@agile-team/wl-skills-gate 0.13.0 → 0.13.2

package/scripts/lib-tests/jenkins-ops-checks.test.mjs

@@ -0,0 +1,171 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { readFileSync, existsSync, rmSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { fixture, bind, put, git } from '../test-support/jenkins-fixture.mjs';
+import { planJenkinsInstallation, applyJenkinsInstallation } from '../../lib/jenkins-installation.js';
+import { loadJenkinsCluster } from '../../lib/jenkins-cluster.js';
+import { digest } from '../../lib/jenkins-integration.js';
+import { stableStringify } from '../../lib/util.js';
+import { nativePipelineEntry } from '../../lib/jenkins-entry-contract.js';
+import { renderFleetJob } from '../../lib/jenkins-job-config.js';
+import { claimOpsCheck, acknowledgeOpsCheck } from '../../lib/jenkins-ops-checks.js';
+
+const env = { WL_JENKINS_READ_USER: 'fixture-reader', WL_JENKINS_READ_TOKEN: 'private-fixture-read-token' };
+const read = file => JSON.parse(readFileSync(file));
+const hash = value => digest(stableStringify(value));
+async function setup(t) {
+  const f = fixture(t);
+  const options = { prefix: path.join(f.base, 'install'), configDir: path.join(f.base, 'config'), registryFiles: [f.registryFile], jenkinsOrigin: 'https://jenkins.example.invalid/', centralAgentLabel: 'central', reviewSignerAgentLabel: 'signer' };
+  const plan = planJenkinsInstallation(options), installed = applyJenkinsInstallation({ ...options, confirm: true, planHash: plan.planHash });
+  await bind(f);
+  const registry = read(f.registryFile); registry.nativeEntry = installed.nativeEntry; put(f.base, 'bindings.json', registry);
+  for (const name of ['automation-config', 'governance-config', 'control-config', 'review-publish-config']) put(options.configDir, name + '.json', {
+    schemaVersion: 1, projects: { 'wl-produce': {} }, sources: [{ id: 'fixture' }], dataDir: f.base, publicKeyFile: 'approved-fixture.pem', identity: { provider: 'fixture' }, authorizationIssuer: 'fixture', reviewPrivateKeyEnv: 'FIXTURE_PRIVATE_FILE',
+  });
+  put(options.configDir, 'jenkins-fleet.json', { schemaVersion: 1, kind: 'wl-gate-jenkins-fleet', jenkinsOrigin: options.jenkinsOrigin, dataDir: path.join(f.base, 'fleet'), registryFiles: [f.registryFile], automationConfigFile: path.join(options.configDir, 'automation-config.json'), selection: { projects: ['wl-produce'], branches: ['test'] }, approvers: ['fixture'] });
+  const binding = registry.bindings[0], cluster = loadJenkinsCluster(installed.clusterFile);
+  let xml = renderFleetJob({ script: nativePipelineEntry(installed.nativeEntry), binding, mode: 'check', secret: 'fixture-shared-gitlab-secret' });
+  const project = { key: 'a'.repeat(24), project: binding.project, branch: binding.branch, scope: binding.scope, job: binding.jobs.check, jobs: [binding.jobs.check], status: 'ready', gaps: [], pinsVerified: true, entryVerified: true, checkJob: binding.jobs.check, bindingId: binding.id, registryFile: f.registryFile, bindingHash: hash(binding), sha: git(f.root, 'rev-parse', 'HEAD'), configHash: digest(xml) };
+  const report = { schemaVersion: 1, kind: 'jenkins-ops-report', runId: randomUUID(), checkedAt: new Date().toISOString(), clusterHash: cluster.configHash, jenkinsOrigin: options.jenkinsOrigin, status: 'ready', globalGaps: [], projects: [project], qualityPassed: false, buildAuthorized: false };
+  const reports = path.join(options.configDir, 'ops-state/runs');
+  const save = value => put(reports, value.runId + '/report.json', value);
+  save(report);
+  const runs = new Map(), summaries = new Map(), calls = [];
+  let failReads = false;
+  const response = data => new Response(JSON.stringify(data));
+  const fetchImpl = async (url, request = {}) => {
+    const u = new URL(url); calls.push(u.pathname + u.search);
+    assert.equal(u.origin, 'https://jenkins.example.invalid'); assert.equal(request.method, 'GET');
+    assert.equal(request.headers.Authorization, 'Basic ' + Buffer.from('fixture-reader:private-fixture-read-token').toString('base64'));
+    assert.equal(request.redirect, 'error');
+    if (failReads) throw Error('network-private-token');
+    if (u.pathname.endsWith('/config.xml')) return new Response(xml);
+    const build = /\/([0-9]+)\/api\/json$/.exec(u.pathname);
+    if (build) return runs.has(build[1]) ? response(runs.get(build[1])) : new Response('', { status: 404 });
+    if (u.pathname.endsWith('/api/json')) return response({ builds: [...runs.values()].sort((a, b) => b.number - a.number).slice(0, 25) });
+    const artifact = /\/([0-9]+)\/artifact\/quality-reports\/quality-summary\.json$/.exec(u.pathname);
+    if (artifact) return summaries.has(artifact[1]) ? response(summaries.get(artifact[1])) : new Response('', { status: 404 });
+    throw Error('unexpected Jenkins route');
+  };
+  const args = { clusterFile: installed.clusterFile, runId: report.runId, key: project.key, env, fetchImpl };
