完善(08-09-deployment-contract-single-source-harness): 收敛部署合同并补失败路径

deploy/trialrun/deploy.sh

@@ -127,8 +127,29 @@ fi
 
 echo ">>> 0. 校验 Git 来源与发布提交"
 PROVENANCE_JSON="$(node "${ROOT_DIR}/${PROVENANCE_SCRIPT}")"
-SOURCE_COMMIT="$(node -e 'const p=JSON.parse(process.argv[1]); process.stdout.write(p.commit)' "$PROVENANCE_JSON")"
-SOURCE_SHORT_COMMIT="$(node -e 'const p=JSON.parse(process.argv[1]); process.stdout.write(p.shortCommit)' "$PROVENANCE_JSON")"
+SOURCE_BUILD_ENV_LINES="$(node -e '
+  const p = JSON.parse(process.argv[1]);
+  for (const [key, value] of Object.entries(p.buildEnv ?? {})) {
+    process.stdout.write(`${key}=${value}\n`);
+  }
+' "$PROVENANCE_JSON")"
+declare -A SOURCE_BUILD_ENV=()
+while IFS='=' read -r key value; do
+  [[ -n "$key" ]] || continue
+  case "$key" in
+    BUILD_SHA|VITE_BUILD_SHA) ;;
+    *) echo "[ERROR] 发布来源包含未知候选构建环境键" >&2; exit 1 ;;
+  esac
+  [[ -z "${SOURCE_BUILD_ENV[$key]+x}" ]] \
+    || { echo "[ERROR] 发布来源包含重复候选构建环境键" >&2; exit 1; }
+  SOURCE_BUILD_ENV["$key"]="$value"
+done <<< "$SOURCE_BUILD_ENV_LINES"
+[[ "${#SOURCE_BUILD_ENV[@]}" -eq 2 \
+  && -n "${SOURCE_BUILD_ENV[BUILD_SHA]:-}" \
+  && -n "${SOURCE_BUILD_ENV[VITE_BUILD_SHA]:-}" ]] \
+  || { echo "[ERROR] 发布来源缺少完整候选构建环境对象" >&2; exit 1; }
+SOURCE_COMMIT="${SOURCE_BUILD_ENV[BUILD_SHA]}"
+SOURCE_SHORT_COMMIT="${SOURCE_BUILD_ENV[VITE_BUILD_SHA]}"
 SOURCE_BRANCH="$(node -e 'const p=JSON.parse(process.argv[1]); process.stdout.write(p.branch)' "$PROVENANCE_JSON")"
 SOURCE_PUBLISHED="$(node -e 'const p=JSON.parse(process.argv[1]); process.stdout.write(String(p.published))' "$PROVENANCE_JSON")"
 SOURCE_REMOTE_VERIFIED="$(node -e 'const p=JSON.parse(process.argv[1]); process.stdout.write(String(p.remoteVerified))' "$PROVENANCE_JSON")"
@@ -274,7 +295,7 @@ run_logged_deploy_stage() {
     echo "[deploy-stage][ERROR] 阶段名称格式无效" >&2
     return 2
   }
-  local log_ref="$DEPLOY_RUNTIME_LOG_REF/${stage}-${BUILD_SHA:0:12}.log"
+  local log_ref="$DEPLOY_RUNTIME_LOG_REF/${stage}-${VITE_BUILD_SHA}.log"
   local log_file="$REMOTE_DIR/$log_ref"
   : > "$log_file"
   chmod 0600 "$log_file"
@@ -334,7 +355,7 @@ ready_ok=0
 for i in $(seq 1 60); do
   if ready_payload="$(curl -fsS "http://127.0.0.1:${server_host_port}/ready" 2>/dev/null)"; then
     if printf '%s' "$ready_payload" | "${compose_cmd[@]}" exec -T \
-      -e EXPECTED_BUILD_SHA="${BUILD_SHA:0:12}" server node -e '
+      -e EXPECTED_BUILD_SHA="${VITE_BUILD_SHA}" server node -e '
       const fs = require("node:fs");
       const payload = JSON.parse(fs.readFileSync(0, "utf8") || "{}");
       if (payload?.data?.buildSha !== process.env.EXPECTED_BUILD_SHA) process.exit(1);