[[ "$cookie_secure" == "true" ]] || fail "PROD_TARGET_COOKIE_SECURE_NOT_TRUE"
case "$actual_origin" in
https://*) ;;
*) fail "PROD_TARGET_ORIGIN_NOT_HTTPS" ;;
esac
origin_host="${actual_origin#https://}"
[[ "$origin_host" != */* && "$origin_host" != *"?"* && "$origin_host" != *"#"* ]] \
|| fail "PROD_TARGET_ORIGIN_NOT_ORIGIN_ONLY"
reject_non_production_host "$origin_host" \
|| fail "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY"
reject_non_production_identity "$actual_db_name" \
|| fail "PROD_TARGET_DB_NON_PRODUCTION_IDENTITY"
if docker compose version >/dev/null 2>&1; then
compose_cmd=(docker compose -p "$COMPOSE_PROJECT_NAME" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE")
elif command -v docker-compose >/dev/null 2>&1; then
compose_cmd=(docker-compose -p "$COMPOSE_PROJECT_NAME" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE")
else
fail "PROD_TARGET_COMPOSE_UNAVAILABLE"
fi
"${compose_cmd[@]}" config >/dev/null 2>&1 || fail "PROD_TARGET_COMPOSE_CONFIG_INVALID"
container_ids() {
docker ps \
--filter "label=com.docker.compose.project=$COMPOSE_PROJECT_NAME" \
--filter "label=com.docker.compose.service=$1" \
--format '{{.ID}}'
}
mapfile -t server_ids < <(container_ids server 2>/dev/null || true)
mapfile -t db_ids < <(container_ids db 2>/dev/null || true)
[[ "${#server_ids[@]}" -eq 1 && "${#db_ids[@]}" -eq 1 ]] \
|| fail "PROD_TARGET_RUNTIME_NOT_UNIQUE"
server_id="${server_ids[0]}"
container_env() {
docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' "$1" \
| sed -n "s/^$2=//p" | tail -n 1
}
[[ "$(container_env "$server_id" NODE_ENV)" == "production" ]] \
|| fail "PROD_TARGET_RUNTIME_NODE_ENV_NOT_PRODUCTION"
[[ "$(container_env "$server_id" COOKIE_SECURE)" == "true" ]] \
|| fail "PROD_TARGET_RUNTIME_COOKIE_SECURE_NOT_TRUE"
[[ "$(hash_text "$(container_env "$server_id" APP_ORIGIN)")" == "$EXPECTED_PRODUCTION_ORIGIN_SHA256" ]] \
|| fail "PROD_TARGET_RUNTIME_ORIGIN_MISMATCH"
postgres_user="$(dotenv_value POSTGRES_USER)" || fail "PROD_TARGET_DB_USER_MISSING"
postgres_db="$(dotenv_value POSTGRES_DB)" || fail "PROD_TARGET_DB_NAME_MISSING"
db_value() {
local sql="$1"
"${compose_cmd[@]}" exec -T db psql -X -U "$postgres_user" -d "$postgres_db" -At -F '|' -c "$sql" </dev/null 2>/dev/null
}
runtime_db_name="$(db_value 'SELECT current_database();' | tr -d '\r\n')" \
|| fail "PROD_DB_IDENTITY_UNAVAILABLE"
[[ "$(hash_text "$runtime_db_name")" == "$EXPECTED_PRODUCTION_DB_NAME_SHA256" ]] \
|| fail "PROD_DB_IDENTITY_MISMATCH"
database_url_identity="$("${compose_cmd[@]}" exec -T server node -e '
try {
const url = new URL(process.env.DATABASE_URL || "");
if (!["postgres:", "postgresql:"].includes(url.protocol)) process.exit(1);
const database = decodeURIComponent(url.pathname.replace(/^\/+/, "").split("?")[0]);
if (!url.hostname || !database) process.exit(1);
process.stdout.write(`${url.hostname}\n${database}`);
} catch {
process.exit(1);
}
' </dev/null 2>/dev/null)" \
|| fail "PROD_DATABASE_URL_IDENTITY_UNAVAILABLE"
database_url_host="${database_url_identity%%$'\n'*}"
database_url_db="${database_url_identity#*$'\n'}"
[[ "$database_url_identity" == *$'\n'* && -n "$database_url_host" && -n "$database_url_db" ]] \
|| fail "PROD_DATABASE_URL_IDENTITY_UNAVAILABLE"
reject_non_production_host "$database_url_host" \
|| fail "PROD_DATABASE_URL_HOST_NON_PRODUCTION_IDENTITY"
[[ "$(hash_text "$database_url_db")" == "$EXPECTED_PRODUCTION_DB_NAME_SHA256" ]] \
|| fail "PROD_DATABASE_URL_IDENTITY_MISMATCH"
pass "target_identity_and_database_identity"
# Required pre-write status gate. No deploy, seed, app switch or business
# write may run before this command completes and its raw output is captured.
set +e
prisma_status_output="$("${compose_cmd[@]}" exec -T server sh -lc 'cd /app/server && npx prisma migrate status' </dev/null 2>&1)"
prisma_status_code=$?