+  const stateFile = path.join(options.configDir, 'ops-state/checks.json');
+  const state = () => read(stateFile), current = () => Object.values(state().claims)[0];
+  const run = (number, claim, extra = {}) => ({ number, building: false, result: 'SUCCESS', actions: [{ parameters: [{ name: 'WL_GATE_DISPATCH_ID', value: claim.dispatchId }, { name: 'WL_REVIEW_SHA', value: claim.sha }] }], artifacts: [], ...extra });
+  return { ...f, args, report, project, options, binding, reports, save, stateFile, state, current, runs, summaries, calls, run, xml: () => xml, setXml: value => { xml = value; }, setFailReads: value => { failReads = value; } };
+}
+
+test('首次claim持久保存唯一dispatch和候选SHA；ack实际编号幂等，运行中和成功跨轮不重复', async t => {
+  const f = await setup(t), claimed = await claimOpsCheck(f.args);
+  assert.equal(claimed.status, 'claimed'); assert.equal(claimed.sha, f.project.sha); assert.match(claimed.dispatchId, /^[a-f0-9-]{36}$/);
+  assert.equal(claimed.attempt, 1); assert.equal(f.current().status, 'claimed'); assert.equal(f.current().dispatchId, claimed.dispatchId);
+  assert.equal((await claimOpsCheck(f.args)).status, 'unknown');
+  await assert.rejects(acknowledgeOpsCheck({ ...f.args, buildNumber: 0 }), /实际Jenkins运行编号/);
+  await assert.rejects(acknowledgeOpsCheck({ ...f.args, runId: randomUUID(), buildNumber: 31 }), /不存在唯一/);
+  assert.equal((await acknowledgeOpsCheck({ ...f.args, buildNumber: 31 })).status, 'started');
+  assert.equal((await acknowledgeOpsCheck({ ...f.args, buildNumber: 31 })).status, 'started');
+  await assert.rejects(acknowledgeOpsCheck({ ...f.args, buildNumber: 32 }), /不能覆盖/);
+  f.runs.set('31', f.run(31, claimed, { building: true, result: null }));
+  assert.equal((await claimOpsCheck(f.args)).status, 'already-started');
+  f.runs.set('31', f.run(31, claimed));
+  const next = { ...f.report, runId: randomUUID() }; f.save(next);
+  assert.equal((await claimOpsCheck({ ...f.args, runId: next.runId })).status, 'already-started');
+  assert.equal(f.current().attempt, 1);
+});
+test('启动返回前中断，凭近期25次运行的dispatchId及SHA找到唯一实际运行后补ack', async t => {
+  const f = await setup(t), claimed = await claimOpsCheck(f.args);
+  f.runs.set('7', f.run(7, claimed));
+  const pending = { ...f.report, runId: randomUUID(), status: 'attention', projects: [{ ...f.project, status: 'attention', gaps: [{ id: 'CHECK-DISPATCH-UNKNOWN', message: '待核对实际启动' }] }] }; f.save(pending);
+  const reconciled = await claimOpsCheck({ ...f.args, runId: pending.runId });
+  assert.equal(reconciled.status, 'already-started'); assert.equal(reconciled.buildNumber, '7');
+  assert.equal(f.current().status, 'started'); assert.equal(f.current().attempt, 1);
+  assert(f.calls.some(c => c.includes('{0,25}') || c.includes('%7B0,25%7D')));
+});
+test('未知启动不盲发；一分钟观察后只有显式确认且对账无匹配才可有界重试', async t => {
+  const f = await setup(t), instant = Date.now(), claimed = await claimOpsCheck({ ...f.args, now: instant });
+  assert.equal((await claimOpsCheck({ ...f.args, now: instant + 60001 })).status, 'unknown');
+  assert.equal((await claimOpsCheck({ ...f.args, now: instant + 1000, retryUnknown: true })).status, 'unknown');
+  const retry = await claimOpsCheck({ ...f.args, now: instant + 60001, retryUnknown: true });
+  assert.equal(retry.status, 'claimed'); assert.equal(retry.attempt, 2); assert.notEqual(retry.dispatchId, claimed.dispatchId);
+  assert.equal(f.current().history[0].dispatchId, claimed.dispatchId);
+  await assert.rejects(acknowledgeOpsCheck({ ...f.args, buildNumber: 31, dispatchId: claimed.dispatchId }), /迟到或其他dispatchId/);
+  assert.equal(f.current().status, 'claimed');
+  assert.equal((await acknowledgeOpsCheck({ ...f.args, buildNumber: 32, dispatchId: retry.dispatchId })).status, 'started');
+});
+test('重复追踪、错误SHA、不可读运行都不能被当成无运行重新启动', async t => {
+  const f = await setup(t), instant = Date.now(), claimed = await claimOpsCheck({ ...f.args, now: instant });
+  f.runs.set('7', f.run(7, claimed)); f.runs.set('8', f.run(8, claimed));
+  assert.equal((await claimOpsCheck({ ...f.args, now: instant + 60001, retryUnknown: true })).status, 'unknown');
+  f.runs.clear(); await acknowledgeOpsCheck({ ...f.args, buildNumber: 9 });
+  f.runs.set('9', f.run(9, { ...claimed, sha: 'b'.repeat(40) }));
+  assert.equal((await claimOpsCheck({ ...f.args, retryUnknown: true })).status, 'unknown');
+  f.runs.clear(); assert.equal((await claimOpsCheck({ ...f.args, retryUnknown: true })).status, 'unknown');
+  assert.equal(f.current().attempt, 1);
+});
+test('只读重验实际Job摘要、受控入口、参数和目标Push触发；漂移先于写启动台账被拒绝', async t => {
+  const f = await setup(t), original = f.xml();
+  f.setXml(original.replace('<includeBranchesSpec>test</includeBranchesSpec>', '<includeBranchesSpec>sit</includeBranchesSpec>'));
+  await assert.rejects(claimOpsCheck(f.args), /配置已漂移/); assert(!existsSync(f.stateFile));
+  // Even a matching updated digest cannot turn an unprotected script into a
+  // CHECK. This isolates the semantic check from the raw config pin check.
