@infly/libs 2.0.53 → 2.1.0

package/build/build-utils/webhook-single.js

@@ -1,136 +1,136 @@
-function shouldSkipWebhook() {
-  const args = process.argv || [];
-  const hasNoWebhookArg = args.some((arg = "") =>
-    ["--nowebhook", "--noWebhook", "--no-webhook"].includes(arg)
-  );
-
-  const env = process.env || {};
-  const envValues = [
-    env.npm_config_nowebhook,
-    env.npm_config_noWebhook,
-    env.NO_WEBHOOK,
-    env.DISABLE_WEBHOOK
-  ];
-  const hasNoWebhookEnv = envValues.some((value) => {
-    const normalized = String(value || "").toLowerCase();
-    return ["1", "true", "yes", "on"].includes(normalized);
-  });
-
-  return hasNoWebhookArg || hasNoWebhookEnv;
-}
-
-function getWebhookMessage() {
-  const args = process.argv || [];
-  const env = process.env || {};
-  const messageEnv =
-    env.npm_config_m ||
-    env.npm_config_message ||
-    env.WEBHOOK_MESSAGE ||
-    env.BUILD_MESSAGE ||
-    "";
-
-  if (messageEnv) {
-    return String(messageEnv).trim();
-  }
-
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] || "";
-
-    if (arg === "-m" || arg === "--message") {
-      return String(args[index + 1] || "").trim();
-    }
-
-    if (arg.startsWith("-m=")) {
-      return arg.slice(3).trim();
-    }
-
-    if (arg.startsWith("--message=")) {
-      return arg.slice(10).trim();
-    }
-  }
-
-  return "";
-}
-
-function postVersionFileAndMsg(publishText, extraParams = {}) {
-  const {
-    projectName,
-    newFileName,
-    gitInfo,
-    webhookUrl = "", // 启用企业微信推送
-    webhookAtUser = [],
-    webhookExtraText = "",
-    gitAutoPushRepos,
-    gitAutoPushReposBranchMap,
-    repos,
-    deployUrl = ""
-  } = extraParams || {};
-  const { branch, commitMsg, author } = gitInfo || {};
-  const webhookMessage = getWebhookMessage();
-  const GITPATH = `https://gitee.com/gdinfly_1/${projectName}/blob/${branch}/${newFileName}`;
-  const UPLOADURL = `https://qyapi.weixin.qq.com/cgi-bin/webhook/upload_media?key=&type=file`;
-  /* const data = {
-        msgtype: "markdown",
-        markdown: {
-            content: `${publishText}\n构建文件：[点击下载](${GITPATH})`,
-        },
-    };
-    if (Array.isArray(webhookAtUser) && webhookAtUser.length > 0) {
-        webhookAtUser.forEach((item, index) => {
-            data.markdown.content = `${data.markdown.content}\n<@${item}>`;
-        });
-    } */
-  let content = publishText;
-  if (gitAutoPushReposBranchMap) {
-    content = [
-      publishText,
-      `构建文件：已推送对应仓库【${repos}】- 分支【${gitAutoPushReposBranchMap[branch]}】`,
-      `构建人：${author}`,
-      deployUrl ? `部署系统：${deployUrl}` : ""
-    ].filter(Boolean).join("\n");
-  } else {
-    content = `${publishText}\n构建文件下载地址：${GITPATH}\n${webhookExtraText}\n`;
-  }
-
-  if (webhookMessage) {
-    content = `${content}\n${webhookMessage}`;
-  }
-
-  // 防御性过滤：防止运行时数据中的 %s 等格式化占位符泄露到推送内容
-  content = (content || "").replace(/%s/g, "");
-
-  const data = {
-    msgtype: "text",
-    text: {
-      content,
-      mentioned_mobile_list: Array.isArray(webhookAtUser) ? webhookAtUser : webhookAtUser[branch] // 支持按分支配置不同的提醒人
-    }
-  };
-
-  if (shouldSkipWebhook()) {
-    console.log(global.logColor?.info || "%s", "🔕 已跳过企业微信机器人推送（nowebhook）");
-    return;
-  }
-
-  try {
-    const axios = require("axios");
-
-    if (axios) {
-      axios
-        .post(webhookUrl, data, {
-          headers: {
-            "Content-Type": "application/json"
-          }
-        })
-        .catch((e) => {
-          console.error("请求出错:", e);
-        });
-    }
-  } catch (error) {
-    console.error("axios is not available, please install it.");
-  }
-}
-