set -e
printf '[production-preflight][PRISMA_STATUS_BEGIN]\n'
printf '%s\n' "$prisma_status_output"
printf '[production-preflight][PRISMA_STATUS_END] exit=%s\n' "$prisma_status_code"
if printf '%s' "$prisma_status_output" | grep -Eiq 'failed migration|migration(s)? have failed|migration failed|rolled back|diverged|drift|could not find migration|database schema is not in sync'; then
fail "PROD_MIGRATION_STATUS_UNSAFE"
fi
if ! printf '%s' "$prisma_status_output" \
| grep -Eiq 'Database schema is up to date|have not yet been applied|No pending migrations'; then
fail "PROD_MIGRATION_STATUS_UNREADABLE"
fi
if [[ "$prisma_status_code" -ne 0 ]] \
&& ! printf '%s' "$prisma_status_output" | grep -Eiq 'have not yet been applied'; then
fail "PROD_MIGRATION_STATUS_UNREADABLE"
fi
declare -a status_pending_ids=()
if printf '%s' "$prisma_status_output" | grep -Eiq 'have not yet been applied'; then
status_pending_text="$(printf '%s\n' "$prisma_status_output" | awk '
tolower($0) ~ /have not yet been applied/ { capture=1; next }
capture { print }
' || true)"
mapfile -t status_pending_ids < <(
printf '%s\n' "$status_pending_text" \
| grep -oE '[0-9]{14}_[A-Za-z0-9_]+' \
| sort -u || true
)
[[ "${#status_pending_ids[@]}" -gt 0 ]] || fail "PROD_MIGRATION_STATUS_PENDING_IDS_UNREADABLE"
fi
migration_rows="$(db_value '
SELECT migration_name,
CASE
WHEN rolled_back_at IS NOT NULL THEN '\''rolled_back'\''
WHEN logs IS NOT NULL AND btrim(logs) <> '\'''\'' THEN '\''logged_failure'\''
WHEN finished_at IS NULL THEN '\''unfinished'\''
ELSE '\''applied'\''
END
FROM "_prisma_migrations"
ORDER BY migration_name;
' | tr -d '\r')" || fail "PROD_MIGRATION_TABLE_UNAVAILABLE"
[[ -n "$migration_rows" ]] || fail "PROD_MIGRATION_TABLE_EMPTY"
declare -A candidate_set=()
declare -A applied_set=()
declare -A seen_db_migrations=()
IFS=',' read -r -a candidate_ids <<<"$CANDIDATE_MIGRATIONS_CSV"
for migration in "${candidate_ids[@]}"; do
[[ "$migration" =~ ^[0-9]{14}_[A-Za-z0-9_]+$ ]] || fail "CANDIDATE_MIGRATION_ID_INVALID"
[[ -z "${candidate_set[$migration]:-}" ]] || fail "CANDIDATE_MIGRATION_DUPLICATE"
candidate_set["$migration"]=1
done
[[ "${#candidate_ids[@]}" -gt 0 ]] || fail "CANDIDATE_MIGRATION_MANIFEST_EMPTY"
abnormal_count=0
while IFS='|' read -r migration state; do
[[ -n "$migration" ]] || continue
[[ -z "${seen_db_migrations[$migration]:-}" ]] || fail "PROD_MIGRATION_DUPLICATE_HISTORY"
seen_db_migrations["$migration"]=1
if [[ "$state" == "applied" ]]; then
applied_set["$migration"]=1
else
abnormal_count=$((abnormal_count + 1))
fi
[[ -n "${candidate_set[$migration]:-}" ]] || fail "PROD_MIGRATION_UNKNOWN_APPLIED"
done <<<"$migration_rows"
[[ "$abnormal_count" -eq 0 ]] || fail "PROD_MIGRATION_FAILED_OR_ROLLED_BACK"
# Before rsync/deploy the running image may not contain newly committed
# migration directories. The SQL candidate-vs-applied diff is therefore the
# allowlist authority; status IDs are only used to reject unknown pending work.
if [[ "${#status_pending_ids[@]}" -gt 0 ]]; then
for migration in "${status_pending_ids[@]}"; do
[[ "$migration" =~ ^[0-9]{14}_[A-Za-z0-9_]+$ ]] || fail "PROD_MIGRATION_STATUS_PENDING_ID_INVALID"
[[ -n "${candidate_set[$migration]:-}" ]] || fail "PROD_MIGRATION_STATUS_UNKNOWN_PENDING"
done
fi
pending_ids=()
for migration in "${candidate_ids[@]}"; do
[[ -n "${applied_set[$migration]:-}" ]] || pending_ids+=("$migration")
done
actual_pending_csv=""
if [[ "${#pending_ids[@]}" -gt 0 ]]; then
actual_pending_csv="$(printf '%s\n' "${pending_ids[@]}" | sort | paste -sd, -)"
fi
expected_pending_csv="$(printf '%s' "$EXPECTED_PENDING_MIGRATIONS_CSV" | tr ',' '\n' | sed '/^$/d' | sort | paste -sd, -)"
[[ "$actual_pending_csv" == "$expected_pending_csv" ]] \
|| fail "PROD_MIGRATION_PENDING_ALLOWLIST_MISMATCH"
pass "migration_reconciliation pending=${actual_pending_csv:-none}"
terminated_count="$(db_value "SELECT count(*) FROM contract_registry WHERE status = 'terminated';" | tr -d '\r\n')" \
|| fail "PROD_TERMINATED_COUNT_UNAVAILABLE"
[[ "$terminated_count" =~ ^[0-9]+$ ]] || fail "PROD_TERMINATED_COUNT_INVALID"
if [[ "$terminated_count" -eq 0 ]]; then
pass "rollbackWindow=OPEN terminatedRows=0"
else
pass "rollbackWindow=CLOSED terminatedRows=${terminated_count}"
fi
pass "migration_status_and_target_checks_complete"
deploy/trialrun/production-preflight.mjs
可执行文件
+316
查看文件
@@ -0,0 +1,316 @@
#!/usr/bin/env node
import { createHash } from "node:crypto";
import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
import { spawnSync } from "node:child_process";
import { isIP } from "node:net";
import path from "node:path";
import process from "node:process";
import { fileURLToPath, pathToFileURL } from "node:url";
const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
const ROOT_DIR = path.resolve(SCRIPT_DIR, "../..");
const REMOTE_SCRIPT = path.join(SCRIPT_DIR, "production-preflight-remote.sh");
const MIGRATION_ID_PATTERN = /^\d{14}_[A-Za-z0-9_]+$/u;
const SSH_TARGET_PATTERN = /^(?:[A-Za-z0-9._-]+@)?[A-Za-z0-9._-]+$/u;