+  f.setXml(original.replace('<sandbox>true</sandbox>', '<sandbox>false</sandbox>'));
+  f.project.configHash = digest(f.xml()); f.save(f.report);
+  await assert.rejects(claimOpsCheck(f.args), /受控入口/); assert(!existsSync(f.stateFile));
+  f.setXml(original.replace('<name>WL_REVIEW_SHA</name>', '<name>OTHER_SHA</name>')); f.project.configHash = digest(f.xml()); f.save(f.report);
+  await assert.rejects(claimOpsCheck(f.args), /候选SHA或启动追踪参数/); assert(!existsSync(f.stateFile));
+});
+test('过期、未来、其他集群、BUILD或缺pins的报告不可借旧ready触发', async t => {
+  const f = await setup(t), original = structuredClone(f.report);
+  for (const mutate of [
+    r => { r.checkedAt = new Date(Date.now() - 31 * 60000).toISOString(); },
+    r => { r.checkedAt = new Date(Date.now() + 60000).toISOString(); },
+    r => { r.clusterHash = 'b'.repeat(64); },
+    r => { r.globalGaps = [{ id: 'CENTRAL-CONFIG' }]; },
+    r => { r.projects[0].pinsVerified = false; },
+    r => { r.projects[0].checkJob = 'produce/BUILD'; },
+    r => { r.projects[0].gaps = [{ id: 'PROJECT-GATE' }]; r.projects[0].status = 'attention'; },
+  ]) {
+    const value = structuredClone(original); mutate(value); f.save(value);
+    await assert.rejects(claimOpsCheck(f.args), /巡检报告|仅本轮/); assert(!existsSync(f.stateFile));
+  }
+});
+test('已核验实际终止的环境失败可重试；同一SHA最多三次，台账完整保存每次dispatch', async t => {
+  const f = await setup(t); let claim = await claimOpsCheck(f.args);
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    assert.equal(claim.attempt, attempt);
+    await acknowledgeOpsCheck({ ...f.args, buildNumber: 10 + attempt });
+    f.runs.set(String(10 + attempt), f.run(10 + attempt, claim, { building: false, result: attempt === 2 ? 'ABORTED' : 'FAILURE', artifacts: [] }));
+    const next = await claimOpsCheck(f.args);
+    if (attempt < 3) { assert.equal(next.status, 'claimed'); assert.notEqual(next.dispatchId, claim.dispatchId); claim = next; }
+    else assert.equal(next.status, 'retry-limit');
+  }
+  assert.equal(f.current().history.length, 2); assert.equal(f.current().attempt, 3);
+});
+test('真实质量发现失败不自动重刷；报告下载失败不能冒充无质量原件', async t => {
+  const f = await setup(t), claim = await claimOpsCheck(f.args);
+  await acknowledgeOpsCheck({ ...f.args, buildNumber: 17 });
+  f.runs.set('17', f.run(17, claim, { result: 'FAILURE', artifacts: [{ relativePath: 'quality-reports/quality-summary.json' }] }));
+  const noOriginal = await claimOpsCheck(f.args); assert.equal(noOriginal.status, 'failed-needs-confirmation');
+  f.summaries.set('17', { run: { project: f.project.project, commitSha: claim.sha, stage: 'ci' }, findings: [{ severity: 'error', ruleId: 'FIXTURE/RISK' }], checks: [{ status: 'passed' }] });
+  assert.equal((await claimOpsCheck(f.args)).status, 'quality-failed');
+  assert.equal((await claimOpsCheck({ ...f.args, retryKnownFailure: true })).status, 'quality-failed');
+  assert.equal(f.current().attempt, 1);
+});
+test('不完整质量结果只读留待确认，明确非代码执行失败才可自动复检', async t => {
+  const f = await setup(t), claim = await claimOpsCheck(f.args);
+  await acknowledgeOpsCheck({ ...f.args, buildNumber: 19 });
+  f.runs.set('19', f.run(19, claim, { result: 'FAILURE', artifacts: [{ relativePath: 'quality-reports/quality-summary.json' }] }));
+  f.summaries.set('19', { run: { project: f.project.project, commitSha: claim.sha, stage: 'ci' }, findings: [], checks: [{ status: 'invalid' }] });
+  assert.equal((await claimOpsCheck(f.args)).status, 'failed-needs-confirmation');
+  f.summaries.set('19', { run: { project: f.project.project, commitSha: claim.sha, stage: 'ci' }, findings: [], checks: [{ status: 'passed' }] });
+  assert.equal((await claimOpsCheck(f.args)).status, 'claimed');
+  assert.equal(f.current().attempt, 2);
+});
+test('台账或工程配置损坏不能忽略后重新启动', async t => {
+  const f = await setup(t); await claimOpsCheck(f.args);
+  put(path.dirname(f.stateFile), 'checks.json', { schemaVersion: 1, claims: null });
+  await assert.rejects(claimOpsCheck(f.args), /台账损坏/);
+  rmSync(path.join(f.options.configDir, 'control-config.json'));
+  await assert.rejects(claimOpsCheck(f.args), /工程配置变化/);
+});

package/scripts/lib-tests/jenkins-ops-native.test.mjs

@@ -0,0 +1,248 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync, existsSync, mkdtempSync, writeFileSync, rmSync} from 'node:fs';
+import {spawnSync} from 'node:child_process';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+
+// These are boundaries of the package-owned Jenkins adapter, not a claim that a
+// text inspection validates Jenkins CPS or the site's credential permissions.
