@agile-team/wl-skills-gate 0.13.1 → 0.13.2

package/scripts/lib-tests/jenkins-ops-native.test.mjs

@@ -0,0 +1,248 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync, existsSync, mkdtempSync, writeFileSync, rmSync} from 'node:fs';
+import {spawnSync} from 'node:child_process';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+
+// These are boundaries of the package-owned Jenkins adapter, not a claim that a
+// text inspection validates Jenkins CPS or the site's credential permissions.
+const native = () => readFileSync(new URL('../../templates/ci/jenkins-native.groovy', import.meta.url), 'utf8');
+
+function endOfBlock(text, open) {
+  let depth = 1, quote = null;
+  for (let i = open + 1; i < text.length; i++) {
+    if (quote) {
+      if (text[i] === '\\') { i++; continue; }
+      if (text.startsWith(quote, i)) { i += quote.length - 1; quote = null; }
+      continue;
+    }
+    if (text.startsWith('//', i)) { const end = text.indexOf('\n', i); i = end < 0 ? text.length : end; continue; }
+    if (text.startsWith('/*', i)) { const end = text.indexOf('*/', i + 2); assert.notEqual(end, -1, 'unterminated Groovy comment'); i = end + 1; continue; }
+    for (const delimiter of ["'''", '"""', "'", '"']) {
+      if (text.startsWith(delimiter, i)) { quote = delimiter; i += delimiter.length - 1; break; }
+    }
+    if (quote) continue;
+    if (text[i] === '{') depth++;
+    if (text[i] === '}' && --depth === 0) return i;
+  }
+  throw Error('unterminated Groovy block');
+}
+
+function opsMethod(source, name = 'wlOpsRun') {
+  const header = new RegExp('\\bdef\\s+' + name + '\\s*\\([^)]*\\)\\s*\\{').exec(source);
+  assert(header, 'doctor must have the package-owned ' + name + ' adapter');
+  const open = header.index + header[0].lastIndexOf('{');
+  return source.slice(open + 1, endOfBlock(source, open));
+}
+
+function credentialBlocks(source) {
+  const scopes = [];
+  for (const match of source.matchAll(/\bwithCredentials\s*\(/g)) {
+    const open = source.indexOf('{', match.index);
+    assert(open >= 0, 'credential binding must have an explicit closure');
+    const end = endOfBlock(source, open);
+    scopes.push({declaration: source.slice(match.index, open), body: source.slice(open + 1, end)});
+  }
+  return scopes;
+}
+
+test('运维监督无需项目登记即可先盘点，检查与通知为三个独立动作', () => {
+  const helper = opsMethod(native());
+  const inventory = helper.indexOf('jenkins ops inventory');
+  const inspect = helper.indexOf('jenkins ops inspect');
+  const finish = helper.indexOf('jenkins ops finish');
+  assert(inventory >= 0 && inspect > inventory && finish > inspect, 'inventory → inspect → finish must be explicit');
+  assert.match(helper, /--cluster/);
+  assert.match(helper, /--target/);
+  assert.match(helper, /--inventory/);
+  assert.match(helper, /--results/);
+  assert.doesNotMatch(helper, /jenkins fleet (?:inventory|plan|apply)|jenkins (?:bind|plan)|review-publish|jenkins (?:admit|build)/,
+    'ops supervision must not require the project registry or silently authorize a build/review');
+});
+
+test('源码检出和项目接入检查不持有Jenkins接口、飞书或签发凭据', () => {
+  const helper = opsMethod(native());
+  const scopes = credentialBlocks(helper);
+  assert(scopes.length >= 2, 'read credentials and notice credentials must be separately scoped');
+  for (const scope of scopes) {
+    assert.doesNotMatch(scope.body, /\bcheckout\s*\(|jenkins ops inspect/,
+      'SCM checkout/inspection must happen outside API and bot credential closures');
+    assert.doesNotMatch(scope.declaration, /wl-jenkins-config-manager|wl-jenkins-build-dispatch|wl-review-signing-key|wl-quality-sso-client-secret/,
+      'read-only supervision cannot obtain write, dispatch, signing or SSO credentials');
+  }
+  const reader = scopes.find(scope => scope.body.includes('jenkins ops inventory'));
+  const notifier = scopes.find(scope => scope.body.includes('jenkins ops finish'));
+  assert(reader, 'inventory must use a scoped Jenkins read credential');
+  assert(notifier, 'finish must use a scoped CI bot credential');
+  assert.match(reader.declaration, /wl-jenkins-ci-readonly/);
+  assert.doesNotMatch(reader.declaration, /feishu/);
+  assert.match(notifier.declaration, /wl-feishu-ci-webhook/);
+  assert.match(notifier.declaration, /wl-feishu-ci-signing-secret/);
+  assert.doesNotMatch(notifier.declaration, /wl-feishu-project|wl-jenkins-ci-readonly/);
+});
+
+test('项目检查失败仍进入汇总，运维报告归档且不启动旧部署任务', () => {
+  const helper = opsMethod(native());
+  assert.match(helper, /\btry\s*\{/);
+  assert.match(helper, /\bfinally\s*\{/,
+    'inspection failures need a finally path for the aggregate report/notice');
+  assert.match(helper, /archiveArtifacts/);
+  assert.match(helper, /returnStatus\s*:\s*true/,
+    'a missing project prerequisite must be recorded before ending the monitoring run');
+  assert.doesNotMatch(helper, /\bbuild\s*\(|\/buildWithParameters|\/build[?'"`\s]|createItem|config\.xml/,
+    'supervision does not rewrite or execute discovered custom deployment jobs');
+});
+
+test('默认doctor执行监督，机器人测试仅走显式连通测试', () => {
+  const source = native();
+  assert.match(source, /cfg\.role\s*==\s*['"]node['"]/);
+  assert.match(source, /params\.TEST_NOTIFICATION/);