const SAFE_ABSOLUTE_PATH_PATTERN = /^\/[A-Za-z0-9._/-]+$/u;
const SAFE_COMPOSE_FILE_PATTERN = /^[A-Za-z0-9._/-]+$/u;
const SAFE_PROJECT_PATTERN = /^[a-z0-9][a-z0-9_-]*$/u;
const FORBIDDEN_IDENTITY_TOKEN_PATTERN = /(^|[._-])(local|localhost|dev|development|test|testing|stage|staging|trialrun|regression|shadow|example)([._-]|$)/u;
const PRISMA_STATUS_KNOWN_PATTERN = /(?:database schema is up to date|have not yet been applied|no pending migrations)/iu;
export class ProductionPreflightError extends Error {
constructor(code) {
super(code);
this.name = "ProductionPreflightError";
this.code = code;
}
}
function fail(code) {
throw new ProductionPreflightError(code);
}
function isNonProductionHost(input) {
const host = String(input ?? "").trim().toLowerCase().replace(/^\[|\]$/gu, "");
if (!host) return true;
if (host === "localhost" || host === "::" || host === "::1" || host.startsWith("::ffff:")) {
return true;
}
const version = isIP(host);
if (version === 4) {
const firstOctet = Number(host.split(".")[0]);
return firstOctet === 0 || firstOctet === 127;
}
return false;
}
export function validateProductionOrigin(input) {
const raw = String(input ?? "").trim();
let url;
try {
url = new URL(raw);
} catch {
fail("PROD_TARGET_ORIGIN_INVALID");
}
if (url.protocol !== "https:" || url.username || url.password) {
fail("PROD_TARGET_ORIGIN_NOT_HTTPS");
}
const host = url.hostname.toLowerCase();
if (
isNonProductionHost(host) ||
host.includes("example") ||
FORBIDDEN_IDENTITY_TOKEN_PATTERN.test(host)
) {
fail("PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY");
}
if (url.pathname !== "/" || url.search || url.hash || raw !== url.origin) {
fail("PROD_TARGET_ORIGIN_NOT_ORIGIN_ONLY");
}
return url.origin;
}
export function validateProductionDbName(input) {
const raw = String(input ?? "").trim();
if (!/^[A-Za-z][A-Za-z0-9_-]{0,62}$/u.test(raw)) {
fail("PROD_TARGET_DB_NAME_INVALID");
}
if (raw.includes("<") || raw.includes(">") || FORBIDDEN_IDENTITY_TOKEN_PATTERN.test(raw.toLowerCase())) {
fail("PROD_TARGET_DB_NON_PRODUCTION_IDENTITY");
}
return raw;
}
export function parseMigrationList(input, { field, allowEmpty = true } = {}) {
const raw = String(input ?? "").trim();
if (!raw && allowEmpty) return [];
if (!raw && !allowEmpty) fail(`${field}_MISSING`);
const values = raw.split(/[\s,]+/u).filter(Boolean);
const seen = new Set();
for (const value of values) {
if (!MIGRATION_ID_PATTERN.test(value)) fail(`${field}_INVALID`);
if (seen.has(value)) fail(`${field}_DUPLICATE`);
seen.add(value);
}
return [...seen].sort();
}
export function collectMigrationManifest(rootDir, commit) {
const result = spawnSync(
"git",
["ls-tree", "-r", "--name-only", commit, "--", "server/prisma/migrations"],
{ cwd: rootDir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
);
if (result.status !== 0) fail("CANDIDATE_MIGRATION_MANIFEST_UNAVAILABLE");
const ids = new Set();
for (const relativePath of result.stdout.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean)) {
const parts = relativePath.split("/");
if (parts.length !== 5 || parts[0] !== "server" || parts[1] !== "prisma" || parts[2] !== "migrations") {
continue;
}
if (parts[4] !== "migration.sql" || !MIGRATION_ID_PATTERN.test(parts[3])) {
fail("CANDIDATE_MIGRATION_MANIFEST_INVALID");
}
ids.add(parts[3]);
}
const manifest = [...ids].sort();
if (manifest.length === 0) fail("CANDIDATE_MIGRATION_MANIFEST_EMPTY");
return manifest;
}
export function sha256Text(value) {
return createHash("sha256").update(String(value), "utf8").digest("hex");
}
function shellQuote(value) {
return `'${String(value).replaceAll("'", "'\\''")}'`;
}
function assertSafeContractValue(name, value, pattern) {
if (!pattern.test(String(value ?? ""))) fail(`${name}_INVALID`);
}
function gitText(args) {
const result = spawnSync("git", args, {
cwd: ROOT_DIR,
encoding: "utf8",
stdio: ["ignore", "pipe", "pipe"],
});
if (result.status !== 0) fail("CANDIDATE_COMMIT_UNAVAILABLE");
return result.stdout.trim();
}
function reportRef(reportDir) {
const relative = path.relative(ROOT_DIR, reportDir).replaceAll(path.sep, "/");
return relative && !relative.startsWith("..") ? relative : "controlled-production-preflight-report";
}
function extractPrismaStatus(stdout) {
const beginMarker = "[production-preflight][PRISMA_STATUS_BEGIN]";
const endMarker = "[production-preflight][PRISMA_STATUS_END]";
const begin = stdout.indexOf(beginMarker);
const end = stdout.indexOf(endMarker, begin + beginMarker.length);
if (begin < 0 || end < 0) return null;
const bodyStart = stdout.indexOf("\n", begin);
const body = stdout.slice(bodyStart >= 0 ? bodyStart + 1 : begin + beginMarker.length, end);
return body.replace(/^\s+|\s+$/gu, "");
}
function stableRemoteSummary(stdout) {
const lines = stdout.split(/\r?\n/u);
let inRawStatus = false;
const summary = [];
for (const line of lines) {
if (line === "[production-preflight][PRISMA_STATUS_BEGIN]") {
inRawStatus = true;
continue;
}
if (line.startsWith("[production-preflight][PRISMA_STATUS_END]")) {
inRawStatus = false;
continue;
}
