@agile-team/wl-skills-gate 0.13.2 → 0.13.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # 变更记录
 
+## 0.13.3
+
+- 兼容 Jenkins 配置回读中的 UTF-8 XML 1.1 声明，保留 DTD、实体、控制字符及任务契约的严格校验。
+- 增加 Jenkins 创建任务后规范化 XML 的往返回归，避免仅回显请求内容的模拟遗漏。
+- 复用公共任务时同时核验串行执行配置，拒绝丢失并发保护的漂移。
+
 ## 0.13.2
 
 - Jenkins运维巡检不依赖项目登记和中央配置即可发现Job、检查接入缺项并发送流水线机器人提醒。

package/README.md

@@ -49,7 +49,7 @@ Gate 是质量执行与裁决层，复用项目已有检查器和适用的 WL
 wl-quality init
 ```
 
-本轮统一使用`0.13.2`固定版本；交付包与批准安装源的版本和字节摘要须一致，安装脚本自动核验。
+本轮统一使用`0.13.3`固定版本；交付包与批准安装源的版本和字节摘要须一致，安装脚本自动核验。
 
 | 项目 | 依赖装在哪里 | 业务构建 |
 | --- | --- | --- |

package/docs/01-quick-start.md

@@ -27,7 +27,7 @@ wl-quality init
 
 ```bash
 npm exec --yes --ignore-scripts --registry=https://registry.npmjs.org/ \
-  --package=@agile-team/wl-skills-gate@0.13.2 -- wl-quality init
+  --package=@agile-team/wl-skills-gate@0.13.3 -- wl-quality init
 ```
 
 向导展示差异与实际安装计划，确认后执行；检查异常不能当成零问题。接入后日常由Hook自动检查；正式Review、远端强制检查、群消息与报告权限仍按现场清单验收。

package/docs/07-jenkins.md

@@ -63,7 +63,7 @@ node('wl-quality-router') { load('/opt/wl-quality/gate-validation/jenkins/entry.
 
 ## 当前交付边界
 
-本轮以0.13.2固定正式版本交付。包发布和隔离测试不代表两业务仓库或远端已接通。正式Review后的自动续建、验证构建结果/制品采集、紧凑检查卡片可靠投递已通过隔离贯通测试；真实项目配置、中央服务、TEST任务和飞书身份仍需现场交接／验收。
+本轮以0.13.3固定正式版本交付。包发布和隔离测试不代表两业务仓库或远端已接通。正式Review后的自动续建、验证构建结果/制品采集、紧凑检查卡片可靠投递已通过隔离贯通测试；真实项目配置、中央服务、TEST任务和飞书身份仍需现场交接／验收。
 
 团队操作以交付包根目录的完整或运维接入操作说明为准，本文供维护者排查底层契约。
 

package/docs/README.md

@@ -1,6 +1,6 @@
 # wl-skills-gate 技术手册索引
 
-当前正式版本0.13.2。团队操作以交付包根目录主说明为准，见[16 项目与运维入口](16-project-ci-integration.md)；本索引提供工具契约与参数参考。
+当前正式版本0.13.3。团队操作以交付包根目录主说明为准，见[16 项目与运维入口](16-project-ci-integration.md)；本索引提供工具契约与参数参考。
 
 授权声明见 [LICENSE](../LICENSE)；公开获取不授予使用、复制、修改或再分发授权，申请入口为 [仓库 Issues](https://github.com/ChenyCHENYU/wl-skills-gate/issues)。
 

package/lib/jenkins-node-bootstrap.js

@@ -14,7 +14,7 @@ export async function planJenkinsBootstrap({configFile,env=process.env,fetchImpl
  const entries=[];
  for(const [role,job] of Object.entries(MAINTENANCE_JOBS)){
   const before=await client.config(job);let action='create',reason='';
-  if(before!==null){try{const v=jobContract(before);const schedule=role==='node'?'H/5 * * * *':'* * * * *';const ownedSchedule=['node','automation','review'].includes(role)&&v.triggers.length===1&&v.triggers[0].type==='hudson.triggers.TimerTrigger'&&v.triggers[0].fields.spec===schedule;assert(v.script===script.trim()&&v.sandbox==='true'&&v.disabled==='false'&&(!v.triggers.length||ownedSchedule),'同名任务存在自定义脚本／触发器或已禁用');action='unchanged';}catch(e){action='blocked';reason=e.message;}}
+  if(before!==null){try{const v=jobContract(before);const schedule=role==='node'?'H/5 * * * *':'* * * * *';const ownedSchedule=['node','automation','review'].includes(role)&&v.triggers.length===1&&v.triggers[0].type==='hudson.triggers.TimerTrigger'&&v.triggers[0].fields.spec===schedule;assert(v.script===script.trim()&&v.sandbox==='true'&&v.disabled==='false'&&v.concurrent&&(!v.triggers.length||ownedSchedule),'同名任务存在自定义脚本／触发器或已禁用');action='unchanged';}catch(e){action='blocked';reason=e.message;}}
   // The operator creates this single initial job; never mutate a running self.
