feat(08-08-production-deployment-validation): 增加生产目标与迁移只读门禁

deploy/trialrun/deploy-existing.sh

@@ -5,6 +5,8 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 DEPLOY_SERVER="${DEPLOY_SERVER:-}"
 DEPLOY_REFRESH_SERVER="${DEPLOY_REFRESH_SERVER:-}"
 DEPLOY_CONTRACT_UNIT="${DEPLOY_CONTRACT_UNIT:-hyb-oa-automatic-backup-daily.service}"
+PROVENANCE_SCRIPT="deploy/trialrun/check-source-provenance.mjs"
+PRODUCTION_PREFLIGHT_SCRIPT="deploy/trialrun/production-preflight.mjs"
 
 # shellcheck source=deployment-contract-lib.sh
 source "$ROOT_DIR/deploy/trialrun/deployment-contract-lib.sh"
@@ -21,6 +23,11 @@ deployment_contract_safe_ssh_target "$DEPLOY_REFRESH_SERVER" \
 deployment_contract_safe_service "$DEPLOY_CONTRACT_UNIT" \
   || fail "DEPLOY_CONTRACT_UNIT 格式无效"
 command -v ssh >/dev/null 2>&1 || fail "缺少 ssh"
+command -v node >/dev/null 2>&1 || fail "缺少 node"
+
+if [[ "${DEPLOY_ALLOW_UNPUBLISHED_COMMIT:-0}" == "1" || -n "${DEPLOY_UNPUBLISHED_REASON:-}" ]]; then
+  fail "生产部署验证不接受未进入上游的提交；灾备 override 必须走独立获批流程"
+fi
 
 declare -A contract=()
 echo "[deploy-existing] 开始只读聚合体检"
@@ -34,6 +41,43 @@ deployment_contract_load "$DEPLOY_SERVER" "$DEPLOY_CONTRACT_UNIT" contract \
   || fail "无法读取完整既有部署合同"
 
 echo "[deploy-existing] 已读取受控 unit 合同；路径与标识不回显"
+
+if [[ -z "${EXPECTED_PRODUCTION_ORIGIN+x}" ]]; then
+  fail "生产部署必须显式提供 EXPECTED_PRODUCTION_ORIGIN（仅进程环境）"
+fi
+if [[ -z "${EXPECTED_PRODUCTION_DB_NAME+x}" ]]; then
+  fail "生产部署必须显式提供 EXPECTED_PRODUCTION_DB_NAME（仅进程环境）"
+fi
+if [[ -z "${EXPECTED_PENDING_MIGRATIONS+x}" ]]; then
+  fail "生产部署必须显式提供 EXPECTED_PENDING_MIGRATIONS（可为空）"
+fi
+[[ -f "$ROOT_DIR/$PROVENANCE_SCRIPT" ]] || fail "缺少发布来源校验脚本"
+[[ -f "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT" ]] || fail "缺少生产迁移 preflight 脚本"
+
+echo ">>> 0.1 校验已批准发布来源（生产 preflight 前）"
+provenance_json="$(node "$ROOT_DIR/$PROVENANCE_SCRIPT" 2>/dev/null)" \
+  || fail "发布来源校验未通过"
+source_commit="$(node -e 'const value = JSON.parse(process.argv[1]); process.stdout.write(value.commit || "")' "$provenance_json")" \
+  || fail "发布来源提交不可用"
+[[ "$source_commit" =~ ^[0-9a-f]{40,64}$ ]] || fail "发布来源提交格式无效"
+
+echo ">>> 0.2 生产目标与迁移 preflight（只读，先于 deploy.sh）"
+PRODUCTION_PREFLIGHT_REPORT_ROOT="${PRODUCTION_PREFLIGHT_REPORT_ROOT:-artifacts/production-preflight-$(date +%Y%m%d-%H%M%S)}"
+EXPECTED_PRODUCTION_ORIGIN="$EXPECTED_PRODUCTION_ORIGIN" \
+EXPECTED_PRODUCTION_DB_NAME="$EXPECTED_PRODUCTION_DB_NAME" \
+EXPECTED_PENDING_MIGRATIONS="$EXPECTED_PENDING_MIGRATIONS" \
+DEPLOY_SERVER="$DEPLOY_SERVER" \
+REMOTE_DIR="${contract[REMOTE_DIR]}" \
+REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \
+COMPOSE_FILE="${contract[COMPOSE_FILE]}" \
+COMPOSE_PROJECT_NAME="${contract[COMPOSE_PROJECT_NAME]}" \
+POSTGRES_DATA_DIR="${contract[POSTGRES_DATA_DIR]}" \
+STORAGE_HOST_DIR="${contract[STORAGE_HOST_DIR]}" \
+CANDIDATE_COMMIT="$source_commit" \
+PRODUCTION_PREFLIGHT_REPORT_DIR="$PRODUCTION_PREFLIGHT_REPORT_ROOT/pre" \
+node "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT" \
+  || fail "生产目标或迁移 preflight 未通过；未进入 deploy.sh"
+
 DEPLOY_SERVER="$DEPLOY_SERVER" \
 REMOTE_DIR="${contract[REMOTE_DIR]}" \
 REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \
@@ -43,9 +87,26 @@ POSTGRES_DATA_DIR="${contract[POSTGRES_DATA_DIR]}" \
 STORAGE_HOST_DIR="${contract[STORAGE_HOST_DIR]}" \
 DEPLOY_DATA_MODE=existing \
 DEPLOY_DEFER_FINAL_SUCCESS=1 \
+DEPLOY_STATUS_OUTPUT_MODE=quiet \
 SYNC_ENV=0 \
 bash "$ROOT_DIR/deploy/trialrun/deploy.sh"
 
+echo ">>> 6.1 部署后 migration status 与目标只读复核"
+EXPECTED_PRODUCTION_ORIGIN="$EXPECTED_PRODUCTION_ORIGIN" \
+EXPECTED_PRODUCTION_DB_NAME="$EXPECTED_PRODUCTION_DB_NAME" \
+EXPECTED_PENDING_MIGRATIONS="" \
+DEPLOY_SERVER="$DEPLOY_SERVER" \
+REMOTE_DIR="${contract[REMOTE_DIR]}" \
+REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \
+COMPOSE_FILE="${contract[COMPOSE_FILE]}" \
+COMPOSE_PROJECT_NAME="${contract[COMPOSE_PROJECT_NAME]}" \
+POSTGRES_DATA_DIR="${contract[POSTGRES_DATA_DIR]}" \
+STORAGE_HOST_DIR="${contract[STORAGE_HOST_DIR]}" \
+CANDIDATE_COMMIT="$source_commit" \
+PRODUCTION_PREFLIGHT_REPORT_DIR="$PRODUCTION_PREFLIGHT_REPORT_ROOT/post" \
+node "$ROOT_DIR/$PRODUCTION_PREFLIGHT_SCRIPT" \
+  || fail "部署后迁移 status/目标复核失败；应用已部署但未进入合同 refresh"
+
 refresh_output=""
 refresh_status=0
 if refresh_output="$(ssh "$DEPLOY_REFRESH_SERVER" refresh 2>/dev/null)"; then