if (!inRawStatus && line.trim()) summary.push(line);
}
return summary.join("\n");
}
function printStableRemoteSummary(stdout) {
const summary = stableRemoteSummary(stdout);
if (summary) process.stdout.write(`${summary}\n`);
}
function sanitizePrismaStatus(status, sensitiveValues = []) {
return status
.split(/\r?\n/u)
.map((line) => {
if (/^\s*Datasource\b/iu.test(line)) return "[redacted datasource line]";
let sanitized = line.replace(/postgres(?:ql)?:\/\/[^\s]+/giu, "<redacted database url>");
for (const value of sensitiveValues) {
if (value) sanitized = sanitized.split(value).join("<redacted>");
}
return sanitized;
})
.join("\n")
.replace(/^\s+|\s+$/gu, "");
}
export function validatePrismaStatusText(status) {
if (!status || !PRISMA_STATUS_KNOWN_PATTERN.test(status)) {
fail("PRISMA_STATUS_OUTPUT_UNREADABLE");
}
return status;
}
function main() {
try {
const deployServer = String(process.env.DEPLOY_SERVER ?? "").trim();
const remoteDir = String(process.env.REMOTE_DIR ?? "").trim();
const remoteEnvFile = String(process.env.REMOTE_ENV_FILE ?? "").trim();
const composeFile = String(process.env.COMPOSE_FILE ?? "").trim();
const composeProjectName = String(process.env.COMPOSE_PROJECT_NAME ?? "").trim();
const postgresDataDir = String(process.env.POSTGRES_DATA_DIR ?? "").trim();
const storageHostDir = String(process.env.STORAGE_HOST_DIR ?? "").trim();
const expectedOriginRaw = process.env.EXPECTED_PRODUCTION_ORIGIN;
const expectedDbNameRaw = process.env.EXPECTED_PRODUCTION_DB_NAME;
const expectedPendingRaw = process.env.EXPECTED_PENDING_MIGRATIONS;
if (expectedOriginRaw == null) fail("EXPECTED_PRODUCTION_ORIGIN_MISSING");
if (expectedDbNameRaw == null) fail("EXPECTED_PRODUCTION_DB_NAME_MISSING");
if (expectedPendingRaw == null) fail("EXPECTED_PENDING_MIGRATIONS_MISSING");
const expectedOrigin = validateProductionOrigin(expectedOriginRaw);
const expectedDbName = validateProductionDbName(expectedDbNameRaw);
const expectedPending = parseMigrationList(expectedPendingRaw, {
field: "EXPECTED_PENDING_MIGRATIONS",
});
assertSafeContractValue("DEPLOY_SERVER", deployServer, SSH_TARGET_PATTERN);
assertSafeContractValue("REMOTE_DIR", remoteDir, SAFE_ABSOLUTE_PATH_PATTERN);
assertSafeContractValue("REMOTE_ENV_FILE", remoteEnvFile, SAFE_ABSOLUTE_PATH_PATTERN);
assertSafeContractValue("POSTGRES_DATA_DIR", postgresDataDir, SAFE_ABSOLUTE_PATH_PATTERN);
assertSafeContractValue("STORAGE_HOST_DIR", storageHostDir, SAFE_ABSOLUTE_PATH_PATTERN);
assertSafeContractValue("COMPOSE_FILE", composeFile, SAFE_COMPOSE_FILE_PATTERN);
assertSafeContractValue("COMPOSE_PROJECT_NAME", composeProjectName, SAFE_PROJECT_PATTERN);
const candidateCommit = String(
process.env.CANDIDATE_COMMIT ?? gitText(["rev-parse", "--verify", "HEAD"]),
).trim();
if (!/^[0-9a-f]{40,64}$/iu.test(candidateCommit)) fail("CANDIDATE_COMMIT_INVALID");
const candidateManifest = collectMigrationManifest(ROOT_DIR, candidateCommit);
const candidateSet = new Set(candidateManifest);
if (expectedPending.some((migration) => !candidateSet.has(migration))) {
fail("EXPECTED_PENDING_MIGRATION_NOT_IN_CANDIDATE");
}
const reportDir = path.resolve(
ROOT_DIR,
process.env.PRODUCTION_PREFLIGHT_REPORT_DIR || `artifacts/production-preflight-${Date.now()}`,
);
mkdirSync(reportDir, { recursive: true, mode: 0o700 });
for (const filename of ["prisma-migrate-status.txt", "preflight-output.txt"]) {
try {
unlinkSync(path.join(reportDir, filename));
} catch (error) {
if (error?.code !== "ENOENT") fail("PRODUCTION_PREFLIGHT_REPORT_NOT_FRESH");
}
}
const remoteCommand = [
`REMOTE_DIR=${shellQuote(remoteDir)}`,
`REMOTE_ENV_FILE=${shellQuote(remoteEnvFile)}`,
`COMPOSE_FILE=${shellQuote(composeFile)}`,
`COMPOSE_PROJECT_NAME=${shellQuote(composeProjectName)}`,
`POSTGRES_DATA_DIR=${shellQuote(postgresDataDir)}`,
`STORAGE_HOST_DIR=${shellQuote(storageHostDir)}`,
`EXPECTED_PRODUCTION_ORIGIN_SHA256=${shellQuote(sha256Text(expectedOrigin))}`,
`EXPECTED_PRODUCTION_DB_NAME_SHA256=${shellQuote(sha256Text(expectedDbName))}`,
`CANDIDATE_MIGRATIONS_CSV=${shellQuote(candidateManifest.join(","))}`,
`EXPECTED_PENDING_MIGRATIONS_CSV=${shellQuote(expectedPending.join(","))}`,
"bash -s",
].join(" ");
const remoteScript = readFileSync(REMOTE_SCRIPT, "utf8");
const result = spawnSync("ssh", [deployServer, remoteCommand], {
cwd: ROOT_DIR,
input: remoteScript,
encoding: "utf8",
stdio: ["pipe", "pipe", "pipe"],
});
const stdout = result.stdout || "";
const rawStatus = extractPrismaStatus(stdout);
if (rawStatus != null) {
validatePrismaStatusText(rawStatus);
const sanitizedStatus = sanitizePrismaStatus(rawStatus, [expectedOrigin, expectedDbName]);
writeFileSync(path.join(reportDir, "prisma-migrate-status.txt"), `${sanitizedStatus}\n`, {
encoding: "utf8",
mode: 0o600,
});
}
const stableSummary = stableRemoteSummary(stdout);
writeFileSync(path.join(reportDir, "preflight-output.txt"), `${stableSummary}\n`, {
encoding: "utf8",
mode: 0o600,
});
printStableRemoteSummary(stdout);
console.log(`[production-preflight] reportRef=${reportRef(reportDir)}`);
