@aipt/idp-deploy 0.1.2

package/release/defaults.v1.json

@@ -0,0 +1,64 @@
+{
+  "schemaVersion": 1,
+  "releaseVersion": "0.1.2",
+  "ociRepositoryRoot": "idp-registry.cn-shanghai.cr.aliyuncs.com/education/oci",
+  "platforms": [
+    "linux/amd64",
+    "linux/arm64"
+  ],
+  "thirdPartyImages": {
+    "IDP_POSTGRES_IMAGE": "postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685",
+    "IDP_CADDY_IMAGE": "caddy:2-alpine@sha256:5f5c8640aae01df9654968d946d8f1a56c497f1dd5c5cda4cf95ab7c14d58648",
+    "IDP_REGISTRY_IMAGE": "verdaccio/verdaccio:6@sha256:fcb86134563534e2f634752e6c6c3edcdb78242ec16578c73ce39d1dadbaa801",
+    "IDP_SMARTGO_OBJECT_STORE_IMAGE": "quay.io/minio/minio:RELEASE.2025-04-22T22-12-26Z@sha256:a1ea29fa28355559ef137d71fc570e508a214ec84ff8083e39bc5428980b015e",
+    "IDP_SMARTGO_OBJECT_STORE_CLIENT_IMAGE": "quay.io/minio/mc:RELEASE.2025-04-16T18-13-26Z@sha256:aead63c77f9db9107f1696fb08ecb0faeda23729cde94b0f663edf4fe09728e3"
+  },
+  "buildImages": {
+    "tech": {
+      "environmentKey": "IDP_TECH_IMAGE",
+      "sourceDirectory": "tech",
+      "context": ".",
+      "dockerfile": "apps/knowledge-service/Dockerfile",
+      "repositorySuffix": "",
+      "buildArgs": {
+        "NODE_IMAGE": "node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5"
+      },
+      "buildSecretFiles": {},
+      "prebuildContract": "none"
+    },
+    "flow": {
+      "environmentKey": "IDP_FLOW_IMAGE",
+      "sourceDirectory": "flow",
+      "context": ".",
+      "dockerfile": "deploy/Dockerfile",
+      "repositorySuffix": "/flow",
+      "buildArgs": {},
+      "buildSecretFiles": {},
+      "prebuildContract": "none"
+    },
+    "portal": {
+      "environmentKey": "IDP_PORTAL_IMAGE",
+      "sourceDirectory": "portal",
+      "context": ".",
+      "dockerfile": "packages/backend/Dockerfile",
+      "repositorySuffix": "/portal",
+      "buildArgs": {},
+      "buildSecretFiles": {},
+      "prebuildContract": "portal-backstage-v1"
+    },
+    "smartgo": {
+      "environmentKey": "IDP_SMARTGO_IMAGE",
+      "sourceDirectory": "smartGO",
+      "context": ".",
+      "dockerfile": "Dockerfile",
+      "repositorySuffix": "/smartgo",
+      "buildArgs": {
+        "NODE_IMAGE": "node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd"
+      },
+      "buildSecretFiles": {
+        "npmrc": "SMARTGO_NPMRC_FILE"
+      },
+      "prebuildContract": "smartgo-managed-v1"
+    }
+  }
+}

package/src/acceptance.mjs

@@ -0,0 +1,127 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { doctorConfig, referencedFiles } from './config.mjs';
+import { IdpError, invariant } from './errors.mjs';
+import {
+  composeOperation,
+  createBackup,
+  testRestore,
+  verifyBackup,
+  verifyDeployment,
+  withInstanceLock,
+  writeReceipt,
+} from './operations.mjs';
+import { run } from './process.mjs';
+import { imageKeysForProfile } from './images.mjs';
+import { resolveProfile } from './profiles.mjs';
+import { assertSafeRegularFile, createExclusiveFile } from './security.mjs';
+
+function parseDockerInfo(stdout) {
+  let document;
+  try { document = JSON.parse(String(Buffer.isBuffer(stdout) ? stdout.toString('utf8') : stdout)); }
+  catch { throw new IdpError('IDP_M4_DOCKER_INFO_INVALID', '无法解析Docker Engine信息'); }
+  const architecture = String(document.Architecture ?? document.ArchitectureName ?? '').toLowerCase();
+  invariant(['arm64', 'aarch64'].includes(architecture), 'IDP_M4_DOCKER_ARCH_INVALID', `Docker Engine不是ARM64：${architecture || 'unknown'}`);
+  invariant(String(document.OSType ?? '').toLowerCase() === 'linux', 'IDP_M4_DOCKER_OS_INVALID', 'Docker Engine容器OS必须是linux');
