修复(08-08-production-deployment-execution): 校验候选 Compose 构建标识

deploy/trialrun/production-preflight.mjs

@@ -163,16 +163,6 @@ export function validateExactProductionIdentity({
   assertExactIdentity("COMPOSE_PROJECT_NAME", composeProjectName, expectedComposeProjectName);
 }
 
-function gitText(args) {
-  const result = spawnSync("git", args, {
-    cwd: ROOT_DIR,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  if (result.status !== 0) fail("CANDIDATE_COMMIT_UNAVAILABLE");
-  return result.stdout.trim();
-}
-
 function reportRef(reportDir) {
   const relative = path.relative(ROOT_DIR, reportDir).replaceAll(path.sep, "/");
   return relative && !relative.startsWith("..") ? relative : "controlled-production-preflight-report";
@@ -283,10 +273,10 @@ function main() {
       expectedComposeProjectName,
     });
 
-    const candidateCommit = String(
-      process.env.CANDIDATE_COMMIT ?? gitText(["rev-parse", "--verify", "HEAD"]),
-    ).trim();
+    if (process.env.CANDIDATE_COMMIT == null) fail("CANDIDATE_COMMIT_MISSING");
+    const candidateCommit = String(process.env.CANDIDATE_COMMIT).trim();
     if (!/^[0-9a-f]{40,64}$/iu.test(candidateCommit)) fail("CANDIDATE_COMMIT_INVALID");
+    const candidateShortCommit = candidateCommit.slice(0, 12);
     const candidateManifest = collectMigrationManifest(ROOT_DIR, candidateCommit);
     const candidateSet = new Set(candidateManifest);
     if (expectedPending.some((migration) => !candidateSet.has(migration))) {
@@ -315,6 +305,8 @@ function main() {
       `STORAGE_HOST_DIR=${shellQuote(storageHostDir)}`,
       `EXPECTED_PRODUCTION_ORIGIN_SHA256=${shellQuote(sha256Text(expectedOrigin))}`,
       `EXPECTED_PRODUCTION_DB_NAME_SHA256=${shellQuote(expectedDbNameHash)}`,
+      `BUILD_SHA=${shellQuote(candidateCommit)}`,
+      `VITE_BUILD_SHA=${shellQuote(candidateShortCommit)}`,
       `CANDIDATE_MIGRATIONS_CSV=${shellQuote(candidateManifest.join(","))}`,
       `EXPECTED_PENDING_MIGRATIONS_CSV=${shellQuote(expectedPending.join(","))}`,
       "bash -s",