if (rawStatus == null) fail("PRISMA_STATUS_OUTPUT_MISSING");
if (result.status !== 0) {
const remoteCode = `${stdout}\n${result.stderr || ""}`.match(/code=([A-Z0-9_]+)/u)?.[1];
fail(remoteCode || "PRODUCTION_PREFLIGHT_REMOTE_FAILED");
}
console.log("[production-preflight][PASS] 生产目标与迁移只读门禁通过");
} catch (error) {
const code = error instanceof ProductionPreflightError
? error.code
: "PRODUCTION_PREFLIGHT_UNEXPECTED_ERROR";
console.error(`[production-preflight][PAUSED] code=${code}`);
process.exitCode = 1;
}
}
const isMain = process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
if (isMain) main();
deploy/trialrun/validate-env-contract.js
+85
查看文件
@@ -38,6 +38,11 @@ const deploymentRefreshHelperPath = path.join(
'scripts/refresh-deployment-contract.sh', 'scripts/refresh-deployment-contract.sh',
); );
const remotePreflightScriptPath = path.join(rootDir, 'deploy/trialrun/preflight-remote.sh'); const remotePreflightScriptPath = path.join(rootDir, 'deploy/trialrun/preflight-remote.sh');
const productionPreflightScriptPath = path.join(rootDir, 'deploy/trialrun/production-preflight.mjs');
const productionPreflightRemoteScriptPath = path.join(
rootDir,
'deploy/trialrun/production-preflight-remote.sh',
);
const dockerfilePath = path.join(rootDir, 'deploy/trialrun/Dockerfile'); const dockerfilePath = path.join(rootDir, 'deploy/trialrun/Dockerfile');
const timerScriptPath = path.resolve( const timerScriptPath = path.resolve(
process.env.ENV_CONTRACT_TIMER_SCRIPT_PATH process.env.ENV_CONTRACT_TIMER_SCRIPT_PATH
@@ -272,6 +277,8 @@ const deploymentPreflightScriptContent = readFile(deploymentPreflightScriptPath)
const deploymentRefreshInstallerContent = readFile(deploymentRefreshInstallerPath); const deploymentRefreshInstallerContent = readFile(deploymentRefreshInstallerPath);
const deploymentRefreshHelperContent = readFile(deploymentRefreshHelperPath); const deploymentRefreshHelperContent = readFile(deploymentRefreshHelperPath);
const remotePreflightScriptContent = readFile(remotePreflightScriptPath); const remotePreflightScriptContent = readFile(remotePreflightScriptPath);
const productionPreflightScriptContent = readFile(productionPreflightScriptPath);
const productionPreflightRemoteScriptContent = readFile(productionPreflightRemoteScriptPath);
const dockerfileContent = readFile(dockerfilePath); const dockerfileContent = readFile(dockerfilePath);
const timerScriptContent = readFile(timerScriptPath); const timerScriptContent = readFile(timerScriptPath);
const automaticBackupTimerScriptContent = readFile(automaticBackupTimerScriptPath); const automaticBackupTimerScriptContent = readFile(automaticBackupTimerScriptPath);
@@ -582,17 +589,33 @@ for (const requiredFragment of [
'check-existing-deployment.sh', 'check-existing-deployment.sh',
'deployment_contract_load', 'deployment_contract_load',
'DEPLOY_DEFER_FINAL_SUCCESS=1', 'DEPLOY_DEFER_FINAL_SUCCESS=1',
'DEPLOY_STATUS_OUTPUT_MODE=quiet',
'ssh "$DEPLOY_REFRESH_SERVER" refresh', 'ssh "$DEPLOY_REFRESH_SERVER" refresh',
'DEPLOYED_BUT_CONTRACT_REFRESH_FAILED', 'DEPLOYED_BUT_CONTRACT_REFRESH_FAILED',
'DEPLOY_DATA_MODE=existing', 'DEPLOY_DATA_MODE=existing',
'SYNC_ENV=0', 'SYNC_ENV=0',
'路径与标识不回显', '路径与标识不回显',
'生产部署验证不接受未进入上游的提交',
]) { ]) {
if (!deployExistingScriptContent.includes(requiredFragment)) { if (!deployExistingScriptContent.includes(requiredFragment)) {
errors.push(`deploy-existing.sh 缺少既有部署合同: ${requiredFragment}`); errors.push(`deploy-existing.sh 缺少既有部署合同: ${requiredFragment}`);
} }
} }
for (const requiredFragment of [
'EXPECTED_PRODUCTION_ORIGIN',
'EXPECTED_PRODUCTION_DB_NAME',
'EXPECTED_PENDING_MIGRATIONS',
'production-preflight.mjs',
'CANDIDATE_COMMIT',
'PRODUCTION_PREFLIGHT_REPORT_DIR',
'未进入 deploy.sh',
]) {
if (!deployExistingScriptContent.includes(requiredFragment)) {
errors.push(`deploy-existing.sh 缺少生产迁移前置门禁: ${requiredFragment}`);
}
}
for (const requiredFragment of [ for (const requiredFragment of [
'systemctl show', 'systemctl show',
'DEPLOY_CONTRACT_KEYS', 'DEPLOY_CONTRACT_KEYS',
@@ -669,6 +692,68 @@ if (deployExistingScriptContent.indexOf('ssh "$DEPLOY_REFRESH_SERVER" refresh')
errors.push('deploy-existing.sh 必须在应用部署成功后刷新备份合同'); errors.push('deploy-existing.sh 必须在应用部署成功后刷新备份合同');
} }
for (const requiredFragment of [
'validateProductionOrigin',
'validateProductionDbName',
'collectMigrationManifest',
'EXPECTED_PENDING_MIGRATIONS',
'PRISMA_STATUS_OUTPUT_MISSING',
'PRISMA_STATUS_OUTPUT_UNREADABLE',
'sanitizePrismaStatus',
'stableRemoteSummary',
'PRODUCTION_PREFLIGHT_REPORT_NOT_FRESH',
'prisma-migrate-status.txt',
'PRODUCTION_PREFLIGHT_REPORT_DIR',
]) {
if (!productionPreflightScriptContent.includes(requiredFragment)) {
errors.push(`production-preflight.mjs 缺少生产目标/候选迁移合同: ${requiredFragment}`);
}
}
for (const requiredFragment of [
'EXPECTED_PRODUCTION_ORIGIN_SHA256',
'EXPECTED_PRODUCTION_DB_NAME_SHA256',
'PRISMA_STATUS_BEGIN',
'FROM "_prisma_migrations"',
'logged_failure',
'PROD_MIGRATION_STATUS_UNKNOWN_PENDING',
'PROD_DATABASE_URL_HOST_NON_PRODUCTION_IDENTITY',