+  const call = source.lastIndexOf('wlOpsRun(cfg)');
+  assert(call > source.indexOf('def call('), 'node routing must invoke the ops adapter by default');
+  assert.match(source, /wlGateNotificationTest\(\)/);
+});
+
+test('承接仅启动持久claim给出的CHECK，启动后记录实际编号，未持有通知或签发凭据', () => {
+  const helper = opsMethod(native(), 'wlOpsContinue');
+  const claim = helper.indexOf('jenkins ops claim-check'), build = helper.indexOf('build('), ack = helper.indexOf('jenkins ops ack-check');
+  assert(claim >= 0 && build > claim && ack > build, 'durable claim → actual CHECK start → actual number acknowledgment');
+  assert.match(helper, /claim\.status\s*==\s*['"]claimed['"]/);
+  assert.match(helper, /build\(job:\s*claim\.job/);
+  assert.match(helper, /waitForStart:\s*true/);
+  assert.match(helper, /--build-number/);
+  assert.match(helper, /--dispatch-id/);
+  assert.match(helper, /started\.number/);
+  assert.match(helper, /name:\s*['"]WL_REVIEW_SHA['"],\s*value:\s*claim\.sha/);
+  assert.match(helper, /name:\s*['"]WL_GATE_DISPATCH_ID['"],\s*value:\s*claim\.dispatchId/);
+  for (const scope of credentialBlocks(helper)) {
+    assert.doesNotMatch(scope.declaration, /feishu|signing-key|build-dispatch|config-manager|sso-client-secret/);
+    assert.doesNotMatch(scope.body, /\bbuild\s*\(/, 'Jenkins interface credentials must end before the child CHECK starts');
+  }
+  assert.doesNotMatch(helper, /review-publish|jenkins (?:admit|build)|\/buildWithParameters/);
+  assert.match(helper, /archiveArtifacts/);
+  assert.match(opsMethod(native()), /wlOpsContinue\(cfg,\s*summary\)/);
+});
+
+test('人工终止不继续检出，通知凭据失败仍保留无发送汇总与归档', () => {
+  const helper = opsMethod(native());
+  assert.match(helper, /catch\s*\(org\.jenkinsci\.plugins\.workflow\.steps\.FlowInterruptedException interrupted\)\s*\{\s*throw interrupted\s*\}/);
+  assert.match(helper, /finally\s*\{\s*deleteDir\(\)\s*\}/);
+  const finishes = helper.split('\n').filter(command => /\bjenkins ops finish\b/.test(command));
+  assert(finishes.some(command => /--send\b/.test(command)), 'configured bot must send the summary');
+  assert(finishes.some(command => !/--send\b/.test(command)), 'missing credential path must still generate a non-sending summary');
+  assert.match(helper, /finally\s*\{\s*archiveArtifacts/);
+});
+
+test('原生Groovy执行监督与承接：凭据隔离、固定SHA、失败不漏档且继续其它项目', {skip: !process.env.WL_GROOVY_JAR}, t => {
+  const jar = process.env.WL_GROOVY_JAR;
+  assert(existsSync(jar), 'WL_GROOVY_JAR must point to an existing Groovy runtime');
+  const directory = mkdtempSync(path.join(tmpdir(), 'wl-ops-groovy-'));
+  t.after(() => rmSync(directory, {recursive: true, force: true}));
+  const harness = path.join(directory, 'ops.groovy');
+  writeFileSync(harness, String.raw`
+def loader = new GroovyClassLoader()
+def interruptedClass = loader.parseClass('package org.jenkinsci.plugins.workflow.steps; class FlowInterruptedException extends Exception { FlowInterruptedException(String message) { super(message) } }')
+def parser = loader.parseClass('package groovy.json; class JsonSlurperClassic { static Map values=[:]; def parseText(String text) { assert values.containsKey(text):text; return values[text] } }')
+def source = new File(args[0]).text
+for (def mode in ['normal', 'no-bot', 'interrupted', 'claim-failure', 'claim-missing', 'claim-unknown', 'already-started', 'ack-failure']) {
+  def events=[], files=[:], env=[:], currentBuild=[:], working=[], credentials=0, builds=0, cleanups=0, startedKeys=[], acknowledgedKeys=[]
+  def multi=mode in ['claim-failure', 'claim-missing', 'claim-unknown', 'ack-failure']
+  def inventory=[runId:'fixture-run', jobsDiscovered:2, targets:[[key:'a'*24, checkoutAllowed:true, branch:'test', repository:'https://gitlab.example.invalid/group/produce.git', credentialId:'scm'],[key:'b'*24, checkoutAllowed:false, branch:null]]]
+  def summary=[runId:'fixture-run', globalGaps:(mode in ['no-bot','interrupted'] ? [[id:'pending']] : []), projects:[[key:'a'*24, status:'ready', checkJob:'produce/CHECK']]]
+  if(multi){inventory.targets[1]=[key:'b'*24,checkoutAllowed:true,branch:'test',repository:'https://gitlab.example.invalid/group/produce.git',credentialId:'scm'];summary.projects<<[key:'b'*24,status:'ready',checkJob:'produce/NEXT-CHECK']}
+  def claim=[status:'claimed', job:'produce/CHECK', sha:'c'*40, dispatchId:'ops-fixture-approved-check']
+  def nextClaim=[status:'claimed', job:'produce/NEXT-CHECK', sha:'d'*40, dispatchId:'ops-fixture-next-check']
+  parser.values=[inventory:inventory, summary:summary, claim:claim, nextClaim:nextClaim, unknown:[status:'unknown',reason:'fixture start unknown'], already:[status:'already-started',job:'produce/CHECK']]
+  Binding binding=new Binding([env:env, params:[:], currentBuild:currentBuild])
+  def shell=new GroovyShell(loader,binding)
+  binding.setVariable('pwd',{->'/workspace'})
+  binding.setVariable('dir',{location,body->working<<location;try{return body()}finally{working.remove(working.size()-1)}})
+  binding.setVariable('deleteDir',{->cleanups++;events<<'cleanup'})
+  binding.setVariable('writeFile',{options->files[options.file]=options.text})
