@agile-team/wl-skills-gate 0.13.1 → 0.13.2

package/templates/ci/jenkins-native.groovy

@@ -1,4 +1,137 @@
 // Package-owned Scripted Pipeline; no separately published shared library.
+def wlOpsRun(Map cfg) {
+  def publicRoot = "${pwd()}/wl-ops-public"
+  dir('wl-ops-public') { deleteDir(); dir('projects') { writeFile file: '.keep', text: '' } }
+  def inventory = null
+  def outcome = 2
+  withEnv(["WL_QUALITY_CLI=${cfg.gateRoot}/bin/wl-quality.js", "WL_OPS_CLUSTER=${cfg.clusterFile}", "WL_OPS_PUBLIC=${publicRoot}"]) {
+    try {
+      stage('发现项目与流水线') {
+        withCredentials([usernamePassword(credentialsId: 'wl-jenkins-ci-readonly', usernameVariable: 'WL_JENKINS_READ_USER', passwordVariable: 'WL_JENKINS_READ_TOKEN')]) {
+          sh '''#!/bin/sh
+set -eu
+set +x
+node "$WL_QUALITY_CLI" jenkins ops inventory --cluster "$WL_OPS_CLUSTER" --out "$WL_OPS_PUBLIC/inventory.json"
+'''
+        }
+        inventory = new groovy.json.JsonSlurperClassic().parseText(readFile('wl-ops-public/inventory.json'))
+        echo "巡检发现 ${inventory.jobsDiscovered} 个任务；目标 ${inventory.targets.size()} 项。"
+      }
+      stage('检查项目接入条件') {
+        for (def target in inventory.targets) {
+          withEnv(["WL_OPS_KEY=${target.key}", "WL_OPS_RESULT=${publicRoot}/projects/${target.key}.json"]) {
+            def checkoutFailed = false
+            if (target.checkoutAllowed == true) {
+              dir("wl-ops-checkouts/${target.key}") {
+                deleteDir()
+                try {
+                try {
+                  timeout(time: 5, unit: 'MINUTES') {
+                    checkout(changelog: false, poll: false, scm: [
+                      $class: 'GitSCM', branches: [[name: "origin/${target.branch}"]],
+                      userRemoteConfigs: [[name: 'origin', url: target.repository, credentialsId: target.credentialId,
+                        refspec: "+refs/heads/${target.branch}:refs/remotes/origin/${target.branch}"]],
+                      extensions: [[$class: 'CloneOption', shallow: true, depth: 1, noTags: true, honorRefspec: true]]
+                    ])
+                  }
+                } catch (org.jenkinsci.plugins.workflow.steps.FlowInterruptedException interrupted) { throw interrupted }
+                catch (Exception checkoutFailure) { checkoutFailed = true; echo '源码检出未完成；仅记录缺项，继续检查其余项目。' }
+                if (!checkoutFailed) {
+                  sh(returnStatus: true, script: '''#!/bin/sh
+set -eu
+node "$WL_QUALITY_CLI" jenkins ops inspect --cluster "$WL_OPS_CLUSTER" --inventory "$WL_OPS_PUBLIC/inventory.json" --target-key "$WL_OPS_KEY" --root "$PWD" --out "$WL_OPS_RESULT"
+''')
+                }
+                } finally { deleteDir() }
+              }
+            }
+            if (checkoutFailed || target.checkoutAllowed != true) {
+              sh(returnStatus: true, script: '''#!/bin/sh
+set -eu
+node "$WL_QUALITY_CLI" jenkins ops inspect --cluster "$WL_OPS_CLUSTER" --inventory "$WL_OPS_PUBLIC/inventory.json" --target-key "$WL_OPS_KEY" --failure checkout-not-completed --out "$WL_OPS_RESULT"
+''')
+            }
+          }
+        }
+      }
+    } finally {
+      try {
+      if (fileExists('wl-ops-public/inventory.json')) {
+        stage('记录缺项与飞书提醒') {
+          try { withEnv(["WL_OPS_RETRY_NOTICE=${params.RETRY_NOTIFICATION == true ? '1' : '0'}"]) { withCredentials([
+            string(credentialsId: 'wl-feishu-ci-webhook', variable: 'WL_FEISHU_CI_WEBHOOK'),