'PROD_MIGRATION_PENDING_ALLOWLIST_MISMATCH',
'rollbackWindow=OPEN',
'PROD_TARGET_ORIGIN_MISMATCH',
]) {
if (!productionPreflightRemoteScriptContent.includes(requiredFragment)) {
errors.push(`production-preflight-remote.sh 缺少只读生产门禁合同: ${requiredFragment}`);
}
}
if (productionPreflightRemoteScriptContent.includes('migrate reset')
|| productionPreflightRemoteScriptContent.includes('db push')
|| productionPreflightRemoteScriptContent.includes('migrate resolve')) {
errors.push('production-preflight-remote.sh 不得包含 reset/db push/resolve 写入路径');
}
if (deployExistingScriptContent.indexOf('node "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT"')
> deployExistingScriptContent.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"')) {
errors.push('deploy-existing.sh 必须在 deploy.sh 前执行生产目标与迁移 preflight');
}
if (!deployScriptContent.includes('DEPLOY_STATUS_OUTPUT_MODE')) {
errors.push('deploy.sh 必须支持受控发布 wrapper 的 quiet migration status 输出模式');
}
if (deployScriptContent.indexOf("DEPLOY_STATUS_OUTPUT_MODE='${DEPLOY_STATUS_OUTPUT_MODE}'") === -1) {
errors.push('deploy.sh 必须将 DEPLOY_STATUS_OUTPUT_MODE 传入远端部署 shell');
}
if (deployExistingScriptContent.indexOf('EXPECTED_PENDING_MIGRATIONS=""')
< deployExistingScriptContent.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"')) {
errors.push('deploy-existing.sh 必须在 deploy.sh 后执行空 pending 的 post-status 复核');
}
if (productionPreflightRemoteScriptContent.indexOf('database_url_identity=')
> productionPreflightRemoteScriptContent.indexOf('prisma_status_output=')) {
errors.push('production-preflight-remote.sh 必须先确认 DATABASE_URL host/db 身份，再执行 migration status');
}
if (deployExistingScriptContent.indexOf('ssh "$DEPLOY_REFRESH_SERVER" refresh')
< deployExistingScriptContent.indexOf('EXPECTED_PENDING_MIGRATIONS=""')) {
errors.push('deploy-existing.sh 必须在 post-status 复核后刷新备份合同');
}
for (const requiredFragment of [ for (const requiredFragment of [
'REMOTE_DIR 是现存仓库根目录', 'REMOTE_DIR 是现存仓库根目录',
'SYNC_ENV=0 要求同步前已有普通远端 .env 文件', 'SYNC_ENV=0 要求同步前已有普通远端 .env 文件',
server/tests/unit/scripts/deployment-safety-contract.test.js
+210 -1
查看文件
@@ -1,7 +1,9 @@
const { execFile } = require("node:child_process"); const { execFile } = require("node:child_process");
const { mkdtemp, mkdir, rm, symlink, writeFile } = require("node:fs/promises"); const { createHash } = require("node:crypto");
const { chmod, mkdtemp, mkdir, rm, symlink, writeFile, readFile } = require("node:fs/promises");
const os = require("node:os"); const os = require("node:os");
const path = require("node:path"); const path = require("node:path");
const { pathToFileURL } = require("node:url");
const { promisify } = require("node:util"); const { promisify } = require("node:util");
const execFileAsync = promisify(execFile); const execFileAsync = promisify(execFile);
@@ -10,6 +12,8 @@ const PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/preflight-remote.sh");
const AGGREGATE_PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/check-existing-deployment.sh"); const AGGREGATE_PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/check-existing-deployment.sh");
const REFRESH_HELPER = path.join(ROOT_DIR, "scripts/refresh-deployment-contract.sh"); const REFRESH_HELPER = path.join(ROOT_DIR, "scripts/refresh-deployment-contract.sh");
const REFRESH_INSTALLER = path.join(ROOT_DIR, "deploy/trialrun/install-deployment-contract-refresh.sh"); const REFRESH_INSTALLER = path.join(ROOT_DIR, "deploy/trialrun/install-deployment-contract-refresh.sh");
const PRODUCTION_PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/production-preflight.mjs");
const PRODUCTION_PREFLIGHT_REMOTE = path.join(ROOT_DIR, "deploy/trialrun/production-preflight-remote.sh");
describe("deployment safety contract", () => { describe("deployment safety contract", () => {
let fixtureRoot; let fixtureRoot;
@@ -87,10 +91,215 @@ describe("deployment safety contract", () => {
expect(wrapper).toContain("DEPLOY_DATA_MODE=existing"); expect(wrapper).toContain("DEPLOY_DATA_MODE=existing");
expect(wrapper).toContain("SYNC_ENV=0"); expect(wrapper).toContain("SYNC_ENV=0");
expect(wrapper).toContain("DEPLOY_DEFER_FINAL_SUCCESS=1"); expect(wrapper).toContain("DEPLOY_DEFER_FINAL_SUCCESS=1");
expect(wrapper).toContain("DEPLOY_STATUS_OUTPUT_MODE=quiet");
expect(deploy).toContain("DEPLOY_STATUS_OUTPUT_MODE");
expect(deploy).toContain("DEPLOY_STATUS_OUTPUT_MODE='${DEPLOY_STATUS_OUTPUT_MODE}'");
expect(wrapper).toContain("生产部署验证不接受未进入上游的提交");
expect(wrapper).toContain("部署后 migration status 与目标只读复核");
expect(wrapper).toContain('EXPECTED_PENDING_MIGRATIONS=""');
expect(wrapper.indexOf('EXPECTED_PENDING_MIGRATIONS=""')).toBeGreaterThan(
wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'),
);
expect(wrapper.indexOf('ssh "$DEPLOY_REFRESH_SERVER" refresh')).toBeGreaterThan(wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"')); expect(wrapper.indexOf('ssh "$DEPLOY_REFRESH_SERVER" refresh')).toBeGreaterThan(wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'));