+  binding.setVariable('readFile',{location->def key=location.toString();assert files.containsKey(key):key;return files[key]})
+  binding.setVariable('fileExists',{location->files.containsKey(location.toString())})
+  binding.setVariable('archiveArtifacts',{options->events<<'archive'})
+  binding.setVariable('stage',{name,body->events<<name;body()})
+  binding.setVariable('timeout',{options,body->body()})
+  binding.setVariable('echo',{message->events<<'echo'})
+  binding.setVariable('withEnv',{values,body->def old=new LinkedHashMap(env);values.each{value->def pair=value.split('=',2);env[pair[0]]=pair[1]};try{return body()}finally{env.clear();env.putAll(old)}})
+  ['usernamePassword','string','file'].each{name->binding.setVariable(name,{options->options})}
+  binding.setVariable('withCredentials',{values,body->
+    if(mode=='no-bot'&&values.any{it.credentialsId.startsWith('wl-feishu')})throw new RuntimeException('fixture missing bot credential')
+    def old=new LinkedHashMap(env);credentials++
+    values.each{value->if(value.variable)env[value.variable]='fixture';if(value.usernameVariable){env[value.usernameVariable]='fixture';env[value.passwordVariable]='fixture'}}
+    try{return body()}finally{credentials--;env.clear();env.putAll(old)}
+  })
+  binding.setVariable('checkout',{options->
+    assert credentials==0:'SCM checkout held API/bot credentials'
+    assert options.scm.branches[0].name=='origin/test'
+    assert options.scm.userRemoteConfigs[0].credentialsId=='scm'
+    events<<'checkout'
+    if(mode=='interrupted')throw interruptedClass.newInstance('fixture manual cancellation')
+    return [GIT_COMMIT:'c'*40]
+  })
+  binding.setVariable('build',{options->
+    assert credentials==0:'CHECK start held interface/bot credentials'
+    def expected=env.WL_OPS_KEY=='a'*24?claim:nextClaim
+    assert options.job==expected.job
+    assert options.waitForStart==true&&options.wait==false&&options.propagate==false
+    assert options.parameters.find{it.name=='WL_REVIEW_SHA'}.value==expected.sha
+    assert options.parameters.find{it.name=='WL_GATE_DISPATCH_ID'}.value==expected.dispatchId
+    builds++;startedKeys<<env.WL_OPS_KEY;events<<'CHECK-start';return [number:40+builds]
+  })
+  binding.setVariable('sh',{options->
+    String command=options instanceof Map?options.script:options
+    if(command.contains('jenkins ops inventory')){assert env.WL_JENKINS_READ_TOKEN;assert !env.WL_FEISHU_CI_SECRET;files['wl-ops-public/inventory.json']='inventory';events<<'inventory'}
+    else if(command.contains('jenkins ops inspect')){assert credentials==0;events<<'inspect'}
+    else if(command.contains('jenkins ops finish')){if(command.contains('--send'))assert env.WL_FEISHU_CI_SECRET;else assert credentials==0;files['wl-ops-public/summary.json']='summary';events<<'finish';return mode in ['no-bot','interrupted']?2:0}
+    else if(command.contains('jenkins ops claim-check')){
+      assert env.WL_JENKINS_READ_TOKEN;assert !env.WL_FEISHU_CI_SECRET;events<<'claim'
+      if(env.WL_OPS_KEY=='a'*24&&mode=='claim-failure')return 2
+      if(env.WL_OPS_KEY=='a'*24&&mode=='claim-missing')return 0
+      files[env.WL_OPS_CLAIM]=env.WL_OPS_KEY=='b'*24?'nextClaim':mode=='claim-unknown'?'unknown':mode=='already-started'?'already':'claim'
+    }
+    else if(command.contains('jenkins ops ack-check')){
+      def expected=env.WL_OPS_KEY=='a'*24?claim:nextClaim
+      assert env.WL_OPS_BUILD==(40+builds).toString()
+      assert env.WL_OPS_DISPATCH==expected.dispatchId
+      assert command.contains('--dispatch-id')
+      if(mode=='ack-failure'&&env.WL_OPS_KEY=='a'*24)throw new RuntimeException('fixture ACK write failed')
+      acknowledgedKeys<<env.WL_OPS_KEY;events<<'ack'
+    }
+    else assert false:command
+    return 0
+  })
+  def script=shell.parse(source,'native_ops.groovy');script.run()
+  def failure=null
+  try{script.wlOpsRun([gateRoot:'/fixed/gate',clusterFile:'/controlled/cluster.json'])}catch(Exception expected){failure=expected}
+  assert events.contains('inventory')&&events.contains('finish')&&events.contains('archive')
+  assert credentials==0
+  if(mode=='normal'){
+    assert failure==null:failure
+    assert builds==1&&events.indexOf('claim')<events.indexOf('CHECK-start')&&events.indexOf('CHECK-start')<events.indexOf('ack')
+    assert events.count('inspect')==2
+  }else if(mode=='no-bot'){
+    assert failure==null:failure
+    assert builds==0&&currentBuild.result=='UNSTABLE'
+  }else if(mode=='interrupted'){
+    assert interruptedClass.isInstance(failure)
+    assert builds==0&&events.count('checkout')==1&&events.count('inspect')==0
+    assert cleanups>=2
+  }else if(mode=='already-started'){
+    assert failure==null:failure
+    assert builds==0&&currentBuild.result==null
+  }else{
+    assert failure==null:failure
+    assert currentBuild.result=='UNSTABLE'
+    assert events.count('archive')>=2
+    if(mode=='ack-failure'){assert startedKeys==['a'*24,'b'*24];assert acknowledgedKeys==['b'*24]}
+    else{assert startedKeys==['b'*24];assert acknowledgedKeys==['b'*24]}
+  }
+}
+println 'Operations native Groovy mock passed: normal/no-bot/interrupted/claim-failure/claim-missing/claim-unknown/already-started/ack-failure.'