   if(role==='fleet'&&before===null){action='blocked';reason='先创建wl-quality-fleet并填入生成的一行入口';}
   entries.push({role,job,action,...(reason?{reason}:{}),beforeHash:before===null?null:digest(before)});

package/lib/xml.js

@@ -1,4 +1,4 @@
-// 仅接受完整、无 DTD 的 XML；不支持的格式失败关闭，不猜测测试结果。
+// 接受完整、无 DTD 的 UTF-8 XML 1.0／1.1 声明；仍使用严格受限字符与元素子集，不猜测测试结果。
 function decode(text) {
   if (/&(?!(?:amp|lt|gt|quot|apos|#\d+|#x[\da-fA-F]+);)/.test(text)) throw new Error("XML 包含未知或未闭合实体");
   return text.replace(/&([^;]+);/g, (_, entity) => {
@@ -26,6 +26,12 @@ function opening(tag) {
 
 export function parseXml(xml) {
   xml = xml.replace(/^\uFEFF/, "");
+  // Normalize physical line endings before decoding references (XML 1.0/1.1 §2.11).
+  const xml11 = /^<\?xml\s+version\s*=\s*(?:"1\.1"|'1\.1')(?=\s|\?>)/.test(xml);
+  const declaration = /^<\?xml[\s\S]*?\?>/.exec(xml)?.[0] || "";
+  if (xml11 && /[\u0085\u2028]/.test(declaration)) throw new Error("XML 1.1 声明包含非法换行");
+  if (xml11 && /[\u007f-\u0084\u0086-\u009f]/.test(xml)) throw new Error("XML 1.1 包含非法字面控制字符");
+  xml = xml.replace(xml11 ? /\r\n|\r\u0085|\r|\u0085|\u2028/g : /\r\n|\r/g, "\n");
   if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/.test(xml)) throw new Error("XML 包含非法控制字符");
   const token = /<!--[\s\S]*?-->|<\?[^?]*(?:\?(?!>)[^?]*)*\?>|<!\[CDATA\[[\s\S]*?\]\]>|<(?:(?:[^<>"']|"[^"<]*"|'[^'<]*')+)>|[^<]+/gy;
   const stack = [];
@@ -42,7 +48,7 @@ export function parseXml(xml) {
       continue;
     }
     if (value.startsWith("<?")) {
-      if (m.index !== 0 || !/^<\?xml\s+version\s*=\s*(?:"1\.0"|'1\.0')(?:\s+encoding\s*=\s*(?:"UTF-8"|'UTF-8'))?(?:\s+standalone\s*=\s*(?:"(?:yes|no)"|'(?:yes|no)'))?\s*\?>$/i.test(value)) throw new Error("仅支持开头完整的 UTF-8 XML 1.0 声明");
+      if (m.index !== 0 || !/^<\?xml\s+version\s*=\s*(?:"1\.[01]"|'1\.[01]')(?:\s+encoding\s*=\s*(?:"UTF-8"|'UTF-8'))?(?:\s+standalone\s*=\s*(?:"(?:yes|no)"|'(?:yes|no)'))?\s*\?>$/i.test(value)) throw new Error("仅支持开头完整的 UTF-8 XML 1.0／1.1 声明");
       continue;
     }
     if (value.startsWith("<![CDATA[")) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@agile-team/wl-skills-gate",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@agile-team/wl-skills-gate",
-      "version": "0.13.2",
+      "version": "0.13.3",
       "license": "UNLICENSED",
       "dependencies": {
         "@secretlint/node": "13.0.7",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agile-team/wl-skills-gate",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "质量工程执行包 — 统一接入、九维Review证据授权、自动门禁、可信CI采集与分类治理通知",
   "type": "module",
   "main": "./lib/run.js",

package/scripts/lib-tests/jenkins-native.test.mjs

@@ -33,7 +33,7 @@ test('真实扫描入口生成本轮公共入口工件；旧Gate或不同SHA不
 });
 test('公共任务首次只建四个、逐个回读；重跑零写入，同名自定义不覆盖，超时先对账',async t=>{
  const f=fixture(t),v=installed(f),script=nativePipelineEntry(v.result.nativeEntry);const jobs=new Map(),env={WL_JENKINS_CONFIG_USER:'service',WL_JENKINS_CONFIG_TOKEN:'fixture'},posts=[];let unknown=true;
- const xml=s=>`<flow-definition><properties/><definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition"><script>${s}</script><sandbox>true</sandbox></definition><disabled>false</disabled></flow-definition>`;