+const native = () => readFileSync(new URL('../../templates/ci/jenkins-native.groovy', import.meta.url), 'utf8');
+
+function endOfBlock(text, open) {
+  let depth = 1, quote = null;
+  for (let i = open + 1; i < text.length; i++) {
+    if (quote) {
+      if (text[i] === '\\') { i++; continue; }
+      if (text.startsWith(quote, i)) { i += quote.length - 1; quote = null; }
+      continue;
+    }
+    if (text.startsWith('//', i)) { const end = text.indexOf('\n', i); i = end < 0 ? text.length : end; continue; }
+    if (text.startsWith('/*', i)) { const end = text.indexOf('*/', i + 2); assert.notEqual(end, -1, 'unterminated Groovy comment'); i = end + 1; continue; }
+    for (const delimiter of ["'''", '"""', "'", '"']) {
+      if (text.startsWith(delimiter, i)) { quote = delimiter; i += delimiter.length - 1; break; }
+    }
+    if (quote) continue;
+    if (text[i] === '{') depth++;
+    if (text[i] === '}' && --depth === 0) return i;
+  }
+  throw Error('unterminated Groovy block');
+}
+
+function opsMethod(source, name = 'wlOpsRun') {
+  const header = new RegExp('\\bdef\\s+' + name + '\\s*\\([^)]*\\)\\s*\\{').exec(source);
+  assert(header, 'doctor must have the package-owned ' + name + ' adapter');
+  const open = header.index + header[0].lastIndexOf('{');
+  return source.slice(open + 1, endOfBlock(source, open));
+}
+
+function credentialBlocks(source) {
+  const scopes = [];
+  for (const match of source.matchAll(/\bwithCredentials\s*\(/g)) {
+    const open = source.indexOf('{', match.index);
+    assert(open >= 0, 'credential binding must have an explicit closure');
+    const end = endOfBlock(source, open);
+    scopes.push({declaration: source.slice(match.index, open), body: source.slice(open + 1, end)});
+  }
+  return scopes;
+}
+
+test('运维监督无需项目登记即可先盘点，检查与通知为三个独立动作', () => {
+  const helper = opsMethod(native());
+  const inventory = helper.indexOf('jenkins ops inventory');
+  const inspect = helper.indexOf('jenkins ops inspect');
+  const finish = helper.indexOf('jenkins ops finish');
+  assert(inventory >= 0 && inspect > inventory && finish > inspect, 'inventory → inspect → finish must be explicit');
+  assert.match(helper, /--cluster/);
+  assert.match(helper, /--target/);
+  assert.match(helper, /--inventory/);
+  assert.match(helper, /--results/);
+  assert.doesNotMatch(helper, /jenkins fleet (?:inventory|plan|apply)|jenkins (?:bind|plan)|review-publish|jenkins (?:admit|build)/,
+    'ops supervision must not require the project registry or silently authorize a build/review');
+});
+
+test('源码检出和项目接入检查不持有Jenkins接口、飞书或签发凭据', () => {
+  const helper = opsMethod(native());
+  const scopes = credentialBlocks(helper);
+  assert(scopes.length >= 2, 'read credentials and notice credentials must be separately scoped');
+  for (const scope of scopes) {
+    assert.doesNotMatch(scope.body, /\bcheckout\s*\(|jenkins ops inspect/,
+      'SCM checkout/inspection must happen outside API and bot credential closures');
+    assert.doesNotMatch(scope.declaration, /wl-jenkins-config-manager|wl-jenkins-build-dispatch|wl-review-signing-key|wl-quality-sso-client-secret/,
+      'read-only supervision cannot obtain write, dispatch, signing or SSO credentials');
+  }
+  const reader = scopes.find(scope => scope.body.includes('jenkins ops inventory'));
+  const notifier = scopes.find(scope => scope.body.includes('jenkins ops finish'));
+  assert(reader, 'inventory must use a scoped Jenkins read credential');
+  assert(notifier, 'finish must use a scoped CI bot credential');
+  assert.match(reader.declaration, /wl-jenkins-ci-readonly/);
+  assert.doesNotMatch(reader.declaration, /feishu/);
+  assert.match(notifier.declaration, /wl-feishu-ci-webhook/);
+  assert.match(notifier.declaration, /wl-feishu-ci-signing-secret/);
+  assert.doesNotMatch(notifier.declaration, /wl-feishu-project|wl-jenkins-ci-readonly/);
+});
+
+test('项目检查失败仍进入汇总，运维报告归档且不启动旧部署任务', () => {
+  const helper = opsMethod(native());
+  assert.match(helper, /\btry\s*\{/);
+  assert.match(helper, /\bfinally\s*\{/,
+    'inspection failures need a finally path for the aggregate report/notice');
+  assert.match(helper, /archiveArtifacts/);
+  assert.match(helper, /returnStatus\s*:\s*true/,
+    'a missing project prerequisite must be recorded before ending the monitoring run');
+  assert.doesNotMatch(helper, /\bbuild\s*\(|\/buildWithParameters|\/build[?'"`\s]|createItem|config\.xml/,
+    'supervision does not rewrite or execute discovered custom deployment jobs');
+});
+
+test('默认doctor执行监督，机器人测试仅走显式连通测试', () => {
+  const source = native();
+  assert.match(source, /cfg\.role\s*==\s*['"]node['"]/);
+  assert.match(source, /params\.TEST_NOTIFICATION/);
+  const call = source.lastIndexOf('wlOpsRun(cfg)');
+  assert(call > source.indexOf('def call('), 'node routing must invoke the ops adapter by default');
+  assert.match(source, /wlGateNotificationTest\(\)/);
+});
+
+test('承接仅启动持久claim给出的CHECK，启动后记录实际编号，未持有通知或签发凭据', () => {
+  const helper = opsMethod(native(), 'wlOpsContinue');