+  return { architecture, osType: 'linux', serverVersion: String(document.ServerVersion ?? 'unknown'), operatingSystem: String(document.OperatingSystem ?? 'unknown') };
+}
+
+export function verifyMacM4Host({ runner = run, host = { platform: os.platform(), arch: os.arch() } } = {}) {
+  invariant(host.platform === 'darwin' && host.arch === 'arm64', 'IDP_M4_NATIVE_HOST_REQUIRED', `M4正式验收必须在darwin/arm64原生宿主执行，当前为${host.platform}/${host.arch}`);
+  const result = runner('docker', ['info', '--format', '{{json .}}'], { capture: true });
+  return { host, docker: parseDockerInfo(result.stdout) };
+}
+
+function npmEnvironment(runtimeDirectory) {
+  const environment = { ...process.env };
+  for (const key of Object.keys(environment)) {
+    if (key.startsWith('NPM_CONFIG_') || /(?:NPM|NODE)_AUTH_TOKEN/u.test(key)) delete environment[key];
+  }
+  environment.NPM_CONFIG_CACHE = path.join(runtimeDirectory, 'npm-cache');
+  environment.NPM_CONFIG_GLOBALCONFIG = path.join(runtimeDirectory, 'empty-global-npmrc');
+  return environment;
+}
+
+function prepareNpmAcceptance({ root, env, runner }) {
+  const ref = referencedFiles(root).find((entry) => entry.key === 'IDP_REGISTRY_ACCEPTANCE_NPMRC_FILE');
+  invariant(ref, 'IDP_REGISTRY_ACCEPTANCE_NPMRC_MISSING', '缺少IDP_REGISTRY_ACCEPTANCE_NPMRC_FILE声明');
+  assertSafeRegularFile(ref.absolute, 0o600, { allowEmpty: false, role: 'Registry验收npmrc' });
+  const runtimeDirectory = fs.mkdtempSync(path.join(env.IDP_RUNTIME_DIR, 'tmp', 'npm-acceptance-'));
+  fs.chmodSync(runtimeDirectory, 0o700);
+  fs.mkdirSync(path.join(runtimeDirectory, 'consumer'), { mode: 0o700 });
+  createExclusiveFile(path.join(runtimeDirectory, 'empty-global-npmrc'), '', 0o600);
+  const packageName = `@aipt/idp-acceptance-${Date.now()}-${crypto.randomBytes(3).toString('hex')}`;
+  const version = '1.0.0';
+  createExclusiveFile(path.join(runtimeDirectory, 'package.json'), `${JSON.stringify({ name: packageName, version, private: false, main: 'index.js', scripts: {} }, null, 2)}\n`, 0o600);
+  createExclusiveFile(path.join(runtimeDirectory, 'index.js'), "export const acceptance = 'passed';\n", 0o600);
+  createExclusiveFile(path.join(runtimeDirectory, 'consumer', 'package.json'), `${JSON.stringify({ name: 'idp-acceptance-consumer', version: '1.0.0', private: true }, null, 2)}\n`, 0o600);
+  const registry = `http://127.0.0.1:${env.IDP_REGISTRY_PORT}`;
+  const common = ['--userconfig', ref.absolute, '--globalconfig', path.join(runtimeDirectory, 'empty-global-npmrc'), '--registry', registry, '--ignore-scripts'];
+  const processEnvironment = npmEnvironment(runtimeDirectory);
+  const publish = () => runner('npm', ['publish', ...common], { cwd: runtimeDirectory, env: processEnvironment, capture: true });
+  const install = () => {
+    runner('npm', ['install', `${packageName}@${version}`, ...common, '--no-audit', '--no-fund'], { cwd: path.join(runtimeDirectory, 'consumer'), env: processEnvironment, capture: true });
+    const installed = path.join(runtimeDirectory, 'consumer', 'node_modules', '@aipt', packageName.slice('@aipt/'.length), 'package.json');
+    assertSafeRegularFile(installed, 0o644, { allowEmpty: false, role: 'Registry验收安装产物' });
+  };
+  const unpublish = () => runner('npm', ['unpublish', `${packageName}@${version}`, '--force', ...common], { cwd: runtimeDirectory, env: processEnvironment, capture: true });
+  const cleanup = () => fs.rmSync(runtimeDirectory, { recursive: true, force: true });
+  return { packageName, version, publish, install, unpublish, cleanup };
+}
+
+export function acceptMacM4({ repositoryRoot, configRoot, profile = 'core', confirmation, runner = run, host } = {}) {