+ const xml=s=>`<flow-definition><properties><org.jenkinsci.plugins.workflow.job.properties.DisableConcurrentBuildsJobProperty><abortPrevious>false</abortPrevious></org.jenkinsci.plugins.workflow.job.properties.DisableConcurrentBuildsJobProperty></properties><definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition"><script>${s}</script><sandbox>true</sandbox></definition><disabled>false</disabled></flow-definition>`;
  jobs.set('wl-quality-fleet',xml(script));const fetchImpl=async(url,o)=>{const u=new URL(url);if(o.method==='GET'){const name=decodeURIComponent(u.pathname.split('/')[2]);return jobs.has(name)?new Response(jobs.get(name)):new Response('',{status:404});}assert.equal(u.pathname,'/createItem');const name=u.searchParams.get('name');posts.push(name);jobs.set(name,o.body);if(unknown){unknown=false;throw Error('timeout after create');}return new Response('');};
  const options={configFile:v.result.clusterFile,env,fetchImpl};let p=await planJenkinsBootstrap(options);assert.equal(p.entries.filter(e=>e.action==='create').length,4);await assert.rejects(applyJenkinsBootstrap({...options,confirm:true,planHash:'0'.repeat(64)}),/预览/);let result=await applyJenkinsBootstrap({...options,confirm:true,planHash:p.planHash});assert.equal(result.status,'common-jobs-verified',JSON.stringify(result));assert.equal(posts.length,4);assert(result.entries.some(e=>e.writeReconciled));assert(!result.businessBuildsTriggered);assert(!result.schedulesEnabled);assert.equal(jobs.size,5);p=await planJenkinsBootstrap(options);result=await applyJenkinsBootstrap({...options,confirm:true,planHash:p.planHash});assert.equal(result.status,'common-jobs-verified');assert.equal(posts.length,4);jobs.set('wl-quality-review',xml('echo custom'));p=await planJenkinsBootstrap(options);assert.equal(p.status,'blocked');await assert.rejects(applyJenkinsBootstrap({...options,confirm:true,planHash:p.planHash}),/阻断/);assert.equal(jobContract(jobs.get('wl-quality-review')).script,'echo custom');
 });
@@ -41,7 +41,7 @@ test('公共入口配置拒绝符号链接和注入路径',t=>{const f=fixture(t
 
 test('公共任务已启用包内定时后仍可重复核验；未知定时和禁用任务拒绝冒充可用',async t=>{
  const f=fixture(t),v=installed(f),script=nativePipelineEntry(v.result.nativeEntry);let spec='* * * * *',disabled=false;
- const fetchImpl=async url=>{const role=decodeURIComponent(new URL(url).pathname.split('/')[2]);const trigger=role==='wl-quality-central'?`<org.jenkinsci.plugins.workflow.job.properties.PipelineTriggersJobProperty><triggers><hudson.triggers.TimerTrigger><spec>${spec}</spec></hudson.triggers.TimerTrigger></triggers></org.jenkinsci.plugins.workflow.job.properties.PipelineTriggersJobProperty>`:'';return new Response(`<flow-definition><properties>${trigger}</properties><definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition"><script>${script}</script><sandbox>true</sandbox></definition><disabled>${disabled}</disabled></flow-definition>`);};
+ const fetchImpl=async url=>{const role=decodeURIComponent(new URL(url).pathname.split('/')[2]);const trigger=role==='wl-quality-central'?`<org.jenkinsci.plugins.workflow.job.properties.PipelineTriggersJobProperty><triggers><hudson.triggers.TimerTrigger><spec>${spec}</spec></hudson.triggers.TimerTrigger></triggers></org.jenkinsci.plugins.workflow.job.properties.PipelineTriggersJobProperty>`:'';return new Response(`<flow-definition><properties><org.jenkinsci.plugins.workflow.job.properties.DisableConcurrentBuildsJobProperty><abortPrevious>false</abortPrevious></org.jenkinsci.plugins.workflow.job.properties.DisableConcurrentBuildsJobProperty>${trigger}</properties><definition class="org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition"><script>${script}</script><sandbox>true</sandbox></definition><disabled>${disabled}</disabled></flow-definition>`);};
