@wdyy/skills 0.1.4 → 0.1.6

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.test.mjs

@@ -1,11 +1,34 @@
 import assert from 'node:assert/strict';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import {
+  chmod,
+  cp,
+  copyFile,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readlink,
+  readdir,
+  rm,
+  stat,
+  symlink,
+  unlink,
+  writeFile,
+} from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { afterEach, test } from 'node:test';
 import { spawnSync } from 'node:child_process';
 
-const validator = new URL('./validate-deployment-package.mjs', import.meta.url);
+const scriptsRoot = dirname(fileURLToPath(import.meta.url));
+const skillRoot = resolve(scriptsRoot, '..');
+const templatesRoot = join(skillRoot, 'templates');
+const validator = join(scriptsRoot, 'validate-deployment-package.mjs');
+const deployTemplate = join(templatesRoot, 'deploy.sh.template');
+const composeTemplate = join(templatesRoot, 'docker-compose.blue-green.yml');
+const nginxTemplate = join(templatesRoot, 'nginx-upstream.template.conf');
+const dockerignoreTemplate = join(templatesRoot, 'dockerignore.template');
 const temporaryDirectories = [];
 
 afterEach(async () => {
@@ -16,57 +39,572 @@ afterEach(async () => {
   );
 });
 
-async function createFiles({ includeRollback = true } = {}) {
-  const directory = await mkdtemp(join(tmpdir(), 'deployment-package-'));
+async function createTemporaryDirectory(prefix) {
+  const directory = await mkdtemp(join(tmpdir(), prefix));
   temporaryDirectories.push(directory);
-  const deploy = join(directory, 'deploy.sh');
-  const nginx = join(directory, 'nginx.conf');
-  const compose = join(directory, 'compose.yml');
-  await writeFile(
-    deploy,
-    `case "$1" in
-start) version="$2";;
-stop) ;;
-restart) ;;
-status) ;;
-${includeRollback ? 'rollback) version="$2";;' : ''}
-esac
-HEALTH_URL=/health
-VERSION_URL=/version
-database/migrations
-`,
-  );
+  return directory;
+}
+
+async function listFiles(root, directory = root) {
+  const result = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) result.push(...await listFiles(root, path));
+    else if (entry.isFile()) result.push(relative(root, path).split(sep).join('/'));
+  }
+  return result;
+}
+
+async function writeManifest(versionRoot) {
+  const paths = (await listFiles(versionRoot))
+    .filter((path) => path !== 'manifest.sha256')
+    .sort();
+  const lines = [];
+  for (const path of paths) {
+    const checksum = createHash('sha256')
+      .update(await readFile(join(versionRoot, path)))
+      .digest('hex');
+    lines.push(`${checksum}  ${path}`);
+  }
+  await writeFile(join(versionRoot, 'manifest.sha256'), `${lines.join('\n')}\n`);
+}
+
+async function createPackage() {
+  const directory = await createTemporaryDirectory('deployment-package-');
+  const packageRoot = join(directory, 'deploy');
+  const version = '20260730-001';
+  const versionRoot = join(packageRoot, version);
+  await Promise.all([
+    mkdir(join(versionRoot, 'database', 'migrations'), { recursive: true }),
+    mkdir(join(versionRoot, 'scripts'), { recursive: true }),
+    mkdir(join(versionRoot, 'docker'), { recursive: true }),
+    mkdir(join(versionRoot, 'nginx'), { recursive: true }),
+  ]);
+  await copyFile(deployTemplate, join(packageRoot, 'deploy.sh'));
+  await chmod(join(packageRoot, 'deploy.sh'), 0o755);
+  await writeFile(join(packageRoot, 'release.env'), `RELEASE_VERSION=${version}\n`);
+  await writeFile(join(versionRoot, 'frontend.tar.gz'), 'frontend archive');
+  await writeFile(join(versionRoot, 'backend-image.tar'), 'backend image');
   await writeFile(
-    nginx,
-    'location /releases/ { root /srv/app; }\nroot /srv/app/current;\n',
+    join(versionRoot, 'database', 'migrations', 'V001__baseline.sql'),
+    'SELECT 1;\n',
   );
   await writeFile(
-    compose,
-    'backend-blue:\nbackend-green:\nINSTANCE_ID: blue\nINSTANCE_ID: green\nLOG_DIR: /logs\n',
+    join(versionRoot, 'scripts', 'apply-migrations.sh'),
+    '#!/usr/bin/env bash\nset -euo pipefail\n',
   );
-  return { deploy, nginx, compose };
+  await chmod(join(versionRoot, 'scripts', 'apply-migrations.sh'), 0o755);
+  await copyFile(composeTemplate, join(versionRoot, 'docker', 'docker-compose.blue-green.yml'));
+  await copyFile(nginxTemplate, join(versionRoot, 'nginx', 'site.conf'));
+  await writeManifest(versionRoot);
+  return {
+    directory,
+    packageRoot,
+    version,
+    versionRoot,
+    deploy: join(packageRoot, 'deploy.sh'),
+    compose: join(versionRoot, 'docker', 'docker-compose.blue-green.yml'),
+    nginx: join(versionRoot, 'nginx', 'site.conf'),
+  };
 }
 