+            string(credentialsId: 'wl-feishu-ci-signing-secret', variable: 'WL_FEISHU_CI_SECRET')
+          ]) {
+            outcome = sh(returnStatus: true, script: '''#!/bin/sh
+set -eu
+set +x
+set -- jenkins ops finish --cluster "$WL_OPS_CLUSTER" --inventory "$WL_OPS_PUBLIC/inventory.json" --results "$WL_OPS_PUBLIC/projects" --out "$WL_OPS_PUBLIC/summary.json" --send
+if [ "$WL_OPS_RETRY_NOTICE" = '1' ]; then set -- "$@" --retry-notification; fi
+node "$WL_QUALITY_CLI" "$@"
+''')
+          } } } catch (org.jenkinsci.plugins.workflow.steps.FlowInterruptedException interrupted) { throw interrupted }
+          catch (Exception noticeFailure) {
+            echo '通知阶段未完成；请核对流水线机器人凭据。本次仍生成巡检原件，不登记消息送达。'
+            if (!fileExists('wl-ops-public/summary.json')) sh(returnStatus: true, script: '''#!/bin/sh
+set -eu
+node "$WL_QUALITY_CLI" jenkins ops finish --cluster "$WL_OPS_CLUSTER" --inventory "$WL_OPS_PUBLIC/inventory.json" --results "$WL_OPS_PUBLIC/projects" --out "$WL_OPS_PUBLIC/summary.json"
+''')
+            outcome = 2
+          }
+        }
+      }
+      } finally { archiveArtifacts artifacts: 'wl-ops-public/*.json,wl-ops-public/*.html,wl-ops-public/projects/*.json', allowEmptyArchive: true }
+    }
+  }
+  if (fileExists('wl-ops-public/summary.json')) {
+    def summary = new groovy.json.JsonSlurperClassic().parseText(readFile('wl-ops-public/summary.json'))
+    if (!summary.globalGaps) wlOpsContinue(cfg, summary)
+  }
+  if (outcome != 0) { currentBuild.result = 'UNSTABLE'; echo '运维巡检有待处理项或消息未确认送达；见本次归档，修复后下一轮自动复查。本结果不授予构建准入。' }
+}
+
+// Only package-verified CHECK jobs can be resumed; never arbitrary legacy deploy jobs.
+def wlOpsContinue(Map cfg, Map summary) {
+  try {
+  stage('承接已就绪项目的九维检查') {
+    for (def project in summary.projects.findAll { it.checkJob && (it.status == 'ready' || it.gaps.every { g -> g.id == 'CHECK-DISPATCH-UNKNOWN' }) }) {
+      withEnv(["WL_QUALITY_CLI=${cfg.gateRoot}/bin/wl-quality.js", "WL_OPS_CLUSTER=${cfg.clusterFile}", "WL_OPS_RUN=${summary.runId}", "WL_OPS_KEY=${project.key}", "WL_OPS_CLAIM=wl-ops-public/claim-${project.key}.json", "WL_OPS_ACK=wl-ops-public/ack-${project.key}.json", "WL_OPS_RETRY_CHECK=${params.RETRY_UNCONFIRMED_CHECK == true ? '1' : '0'}"]) {
+        def claimCode = 2
+        withCredentials([usernamePassword(credentialsId: 'wl-jenkins-ci-readonly', usernameVariable: 'WL_JENKINS_READ_USER', passwordVariable: 'WL_JENKINS_READ_TOKEN')]) {
+        claimCode = sh(returnStatus: true, script: '''#!/bin/sh
+set -eu
+set +x
+set -- jenkins ops claim-check --cluster "$WL_OPS_CLUSTER" --run-id "$WL_OPS_RUN" --target-key "$WL_OPS_KEY" --out "$WL_OPS_CLAIM"
+if [ "$WL_OPS_RETRY_CHECK" = '1' ]; then set -- "$@" --retry-unknown; fi
+node "$WL_QUALITY_CLI" "$@"
+''')
+        }
+        if (claimCode == 0 && fileExists("wl-ops-public/claim-${project.key}.json")) {
+        def claim = new groovy.json.JsonSlurperClassic().parseText(readFile("wl-ops-public/claim-${project.key}.json"))
+        if (claim.status == 'claimed') {
+          try {
+            def started = build(job: claim.job, wait: false, waitForStart: true, propagate: false,
+              parameters: [string(name: 'WL_REVIEW_SHA', value: claim.sha), string(name: 'WL_GATE_DISPATCH_ID', value: claim.dispatchId)])
+            withEnv(["WL_OPS_BUILD=${started.number}", "WL_OPS_DISPATCH=${claim.dispatchId}"]) {
+              sh '''#!/bin/sh
+set -eu