  const options={configFile:v.result.clusterFile,env:{WL_JENKINS_CONFIG_USER:'service',WL_JENKINS_CONFIG_TOKEN:'fixture'},fetchImpl};assert.equal((await planJenkinsBootstrap(options)).status,'preview');spec='H * * * *';assert.equal((await planJenkinsBootstrap(options)).status,'blocked');spec='* * * * *';disabled=true;assert.equal((await planJenkinsBootstrap(options)).status,'blocked');
 });
 

package/scripts/lib-tests/jenkins-xml-roundtrip.test.mjs

@@ -0,0 +1,156 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtempSync,mkdirSync,readFileSync,rmSync,realpathSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {parseXml} from '../../lib/xml.js';
+import {jobContract} from '../../lib/jenkins-job-config.js';
+import {GATE_VERSION} from '../../lib/jenkins-integration.js';
+import {nativePipelineEntry} from '../../lib/jenkins-entry-contract.js';
+import {planJenkinsInstallation,applyJenkinsInstallation} from '../../lib/jenkins-installation.js';
+import {planJenkinsBootstrap,applyJenkinsBootstrap} from '../../lib/jenkins-node-bootstrap.js';
+import {MAINTENANCE_JOBS} from '../../lib/jenkins-cluster.js';
+
+// Jenkins switched its XML output to 1.1 in 2.107.1. A protocol mock which
+// echoes createItem's request body never exercises the real config.xml format.
+// This fixture independently rebuilds Jenkins-style persisted XML from the
+// approved script; it never stores or returns the submitted request body.
+const declaration=quote=>`<?xml version=${quote}1.1${quote} encoding=${quote}UTF-8${quote}?>`;
+const text=value=>String(value).replaceAll('&','&amp;').replaceAll('<','&lt;').replaceAll('>','&gt;').replaceAll('"','&quot;').replaceAll("'",'&apos;').replaceAll('\n','&#xA;');
+function persistedJob(script,{quote='"',scriptOverride,sandbox='true',disabled='false',concurrent=true,spec=null}={}) {
+ const properties=[
+  '<hudson.model.ParametersDefinitionProperty><parameterDefinitions/></hudson.model.ParametersDefinitionProperty>',
+  concurrent?'<org.jenkinsci.plugins.workflow.job.properties.DisableConcurrentBuildsJobProperty><abortPrevious>false</abortPrevious></org.jenkinsci.plugins.workflow.job.properties.DisableConcurrentBuildsJobProperty>':'',
+  '<org.jenkinsci.plugins.workflow.job.properties.PipelineTriggersJobProperty><triggers>'+(spec===null?'':`<hudson.triggers.TimerTrigger><spec>${text(spec)}</spec></hudson.triggers.TimerTrigger>` )+'</triggers></org.jenkinsci.plugins.workflow.job.properties.PipelineTriggersJobProperty>'
+ ].filter(Boolean).reverse().join('\n    ');
+ return `${declaration(quote)}\n<flow-definition plugin="workflow-job@1505.fixture">
+  <actions/>
+  <description>WL Gate common task &amp; regression</description>
+  <keepDependencies>false</keepDependencies>
+  <properties>
+    ${properties}
+  </properties>
+  <definition plugin='workflow-cps@4218.fixture' class='org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition'>
+    <script>${text(scriptOverride??script)}</script>
+    <sandbox>${sandbox}</sandbox>
+  </definition>
+  <triggers/>
+  <disabled>${disabled}</disabled>
+</flow-definition>\n`;