-test('接受版本化前端、蓝绿后端和完整命令', async () => {
-  const files = await createFiles();
-  const result = spawnSync(
+function runValidator(files) {
+  return spawnSync(
     process.execPath,
-    [validator.pathname, files.deploy, files.nginx, files.compose],
+    [validator, files.deploy, files.nginx, files.compose, files.packageRoot],
     { encoding: 'utf8' },
   );
+}
+
+async function replace(path, from, to) {
+  const content = await readFile(path, 'utf8');
+  assert.ok(content.includes(from), `fixture replacement source not found: ${from}`);
+  await writeFile(path, content.replace(from, to));
+}
+
+test('接受自动 build、完整单版本目录和无参数 start', async () => {
+  const files = await createPackage();
+  const result = runValidator(files);
 
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /valid deployment package/);
+  assert.match(result.stdout, /valid deployment package 20260730-001/);
 });
 
 test('缺少 rollback 命令时明确失败', async () => {
-  const files = await createFiles({ includeRollback: false });
-  const result = spawnSync(
-    process.execPath,
-    [validator.pathname, files.deploy, files.nginx, files.compose],
-    { encoding: 'utf8' },
-  );
+  const files = await createPackage();
+  await replace(files.deploy, '\n  rollback)\n', '\n  legacy_command)\n');
+  const result = runValidator(files);
 