+  const preliminary = doctorConfig(configRoot, { requireConfigured: true, profile });
+  invariant(confirmation === preliminary.env.IDP_INSTANCE_ID, 'IDP_M4_RESTART_CONFIRMATION_REQUIRED', 'M4验收包含一次冷停机，必须用--confirm-restart提供完全相同的IDP_INSTANCE_ID');
+  invariant(preliminary.env.IDP_RUNTIME_PLATFORM === 'linux/arm64', 'IDP_M4_RUNTIME_PLATFORM_INVALID', 'M4正式验收要求IDP_RUNTIME_PLATFORM=linux/arm64');
+  const native = verifyMacM4Host({ runner, host });
+  const active = new Set(resolveProfile(profile));
+  invariant(active.has('registry') || active.has('postgresql'), 'IDP_M4_ACCEPTANCE_PROFILE_INVALID', 'M4完整验收要求Profile至少包含Registry或PostgreSQL持久数据');
+
+  composeOperation({ repositoryRoot, configRoot, profile, command: ['up', '-d', '--wait'], allowProfileSwitch: true, runner });
+  const initial = verifyDeployment({ repositoryRoot, configRoot, profile, runner }).receipt;
+  const images = [];
+  for (const key of imageKeysForProfile(profile)) {
+    const inspected = runner('docker', ['image', 'inspect', preliminary.env[key], '--format', '{{.Os}}/{{.Architecture}}'], { capture: true });
+    const platform = String(inspected.stdout).trim().toLowerCase();
+    invariant(['linux/arm64', 'linux/aarch64'].includes(platform), 'IDP_M4_IMAGE_PLATFORM_INVALID', `${key}本地镜像平台不是linux/arm64：${platform}`);
+    images.push({ key, platform });
+  }
+
+  const backup = createBackup({ repositoryRoot, configRoot, profile, runner });
+  const backupVerified = verifyBackup({ configRoot, generationId: backup.receipt.generationId }).receipt;
+  const restoreTested = testRestore({ repositoryRoot, configRoot, generationId: backup.receipt.generationId, runner }).receipt;
+  const npmAcceptance = active.has('registry') ? prepareNpmAcceptance({ root: preliminary.root, env: preliminary.env, runner }) : null;
+  let stopped = false;
+  let published = false;
+  try {
+    if (npmAcceptance) { npmAcceptance.publish(); published = true; }
+    composeOperation({ repositoryRoot, configRoot, profile, command: ['down'], runner });
+    stopped = true;
+    composeOperation({ repositoryRoot, configRoot, profile, command: ['up', '-d', '--wait'], runner });
+    stopped = false;
+    const restarted = verifyDeployment({ repositoryRoot, configRoot, profile, runner }).receipt;
+    if (npmAcceptance) npmAcceptance.install();
+    if (npmAcceptance) { npmAcceptance.unpublish(); published = false; }
+    const { root, env, report } = doctorConfig(configRoot, { requireConfigured: true, profile });
+    return withInstanceLock(root, env, 'acceptance:mac-m4', () => writeReceipt(env, 'acceptance-mac-m4', {
+      profile, configDigest: report.digest, native, images, initialVerifyDigest: initial.digest,
+      coldRestartVerifyDigest: restarted.digest, backupGenerationId: backup.receipt.generationId,
+      backupVerifyDigest: backupVerified.digest, restoreTestDigest: restoreTested.digest,
+      registryPublishInstall: npmAcceptance ? { packageName: npmAcceptance.packageName, version: npmAcceptance.version, status: 'passed-across-cold-restart' } : null,
+      status: 'passed',
+    }));
+  } catch (error) {
+    if (stopped) {
+      try { composeOperation({ repositoryRoot, configRoot, profile, command: ['up', '-d', '--wait'], runner }); }
+      catch (recoveryError) { throw new IdpError('IDP_M4_ACCEPTANCE_RECOVERY_FAILED', `M4验收失败且服务恢复失败：${recoveryError.message}`, { originalError: error.message }); }
+    }
+    throw error;
+  } finally {
+    if (npmAcceptance) {
+      if (published) { try { npmAcceptance.unpublish(); } catch {} }
+      npmAcceptance.cleanup();
+    }
+  }
+}