+node "$WL_QUALITY_CLI" jenkins ops ack-check --cluster "$WL_OPS_CLUSTER" --run-id "$WL_OPS_RUN" --target-key "$WL_OPS_KEY" --build-number "$WL_OPS_BUILD" --dispatch-id "$WL_OPS_DISPATCH" --out "$WL_OPS_ACK"
+'''
+            }
+            echo "CHECK已启动：${claim.job} #${started.number}；正式检查及Review结论以该运行原件为准。"
+          } catch (org.jenkinsci.plugins.workflow.steps.FlowInterruptedException interrupted) { throw interrupted }
+          catch (Exception dispatchFailure) { currentBuild.result = 'UNSTABLE'; echo 'CHECK启动未确认，已保留本轮记录；下轮提醒核对，不自动重复启动。' }
+        } else {
+          if (claim.status != 'already-started') currentBuild.result = 'UNSTABLE'
+          echo "CHECK承接：${claim.status}；${claim.reason ?: '已有实际启动记录，未重复启动'}"
+        }
+        } else { currentBuild.result = 'UNSTABLE'; echo '本项目CHECK承接核验未通过，未启动；按本轮控制台缺项修复，其余项目继续。' }
+      }
+    }
+  }
+  } finally { archiveArtifacts artifacts: 'wl-ops-public/claim-*.json,wl-ops-public/ack-*.json', allowEmptyArchive: true }
+}
+
 def wlFleetRun(Map cfg, String action, String batch = '', String planHash = '') {
   def code = 2
   withEnv(["WL_APPROVED_GATE_CLI=${cfg.gateRoot}/bin/wl-skills-gate.js",
@@ -58,7 +191,11 @@ def call(Map cfg, def bootstrap) {
       try {
         if (cfg.role != 'job') {
           def options = [disableConcurrentBuilds()]
-          if (cfg.role == 'node') options.add(parameters([booleanParam(name: 'TEST_NOTIFICATION', defaultValue: false, description: '仅测试流水线机器人签名推送')]))
+          if (cfg.role == 'node') {
+            def enabled = params.ENABLE_MONITOR == true
+            options.add(parameters([booleanParam(name: 'TEST_NOTIFICATION', defaultValue: false, description: '仅测试流水线机器人签名推送'), booleanParam(name: 'ENABLE_MONITOR', defaultValue: enabled, description: '启用每5分钟发现项目、检查接入缺项并提醒；不代替业务九维检查'), booleanParam(name: 'RETRY_NOTIFICATION', defaultValue: false, description: '核对群记录后补发本轮缺项通知，可能重复；仅本次'), booleanParam(name: 'RETRY_UNCONFIRMED_CHECK', defaultValue: false, description: '核对队列和运行记录后重试未确认CHECK，可能重复；仅本次')]))
+            options.add(pipelineTriggers(enabled ? [cron('H/5 * * * *')] : []))
+          }
           if (cfg.role == 'fleet') options.add(parameters([
             choice(name: 'ACTION', choices: ['准备公共任务', '盘点', '预览', '接入', '续跑', '核验', '回退'], description: '首轮准备公共任务，之后按批准登记批量接入'),
             string(name: 'BATCH', defaultValue: '', description: '续跑、核验、回退填写原批次ID')]))
@@ -75,6 +212,7 @@ def call(Map cfg, def bootstrap) {
             load("${cfg.gateRoot}/templates/ci/jenkins-gate.groovy").call(cfg)
           } else if (cfg.role == 'node') {
             if (params.TEST_NOTIFICATION) stage('飞书连通测试') { bootstrap.wlGateNotificationTest() }
+            else wlOpsRun(cfg)
           } else if (cfg.role == 'verify') {
             stage('核验Gate接线') {
               withCredentials([usernamePassword(credentialsId: 'wl-jenkins-ci-readonly', usernameVariable: 'WL_JENKINS_READ_USER', passwordVariable: 'WL_JENKINS_READ_TOKEN')]) {

package/templates/onboarding/backend/quality-tools.package.json

@@ -3,7 +3,7 @@
   "private": true,
   "engines": { "node": "^22.13.0 || >=24.0.0" },
   "devDependencies": {
-    "@agile-team/wl-skills-gate": "0.13.1",
+    "@agile-team/wl-skills-gate": "0.13.2",
     "@agile-team/wl-skills-bd": "0.41.1"
   }
 }

package/templates/quality/rules.lock.json

@@ -1,6 +1,6 @@
 {
   "lockVersion": 1,
-  "wl-skills-gate": "0.13.1",
+  "wl-skills-gate": "0.13.2",
   "tools": {
     "TS-TYPECHECK": "<填写 vue-tsc --version 的完整输出>",
     "FE-ESLINT": "<填写 eslint --version 的完整输出>"