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /rollback/);
 });
+
+test('拒绝旧 start version 语法', async () => {
+  const files = await createPackage();
+  await replace(
+    files.deploy,
+    'start)\n    [[ "$#" -eq 1 ]] || usage',
+    'start)\n    version="$2"',
+  );
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /start/);
+});
+
+test('拒绝固定 srv 部署根目录', async () => {
+  const files = await createPackage();
+  await replace(files.nginx, '__DEPLOY_ROOT__', '/srv/fixed-project');
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /fixed \/srv path/);
+});
+
+test('拒绝 Nginx 模板写死代理 URL', async () => {
+  const files = await createPackage();
+  await replace(files.nginx, '__BACKEND_PROXY_URL__', 'http://backend_active');
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /BACKEND_PROXY_URL/);
+});
+
+test('拒绝缺失迁移执行器', async () => {
+  const files = await createPackage();
+  await unlink(join(files.versionRoot, 'scripts', 'apply-migrations.sh'));
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /apply-migrations/);
+});
+
+test('拒绝缺失校验清单', async () => {
+  const files = await createPackage();
+  await unlink(join(files.versionRoot, 'manifest.sha256'));
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /manifest/);
+});
+
+test('拒绝生产环境文件进入版本目录', async () => {
+  const files = await createPackage();
+  await writeFile(join(files.versionRoot, '.env.production'), 'DATABASE_URL=secret\n');
+  await writeManifest(files.versionRoot);
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /secret file/);
+});
+
+test('拒绝版本目录中的符号链接', async () => {
+  const files = await createPackage();
+  await symlink('../outside-secret', join(files.versionRoot, 'linked-secret'));
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /symbolic links/);
+});
+
+test('拒绝文件与校验清单不一致', async () => {
+  const files = await createPackage();
+  await writeFile(join(files.versionRoot, 'backend-image.tar'), 'changed image');
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Checksum mismatch/);
+});
+
+test('拒绝 deploy.sh 自动上传', async () => {
+  const files = await createPackage();
+  await writeFile(files.deploy, `${await readFile(files.deploy, 'utf8')}\nscp deploy server:/tmp\n`);
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /must not upload/);
+});
+
+test('拒绝 LOG_DIR 和 HOST_LOG_DIR 可配置日志目录', async () => {
+  const files = await createPackage();
+  await writeFile(
+    files.compose,
+    `services:
+  backend-blue:
+    environment:
+      INSTANCE_ID: blue
+      LOG_DIR: /var/log/application
+    volumes:
+      - \${HOST_LOG_DIR}/backend/blue:/app/logs
+  backend-green:
+    environment:
+      INSTANCE_ID: green
+      LOG_DIR: /var/log/application
+    volumes:
+      - \${HOST_LOG_DIR}/backend/green:/app/logs
+`,
+  );
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /project-root/);
+});
+
+test('拒绝 blue 和 green 使用不同日志目录', async () => {
+  const files = await createPackage();
+  await writeFile(
+    files.compose,
+    `services:
+  backend-blue:
+    environment:
+      INSTANCE_ID: blue
+    volumes:
+      - ../../logs/backend/blue:/app/logs
+  backend-green:
+    environment:
+      INSTANCE_ID: green
+    volumes:
+      - ../../logs/backend/green:/app/logs
+`,
+  );
+  const result = runValidator(files);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /project-root/);
+});
+
+async function createBuildFixture({ agentsContent = '# Target Project\n', secretMigration = false } = {}) {
+  const directory = await createTemporaryDirectory('deployment-build-');
+  const fakeBin = join(directory, 'fake-bin');
+  await Promise.all([
+    mkdir(fakeBin, { recursive: true }),
+    mkdir(join(directory, 'src', 'backend'), { recursive: true }),
+    mkdir(join(directory, 'database', 'migrations'), { recursive: true }),
+    mkdir(join(directory, 'scripts', 'deployment'), { recursive: true }),
+  ]);
+  await copyFile(deployTemplate, join(directory, 'deploy.sh'));
+  await chmod(join(directory, 'deploy.sh'), 0o755);
+  await writeFile(join(directory, 'AGENTS.md'), agentsContent);
+  await writeFile(
+    join(directory, '.env'),
+    'PROJECT_NAME=fixture\nBACKEND_CONTAINER_PORT=3000\n',
+  );
+  await copyFile(dockerignoreTemplate, join(directory, '.dockerignore'));
+  await writeFile(join(directory, 'src', 'backend', 'Dockerfile'), 'FROM scratch\n');
+  await writeFile(
+    join(directory, 'database', 'migrations', 'V001__baseline.sql'),
+    'SELECT 1;\n',
+  );
+  if (secretMigration) {
+    await writeFile(
+      join(directory, 'database', 'migrations', '.env.production'),
+      'DATABASE_URL=secret\n',
+    );
+  }
+  await writeFile(
+    join(directory, 'scripts', 'apply-migrations.sh'),
+    `#!/usr/bin/env bash