+  const claim = helper.indexOf('jenkins ops claim-check'), build = helper.indexOf('build('), ack = helper.indexOf('jenkins ops ack-check');
+  assert(claim >= 0 && build > claim && ack > build, 'durable claim → actual CHECK start → actual number acknowledgment');
+  assert.match(helper, /claim\.status\s*==\s*['"]claimed['"]/);
+  assert.match(helper, /build\(job:\s*claim\.job/);
+  assert.match(helper, /waitForStart:\s*true/);
+  assert.match(helper, /--build-number/);
+  assert.match(helper, /--dispatch-id/);
+  assert.match(helper, /started\.number/);
+  assert.match(helper, /name:\s*['"]WL_REVIEW_SHA['"],\s*value:\s*claim\.sha/);
+  assert.match(helper, /name:\s*['"]WL_GATE_DISPATCH_ID['"],\s*value:\s*claim\.dispatchId/);
+  for (const scope of credentialBlocks(helper)) {
+    assert.doesNotMatch(scope.declaration, /feishu|signing-key|build-dispatch|config-manager|sso-client-secret/);
+    assert.doesNotMatch(scope.body, /\bbuild\s*\(/, 'Jenkins interface credentials must end before the child CHECK starts');
+  }
+  assert.doesNotMatch(helper, /review-publish|jenkins (?:admit|build)|\/buildWithParameters/);
+  assert.match(helper, /archiveArtifacts/);
+  assert.match(opsMethod(native()), /wlOpsContinue\(cfg,\s*summary\)/);
+});
+
+test('人工终止不继续检出，通知凭据失败仍保留无发送汇总与归档', () => {
+  const helper = opsMethod(native());
+  assert.match(helper, /catch\s*\(org\.jenkinsci\.plugins\.workflow\.steps\.FlowInterruptedException interrupted\)\s*\{\s*throw interrupted\s*\}/);
+  assert.match(helper, /finally\s*\{\s*deleteDir\(\)\s*\}/);
+  const finishes = helper.split('\n').filter(command => /\bjenkins ops finish\b/.test(command));
+  assert(finishes.some(command => /--send\b/.test(command)), 'configured bot must send the summary');
+  assert(finishes.some(command => !/--send\b/.test(command)), 'missing credential path must still generate a non-sending summary');
+  assert.match(helper, /finally\s*\{\s*archiveArtifacts/);
+});
+
+test('原生Groovy执行监督与承接：凭据隔离、固定SHA、失败不漏档且继续其它项目', {skip: !process.env.WL_GROOVY_JAR}, t => {
+  const jar = process.env.WL_GROOVY_JAR;
+  assert(existsSync(jar), 'WL_GROOVY_JAR must point to an existing Groovy runtime');
+  const directory = mkdtempSync(path.join(tmpdir(), 'wl-ops-groovy-'));
+  t.after(() => rmSync(directory, {recursive: true, force: true}));
+  const harness = path.join(directory, 'ops.groovy');
+  writeFileSync(harness, String.raw`
+def loader = new GroovyClassLoader()
+def interruptedClass = loader.parseClass('package org.jenkinsci.plugins.workflow.steps; class FlowInterruptedException extends Exception { FlowInterruptedException(String message) { super(message) } }')
+def parser = loader.parseClass('package groovy.json; class JsonSlurperClassic { static Map values=[:]; def parseText(String text) { assert values.containsKey(text):text; return values[text] } }')
+def source = new File(args[0]).text
+for (def mode in ['normal', 'no-bot', 'interrupted', 'claim-failure', 'claim-missing', 'claim-unknown', 'already-started', 'ack-failure']) {
+  def events=[], files=[:], env=[:], currentBuild=[:], working=[], credentials=0, builds=0, cleanups=0, startedKeys=[], acknowledgedKeys=[]
+  def multi=mode in ['claim-failure', 'claim-missing', 'claim-unknown', 'ack-failure']
+  def inventory=[runId:'fixture-run', jobsDiscovered:2, targets:[[key:'a'*24, checkoutAllowed:true, branch:'test', repository:'https://gitlab.example.invalid/group/produce.git', credentialId:'scm'],[key:'b'*24, checkoutAllowed:false, branch:null]]]
+  def summary=[runId:'fixture-run', globalGaps:(mode in ['no-bot','interrupted'] ? [[id:'pending']] : []), projects:[[key:'a'*24, status:'ready', checkJob:'produce/CHECK']]]
+  if(multi){inventory.targets[1]=[key:'b'*24,checkoutAllowed:true,branch:'test',repository:'https://gitlab.example.invalid/group/produce.git',credentialId:'scm'];summary.projects<<[key:'b'*24,status:'ready',checkJob:'produce/NEXT-CHECK']}
+  def claim=[status:'claimed', job:'produce/CHECK', sha:'c'*40, dispatchId:'ops-fixture-approved-check']
+  def nextClaim=[status:'claimed', job:'produce/NEXT-CHECK', sha:'d'*40, dispatchId:'ops-fixture-next-check']
+  parser.values=[inventory:inventory, summary:summary, claim:claim, nextClaim:nextClaim, unknown:[status:'unknown',reason:'fixture start unknown'], already:[status:'already-started',job:'produce/CHECK']]
+  Binding binding=new Binding([env:env, params:[:], currentBuild:currentBuild])
+  def shell=new GroovyShell(loader,binding)
+  binding.setVariable('pwd',{->'/workspace'})
+  binding.setVariable('dir',{location,body->working<<location;try{return body()}finally{working.remove(working.size()-1)}})
+  binding.setVariable('deleteDir',{->cleanups++;events<<'cleanup'})
+  binding.setVariable('writeFile',{options->files[options.file]=options.text})
+  binding.setVariable('readFile',{location->def key=location.toString();assert files.containsKey(key):key;return files[key]})
+  binding.setVariable('fileExists',{location->files.containsKey(location.toString())})