-module.exports = {
-  postVersionFileAndMsg
-};
+function shouldSkipWebhook() {
+  const args = process.argv || [];
+  const hasNoWebhookArg = args.some((arg = "") =>
+    ["--nowebhook", "--noWebhook", "--no-webhook"].includes(arg)
+  );
+
+  const env = process.env || {};
+  const envValues = [
+    env.npm_config_nowebhook,
+    env.npm_config_noWebhook,
+    env.NO_WEBHOOK,
+    env.DISABLE_WEBHOOK
+  ];
+  const hasNoWebhookEnv = envValues.some((value) => {
+    const normalized = String(value || "").toLowerCase();
+    return ["1", "true", "yes", "on"].includes(normalized);
+  });
+
+  return hasNoWebhookArg || hasNoWebhookEnv;
+}
+
+function getWebhookMessage() {
+  const args = process.argv || [];
+  const env = process.env || {};
+  const messageEnv =
+    env.npm_config_m ||
+    env.npm_config_message ||
+    env.WEBHOOK_MESSAGE ||
+    env.BUILD_MESSAGE ||
+    "";
+
+  if (messageEnv) {
+    return String(messageEnv).trim();
+  }
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] || "";
+
+    if (arg === "-m" || arg === "--message") {
+      return String(args[index + 1] || "").trim();
+    }
+
+    if (arg.startsWith("-m=")) {
+      return arg.slice(3).trim();
+    }
+
+    if (arg.startsWith("--message=")) {
+      return arg.slice(10).trim();
+    }
+  }
+
+  return "";
+}
+
+function postVersionFileAndMsg(publishText, extraParams = {}) {
+  const {
+    projectName,
+    newFileName,
+    gitInfo,
+    webhookUrl = "", // 启用企业微信推送
+    webhookAtUser = [],
+    webhookExtraText = "",
+    gitAutoPushRepos,
+    gitAutoPushReposBranchMap,
+    repos,
+    deployUrl = ""
+  } = extraParams || {};
+  const { branch, commitMsg, author } = gitInfo || {};
+  const webhookMessage = getWebhookMessage();
+  const GITPATH = `https://gitee.com/gdinfly_1/${projectName}/blob/${branch}/${newFileName}`;
+  const UPLOADURL = `https://qyapi.weixin.qq.com/cgi-bin/webhook/upload_media?key=&type=file`;
+  /* const data = {
+        msgtype: "markdown",
+        markdown: {
+            content: `${publishText}\n构建文件：[点击下载](${GITPATH})`,
+        },
+    };
+    if (Array.isArray(webhookAtUser) && webhookAtUser.length > 0) {
+        webhookAtUser.forEach((item, index) => {
+            data.markdown.content = `${data.markdown.content}\n<@${item}>`;
+        });
+    } */
+  let content = publishText;
+  if (gitAutoPushReposBranchMap) {
+    content = [
+      publishText,
+      `构建文件：已推送对应仓库【${repos}】- 分支【${gitAutoPushReposBranchMap[branch]}】`,
+      `构建人：${author}`,
+      deployUrl ? `部署系统：${deployUrl}` : ""
+    ].filter(Boolean).join("\n");
+  } else {
+    content = `${publishText}\n构建文件下载地址：${GITPATH}\n${webhookExtraText}\n`;
+  }
+
+  if (webhookMessage) {
+    content = `${content}\n${webhookMessage}`;
+  }
+
+  // 防御性过滤：防止运行时数据中的 %s 等格式化占位符泄露到推送内容
+  content = (content || "").replace(/%s/g, "");
+
+  const data = {
+    msgtype: "text",
+    text: {
+      content,
+      mentioned_mobile_list: Array.isArray(webhookAtUser) ? webhookAtUser : webhookAtUser[branch] // 支持按分支配置不同的提醒人
+    }
+  };
+
+  if (shouldSkipWebhook()) {
+    console.log(global.logColor?.info || "%s", "🔕 已跳过企业微信机器人推送（nowebhook）");
+    return;
+  }
+
+  try {
+    const axios = require("axios");
+
+    if (axios) {
+      axios
+        .post(webhookUrl, data, {
+          headers: {
+            "Content-Type": "application/json"
+          }
+        })
+        .catch((e) => {
+          console.error("请求出错:", e);
+        });
+    }
+  } catch (error) {
+    console.error("axios is not available, please install it.");
+  }
+}
+
+module.exports = {
+  postVersionFileAndMsg
+};

