R66 A1-A6：小团队试点收敛与上线验收

scripts/qa/run-web-gates.sh

@@ -14,6 +14,9 @@ QA_DB_PORT="${QA_DB_PORT:-5432}"
 QA_DB_USER="${QA_DB_USER:-hyboa_user}"
 QA_DB_PASSWORD="${QA_DB_PASSWORD:-hyboa_password}"
 QA_DB_ADMIN_DB="${QA_DB_ADMIN_DB:-postgres}"
+QA_DB_CLIENT="${QA_DB_CLIENT:-host}"
+QA_DB_DOCKER_CONTAINER="${QA_DB_DOCKER_CONTAINER:-hyb-oa-trialrun-db}"
+QA_DOCKER_USE_SG="${QA_DOCKER_USE_SG:-0}"
 QA_DB_PREFIX="${QA_DB_PREFIX:-hyb_oa_webgate}"
 QA_KEEP_DB="${QA_KEEP_DB:-0}"
 QA_SERVER_LOG="${QA_SERVER_LOG:-/tmp/hyb-oa-web-gates-server.log}"
@@ -38,11 +41,65 @@ Usage: bash scripts/qa/run-web-gates.sh <smoke-local|full-local|smoke-live>
 可选环境变量：
   QA_PORT / QA_HOST
   QA_DB_HOST / QA_DB_PORT / QA_DB_USER / QA_DB_PASSWORD / QA_DB_ADMIN_DB
+  QA_DB_CLIENT=host|docker
+  QA_DB_DOCKER_CONTAINER / QA_DOCKER_USE_SG=1
   QA_DB_PREFIX / QA_DB_NAME / QA_KEEP_DB
   LIVE_SMOKE_BASE_URL / LIVE_SMOKE_ADMIN_* / LIVE_SMOKE_EMPLOYEE_* / LIVE_EXPECT_WECOM_STATUS
 USAGE
 }
 
+qa_join_command() {
+  local command="$1"
+  shift
+  local rendered="$command"
+  local arg
+  local quoted
+
+  for arg in "$@"; do
+    printf -v quoted '%q' "$arg"
+    rendered+=" $quoted"
+  done
+
+  printf '%s' "$rendered"
+}
+
+qa_docker() {
+  if [[ "$QA_DOCKER_USE_SG" == "1" ]]; then
+    local command
+    command="$(qa_join_command docker "$@")"
+    sg docker -c "$command"
+    return
+  fi
+
+  docker "$@"
+}
+
+qa_require_db_client() {
+  case "$QA_DB_CLIENT" in
+    host)
+      qa_require_cmd psql
+      qa_require_cmd createdb
+      qa_require_cmd dropdb
+      ;;
+    docker)
+      qa_require_cmd docker
+      if [[ "$QA_DOCKER_USE_SG" == "1" ]]; then
+        qa_require_cmd sg
+      fi
+
+      if ! qa_docker inspect "$QA_DB_DOCKER_CONTAINER" >/dev/null 2>&1; then
+        echo "[ERROR] PostgreSQL 容器不可用: $QA_DB_DOCKER_CONTAINER" >&2
+        echo "[ERROR] 请确认容器运行，或设置 QA_DB_DOCKER_CONTAINER=<container>。" >&2
+        exit 1
+      fi
+      ;;
+    *)
+      echo "[ERROR] QA_DB_CLIENT 仅支持 host 或 docker，当前: $QA_DB_CLIENT" >&2
+      exit 1
+      ;;
+  esac
+}
+
 qa_port_in_use() {
   python3 - "$QA_HOST" "$QA_PORT" <<'PY'
 import socket, sys
@@ -129,10 +186,22 @@ qa_wait_ready() {
 }
 
 qa_psql() {
+  if [[ "$QA_DB_CLIENT" == "docker" ]]; then
+    qa_docker exec -e "PGPASSWORD=$QA_DB_PASSWORD" "$QA_DB_DOCKER_CONTAINER" \
+      psql -v ON_ERROR_STOP=1 -U "$QA_DB_USER" -d "$QA_DB_ADMIN_DB" "$@"
+    return
+  fi
+
   PGPASSWORD="$QA_DB_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$QA_DB_HOST" -p "$QA_DB_PORT" -U "$QA_DB_USER" -d "$QA_DB_ADMIN_DB" "$@"
 }
 
 qa_createdb() {
+  if [[ "$QA_DB_CLIENT" == "docker" ]]; then
+    qa_docker exec -e "PGPASSWORD=$QA_DB_PASSWORD" "$QA_DB_DOCKER_CONTAINER" \
+      createdb -U "$QA_DB_USER" "$QA_DB_NAME"
+    return
+  fi
+
   PGPASSWORD="$QA_DB_PASSWORD" createdb -h "$QA_DB_HOST" -p "$QA_DB_PORT" -U "$QA_DB_USER" "$QA_DB_NAME"
 }
 
@@ -143,6 +212,12 @@ qa_dropdb() {
   fi
 
   qa_psql -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '${QA_DB_NAME}' AND pid <> pg_backend_pid();" >/dev/null || true
+  if [[ "$QA_DB_CLIENT" == "docker" ]]; then
+    qa_docker exec -e "PGPASSWORD=$QA_DB_PASSWORD" "$QA_DB_DOCKER_CONTAINER" \
+      dropdb --if-exists -U "$QA_DB_USER" "$QA_DB_NAME" >/dev/null || true
+    return
+  fi
+
   PGPASSWORD="$QA_DB_PASSWORD" dropdb --if-exists -h "$QA_DB_HOST" -p "$QA_DB_PORT" -U "$QA_DB_USER" "$QA_DB_NAME" >/dev/null || true
 }
 
@@ -343,9 +418,7 @@ qa_run_live_smoke() {
 case "$MODE" in
   smoke-local)
     qa_require_cmd curl
-    qa_require_cmd psql
-    qa_require_cmd createdb
-    qa_require_cmd dropdb
+    qa_require_db_client
     qa_require_cmd node
     qa_require_cmd npm
     trap qa_cleanup EXIT
@@ -353,9 +426,7 @@ case "$MODE" in
     ;;
   full-local)
     qa_require_cmd curl
-    qa_require_cmd psql
-    qa_require_cmd createdb
-    qa_require_cmd dropdb
+    qa_require_db_client
     qa_require_cmd node
     qa_require_cmd npm
     trap qa_cleanup EXIT