+`);
+  const result = spawnSync(process.env.JAVA || 'java', ['-cp', jar, 'groovy.ui.GroovyMain', harness, new URL('../../templates/ci/jenkins-native.groovy', import.meta.url).pathname], {encoding: 'utf8', timeout: 30000});
+  assert.equal(result.status, 0, result.stderr + '\n' + result.stdout);
+  assert.match(result.stdout, /Operations native Groovy mock passed/);
+});

package/scripts/lib-tests/jenkins-ops-notification.test.mjs

@@ -0,0 +1,88 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHmac } from 'node:crypto';
+import { opsNotification, sendOpsNotification } from '../../lib/jenkins-ops-notification.js';
+
+const report = () => ({ kind: 'jenkins-ops-report', checkedAt: '2026-10-22T01:02:03Z', jenkinsOrigin: 'https://jenkins.example.invalid/', runUrl: 'https://jenkins.example.invalid/job/doctor/7/', status: 'attention', globalGaps: [], projects: [{ key: 'p:test', project: 'wl-produce', branch: 'test', jobs: ['p-test'], status: 'attention', gaps: [{ id: 'gate-package-missing', message: '项目未安装Gate', action: '技术经理执行项目接入，再自动复检' }], technicalManager: 'manager', executor: 'author' }], remoteModified: false, qualityPassed: false, buildAuthorized: false });
+const person = (name, id, verified = true) => ({ name, feishu: { idType: 'user_id', id, verified } });
+const config = () => ({ people: { manager: person('经理', 'verified-manager'), author: person('执行人', 'verified-author'), observer: person('李月', 'verified-observer') }, owners: { 'wl-produce': { technicalManager: 'manager', managerSubmissionNotify: 'observer' } } });
+const json = value => JSON.stringify(value);
+const env = { WL_FEISHU_CI_WEBHOOK: 'https://open.feishu.cn/open-apis/bot/v2/hook/ci-fixture', WL_FEISHU_CI_SECRET: 'fixture-secret' };
+
+test('运维缺项通知无需项目配置：时间、缺项、动作与真实@；不冒充质量通过', () => {
+  const out = opsNotification(report(), config()), content = json(out.payload);
+  assert.deepEqual(out.mentions.sort(), ['verified-author', 'verified-manager']);
+  assert.equal(out.mentionMappingComplete, true);
+  assert.match(content, /2026年10月22日 09:02:03/);
+  assert.match(content, /项目未安装Gate/); assert.match(content, /自动复检/); assert.match(content, /未接入不等于扫描通过/);
+  assert.match(content, /<at id=\\"verified-manager/); assert.match(content, /查看本次接入检查/);
+});
+test('姓名工号不推断飞书身份；无真实ID仍发送缺项卡', () => {
+  const c = config(); c.people.manager.feishu.verified = false; c.people.author = { name: '杨晨誉', employeeId: '409322' };
+  const out = opsNotification(report(), c);
+  assert.equal(out.mentionMappingComplete, false); assert.deepEqual(out.mentions, []);
+  assert.doesNotMatch(json(out.payload), /<at /); assert.match(json(out.payload), /真实 @ 尚未配置/);
+});
+test('同一人员去重，经理本人提交才同步指定观察人', () => {
+  const r = report(); r.projects[0].executor = 'manager';
+  const out = opsNotification(r, config()), content = json(out.payload);
+  assert.deepEqual(out.mentions.sort(), ['verified-manager', 'verified-observer']);
+  assert.equal((content.match(/<at id=\\"verified-manager/g) || []).length, 1);
+  assert.equal((content.match(/<at id=\\"verified-observer/g) || []).length, 1);
+});
+test('同一飞书ID的不同人员键去重；额外主责和公共兜底人都实际出现在卡片中', () => {
+  const r = report(), c = config(); c.people.author.feishu.id = c.people.manager.feishu.id;
+  c.people.ops = person('运维', 'verified-ops'); c.owners['wl-produce'].recipients = ['ops']; c.fallbackRecipients = ['observer'];
+  const out = opsNotification(r, c), content = json(out.payload);
+  assert.deepEqual(out.mentions.sort(), ['verified-manager', 'verified-observer', 'verified-ops']);
+  for (const id of out.mentions) assert.equal((content.match(new RegExp('<at id=\\\\"' + id, 'g')) || []).length, 1);
+});
+test('项目限前三摘要，但所有项目责任人仍提醒；不修改输入', () => {
+  const r = report(), c = config();
+  r.projects = Array.from({ length: 5 }, (_, i) => ({ ...r.projects[0], key: 'project-' + i, project: 'project-' + i, technicalManager: 'm' + i, executor: 'a' + i }));
+  for (let i = 0; i < 5; i++) { c.people['m' + i] = person('经理' + i, 'manager-' + i); c.people['a' + i] = person('执行人' + i, 'author-' + i); }
+  const before = json(r), out = opsNotification(r, c), content = json(out.payload);
+  assert.match(content, /3\/5/); assert.doesNotMatch(content, /project-3 ·/); assert.equal(out.mentions.length, 10); assert.equal(json(r), before);
+});
+test('仅真实同源HTTPS本次记录可点击，缺失地址不伪造详情页', () => {
+  for (const url of [undefined, 'http://localhost:8090/', 'https://attacker.invalid/', 'https://jenkins.example.invalid/?token=private']) {
+    const r = report(); r.runUrl = url; const out = opsNotification(r);
+    assert.doesNotMatch(json(out.payload), /open_url/); assert.doesNotMatch(json(out.payload), /private/);
+  }
+});
+test('全局缺项分类且限前两条；恢复卡绿色但仍要求九维和Review', () => {