package/build/docker/compose-command.js

@@ -1,74 +1,74 @@
-const fs = require("node:fs");
-const path = require("node:path");
-
-const {
-  EXIT_SELECTION,
-  selectOption: defaultSelectOption,
+const fs = require("node:fs");
+const path = require("node:path");
+
+const {
+  EXIT_SELECTION,
+  selectOption: defaultSelectOption,
 } = require("../../cli/select-option");
-const { composeRelease: defaultComposeRelease } = require("./compose-release");
-
-function loadTargetConfig(configPath) {
-  const resolvedPath = path.resolve(configPath);
-  delete require.cache[require.resolve(resolvedPath)];
-  return {
-    config: require(resolvedPath),
-    configDir: path.dirname(resolvedPath),
-  };
-}
-
-function loadPackageTargetConfig(cwd = process.cwd()) {
-  const packagePath = path.resolve(cwd, "package.json");
-  if (!fs.existsSync(packagePath)) {
-    throw new Error(`Package config not found: ${packagePath}`);
-  }
-  delete require.cache[require.resolve(packagePath)];
-  const packageJson = require(packagePath);
-  return {
-    config: packageJson.infly?.docker,
-    configDir: path.dirname(packagePath),
-  };
-}
-
-async function runComposeCommand(options = {}, dependencies = {}) {
-  const composeRelease = dependencies.composeRelease || defaultComposeRelease;
-  const usesDirectConfig = !options.config
-    && !options.configObject
-    && (options.projectDir || options.file);
-  if (usesDirectConfig) return composeRelease(options);
-
-  const loaded = options.config
-    ? loadTargetConfig(options.config)
-    : options.configObject
-      ? { config: options.configObject, configDir: options.configDir || process.cwd() }
-      : loadPackageTargetConfig(options.cwd || process.cwd());
-  const targets = loaded.config?.targets;
-  if (!targets || Object.keys(targets).length === 0) {
-    throw new Error("Docker target config must define at least one target.");
-  }
-
-  const selectOption = dependencies.selectOption || defaultSelectOption;
-  const log = dependencies.log || console.log;
-  const targetName = options.target || await selectOption(
-    "请选择 Docker 发布目标",
-    Object.entries(targets).map(([value, target]) => ({
-      value,
-      label: target.label || value,
-    })),
-  );
-  if (targetName === EXIT_SELECTION) {
-    log("已退出，未执行任何操作。");
-    return { cancelled: true };
-  }
-  const target = targets[targetName];
-  if (!target) throw new Error(`Unknown Docker target: ${targetName}`);
-
-  return composeRelease({
-    projectDir: loaded.configDir,
-    file: target.file,
-    bump: options.bump || "patch",
-    push: Boolean(options.push),
-    dryRun: Boolean(options.dryRun),
-  });
-}
-
-module.exports = { loadPackageTargetConfig, loadTargetConfig, runComposeCommand };
+const { composeRelease: defaultComposeRelease } = require("./compose-release");
+
+function loadTargetConfig(configPath) {
+  const resolvedPath = path.resolve(configPath);
+  delete require.cache[require.resolve(resolvedPath)];
+  return {
+    config: require(resolvedPath),
+    configDir: path.dirname(resolvedPath),
+  };
+}
+
+function loadPackageTargetConfig(cwd = process.cwd()) {
+  const packagePath = path.resolve(cwd, "package.json");
+  if (!fs.existsSync(packagePath)) {
+    throw new Error(`Package config not found: ${packagePath}`);
+  }
+  delete require.cache[require.resolve(packagePath)];
+  const packageJson = require(packagePath);
+  return {
+    config: packageJson.infly?.docker,
+    configDir: path.dirname(packagePath),
+  };
+}
+
+async function runComposeCommand(options = {}, dependencies = {}) {
+  const composeRelease = dependencies.composeRelease || defaultComposeRelease;
+  const usesDirectConfig = !options.config
+    && !options.configObject
+    && (options.projectDir || options.file);
+  if (usesDirectConfig) return composeRelease(options);
+
+  const loaded = options.config
+    ? loadTargetConfig(options.config)
+    : options.configObject
+      ? { config: options.configObject, configDir: options.configDir || process.cwd() }
+      : loadPackageTargetConfig(options.cwd || process.cwd());
+  const targets = loaded.config?.targets;
+  if (!targets || Object.keys(targets).length === 0) {
+    throw new Error("Docker target config must define at least one target.");
+  }
+
+  const selectOption = dependencies.selectOption || defaultSelectOption;
+  const log = dependencies.log || console.log;
+  const targetName = options.target || await selectOption(
+    "请选择 Docker 发布目标",
+    Object.entries(targets).map(([value, target]) => ({
+      value,
+      label: target.label || value,
+    })),
+  );
+  if (targetName === EXIT_SELECTION) {
+    log("已退出，未执行任何操作。");
+    return { cancelled: true };
+  }
+  const target = targets[targetName];
+  if (!target) throw new Error(`Unknown Docker target: ${targetName}`);
+
+  return composeRelease({
+    projectDir: loaded.configDir,
+    file: target.file,
+    bump: options.bump || "patch",
+    push: Boolean(options.push),
+    dryRun: Boolean(options.dryRun),
+  });
+}
+
+module.exports = { loadPackageTargetConfig, loadTargetConfig, runComposeCommand };