expect(wrapper).toContain("DEPLOYED_BUT_CONTRACT_REFRESH_FAILED"); expect(wrapper).toContain("DEPLOYED_BUT_CONTRACT_REFRESH_FAILED");
}); });
it("requires production target identity and pending migration allowlist before deploy.sh", async () => {
const wrapper = await readFile(path.join(ROOT_DIR, "deploy/trialrun/deploy-existing.sh"), "utf8");
const preflight = await readFile(PRODUCTION_PREFLIGHT, "utf8");
const remote = await readFile(PRODUCTION_PREFLIGHT_REMOTE, "utf8");
expect(wrapper).toContain("EXPECTED_PRODUCTION_ORIGIN");
expect(wrapper).toContain("EXPECTED_PRODUCTION_DB_NAME");
expect(wrapper).toContain("EXPECTED_PENDING_MIGRATIONS");
expect(wrapper.indexOf('node "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT"')).toBeLessThan(
wrapper.indexOf('bash "$ROOT_DIR/deploy/trialrun/deploy.sh"'),
);
expect(preflight).toContain("CANDIDATE_MIGRATIONS_CSV");
expect(preflight).toContain("PRISMA_STATUS_OUTPUT_MISSING");
expect(preflight).toContain("PRISMA_STATUS_OUTPUT_UNREADABLE");
expect(preflight).toContain("redacted datasource line");
expect(preflight).toContain("PRODUCTION_PREFLIGHT_REPORT_NOT_FRESH");
expect(remote).toContain("PRISMA_STATUS_BEGIN");
expect(remote).toContain("PROD_MIGRATION_STATUS_UNKNOWN_PENDING");
expect(remote).toContain("logged_failure");
expect(remote).toContain("PROD_DATABASE_URL_HOST_NON_PRODUCTION_IDENTITY");
expect(remote).toContain('FROM "_prisma_migrations"');
expect(remote).toContain("rollbackWindow=OPEN");
expect(remote).not.toMatch(/\b(prisma migrate reset|prisma db push|prisma migrate resolve)\b/);
expect(remote.indexOf("PRISMA_STATUS_BEGIN")).toBeLessThan(remote.indexOf("_prisma_migrations"));
});
it("rejects loopback/staging production identities without invoking SSH", async () => {
const target = await import(pathToFileURL(PRODUCTION_PREFLIGHT).href);
expect(() => target.validateProductionOrigin("https://127.0.0.1")).toThrowError(
expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
);
expect(() => target.validateProductionOrigin("https://staging.example.com")).toThrowError(
expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
);
expect(() => target.validateProductionOrigin("https://0.0.0.0")).toThrowError(
expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
);
expect(() => target.validateProductionOrigin("https://[::ffff:127.0.0.1]")).toThrowError(
expect.objectContaining({ code: "PROD_TARGET_ORIGIN_NON_PRODUCTION_IDENTITY" }),
);
expect(() => target.validateProductionDbName("hyb_oa_regression")).toThrowError(
expect.objectContaining({ code: "PROD_TARGET_DB_NON_PRODUCTION_IDENTITY" }),
);
expect(() => target.validatePrismaStatusText("")).toThrowError(
expect.objectContaining({ code: "PRISMA_STATUS_OUTPUT_UNREADABLE" }),
);
expect(() => target.validatePrismaStatusText("unexpected output")).toThrowError(
expect.objectContaining({ code: "PRISMA_STATUS_OUTPUT_UNREADABLE" }),
);
});
it("captures a redacted pre-status evidence copy from a controlled SSH fixture", async () => {
const fakeBin = path.join(fixtureRoot, "bin");
const reportDir = path.join(fixtureRoot, "report");
const sshCapture = path.join(fixtureRoot, "ssh-command.txt");
await mkdir(fakeBin, { recursive: true });
await mkdir(reportDir, { recursive: true });
await writeFile(path.join(reportDir, "prisma-migrate-status.txt"), "stale PASS\n");
const fakeSsh = path.join(fakeBin, "ssh");
await writeFile(
fakeSsh,
[
"#!/usr/bin/env node",
"require('node:fs').writeFileSync(process.env.FAKE_SSH_CAPTURE, process.argv.slice(2).join(' '));",
"process.stdout.write('[production-preflight][PASS] target_identity\\n');",
"process.stdout.write('[production-preflight][PRISMA_STATUS_BEGIN]\\n');",
"process.stdout.write('Datasource \\\"db\\\": PostgreSQL database \\\"hyb_oa\\\" at \\\"db.internal:5432\\\"\\n');",
"process.stdout.write('Database schema is up to date!\\n');",
"process.stdout.write('[production-preflight][PRISMA_STATUS_END] exit=0\\n');",
"process.stdout.write('[production-preflight][PASS] migration_reconciliation pending=none\\n');",
"process.stdout.write('[production-preflight][PASS] rollbackWindow=OPEN terminatedRows=0\\n');",
].join("\n"),
{ mode: 0o700 },
);
await chmod(fakeSsh, 0o700);
const candidateCommit = require("node:child_process")
.execFileSync("git", ["rev-parse", "HEAD"], { cwd: ROOT_DIR, encoding: "utf8" })
.trim();
const result = await execFileAsync("node", [PRODUCTION_PREFLIGHT], {
cwd: ROOT_DIR,
env: {
...process.env,
PATH: `${fakeBin}${path.delimiter}${process.env.PATH}`,
DEPLOY_SERVER: "deploy.example.invalid",
REMOTE_DIR: remoteDir,
REMOTE_ENV_FILE: envFile,
COMPOSE_FILE: "deploy/trialrun/docker-compose.yml",
COMPOSE_PROJECT_NAME: "production_app",
POSTGRES_DATA_DIR: postgresDir,
STORAGE_HOST_DIR: storageDir,
EXPECTED_PRODUCTION_ORIGIN: "https://oa.hyinda.com",
EXPECTED_PRODUCTION_DB_NAME: "hyb_oa",
EXPECTED_PENDING_MIGRATIONS: "",
CANDIDATE_COMMIT: candidateCommit,
PRODUCTION_PREFLIGHT_REPORT_DIR: reportDir,
FAKE_SSH_CAPTURE: sshCapture,
},
});
const statusEvidence = await readFile(path.join(reportDir, "prisma-migrate-status.txt"), "utf8");
