@infly/libs 2.0.46 → 2.0.47

package/build/docker/release-docker.js

@@ -0,0 +1,199 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { execFileSync, spawnSync } = require("node:child_process");
+const dotenv = require("dotenv");
+const { dockerBuildPush } = require("./docker-build-push");
+
+const SAFE_SCRIPT_NAME = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
+
+function normalizeEmergencyOptions({
+  emergency = false,
+  emergencyReason,
+  standalone = false,
+  commitOnly = false,
+  healthCheck = false,
+} = {}) {
+  if (!emergency) return { emergency: false, emergencyReason: "" };
+  if (!standalone || !commitOnly || !healthCheck) {
+    throw new Error(
+      "紧急构建必须同时启用 --standalone、--commit-only 和 --health-check"
+    );
+  }
+  if (typeof emergencyReason !== "string") {
+    throw new Error("紧急构建必须通过 --emergency-reason 填写原因或审批/故障单号");
+  }
+  const normalizedReason = emergencyReason.trim();
+  if (normalizedReason.length < 8 || normalizedReason.length > 200) {
+    throw new Error("紧急构建原因长度必须为 8 到 200 个字符");
+  }
+  if (/[\u0000-\u001f\u007f]/.test(normalizedReason)) {
+    throw new Error("紧急构建原因不能包含控制字符");
+  }
+  return { emergency: true, emergencyReason: normalizedReason };
+}
+
+function run(command, args, label, cwd) {
+  console.log(`\n>>> ${label}`);
+  const result = spawnSync(command, args, {
+    cwd,
+    env: process.env,
+    stdio: "inherit",
+    shell: false,
+  });
+
+  if (result.error) throw new Error(`${label}无法启动: ${result.error.message}`);
+  if (result.status !== 0) throw new Error(`${label}失败，退出码: ${result.status}`);
+}
+
+function runShellCommand(command, label, cwd) {
+  if (/[\r\n&|<>^]/.test(command)) {
+    throw new Error(`${label}包含不安全的 Windows shell 字符`);
+  }
+  run(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", command], label, cwd);
+}
+
+function runPnpmScript(scriptName, cwd) {
+  if (!SAFE_SCRIPT_NAME.test(scriptName)) {
+    throw new Error(`dockerRelease.checks 包含非法脚本名: ${scriptName}`);
+  }
+  const label = `项目检查: pnpm run ${scriptName}`;
+  if (process.platform === "win32") {
+    runShellCommand(`pnpm run ${scriptName}`, label, cwd);
+  } else {
+    run("pnpm", ["run", scriptName], label, cwd);
+  }
+}
+
+function runSonarScanner(cwd, projectVersion) {
+  const label = "SonarQube 扫描与质量门禁";
+  const scannerArgs = [`-Dsonar.projectVersion=${projectVersion}`];
+  if (process.platform === "win32") {
+    runShellCommand(`sonar-scanner ${scannerArgs[0]}`, label, cwd);
+  } else {
+    run("sonar-scanner", scannerArgs, label, cwd);
+  }
+}
+
+function resolveProjectVersion(projectRoot) {
+  const fullCommit = execFileSync("git", ["rev-parse", "HEAD"], {
+    cwd: projectRoot,
+    encoding: "utf-8",
+  }).trim();
+  const commitHash = execFileSync("git", ["rev-parse", "--short=12", "HEAD"], {
+    cwd: projectRoot,
+    encoding: "utf-8",
+  }).trim();
+  if (!/^[0-9a-f]{7,40}$/i.test(fullCommit) || !/^[0-9a-f]{7,40}$/i.test(commitHash)) {
+    throw new Error("无法从当前项目解析合法的 Git commit hash");
+  }
+  return { commitHash: commitHash.toLowerCase(), fullCommit: fullCommit.toLowerCase() };
+}
+
+function assertCleanProject(projectRoot) {
+  const changes = execFileSync("git", ["status", "--porcelain", "--untracked-files=all"], {
+    cwd: projectRoot,
+    encoding: "utf-8",
+  }).trim();
+  if (changes) {
+    throw new Error("当前项目存在未提交改动；为保证镜像、Sonar revision 与 commit 标签一致，发布已终止");
+  }
+}
+
+function resolveInsideProject(projectRoot, relativePath, fieldName) {
+  if (typeof relativePath !== "string" || !relativePath.trim()) {
+    throw new Error(`${fieldName} 必须是非空相对路径`);
+  }
+  const resolved = path.resolve(projectRoot, relativePath);