+  const r = report(); r.globalGaps = Array.from({ length: 4 }, (_, i) => ({ id: 'credential-' + i, message: '公共凭据缺项' + i, action: '配置受控凭据' }));
+  assert.match(json(opsNotification(r).payload), /凭据／访问权限 4/);
+  r.globalGaps = []; r.projects[0].status = 'ready'; r.projects[0].gaps = []; r.status = 'ready'; r.recovered = true;
+  const out = opsNotification(r, config()); assert.equal(out.payload.card.header.template, 'green'); assert.match(json(out.payload), /转入现有九维检查与Review准入/);
+  r.globalGaps = [{ id: 'missing-config', message: '仍然缺配置' }]; assert.notEqual(opsNotification(r).payload.card.header.template, 'green');
+});
+test('只读取CI机器人、正确签名和飞书确认；密钥不出现在回执中', async () => {
+  let calls = 0;
+  const out = await sendOpsNotification(report(), config(), { env: { ...env, WL_FEISHU_PROJECT_WEBHOOK: 'https://wrong.invalid/' }, now: 123000, fetchImpl: async (url, options) => {
+    calls++; assert.equal(url, env.WL_FEISHU_CI_WEBHOOK); assert.equal(options.redirect, 'error');
+    const body = JSON.parse(options.body); assert.equal(body.timestamp, '123');
+    assert.equal(body.sign, createHmac('sha256', '123\nfixture-secret').update('').digest('base64')); assert.doesNotMatch(options.body, /fixture-secret/);
+    return { status: 200, text: async () => '{"code":0}' };
+  } });
+  assert.equal(calls, 1); assert.equal(out.status, 'sent'); assert.equal(out.qualityPassed, false); assert.doesNotMatch(json(out), /fixture-secret|ci-fixture/);
+});
+test('超时未知不重发；HTTP和provider错误不可记sent；异常文本去敏', async () => {
+  let calls = 0;
+  const unknown = await sendOpsNotification(report(), config(), { env, fetchImpl: async () => { calls++; throw new Error('private-secret-token'); } });
+  assert.equal(calls, 1); assert.equal(unknown.status, 'unknown'); assert.doesNotMatch(json(unknown), /private-secret-token/);
+  for (const response of [{ status: 403 }, { status: 200, text: async () => '{"code":19021}' }, { status: 200, text: async () => '{"code":19021,"StatusCode":0}' }, { status: 200, text: async () => '{}' }]) assert.equal((await sendOpsNotification(report(), {}, { env, fetchImpl: async () => response })).status, 'rejected');
+  assert.equal((await sendOpsNotification(report(), {}, { env, fetchImpl: async () => ({ status: 200, text: async () => 'bad-json' }) })).status, 'unknown');
+});
+test('不降级项目机器人；带凭据地址拒绝；无@不会阻止有效CI消息送达', async () => {
+  let calls = 0; const fetchImpl = async () => { calls++; return { status: 200, text: async () => '{"StatusCode":0}' }; };
+  assert.equal((await sendOpsNotification(report(), {}, { env: { WL_FEISHU_PROJECT_WEBHOOK: env.WL_FEISHU_CI_WEBHOOK, WL_FEISHU_PROJECT_SECRET: env.WL_FEISHU_CI_SECRET }, fetchImpl })).status, 'not-sent');
+  assert.equal((await sendOpsNotification(report(), {}, { env: { ...env, WL_FEISHU_CI_WEBHOOK: 'https://name:password@open.feishu.cn/open-apis/bot/v2/hook/ci' }, fetchImpl })).status, 'not-sent');
+  assert.equal(calls, 0);
+  const out = await sendOpsNotification(report(), {}, { env, fetchImpl }); assert.equal(out.status, 'sent'); assert.equal(out.mentionMappingComplete, false); assert.equal(calls, 1);
+});
+test('缺项信息中的token或地址凭据去敏；报告类型无效拒绝', () => {
+  const r = report(); r.projects[0].gaps[0].message = 'secret=really-private https://name:pass@internal.invalid/path?token=private';
+  const content = json(opsNotification(r).payload); assert.doesNotMatch(content, /really-private|name:pass|token=private/);
+  assert.throws(() => opsNotification({}), /真实运维接入检查报告/);
+});

package/scripts/lib-tests/jenkins-ops.test.mjs

@@ -0,0 +1,238 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import {existsSync, readFileSync, rmSync} from 'node:fs';
+import {randomUUID, createHmac} from 'node:crypto';
+import {fixture, git, put, commit, bind} from '../test-support/jenkins-fixture.mjs';
+import {planJenkinsInstallation, applyJenkinsInstallation} from '../../lib/jenkins-installation.js';
+import {inventoryOps, inspectOpsProject, finishOps, opsReportHtml} from '../../lib/jenkins-ops.js';
+import {nativePipelineEntry} from '../../lib/jenkins-entry-contract.js';
+import {renderFleetJob} from '../../lib/jenkins-job-config.js';
+
+const repository = 'https://gitlab.example.invalid/produce/wl-produce.git';
+const readEnv = {WL_JENKINS_READ_USER: 'readonly', WL_JENKINS_READ_TOKEN: 'fixture-read-secret'};
+const noticeEnv = {
+  WL_FEISHU_CI_WEBHOOK: 'https://open.feishu.cn/open-apis/bot/v2/hook/test-fixture-ci',
+  WL_FEISHU_CI_SECRET: 'fixture-ci-signing-secret',
+  JOB_NAME: 'wl-quality-doctor', BUILD_NUMBER: '21',
+  BUILD_URL: 'https://jenkins.example.invalid/job/wl-quality-doctor/21/',
+};
+const escapeXml = value => value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;');