+set -euo pipefail
+if [[ -n "\${COMMAND_LOG:-}" ]]; then
+  printf 'migration %s\\n' "\${MIGRATIONS_DIR:-}" >> "$COMMAND_LOG"
+fi
+`,
+  );
+  await chmod(join(directory, 'scripts', 'apply-migrations.sh'), 0o755);
+  await copyFile(
+    composeTemplate,
+    join(directory, 'scripts', 'deployment', 'docker-compose.blue-green.yml'),
+  );
+  await copyFile(
+    nginxTemplate,
+    join(directory, 'scripts', 'deployment', 'nginx-site.conf'),
+  );
+
+  const fakePnpm = join(fakeBin, 'pnpm');
+  await writeFile(
+    fakePnpm,
+    `#!/usr/bin/env bash
+set -euo pipefail
+if [[ "\${FAIL_GATE:-}" == "\${1:-}" ]]; then
+  echo "forced pnpm failure: $1" >&2
+  exit 9
+fi
+if [[ "\${1:-}" == build ]]; then
+  mkdir -p src/frontend/dist
+  printf '<!doctype html><script src="%sapp.js"></script>\\n' "$VITE_RELEASE_BASE" > src/frontend/dist/index.html
+  printf 'console.log("ok")\\n' > src/frontend/dist/app.js
+fi
+`,
+  );
+  await chmod(fakePnpm, 0o755);
+
+  const fakeDocker = join(fakeBin, 'docker');
+  await writeFile(
+    fakeDocker,
+    `#!/usr/bin/env bash
+set -euo pipefail
+if [[ -n "\${COMMAND_LOG:-}" ]]; then
+  printf 'docker %s\\n' "$*" >> "$COMMAND_LOG"
+fi
+case "\${1:-}" in
+  build)
+    exit 0
+    ;;
+  image)
+    [[ "\${2:-}" == inspect ]]
+    ;;
+  save)
+    shift
+    output=
+    while [[ "$#" -gt 0 ]]; do
+      if [[ "$1" == -o ]]; then
+        output="$2"
+        shift 2
+      else
+        shift
+      fi
+    done
+    [[ -n "$output" ]]
+    printf 'fixture image\\n' > "$output"
+    ;;
+  load|compose)
+    exit 0
+    ;;
+  *)
+    echo "unexpected docker command: $*" >&2
+    exit 10
+    ;;
+esac
+`,
+  );
+  await chmod(fakeDocker, 0o755);
+
+  const fakeCurl = join(fakeBin, 'curl');
+  await writeFile(
+    fakeCurl,
+    `#!/usr/bin/env bash
+set -euo pipefail
+url="\${!#}"
+if [[ "$url" == */version ]]; then
+  printf '%s' "\${EXPECTED_VERSION:?}"
+else
+  printf 'ok'
+fi
+`,
+  );
+  await chmod(fakeCurl, 0o755);
+
+  const fakeNginx = join(fakeBin, 'nginx');
+  await writeFile(
+    fakeNginx,
+    `#!/usr/bin/env bash
+set -euo pipefail
+if [[ -n "\${COMMAND_LOG:-}" ]]; then
+  printf 'nginx %s\\n' "$*" >> "$COMMAND_LOG"
+fi
+`,
+  );
+  await chmod(fakeNginx, 0o755);
+
+  const fakePsql = join(fakeBin, 'psql');
+  await writeFile(fakePsql, '#!/usr/bin/env bash\nset -euo pipefail\n');
+  await chmod(fakePsql, 0o755);
+
+  const fakeMv = join(fakeBin, 'mv');
+  await writeFile(
+    fakeMv,
+    `#!/usr/bin/env bash
+set -euo pipefail
+if [[ "\${1:-}" == -Tf ]]; then
+  shift
+  exec /bin/mv -f "$@"
+fi
+exec /bin/mv "$@"
+`,
+  );
+  await chmod(fakeMv, 0o755);
+  return { directory, fakeBin, commandLog: join(directory, 'commands.log') };
+}
+
+function runBuild(fixture, extraEnv = {}, ...extraArguments) {
+  return spawnSync(
+    'bash',
+    ['deploy.sh', 'build', ...extraArguments],
+    {
+      cwd: fixture.directory,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        PATH: `${fixture.fakeBin}:${process.env.PATH}`,
+        ...extraEnv,
+      },
+    },
+  );
+}
+
+function currentDateText() {
+  const value = new Date();
+  return [
+    String(value.getFullYear()).padStart(4, '0'),
+    String(value.getMonth() + 1).padStart(2, '0'),
+    String(value.getDate()).padStart(2, '0'),
+  ].join('');
+}
+
+test('build 首次生成 001、同日递增并只保留当前完整版本目录', async () => {
+  const fixture = await createBuildFixture();
+  const date = currentDateText();
+
+  const first = runBuild(fixture);
+  assert.equal(first.status, 0, first.stderr);
+  assert.equal(
+    await readFile(join(fixture.directory, 'deploy', 'release.env'), 'utf8'),
+    `RELEASE_VERSION=${date}-001\n`,
+  );
+  assert.deepEqual(
+    (await readdir(join(fixture.directory, 'deploy'))).sort(),
+    [`${date}-001`, 'deploy.sh', 'release.env'].sort(),
+  );
+  assert.match(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), new RegExp(`${date}-001`));
+  assert.ok((await stat(join(
+    fixture.directory,
+    'deploy',
+    `${date}-001`,
+    'scripts',
+    'apply-migrations.sh',
+  ))).mode & 0o111);
+
+  const second = runBuild(fixture);
+  assert.equal(second.status, 0, second.stderr);
+  assert.equal(
+    await readFile(join(fixture.directory, 'deploy', 'release.env'), 'utf8'),
+    `RELEASE_VERSION=${date}-002\n`,
+  );
+  assert.deepEqual(
+    (await readdir(join(fixture.directory, 'deploy'))).sort(),
+    [`${date}-002`, 'deploy.sh', 'release.env'].sort(),
+  );
+  const agents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
+  assert.match(agents, new RegExp(`${date}-001`));
+  assert.match(agents, new RegExp(`${date}-002`));
+});
+
+test('build 门禁失败时不写发布记录且不暴露 deploy 目录', async () => {