+  binding.setVariable('archiveArtifacts',{options->events<<'archive'})
+  binding.setVariable('stage',{name,body->events<<name;body()})
+  binding.setVariable('timeout',{options,body->body()})
+  binding.setVariable('echo',{message->events<<'echo'})
+  binding.setVariable('withEnv',{values,body->def old=new LinkedHashMap(env);values.each{value->def pair=value.split('=',2);env[pair[0]]=pair[1]};try{return body()}finally{env.clear();env.putAll(old)}})
+  ['usernamePassword','string','file'].each{name->binding.setVariable(name,{options->options})}
+  binding.setVariable('withCredentials',{values,body->
+    if(mode=='no-bot'&&values.any{it.credentialsId.startsWith('wl-feishu')})throw new RuntimeException('fixture missing bot credential')
+    def old=new LinkedHashMap(env);credentials++
+    values.each{value->if(value.variable)env[value.variable]='fixture';if(value.usernameVariable){env[value.usernameVariable]='fixture';env[value.passwordVariable]='fixture'}}
+    try{return body()}finally{credentials--;env.clear();env.putAll(old)}
+  })
+  binding.setVariable('checkout',{options->
+    assert credentials==0:'SCM checkout held API/bot credentials'
+    assert options.scm.branches[0].name=='origin/test'
+    assert options.scm.userRemoteConfigs[0].credentialsId=='scm'
+    events<<'checkout'
+    if(mode=='interrupted')throw interruptedClass.newInstance('fixture manual cancellation')
+    return [GIT_COMMIT:'c'*40]
+  })
+  binding.setVariable('build',{options->
+    assert credentials==0:'CHECK start held interface/bot credentials'
+    def expected=env.WL_OPS_KEY=='a'*24?claim:nextClaim
+    assert options.job==expected.job
+    assert options.waitForStart==true&&options.wait==false&&options.propagate==false
+    assert options.parameters.find{it.name=='WL_REVIEW_SHA'}.value==expected.sha
+    assert options.parameters.find{it.name=='WL_GATE_DISPATCH_ID'}.value==expected.dispatchId
+    builds++;startedKeys<<env.WL_OPS_KEY;events<<'CHECK-start';return [number:40+builds]
+  })
+  binding.setVariable('sh',{options->
+    String command=options instanceof Map?options.script:options
+    if(command.contains('jenkins ops inventory')){assert env.WL_JENKINS_READ_TOKEN;assert !env.WL_FEISHU_CI_SECRET;files['wl-ops-public/inventory.json']='inventory';events<<'inventory'}
+    else if(command.contains('jenkins ops inspect')){assert credentials==0;events<<'inspect'}
+    else if(command.contains('jenkins ops finish')){if(command.contains('--send'))assert env.WL_FEISHU_CI_SECRET;else assert credentials==0;files['wl-ops-public/summary.json']='summary';events<<'finish';return mode in ['no-bot','interrupted']?2:0}
+    else if(command.contains('jenkins ops claim-check')){
+      assert env.WL_JENKINS_READ_TOKEN;assert !env.WL_FEISHU_CI_SECRET;events<<'claim'
+      if(env.WL_OPS_KEY=='a'*24&&mode=='claim-failure')return 2
+      if(env.WL_OPS_KEY=='a'*24&&mode=='claim-missing')return 0
+      files[env.WL_OPS_CLAIM]=env.WL_OPS_KEY=='b'*24?'nextClaim':mode=='claim-unknown'?'unknown':mode=='already-started'?'already':'claim'
+    }
+    else if(command.contains('jenkins ops ack-check')){
+      def expected=env.WL_OPS_KEY=='a'*24?claim:nextClaim
+      assert env.WL_OPS_BUILD==(40+builds).toString()
+      assert env.WL_OPS_DISPATCH==expected.dispatchId
+      assert command.contains('--dispatch-id')
+      if(mode=='ack-failure'&&env.WL_OPS_KEY=='a'*24)throw new RuntimeException('fixture ACK write failed')
+      acknowledgedKeys<<env.WL_OPS_KEY;events<<'ack'
+    }
+    else assert false:command
+    return 0
+  })
+  def script=shell.parse(source,'native_ops.groovy');script.run()
+  def failure=null
+  try{script.wlOpsRun([gateRoot:'/fixed/gate',clusterFile:'/controlled/cluster.json'])}catch(Exception expected){failure=expected}
+  assert events.contains('inventory')&&events.contains('finish')&&events.contains('archive')
+  assert credentials==0
+  if(mode=='normal'){
+    assert failure==null:failure
+    assert builds==1&&events.indexOf('claim')<events.indexOf('CHECK-start')&&events.indexOf('CHECK-start')<events.indexOf('ack')
+    assert events.count('inspect')==2
+  }else if(mode=='no-bot'){
+    assert failure==null:failure
+    assert builds==0&&currentBuild.result=='UNSTABLE'
+  }else if(mode=='interrupted'){
+    assert interruptedClass.isInstance(failure)
+    assert builds==0&&events.count('checkout')==1&&events.count('inspect')==0
+    assert cleanups>=2
+  }else if(mode=='already-started'){
+    assert failure==null:failure
+    assert builds==0&&currentBuild.result==null
+  }else{
+    assert failure==null:failure
+    assert currentBuild.result=='UNSTABLE'
+    assert events.count('archive')>=2
+    if(mode=='ack-failure'){assert startedKeys==['a'*24,'b'*24];assert acknowledgedKeys==['b'*24]}
+    else{assert startedKeys==['b'*24];assert acknowledgedKeys==['b'*24]}
+  }
+}
+println 'Operations native Groovy mock passed: normal/no-bot/interrupted/claim-failure/claim-missing/claim-unknown/already-started/ack-failure.'