+}
+const jobNames=Object.values(MAINTENANCE_JOBS);
+function installed(t) {
+ const base=mkdtempSync(path.join(realpathSync(tmpdir()),'wl-xml-roundtrip-'));
+ t.after(()=>rmSync(base,{recursive:true,force:true}));
+ const configDir=path.join(base,'config');mkdirSync(configDir);
+ const input={prefix:path.join(base,'install space'),configDir,registryFiles:[path.join(configDir,'bindings.json')],jenkinsOrigin:'https://jenkins.example.invalid/',centralAgentLabel:'central',reviewSignerAgentLabel:'signer'};
+ const plan=planJenkinsInstallation(input);
+ const node=applyJenkinsInstallation({...input,confirm:true,planHash:plan.planHash});
+ const script=nativePipelineEntry(node.nativeEntry),jobs=new Map([['wl-quality-fleet',persistedJob(script)]]);
+ const calls=[],created=[],submitted=[];
+ const fixture={node,script,jobs,calls,created,submitted,quote:'"',lostReply:false,mutateCreated:null};
+ fixture.fetchImpl=async(endpoint,request)=>{
+  const url=new URL(endpoint);assert.equal(url.origin,'https://jenkins.example.invalid');
+  calls.push({method:request.method,path:url.pathname});
+  if(request.method==='GET'){
+   const match=/^\/job\/([^/]+)\/config\.xml$/.exec(url.pathname);assert.ok(match,'only expected metadata requests');
+   const name=decodeURIComponent(match[1]);
+   return jobs.has(name)?new Response(jobs.get(name),{headers:{'Content-Type':'application/xml; charset=UTF-8'}}):new Response('',{status:404});
+  }
+  assert.equal(request.method,'POST');assert.equal(url.pathname,'/createItem');
+  const name=url.searchParams.get('name');assert.ok(jobNames.includes(name));
+  assert.ok(!jobs.has(name),'create-only must not overwrite an existing job');
+  assert.equal(jobContract(request.body).script,script.trim(),'submit the approved native entry');
+  submitted.push(request.body);created.push(name);
+  let saved=persistedJob(script,{quote:fixture.quote});
+  if(fixture.mutateCreated)saved=fixture.mutateCreated(name,saved);
+  assert.notEqual(saved,request.body,'persisted Jenkins response must not echo request XML');
+  jobs.set(name,saved);
+  if(fixture.lostReply){fixture.lostReply=false;throw Error('fixture response lost after Jenkins saved config');}
+  return new Response('',{status:200});
+ };
+ fixture.options={configFile:node.clusterFile,env:{WL_JENKINS_CONFIG_USER:'fixture-admin',WL_JENKINS_CONFIG_TOKEN:'fixture-not-real'},fetchImpl:fixture.fetchImpl};
+ return fixture;
+}
+
+for(const [name,header] of [
+ ['XML 1.0 UTF-8 declaration','<?xml version="1.0" encoding="UTF-8"?>'],
+ ['Jenkins XML 1.1 double-quoted declaration',declaration('"')],
+ ['Jenkins XML 1.1 single-quoted declaration',declaration("'")]
+])test(name,()=>assert.equal(parseXml(header+'\n<root>正常 &amp; safe</root>').text,'正常 & safe'));
+
+for(const [label,header,lineEnding] of [
+ ['1.0 CRLF','<?xml version="1.0"?>','\r\n'],
+ ['1.1 CRLF',declaration('"'),'\r\n'],
+ ['1.1 CR+NEL',declaration('"'),'\r\u0085'],
+ ['1.1 NEL',declaration('"'),'\u0085'],
+ ['1.1 Unicode line separator',declaration("'"),'\u2028']
+])test(`XML physical line endings normalize before contract comparison: ${label}`,()=>{
+ assert.equal(parseXml(header+lineEnding+'<root>a'+lineEnding+'b</root>').text,'a\nb');
+});
+test('XML character references remain explicit characters after physical newline normalization',()=>{