+const scmXml = (branch = 'test') => `<flow-definition><properties/><definition class="org.jenkinsci.plugins.workflow.cps.CpsScmFlowDefinition"><scm class="hudson.plugins.git.GitSCM"><userRemoteConfigs><hudson.plugins.git.UserRemoteConfig><url>${repository}</url><credentialsId>scm-readonly</credentialsId></hudson.plugins.git.UserRemoteConfig></userRemoteConfigs><branches><hudson.plugins.git.BranchSpec><name>${branch}</name></hudson.plugins.git.BranchSpec></branches></scm><scriptPath>Jenkinsfile</scriptPath></definition><disabled>false</disabled></flow-definition>`;
+const inlineXml = script => `<flow-definition><properties/><definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition"><script>${escapeXml(script)}</script><sandbox>true</sandbox></definition><disabled>false</disabled></flow-definition>`;
+
+function install(t) {
+  const f = fixture(t);
+  git(f.root, 'remote', 'set-url', 'origin', repository);
+  const options = {prefix: path.join(f.base, 'install'), configDir: path.join(f.base, 'config'), registryFiles: [f.registryFile], jenkinsOrigin: 'https://jenkins.example.invalid/', centralAgentLabel: 'central', reviewSignerAgentLabel: 'signer'};
+  const plan = planJenkinsInstallation(options);
+  const installed = applyJenkinsInstallation({...options, confirm: true, planHash: plan.planHash});
+  const configFile = path.join(options.configDir, 'jenkins-ops.json');
+  const config = JSON.parse(readFileSync(configFile));
+  config.people = {manager: {name: '技术经理', feishu: {idType: 'open_id', id: 'ou_fixture_manager', verified: true}}};
+  config.owners = {'wl-produce': {technicalManager: 'manager'}};
+  put(options.configDir, 'jenkins-ops.json', config);
+  return {...f, installed, clusterFile: installed.clusterFile, configDir: options.configDir};
+}
+
+function jenkinsProvider(jobs) {
+  const calls = [];
+  const fetchImpl = async (url, options = {}) => {
+    const endpoint = new URL(url);
+    calls.push({url: endpoint.href, method: options.method || 'GET'});
+    assert.equal(endpoint.origin, 'https://jenkins.example.invalid');
+    assert.equal(options.method, 'GET', 'ops inventory must never write Jenkins');
+    assert.equal(options.headers.Authorization, 'Basic ' + Buffer.from('readonly:fixture-read-secret').toString('base64'));
+    const segments = endpoint.pathname.split('/').filter(Boolean), job = [];
+    let index = 0;
+    while (segments[index] === 'job') { job.push(decodeURIComponent(segments[index + 1])); index += 2; }
+    const suffix = segments.slice(index).join('/'), full = job.join('/');
+    if (suffix === 'api/json') {
+      const children = new Map();
+      for (const name of jobs.keys()) {
+        if (full && !name.startsWith(full + '/')) continue;
+        const parts = (full ? name.slice(full.length + 1) : name).split('/');
+        children.set(parts[0], {name: parts[0], _class: parts.length > 1 ? 'com.cloudbees.hudson.plugins.folder.Folder' : 'org.jenkinsci.plugins.workflow.job.WorkflowJob'});
+      }
+      return new Response(JSON.stringify({jobs: [...children.values()]}));
+    }
+    if (suffix === 'config.xml') return jobs.has(full) ? new Response(jobs.get(full)) : new Response('', {status: 404});
+    throw Error('unexpected read route: ' + endpoint.pathname);
+  };
+  return {calls, fetchImpl};
+}
+
+const freshInventory = inventory => ({...inventory, runId: randomUUID()});
+const failureResult = (f, inventory) => inspectOpsProject({clusterFile: f.clusterFile, inventory, targetKey: inventory.targets[0].key, failure: 'checkout-not-completed'});
+const inspection = (f, inventory) => inspectOpsProject({clusterFile: f.clusterFile, inventory, targetKey: inventory.targets[0].key, root: f.root});
+
+async function controlledProject(t) {
+  const f = install(t);
+  put(f.root, 'pom.xml', '<project><modelVersion>4.0.0</modelVersion><artifactId>fixture</artifactId><profiles><profile><id>wl-quality-audit</id></profile><profile><id>wl-quality-unit</id></profile></profiles></project>');
+  put(f.root, '.wl-skills-bd/capabilities.json', {schemaVersion: 1, fixture: true});
+  const policy = JSON.parse(readFileSync(path.join(f.root, 'quality/policy.yml')));
+  policy.checks[0].profiles.push('release'); policy.releaseRequires = ['FIXTURE'];
+  put(f.root, 'quality/policy.yml', policy);
+  commit(f.root);
+  const seed = JSON.parse(readFileSync(f.seedFile)); seed.binding.repository = repository;
+  put(f.base, 'seed.json', seed);
+  await bind(f);
+  const registry = JSON.parse(readFileSync(f.registryFile)); registry.nativeEntry = f.installed.nativeEntry;
+  put(f.base, 'bindings.json', registry);
+  // Readiness performs file-level handover checks. These controlled fixture
+  // documents are not used to pretend a real SSO, Review signer or build ran.