+`);
+  const result = spawnSync(process.env.JAVA || 'java', ['-cp', jar, 'groovy.ui.GroovyMain', harness, new URL('../../templates/ci/jenkins-native.groovy', import.meta.url).pathname], {encoding: 'utf8', timeout: 30000});
+  assert.equal(result.status, 0, result.stderr + '\n' + result.stdout);
+  assert.match(result.stdout, /Operations native Groovy mock passed/);
+});

package/scripts/lib-tests/jenkins-ops-notification.test.mjs

@@ -0,0 +1,88 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHmac } from 'node:crypto';
+import { opsNotification, sendOpsNotification } from '../../lib/jenkins-ops-notification.js';
+
+const report = () => ({ kind: 'jenkins-ops-report', checkedAt: '2026-10-22T01:02:03Z', jenkinsOrigin: 'https://jenkins.example.invalid/', runUrl: 'https://jenkins.example.invalid/job/doctor/7/', status: 'attention', globalGaps: [], projects: [{ key: 'p:test', project: 'wl-produce', branch: 'test', jobs: ['p-test'], status: 'attention', gaps: [{ id: 'gate-package-missing', message: '项目未安装Gate', action: '技术经理执行项目接入，再自动复检' }], technicalManager: 'manager', executor: 'author' }], remoteModified: false, qualityPassed: false, buildAuthorized: false });
+const person = (name, id, verified = true) => ({ name, feishu: { idType: 'user_id', id, verified } });
+const config = () => ({ people: { manager: person('经理', 'verified-manager'), author: person('执行人', 'verified-author'), observer: person('李月', 'verified-observer') }, owners: { 'wl-produce': { technicalManager: 'manager', managerSubmissionNotify: 'observer' } } });
+const json = value => JSON.stringify(value);
+const env = { WL_FEISHU_CI_WEBHOOK: 'https://open.feishu.cn/open-apis/bot/v2/hook/ci-fixture', WL_FEISHU_CI_SECRET: 'fixture-secret' };
+
+test('运维缺项通知无需项目配置：时间、缺项、动作与真实@；不冒充质量通过', () => {
+  const out = opsNotification(report(), config()), content = json(out.payload);
+  assert.deepEqual(out.mentions.sort(), ['verified-author', 'verified-manager']);
+  assert.equal(out.mentionMappingComplete, true);
+  assert.match(content, /2026年10月22日 09:02:03/);
+  assert.match(content, /项目未安装Gate/); assert.match(content, /自动复检/); assert.match(content, /未接入不等于扫描通过/);
+  assert.match(content, /<at id=\\"verified-manager/); assert.match(content, /查看本次接入检查/);
+});
+test('姓名工号不推断飞书身份；无真实ID仍发送缺项卡', () => {
+  const c = config(); c.people.manager.feishu.verified = false; c.people.author = { name: '杨晨誉', employeeId: '409322' };
+  const out = opsNotification(report(), c);
+  assert.equal(out.mentionMappingComplete, false); assert.deepEqual(out.mentions, []);
+  assert.doesNotMatch(json(out.payload), /<at /); assert.match(json(out.payload), /真实 @ 尚未配置/);
+});
+test('同一人员去重，经理本人提交才同步指定观察人', () => {
+  const r = report(); r.projects[0].executor = 'manager';
+  const out = opsNotification(r, config()), content = json(out.payload);
+  assert.deepEqual(out.mentions.sort(), ['verified-manager', 'verified-observer']);
+  assert.equal((content.match(/<at id=\\"verified-manager/g) || []).length, 1);
+  assert.equal((content.match(/<at id=\\"verified-observer/g) || []).length, 1);
+});
+test('同一飞书ID的不同人员键去重；额外主责和公共兜底人都实际出现在卡片中', () => {
+  const r = report(), c = config(); c.people.author.feishu.id = c.people.manager.feishu.id;
+  c.people.ops = person('运维', 'verified-ops'); c.owners['wl-produce'].recipients = ['ops']; c.fallbackRecipients = ['observer'];
+  const out = opsNotification(r, c), content = json(out.payload);
+  assert.deepEqual(out.mentions.sort(), ['verified-manager', 'verified-observer', 'verified-ops']);
+  for (const id of out.mentions) assert.equal((content.match(new RegExp('<at id=\\\\"' + id, 'g')) || []).length, 1);
+});
+test('项目限前三摘要，但所有项目责任人仍提醒；不修改输入', () => {
+  const r = report(), c = config();
+  r.projects = Array.from({ length: 5 }, (_, i) => ({ ...r.projects[0], key: 'project-' + i, project: 'project-' + i, technicalManager: 'm' + i, executor: 'a' + i }));
+  for (let i = 0; i < 5; i++) { c.people['m' + i] = person('经理' + i, 'manager-' + i); c.people['a' + i] = person('执行人' + i, 'author-' + i); }
+  const before = json(r), out = opsNotification(r, c), content = json(out.payload);