+ assert.equal(parseXml(declaration('"')+'<root>a&#13;b&#x85;c&#x2028;d&#10;e</root>').text,'a\rb\u0085c\u2028d\ne');
+});
+
+for(const [label,xml] of [
+ ['unsupported XML version','<?xml version="1.2"?><root/>'],
+ ['unsupported encoding','<?xml version="1.1" encoding="UTF-16"?><root/>'],
+ ['second declaration',declaration('"')+declaration('"')+'<root/>'],
+ ['external DTD',declaration('"')+'<!DOCTYPE root SYSTEM "file:///not-read"><root/>'],
+ ['internal entity declaration',declaration('"')+'<!DOCTYPE root [<!ENTITY x "private">]><root>&x;</root>'],
+ ['unknown entity',declaration('"')+'<root>&notDeclared;</root>'],
+ ['literal control character',declaration('"')+'<root>\u0001</root>'],
+ ['zero character reference',declaration('"')+'<root>&#0;</root>']
+])test(`XML 1.1 support stays fail-closed: ${label}`,()=>assert.throws(()=>parseXml(xml)));
+
+for(const quote of ['"',"'"])test(`real bootstrap plan/apply verifies all five normalized Jenkins jobs (${quote} declaration) and reuses them`,async t=>{
+ const f=installed(t);f.quote=quote;
+ f.jobs.set('wl-quality-fleet',persistedJob(f.script,{quote}));
+ assert.equal(JSON.parse(readFileSync(new URL('../../package.json',import.meta.url))).version,GATE_VERSION);
+ let p=await planJenkinsBootstrap(f.options);
+ assert.equal(p.status,'preview');assert.equal(p.entries.filter(e=>e.action==='create').length,4);
+ let result=await applyJenkinsBootstrap({...f.options,confirm:true,planHash:p.planHash});
+ assert.equal(result.status,'common-jobs-verified',JSON.stringify(result));
+ assert.equal(result.entries.length,5);assert.ok(result.entries.every(e=>e.status==='verified'));
+ assert.equal(result.businessBuildsTriggered,false);assert.equal(result.schedulesEnabled,false);
+ assert.equal(f.created.length,4);assert.equal(f.jobs.size,5);
+ for(const xml of f.jobs.values())assert.ok(xml.startsWith(declaration(quote)));
+ const persisted=[...f.jobs];p=await planJenkinsBootstrap(f.options);
+ assert.ok(p.entries.every(e=>e.action==='unchanged'));
+ result=await applyJenkinsBootstrap({...f.options,confirm:true,planHash:p.planHash});
+ assert.equal(result.status,'common-jobs-verified');assert.equal(f.created.length,4);assert.deepEqual([...f.jobs],persisted);
+ assert.ok(f.calls.every(c=>c.method==='GET'||c.path==='/createItem'),'no overwrite, build, credential, or secret endpoint');
+});
+test('Jenkins-normalized readback reconciles a lost create response without duplicating the saved job',async t=>{
+ const f=installed(t);f.lostReply=true;
+ const p=await planJenkinsBootstrap(f.options),result=await applyJenkinsBootstrap({...f.options,confirm:true,planHash:p.planHash});
+ assert.equal(result.status,'common-jobs-verified',JSON.stringify(result));
+ assert.equal(result.entries.filter(e=>e.writeReconciled).length,1);assert.equal(f.created.length,4);
+});
+test('owned maintenance schedules survive normalized property/trigger serialization without extra writes',async t=>{
+ const f=installed(t);
+ for(const [role,name] of Object.entries(MAINTENANCE_JOBS))f.jobs.set(name,persistedJob(f.script,{spec:role==='node'?'H/5 * * * *':['review','automation'].includes(role)?'* * * * *':null}));
+ const p=await planJenkinsBootstrap(f.options);assert.equal(p.status,'preview',JSON.stringify(p));
+ const r=await applyJenkinsBootstrap({...f.options,confirm:true,planHash:p.planHash});