package/build/docker/compose-release.js

@@ -2,9 +2,9 @@ const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
 const path = require("node:path");
 
-function bumpComposeImageVersion(content, bump = "patch") {
-  if (bump !== "patch") {
-    throw new Error(`Unsupported version bump: ${bump}. Only patch is supported.`);
+function bumpComposeImageVersion(content, bump = "patch") {
+  if (!["none", "patch"].includes(bump)) {
+    throw new Error(`Unsupported version bump: ${bump}. Supported values: none, patch.`);
   }
 
   const imageRegex = /^(\s*image:\s*)([^\s#]+):(\d+)\.(\d+)\.(\d+)(\s*(?:#.*)?)$/gm;
@@ -14,10 +14,12 @@ function bumpComposeImageVersion(content, bump = "patch") {
     throw new Error(`Compose file must contain exactly one versioned image; found ${matches.length}.`);
   }
 
-  const [, prefix, image, major, minor, patchVersion, suffix] = matches[0];
-  const from = `${image}:${major}.${minor}.${patchVersion}`;
-  const to = `${image}:${major}.${minor}.${Number(patchVersion) + 1}`;
-  const replacement = `${prefix}${to}${suffix}`;
+  const [, prefix, image, major, minor, patchVersion, suffix] = matches[0];
+  const from = `${image}:${major}.${minor}.${patchVersion}`;
+  const to = bump === "none"
+    ? from
+    : `${image}:${major}.${minor}.${Number(patchVersion) + 1}`;
+  const replacement = `${prefix}${to}${suffix}`;
 
   return {
     content: content.replace(imageRegex, replacement),
@@ -62,7 +64,11 @@ function composeRelease(options = {}, dependencies = {}) {
   const updated = bumpComposeImageVersion(original, bump);
   const baseArgs = ["compose", "-f", resolved.composePath];
 
-  console.log(`Version update: ${updated.from} -> ${updated.to}`);
+  if (bump === "none") {
+    console.log(`Version fixed: ${updated.from}`);
+  } else {
+    console.log(`Version update: ${updated.from} -> ${updated.to}`);
+  }
 
   if (dryRun) {
     console.log(`[dry-run] docker ${[...baseArgs, "config"].join(" ")}`);
@@ -71,13 +77,14 @@ function composeRelease(options = {}, dependencies = {}) {
     return { ...updated, projectDir: resolved.projectDir, composePath: resolved.composePath };
   }
 