+  for (const name of ['automation-config', 'governance-config', 'control-config', 'review-publish-config']) {
+    put(f.configDir, name + '.json', {schemaVersion: 1, projects: {'wl-produce': {}}, sources: [{id: 'fixture'}], dataDir: f.base, publicKeyFile: 'approved-fixture.pem', identity: {provider: 'fixture'}, authorizationIssuer: 'fixture', reviewPrivateKeyEnv: 'FIXTURE_PRIVATE_FILE'});
+  }
+  put(f.configDir, 'jenkins-fleet.json', {schemaVersion: 1, kind: 'wl-gate-jenkins-fleet', jenkinsOrigin: 'https://jenkins.example.invalid/', dataDir: path.join(f.base, 'fleet'), registryFiles: [f.registryFile], automationConfigFile: path.join(f.configDir, 'automation-config.json'), selection: {projects: ['wl-produce'], branches: ['test']}, approvers: ['fixture']});
+  const binding = registry.bindings[0];
+  const xml = renderFleetJob({script: nativePipelineEntry(f.installed.nativeEntry), binding, mode: 'check', secret: 'fixture-gitlab-hook-secret'});
+  const jobs = new Map([[binding.jobs.check, xml]]), provider = jenkinsProvider(jobs);
+  const inventory = await inventoryOps({clusterFile: f.clusterFile, env: readEnv, fetchImpl: provider.fetchImpl});
+  return {...f, registry, binding, jobs, provider, inventory};
+}
+
+async function readyReport(f, inventory = f.inventory) {
+  const result = inspection(f, inventory);
+  assert.equal(result.status, 'ready', JSON.stringify(result.gaps));
+  assert.equal(result.pinsVerified, true);
+  const report = await finishOps({clusterFile: f.clusterFile, inventory, results: [result], send: false});
+  assert.equal(report.status, 'ready', JSON.stringify(report.globalGaps));
+  return report;
+}
+
+test('无登记／中央配置也能真实盘点、发现项目缺Gate并通过CI机器人持久提醒；不变不刷屏', async t => {
+  const f = install(t);
+  rmSync(path.join(f.root, 'quality'), {recursive: true});
+  commit(f.root);
+  const provider = jenkinsProvider(new Map([['生产/后端-test', scmXml()]]));
+  const inventory = await inventoryOps({clusterFile: f.clusterFile, env: readEnv, fetchImpl: provider.fetchImpl});
+  assert(!existsSync(f.registryFile));
+  assert(!existsSync(path.join(f.configDir, 'automation-config.json')));
+  assert.equal(inventory.targets.length, 1);
+  assert.equal(inventory.targets[0].checkoutAllowed, true);
+  assert.equal(inventory.remoteModified, false);
+  assert.equal(provider.calls.every(call => call.method === 'GET'), true);
+  const result = inspection(f, inventory);
+  assert.equal(result.status, 'attention');
+  assert(result.gaps.some(g => g.id === 'PROJECT-GATE'));
+  assert(result.gaps.some(g => g.id === 'UNCONTROLLED-JOB'));
+  const sent = [];
+  const send = async (url, options) => {
+    assert.equal(url, noticeEnv.WL_FEISHU_CI_WEBHOOK);
+    const card = JSON.parse(options.body);
+    assert.equal(card.sign, createHmac('sha256', `${card.timestamp}\n${noticeEnv.WL_FEISHU_CI_SECRET}`).update('').digest('base64'));
+    sent.push(card);
+    return new Response(JSON.stringify({code: 0}));
+  };
+  const report = await finishOps({clusterFile: f.clusterFile, inventory, results: [result], env: noticeEnv, send: true, fetchImpl: send});
+  assert.equal(report.notification.status, 'sent');
+  assert.equal(report.notification.mentionMappingComplete, true);
+  assert.deepEqual(report.notification.mentions, ['ou_fixture_manager']);
+  assert.equal(report.qualityPassed, false);
+  assert.equal(report.buildAuthorized, false);
+  assert.match(JSON.stringify(sent[0]), /PROJECT-GATE|quality\/workspace|尚未完整接入Gate/);
+  const state = JSON.parse(readFileSync(path.join(f.configDir, 'ops-state/state.json')));
+  assert(Object.values(state.notices).some(item => item.status === 'sent' && item.runId === inventory.runId));
+  assert(existsSync(path.join(f.configDir, 'ops-state/runs', inventory.runId, 'report.json')));
+  const next = freshInventory(inventory);
+  const again = await finishOps({clusterFile: f.clusterFile, inventory: next, results: [inspection(f, next)], env: noticeEnv, send: true, fetchImpl: send});
+  assert.equal(again.notification.status, 'unchanged');
+  assert.equal(sent.length, 1);
+});
+
+test('飞书送达未知保留待核对；下一轮相同缺项不会自动补发', async t => {
+  const f = install(t), provider = jenkinsProvider(new Map([['后端-test', scmXml()]]));
+  const inventory = await inventoryOps({clusterFile: f.clusterFile, env: readEnv, fetchImpl: provider.fetchImpl});
+  let sends = 0;
+  const unknown = async () => { sends++; throw Error('fixture timeout after server may have accepted'); };
+  const first = await finishOps({clusterFile: f.clusterFile, inventory, results: [failureResult(f, inventory)], env: noticeEnv, send: true, fetchImpl: unknown});
+  assert.equal(first.notification.status, 'unknown');
+  const next = freshInventory(inventory);
+  const second = await finishOps({clusterFile: f.clusterFile, inventory: next, results: [failureResult(f, next)], env: noticeEnv, send: true, fetchImpl: unknown});
+  assert.equal(second.notification.status, 'unknown');
+  assert.equal(sends, 1);
+  const state = JSON.parse(readFileSync(path.join(f.configDir, 'ops-state/state.json')));
+  assert(Object.values(state.notices).some(item => item.status === 'unknown'));
+});
+
+test('动态参数不猜固定分支，多仓库不擅选；feature分支不进入目标检查', async t => {
+  const f = install(t);
+  const dynamic = `pipeline { agent any\nenvironment {\nGIT_URL = '${repository}'\nGIT_CREDENTIAL_ID = 'scm-readonly'\n}\nstages { stage('checkout') { steps { git branch: env.TAG, credentialsId: env.GIT_CREDENTIAL_ID, url: env.GIT_URL } } } }`;
+  const multi = scmXml().replace('</userRemoteConfigs>', '<hudson.plugins.git.UserRemoteConfig><url>https://gitlab.example.invalid/common/shared.git</url><credentialsId>scm-readonly</credentialsId></hudson.plugins.git.UserRemoteConfig></userRemoteConfigs>');
+  const provider = jenkinsProvider(new Map([['参数分支', inlineXml(dynamic)], ['多仓库', multi], ['自己的分支', scmXml('feature/order-fix')]]));