+  assert.match(content, /3\/5/); assert.doesNotMatch(content, /project-3 ·/); assert.equal(out.mentions.length, 10); assert.equal(json(r), before);
+});
+test('仅真实同源HTTPS本次记录可点击，缺失地址不伪造详情页', () => {
+  for (const url of [undefined, 'http://localhost:8090/', 'https://attacker.invalid/', 'https://jenkins.example.invalid/?token=private']) {
+    const r = report(); r.runUrl = url; const out = opsNotification(r);
+    assert.doesNotMatch(json(out.payload), /open_url/); assert.doesNotMatch(json(out.payload), /private/);
+  }
+});
+test('全局缺项分类且限前两条；恢复卡绿色但仍要求九维和Review', () => {
+  const r = report(); r.globalGaps = Array.from({ length: 4 }, (_, i) => ({ id: 'credential-' + i, message: '公共凭据缺项' + i, action: '配置受控凭据' }));
+  assert.match(json(opsNotification(r).payload), /凭据／访问权限 4/);
+  r.globalGaps = []; r.projects[0].status = 'ready'; r.projects[0].gaps = []; r.status = 'ready'; r.recovered = true;
+  const out = opsNotification(r, config()); assert.equal(out.payload.card.header.template, 'green'); assert.match(json(out.payload), /转入现有九维检查与Review准入/);
+  r.globalGaps = [{ id: 'missing-config', message: '仍然缺配置' }]; assert.notEqual(opsNotification(r).payload.card.header.template, 'green');
+});
+test('只读取CI机器人、正确签名和飞书确认；密钥不出现在回执中', async () => {
+  let calls = 0;
+  const out = await sendOpsNotification(report(), config(), { env: { ...env, WL_FEISHU_PROJECT_WEBHOOK: 'https://wrong.invalid/' }, now: 123000, fetchImpl: async (url, options) => {
+    calls++; assert.equal(url, env.WL_FEISHU_CI_WEBHOOK); assert.equal(options.redirect, 'error');
+    const body = JSON.parse(options.body); assert.equal(body.timestamp, '123');
+    assert.equal(body.sign, createHmac('sha256', '123\nfixture-secret').update('').digest('base64')); assert.doesNotMatch(options.body, /fixture-secret/);
+    return { status: 200, text: async () => '{"code":0}' };
+  } });
+  assert.equal(calls, 1); assert.equal(out.status, 'sent'); assert.equal(out.qualityPassed, false); assert.doesNotMatch(json(out), /fixture-secret|ci-fixture/);
+});
+test('超时未知不重发；HTTP和provider错误不可记sent；异常文本去敏', async () => {
+  let calls = 0;
+  const unknown = await sendOpsNotification(report(), config(), { env, fetchImpl: async () => { calls++; throw new Error('private-secret-token'); } });
+  assert.equal(calls, 1); assert.equal(unknown.status, 'unknown'); assert.doesNotMatch(json(unknown), /private-secret-token/);
+  for (const response of [{ status: 403 }, { status: 200, text: async () => '{"code":19021}' }, { status: 200, text: async () => '{"code":19021,"StatusCode":0}' }, { status: 200, text: async () => '{}' }]) assert.equal((await sendOpsNotification(report(), {}, { env, fetchImpl: async () => response })).status, 'rejected');
+  assert.equal((await sendOpsNotification(report(), {}, { env, fetchImpl: async () => ({ status: 200, text: async () => 'bad-json' }) })).status, 'unknown');
+});
+test('不降级项目机器人；带凭据地址拒绝；无@不会阻止有效CI消息送达', async () => {
+  let calls = 0; const fetchImpl = async () => { calls++; return { status: 200, text: async () => '{"StatusCode":0}' }; };
+  assert.equal((await sendOpsNotification(report(), {}, { env: { WL_FEISHU_PROJECT_WEBHOOK: env.WL_FEISHU_CI_WEBHOOK, WL_FEISHU_PROJECT_SECRET: env.WL_FEISHU_CI_SECRET }, fetchImpl })).status, 'not-sent');
+  assert.equal((await sendOpsNotification(report(), {}, { env: { ...env, WL_FEISHU_CI_WEBHOOK: 'https://name:password@open.feishu.cn/open-apis/bot/v2/hook/ci' }, fetchImpl })).status, 'not-sent');
+  assert.equal(calls, 0);
+  const out = await sendOpsNotification(report(), {}, { env, fetchImpl }); assert.equal(out.status, 'sent'); assert.equal(out.mentionMappingComplete, false); assert.equal(calls, 1);
+});
+test('缺项信息中的token或地址凭据去敏；报告类型无效拒绝', () => {
+  const r = report(); r.projects[0].gaps[0].message = 'secret=really-private https://name:pass@internal.invalid/path?token=private';
+  const content = json(opsNotification(r).payload); assert.doesNotMatch(content, /really-private|name:pass|token=private/);
+  assert.throws(() => opsNotification({}), /真实运维接入检查报告/);
+});