-  fs.writeFileSync(resolved.composePath, updated.content, "utf8");
-  try {
+  const versionChanged = updated.content !== original;
+  if (versionChanged) fs.writeFileSync(resolved.composePath, updated.content, "utf8");
+  try {
     runDocker([...baseArgs, "config"], { cwd: resolved.projectDir });
     runDocker([...baseArgs, "build"], { cwd: resolved.projectDir });
     if (push) runDocker([...baseArgs, "push"], { cwd: resolved.projectDir });
-  } catch (error) {
-    fs.writeFileSync(resolved.composePath, original, "utf8");
+  } catch (error) {
+    if (versionChanged) fs.writeFileSync(resolved.composePath, original, "utf8");
     throw error;
   }
 

package/build/docker/deployment/deploy.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+bundle_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+source "$bundle_dir/config.sh"
+: "${CCR_USERNAME:?未注入镜像仓库用户名}"
+: "${CCR_PASSWORD:?未注入镜像仓库密码}"
+: "${SSH_KNOWN_HOSTS:?未注入已核验的 SSH host keys}"
+[[ $# -gt 0 ]] || { echo '需要组件=正式镜像参数' >&2; exit 2; }
+local_tmp=$(mktemp -d)
+remote_tmp=""
+ssh_target="${ssh_user}@${server}"
+ssh_options=(-o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$SSH_KNOWN_HOSTS")
+cleanup() {
+  if [[ "$remote_tmp" =~ ^/tmp/tmp\.[a-zA-Z0-9]+$ ]]; then
+    ssh "${ssh_options[@]}" "$ssh_target" "rm -rf -- '$remote_tmp'" >/dev/null 2>&1 || true
+  fi
+  rm -rf -- "$local_tmp"
+}
+trap cleanup EXIT
+remote_tmp=$(ssh "${ssh_options[@]}" "$ssh_target" 'mktemp -d')
+[[ "$remote_tmp" =~ ^/tmp/tmp\.[a-zA-Z0-9]+$ ]] || { echo '服务器返回非法临时目录' >&2; exit 1; }
+# 凭据只写入本次临时 Docker 配置，退出时清理，不进入项目配置或日志。
+auth_value=$(printf '%s:%s' "$CCR_USERNAME" "$CCR_PASSWORD" | base64 | tr -d '\r\n')
+umask 077
+printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$registry" "$auth_value" > "$local_tmp/config.json"
+scp "${ssh_options[@]}" "$bundle_dir/release.sh" "$bundle_dir/health-check.sh" "$bundle_dir/config.sh" \
+  "$bundle_dir/docker-compose.release.yml" "$local_tmp/config.json" "$ssh_target:$remote_tmp/"
+remote_command=(sudo env "DOCKER_CONFIG=$remote_tmp" bash "$remote_tmp/release.sh" "$@")
+printf -v remote_quoted '%q ' "${remote_command[@]}"
+ssh "${ssh_options[@]}" "$ssh_target" "$remote_quoted"