const sshCommand = await readFile(sshCapture, "utf8");
expect(result.stdout).toContain("[production-preflight][PASS]");
expect(statusEvidence).toContain("Database schema is up to date!");
expect(statusEvidence).toContain("[redacted datasource line]");
expect(statusEvidence).not.toContain("hyb_oa");
expect(statusEvidence).not.toContain("db.internal:5432");
expect(result.stdout).not.toContain("oa.hyinda.com");
expect(result.stdout).not.toContain("hyb_oa");
expect(sshCommand).not.toContain("oa.hyinda.com");
expect(sshCommand).not.toContain("hyb_oa");
expect(sshCommand).toContain("EXPECTED_PRODUCTION_ORIGIN_SHA256");
expect(sshCommand).toContain("EXPECTED_PRODUCTION_DB_NAME_SHA256");
});
it("runs the remote gate against synthetic status and migration history", async () => {
const fakeBin = path.join(fixtureRoot, "remote-bin");
await mkdir(fakeBin, { recursive: true });
await writeFile(path.join(remoteDir, "deploy/trialrun/.env"), [
"APP_ORIGIN=https://oa.example.com",
"POSTGRES_DB=production_db",
"POSTGRES_USER=synthetic_user",
"NODE_ENV=production",
"COOKIE_SECURE=true",
"",
].join("\n"), { mode: 0o600 });
await writeFile(path.join(fakeBin, "docker"), [
"#!/usr/bin/env bash",
"set -euo pipefail",
"joined=\"$*\"",
"mode=\"${FAKE_REMOTE_MODE:-happy}\"",
"if [[ \"$1\" == compose && \"${2:-}\" == version ]]; then exit 0; fi",
"if [[ \"$1\" == ps ]]; then",
" if [[ \"$joined\" == *service=server* ]]; then printf 'server1\\n'; else printf 'db1\\n'; fi",
" exit 0",
"fi",
"if [[ \"$1\" == inspect ]]; then printf 'NODE_ENV=production\\nCOOKIE_SECURE=true\\nAPP_ORIGIN=https://oa.example.com\\n'; exit 0; fi",
"if [[ \"$joined\" == *' config'* ]]; then exit 0; fi",
"if [[ \"$joined\" == *' exec '* && \"$joined\" == *' sh -lc '* ]]; then",
" case \"$mode\" in",
" pending) printf 'Following migration have not yet been applied:\\n20260807193001_followup_migration\\n'; exit 1 ;;",
" unknown) printf 'Following migration have not yet been applied:\\n20260807193002_unknown_migration\\n'; exit 1 ;;",
" *) printf 'Database schema is up to date!\\n'; exit 0 ;;",
" esac",
"fi",
"if [[ \"$joined\" == *' exec '* && \"$joined\" == *' node -e '* ]]; then",
" printf 'db.internal\\nproduction_db\\n'; exit 0",
"fi",
"if [[ \"$joined\" == *'SELECT current_database()'* ]]; then printf 'production_db\\n'; exit 0; fi",
"if [[ \"$joined\" == *'_prisma_migrations'* ]]; then",
" case \"$mode\" in",
" pending) printf '20260807193000_contract_registry_termination_workspace|applied\\n';;",
" logs) printf '20260807193000_contract_registry_termination_workspace|logged_failure\\n';;",
" *) printf '20260807193000_contract_registry_termination_workspace|applied\\n20260807193001_followup_migration|applied\\n';;",
" esac",
" exit 0",
"fi",
"if [[ \"$joined\" == *'contract_registry'* ]]; then printf '0\\n'; exit 0; fi",
"printf 'unexpected fake docker call: %s\\n' \"$joined\" >&2",
"exit 97",
"",
].join("\n"), { mode: 0o700 });
await chmod(path.join(fakeBin, "docker"), 0o700);
const hash = (value) => createHash("sha256").update(value, "utf8").digest("hex");
const runRemote = (mode, expectedPending = "") => execFileAsync("bash", [PRODUCTION_PREFLIGHT_REMOTE], {
cwd: remoteDir,
env: {
...process.env,
PATH: `${fakeBin}${path.delimiter}${process.env.PATH}`,
FAKE_REMOTE_MODE: mode,
REMOTE_DIR: remoteDir,
REMOTE_ENV_FILE: envFile,
COMPOSE_FILE: "deploy/trialrun/docker-compose.yml",
COMPOSE_PROJECT_NAME: "production_app",
POSTGRES_DATA_DIR: postgresDir,
STORAGE_HOST_DIR: storageDir,
EXPECTED_PRODUCTION_ORIGIN_SHA256: hash("https://oa.example.com"),
EXPECTED_PRODUCTION_DB_NAME_SHA256: hash("production_db"),
CANDIDATE_MIGRATIONS_CSV: "20260807193000_contract_registry_termination_workspace,20260807193001_followup_migration",
EXPECTED_PENDING_MIGRATIONS_CSV: expectedPending,
},
});
const result = await runRemote("happy");
expect(result.stdout).toContain("target_identity");
expect(result.stdout).toContain("migration_reconciliation pending=none");
expect(result.stdout).toContain("rollbackWindow=OPEN");
const pendingResult = await runRemote("pending", "20260807193001_followup_migration");
expect(pendingResult.stdout).toContain("migration_reconciliation pending=20260807193001_followup_migration");
await expect(runRemote("unknown")).rejects.toMatchObject({
stderr: expect.stringContaining("PROD_MIGRATION_STATUS_UNKNOWN_PENDING"),
});
await expect(runRemote("logs")).rejects.toMatchObject({
stderr: expect.stringContaining("PROD_MIGRATION_FAILED_OR_ROLLED_BACK"),
});
});
it("aggregates preflight checks and keeps the root helper self-contained", async () => { it("aggregates preflight checks and keeps the root helper self-contained", async () => {
const aggregate = await require("node:fs/promises").readFile(AGGREGATE_PREFLIGHT, "utf8"); const aggregate = await require("node:fs/promises").readFile(AGGREGATE_PREFLIGHT, "utf8");
const helper = await require("node:fs/promises").readFile(REFRESH_HELPER, "utf8"); const helper = await require("node:fs/promises").readFile(REFRESH_HELPER, "utf8");