+ assert.equal(r.status,'common-jobs-verified');assert.equal(f.created.length,0);
+});
+for(const [label,changes] of [
+ ['changed executable script',{scriptOverride:"println 'unexpected owner'"}],
+ ['sandbox disabled',{sandbox:'false'}],
+ ['job disabled',{disabled:'true'}],
+ ['concurrency protection removed',{concurrent:false}],
+ ['unapproved timer trigger',{spec:'H * * * *'}]
+])test(`existing normalized job stays blocked for ${label}`,async t=>{
+ const f=installed(t),original=persistedJob(f.script,changes);f.jobs.set('wl-quality-fleet',original);
+ const p=await planJenkinsBootstrap(f.options);assert.equal(p.status,'blocked',JSON.stringify(p));
+ await assert.rejects(applyJenkinsBootstrap({...f.options,confirm:true,planHash:p.planHash}),/阻断/);
+ assert.equal(f.jobs.get('wl-quality-fleet'),original);assert.equal(f.created.length,0);
+});
+test('a genuinely changed script after create is attention, never a verified bootstrap or automatic overwrite',async t=>{
+ const f=installed(t);f.mutateCreated=(name,saved)=>name==='wl-quality-doctor'?persistedJob(f.script,{scriptOverride:"println 'changed after save'"}):saved;
+ const p=await planJenkinsBootstrap(f.options),result=await applyJenkinsBootstrap({...f.options,confirm:true,planHash:p.planHash});
+ assert.equal(result.status,'attention');assert.equal(result.entries.find(e=>e.job==='wl-quality-doctor').status,'attention');
+ assert.equal(result.businessBuildsTriggered,false);assert.equal(result.schedulesEnabled,false);
+ const writes=f.created.length,next=await planJenkinsBootstrap(f.options);assert.equal(next.status,'blocked');
+ await assert.rejects(applyJenkinsBootstrap({...f.options,confirm:true,planHash:next.planHash}),/阻断/);assert.equal(f.created.length,writes);
+});

package/templates/ci/check-project.config.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "kind": "wl-quality-ci-check",
   "project": "REPLACE_WITH_ACTUAL_PROJECT",
-  "gateVersion": "0.13.2",
+  "gateVersion": "0.13.3",
   "workspaceHash": "REPLACE_WITH_APPROVED_WORKSPACE_SHA256",
   "lockHash": "REPLACE_WITH_APPROVED_LOCK_SHA256",
   "policyHash": "REPLACE_WITH_APPROVED_POLICY_SHA256",

package/templates/ci/jenkins-bootstrap.py

@@ -55,7 +55,7 @@ def preflight(env):
     valid_root = root.is_absolute() and root.is_dir()
     check("gate-root", valid_root, "固定 Gate 目录可读取" if valid_root else "固定 Gate 目录不存在或不可读取",
           "在该Jenkins节点运行本包的接入Jenkins脚本；使用安装回执中的 gateHome。包内入口为 bin/wl-skills-gate.js。")
-    expected = env.get("WL_BOOTSTRAP_GATE_VERSION", "0.13.2")
+    expected = env.get("WL_BOOTSTRAP_GATE_VERSION", "0.13.3")
     try:
         package = json.loads((root / "package.json").read_text())
         correct = package.get("name") == "@agile-team/wl-skills-gate" and package.get("version") == expected

package/templates/onboarding/backend/quality-tools.package.json

@@ -3,7 +3,7 @@
   "private": true,
   "engines": { "node": "^22.13.0 || >=24.0.0" },
   "devDependencies": {
-    "@agile-team/wl-skills-gate": "0.13.2",
+    "@agile-team/wl-skills-gate": "0.13.3",
     "@agile-team/wl-skills-bd": "0.41.1"
   }
 }

package/templates/quality/rules.lock.json

@@ -1,6 +1,6 @@
 {
   "lockVersion": 1,
-  "wl-skills-gate": "0.13.2",
+  "wl-skills-gate": "0.13.3",
   "tools": {
     "TS-TYPECHECK": "<填写 vue-tsc --version 的完整输出>",
     "FE-ESLINT": "<填写 eslint --version 的完整输出>"