+  const relative = path.relative(projectRoot, resolved);
+  if (path.isAbsolute(relative) || relative.startsWith("..")) {
+    throw new Error(`${fieldName} 不得指向项目目录外`);
+  }
+  return resolved;
+}
+
+function readReleaseConfig(projectRoot) {
+  const packagePath = path.join(projectRoot, "package.json");
+  if (!fs.existsSync(packagePath)) throw new Error("当前目录下缺少 package.json");
+  const pkg = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
+  const config = pkg.infly && pkg.infly.dockerRelease;
+  if (!config || !Array.isArray(config.checks) || config.checks.length === 0) {
+    throw new Error("package.json 必须配置 infly.dockerRelease.checks");
+  }
+  config.checks.forEach((scriptName) => {
+    if (typeof scriptName !== "string" || !SAFE_SCRIPT_NAME.test(scriptName)) {
+      throw new Error(`dockerRelease.checks 包含非法脚本名: ${scriptName}`);
+    }
+    if (!pkg.scripts || !pkg.scripts[scriptName]) {
+      throw new Error(`package.json 缺少检查脚本: ${scriptName}`);
+    }
+  });
+
+  const coverageReport = config.coverageReport
+    ? resolveInsideProject(projectRoot, config.coverageReport, "dockerRelease.coverageReport")
+    : undefined;
+  return {
+    checks: [...config.checks],
+    coverageReport,
+    sonar: config.sonar !== false,
+  };
+}
+
+function loadLocalReleaseEnv(projectRoot) {
+  const envPath = path.join(projectRoot, ".env.production.local");
+  if (!fs.existsSync(envPath)) return false;
+
+  const result = dotenv.config({ path: envPath, override: false });
+  if (result.error) {
+    throw new Error(`无法读取本地发布环境文件 ${envPath}: ${result.error.message}`);
+  }
+  return true;
+}
+
+async function releaseDocker(options = {}) {
+  const projectRoot = path.resolve(process.cwd());
+  loadLocalReleaseEnv(projectRoot);
+  const config = readReleaseConfig(projectRoot);
+  assertCleanProject(projectRoot);
+  const projectVersion = resolveProjectVersion(projectRoot);
+  const emergency = normalizeEmergencyOptions(options);
+
+  if (!emergency.emergency && config.sonar && (!process.env.SONAR_TOKEN || !process.env.SONAR_TOKEN.trim())) {
+    throw new Error(
+      "缺少 SONAR_TOKEN；请通过当前进程环境或被 Git 忽略的 .env.production.local 提供"
+    );
+  }
+
+  if (emergency.emergency) {
+    console.warn("\n⚠️ 紧急构建模式：已跳过项目检查和 SonarQube");
+    console.warn(`紧急原因: ${emergency.emergencyReason}`);
+    console.warn(`目标 commit: ${projectVersion.fullCommit}`);
+  } else {
+    for (const scriptName of config.checks) runPnpmScript(scriptName, projectRoot);
+  }
+
+  if (!emergency.emergency && config.coverageReport) {
+    if (!fs.existsSync(config.coverageReport) || fs.statSync(config.coverageReport).size === 0) {
+      throw new Error(`覆盖率报告不存在或为空: ${config.coverageReport}`);
+    }
+    console.log(`✓ 覆盖率报告已生成: ${config.coverageReport}`);
+  }
+
+  if (!emergency.emergency && config.sonar) {
+    runSonarScanner(projectRoot, projectVersion.commitHash);
+  }
+  return dockerBuildPush({
+    ...options,
+    version: projectVersion.commitHash,
+    revision: projectVersion.fullCommit,
+  });
+}
+
+module.exports = {
+  assertCleanProject,
+  loadLocalReleaseEnv,
+  normalizeEmergencyOptions,
+  readReleaseConfig,
+  releaseDocker,
+  resolveInsideProject,
+  resolveProjectVersion,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infly/libs",
-  "version": "2.0.46",
+  "version": "2.0.47",
   "description": "不受前端框架限制的独立工具库",
   "main": "index.js",
   "types": "index.d.ts",
@@ -62,6 +62,7 @@
   "dependencies": {
     "@infly/ts-libs": "workspace:*",
     "connect": "^3.7.0",
+    "dotenv": "16.6.1",
     "enquirer": "^2.4.1",
     "path-browserify": "^1.0.1",
     "serve-static": "^1.15.0",