+  const inventory = await inventoryOps({clusterFile: f.clusterFile, env: readEnv, fetchImpl: provider.fetchImpl});
+  assert.equal(inventory.jobsDiscovered, 3);
+  assert.equal(inventory.targets.length, 2);
+  assert(!inventory.targets.some(target => target.job === '自己的分支'));
+  for (const target of inventory.targets) {
+    assert.equal(target.checkoutAllowed, false);
+    assert.equal(target.branch, null);
+    assert(target.gaps.some(g => g.id === 'SCM-LOCATION'));
+    const result = inspectOpsProject({clusterFile: f.clusterFile, inventory, targetKey: target.key, failure: 'checkout-not-completed'});
+    assert.equal(result.status, 'attention');
+    assert.equal(result.sha, undefined);
+  }
+});
+
+test('检出失败、缺失结果、重复结果和旧runId均保留待处理；不复用历史绿灯', async t => {
+  const f = install(t), provider = jenkinsProvider(new Map([['后端-test', scmXml()]]));
+  const first = await inventoryOps({clusterFile: f.clusterFile, env: readEnv, fetchImpl: provider.fetchImpl});
+  const failed = failureResult(f, first);
+  assert(failed.gaps.some(g => g.id === 'CHECKOUT'));
+  assert.equal(failed.sha, undefined);
+  assert.equal(failed.qualityPassed, false);
+  for (const mode of ['failed', 'missing', 'old', 'duplicate']) {
+    const inventory = freshInventory(first), current = {...failed, runId: inventory.runId};
+    const results = mode === 'missing' ? [] : mode === 'old' ? [failed] : mode === 'duplicate' ? [current, current] : [current];
+    const report = await finishOps({clusterFile: f.clusterFile, inventory, results, send: false});
+    assert.equal(report.projects[0].status, 'attention', mode);
+    assert(report.projects[0].gaps.some(g => g.id === (mode === 'failed' ? 'CHECKOUT' : 'INSPECTION-MISSING')), mode);
+    assert.equal(report.buildAuthorized, false, mode);
+  }
+});
+
+test('干净检出没有node_modules是待固定依赖准备，不误报未声明Gate', async t => {
+  const f = install(t), provider = jenkinsProvider(new Map([['后端-test', scmXml()]]));
+  assert(!existsSync(path.join(f.root, 'quality-tools/node_modules')));
+  const inventory = await inventoryOps({clusterFile: f.clusterFile, env: readEnv, fetchImpl: provider.fetchImpl});
+  const report = inspection(f, inventory);
+  assert.equal(report.projectKind, 'backend');
+  assert(!report.gaps.some(g => g.id === 'PROJECT-GATE' || /^(?:INSTALLED-|ENGINES-)/.test(g.id)));
+  assert(report.dependenciesPreparedByCheck.includes('INSTALLED-GATE'));
+  assert(report.dependenciesPreparedByCheck.includes('INSTALLED-BD'));
+  assert(!report.gaps.some(g => g.id === 'PIN-GATE'));
+  assert.equal(report.qualityPassed, false);
+  assert.equal(report.buildAuthorized, false);
+});
+
+test('真实接入前置恢复后发送恢复提醒；同一缺项复发不能被历史sent吞掉', async t => {
+  const f = await controlledProject(t), first = f.inventory;
+  assert.equal(first.errors.length, 0);
+  let calls = 0;
+  const send = async () => { calls++; return new Response(JSON.stringify({code: 0})); };
+  const before = await finishOps({clusterFile: f.clusterFile, inventory: first, results: [failureResult(f, first)], env: noticeEnv, send: true, fetchImpl: send});
+  assert.equal(before.status, 'attention');
+  assert.equal(before.notification.status, 'sent');
+  const next = freshInventory(first), result = inspection(f, next);
+  assert.equal(result.status, 'ready', JSON.stringify(result.gaps));
+  assert.equal(result.pinsVerified, true);
+  const after = await finishOps({clusterFile: f.clusterFile, inventory: next, results: [result], env: noticeEnv, send: true, fetchImpl: send});
+  assert.equal(after.status, 'ready');
+  assert.equal(after.recovered, true);
+  assert.equal(after.notification.status, 'sent');
+  assert.equal(after.qualityPassed, false);
+  assert.equal(after.buildAuthorized, false);
+  const recurring = freshInventory(first);
+  const recurrence = await finishOps({clusterFile: f.clusterFile, inventory: recurring, results: [failureResult(f, recurring)], env: noticeEnv, send: true, fetchImpl: send});
+  assert.equal(recurrence.notification.status, 'sent', 'a new recurrence after recovery needs a fresh reminder');
+  assert.equal(calls, 3);
+});
+
+test('HTML把项目、Job和缺项当不可信文本转义，不形成脚本与属性注入', () => {
+  const html = opsReportHtml({checkedAt: '<script>alert(1)</script>', status: 'attention', globalGaps: [{message: '<img src=x onerror=alert(1)>', action: '& " < >'}], projects: [{key: 'x" onclick="alert(1)', project: '<script>project()</script>', branch: '<b>test</b>', jobs: ['<img src=x>'], gaps: [{id: '<svg>', message: '<iframe>', action: '<script>fix()</script>'}]}]});
+  assert.doesNotMatch(html, /<script>|<img\b|<iframe>|<svg>|<b>test/);
+  assert.match(html, /&lt;script&gt;project\(\)&lt;\/script&gt;/);
+  assert.match(html, /id="x&quot; onclick=&quot;alert\(1\)"/);
+  assert.match(html, /&amp; &quot; &lt; &gt;/);
+});

package/templates/ci/check-project.config.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "kind": "wl-quality-ci-check",
   "project": "REPLACE_WITH_ACTUAL_PROJECT",
-  "gateVersion": "0.13.1",
+  "gateVersion": "0.13.2",
   "workspaceHash": "REPLACE_WITH_APPROVED_WORKSPACE_SHA256",
   "lockHash": "REPLACE_WITH_APPROVED_LOCK_SHA256",
   "policyHash": "REPLACE_WITH_APPROVED_POLICY_SHA256",

package/templates/ci/jenkins-bootstrap.py

@@ -55,7 +55,7 @@ def preflight(env):
     valid_root = root.is_absolute() and root.is_dir()
     check("gate-root", valid_root, "固定 Gate 目录可读取" if valid_root else "固定 Gate 目录不存在或不可读取",
           "在该Jenkins节点运行本包的接入Jenkins脚本；使用安装回执中的 gateHome。包内入口为 bin/wl-skills-gate.js。")
-    expected = env.get("WL_BOOTSTRAP_GATE_VERSION", "0.13.1")
+    expected = env.get("WL_BOOTSTRAP_GATE_VERSION", "0.13.2")
     try:
         package = json.loads((root / "package.json").read_text())
         correct = package.get("name") == "@agile-team/wl-skills-gate" and package.get("version") == expected