package/build/docker/deployment/health-check.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+bundle_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+source "$bundle_dir/config.sh"
+cd "$project_dir"
+compose=(docker compose --env-file "$secret_env_file" --env-file "$release_env_file" -f "$compose_file" -f "$bundle_dir/docker-compose.release.yml")
+for service in "${health_services[@]}"; do
+  container_id=$("${compose[@]}" ps -q "$service")
+  [[ -n "$container_id" ]] || { echo "服务没有容器: $service" >&2; exit 1; }
+  [[ "$(docker inspect --format '{{.State.Running}}' "$container_id")" == true ]] || {
+    echo "服务未运行: $service" >&2
+    docker logs --tail 100 "$container_id" >&2 || true
+    exit 1
+  }
+done
+check_application
+for health_url in "${health_urls[@]}"; do
+  checked=false
+  for ((attempt=1; attempt<=health_attempts; attempt++)); do
+    if curl --fail --silent --show-error --location --max-time "$health_timeout" --output /dev/null "$health_url"; then
+      checked=true
+      break
+    fi
+    sleep "$health_interval"
+  done
+  [[ "$checked" == true ]] || { echo "健康检查失败: $health_url" >&2; exit 1; }
+  echo "健康检查通过: $health_url"
+done

package/build/docker/deployment/promote-image.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "用法: $0 <组件名称> <qc镜像> <正式镜像> <完整40位commit>" >&2
+  exit 2
+}
+
+[[ $# -eq 4 ]] || usage
+component=$1
+source_image=$2
+final_image=$3
+expected_revision=$4
+
+[[ "$expected_revision" =~ ^[0-9a-f]{40}$ ]] || {
+  echo "$component commit 必须是 40 位小写十六进制值" >&2
+  exit 2
+}
+
+manifest_error=$(mktemp)
+cleanup() {
+  rm -f -- "$manifest_error"
+}
+trap cleanup EXIT
+
+docker manifest inspect "$source_image" >/dev/null
+docker pull "$source_image"
+actual_revision=$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$source_image")
+if [[ "$actual_revision" != "$expected_revision" ]]; then
+  echo "$component qc 镜像完整 revision 校验失败: image=$source_image" >&2
+  exit 1
+fi
+
+if docker manifest inspect "$final_image" >/dev/null 2>"$manifest_error"; then
+  docker pull "$final_image"
+  final_revision=$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$final_image")
+  if [[ "$final_revision" != "$expected_revision" ]]; then
+    echo "$component 正式标签已存在但 revision 不一致，禁止覆盖: image=$final_image" >&2
+    exit 1
+  fi
+  echo "$component 正式镜像已存在且 revision 一致，跳过重复晋升: $final_image"
+  exit 0
+fi
+
+if ! grep -Eqi 'manifest unknown|no such manifest|manifest[^[:cntrl:]]*not found' "$manifest_error"; then
+  echo "$component 正式镜像查询失败，无法确认标签不存在，禁止晋升: $final_image" >&2
+  sed -n '1,5p' "$manifest_error" >&2
+  exit 1
+fi
+
+# 本地构建只写 qc 标签；Jenkins 人工确认后才允许创建不可变正式标签。
+# 使用 pull/tag/push 避免部署节点依赖 Buildx，同时不在 Jenkins 执行 Dockerfile 构建。
+docker tag "$source_image" "$final_image"
+docker push "$final_image"
+docker pull "$final_image"
+final_revision=$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$final_image")
+if [[ "$final_revision" != "$expected_revision" ]]; then
+  echo "$component 晋升后的正式镜像 revision 校验失败: image=$final_image" >&2
+  exit 1
+fi
+echo "$component qc 镜像已晋升为正式 commit 标签: $final_image"