+  const fixture = await createBuildFixture();
+  const originalAgents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
+  const result = runBuild(fixture, { FAIL_GATE: 'lint' });
+
+  assert.equal(result.status, 9);
+  assert.equal(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), originalAgents);
+  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+});
+
+test('build 拒绝损坏的 AGENTS 发布记录', async () => {
+  const fixture = await createBuildFixture({
+    agentsContent: '# Target\n\n## 发布记录\n\n| 版本 | 时间 |\n|---|---|\n',
+  });
+  const result = runBuild(fixture);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /release record table/);
+  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+});
+
+test('build 拒绝把生产秘密从迁移目录带入发布包', async () => {
+  const fixture = await createBuildFixture({ secretMigration: true });
+  const originalAgents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
+  const result = runBuild(fixture);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /secret file/);
+  assert.equal(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), originalAgents);
+  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+});
+
+test('build 在 Docker ignore 不能排除秘密时明确失败', async () => {
+  const fixture = await createBuildFixture();
+  await writeFile(join(fixture.directory, '.dockerignore'), '.env\ndeploy/\n');
+  const originalAgents = await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8');
+  const result = runBuild(fixture);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Docker ignore file is missing required pattern/);
+  assert.equal(await readFile(join(fixture.directory, 'AGENTS.md'), 'utf8'), originalAgents);
+  await assert.rejects(stat(join(fixture.directory, 'deploy')));
+});
+
+test('build 和 start 都拒绝人工版本参数', async () => {
+  const fixture = await createBuildFixture();
+  const build = runBuild(fixture, {}, '20260730-001');
+  const start = spawnSync(
+    'bash',
+    ['deploy.sh', 'start', '20260730-001'],
+    { cwd: fixture.directory, encoding: 'utf8' },
+  );
+
+  assert.equal(build.status, 2);
+  assert.match(build.stderr, /usage/);
+  assert.equal(start.status, 2);
+  assert.match(start.stderr, /usage/);
+});
+
+test('上传到任意目录后 start 从 release.env 完成首个蓝色实例切换', async () => {
+  const fixture = await createBuildFixture();
+  const build = runBuild(fixture);
+  assert.equal(build.status, 0, build.stderr);
+  const releaseEnv = await readFile(join(fixture.directory, 'deploy', 'release.env'), 'utf8');
+  const version = releaseEnv.trim().slice('RELEASE_VERSION='.length);
+
+  const serverRoot = join(fixture.directory, 'chosen server root');
+  await cp(join(fixture.directory, 'deploy'), serverRoot, { recursive: true });
+  await writeFile(
+    join(serverRoot, '.env.production'),
+    `PROJECT_NAME=fixture
+DATABASE_URL=postgresql://fixture
+BACKEND_BIND_IP=127.0.0.1
+BACKEND_LISTEN_HOST=0.0.0.0
+BACKEND_CONTAINER_PORT=3000
+BACKEND_CONTAINER_HEALTH_URL=http://127.0.0.1:3000/health
+BLUE_PORT=3001
+GREEN_PORT=3002
+BLUE_HEALTH_URL=http://127.0.0.1:3001/health
+GREEN_HEALTH_URL=http://127.0.0.1:3002/health
+BLUE_VERSION_URL=http://127.0.0.1:3001/version
+GREEN_VERSION_URL=http://127.0.0.1:3002/version
+BLUE_UPSTREAM=127.0.0.1:3001
+GREEN_UPSTREAM=127.0.0.1:3002
+BACKEND_PROXY_URL=http://backend_active
+`,
+  );
+  const start = spawnSync(
+    'bash',
+    [join(serverRoot, 'deploy.sh'), 'start'],
+    {
+      cwd: fixture.directory,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        PATH: `${fixture.fakeBin}:${process.env.PATH}`,
+        COMMAND_LOG: fixture.commandLog,
+        EXPECTED_VERSION: version,
+      },
+    },
+  );
+
+  assert.equal(start.status, 0, start.stderr);
+  assert.equal(await readlink(join(serverRoot, 'current')), `releases/${version}`);
+  assert.match(await readFile(join(serverRoot, 'state', 'active.env'), 'utf8'), /ACTIVE_COLOR=blue/);
+  assert.match(await readFile(join(serverRoot, 'state', 'active.env'), 'utf8'), new RegExp(version));
+  assert.ok(await readFile(join(serverRoot, 'releases', version, 'index.html'), 'utf8'));
+  const nginxSite = await readFile(join(serverRoot, 'nginx', 'site.conf'), 'utf8');
+  assert.ok(!nginxSite.includes('__DEPLOY_ROOT__'));
+  assert.ok(!nginxSite.includes('__BACKEND_PROXY_URL__'));
+  assert.ok(nginxSite.includes(serverRoot));
+  assert.match(nginxSite, /proxy_pass http:\/\/backend_active;/);
+  const commandLog = await readFile(fixture.commandLog, 'utf8');
+  assert.match(commandLog, /migration/);
+  assert.match(commandLog, /docker load/);
+  assert.match(commandLog, /backend-blue/);
+  assert.match(commandLog, /nginx -t/);
+  assert.match(commandLog, /nginx -s reload/);
+});

package/.well-known/skills/wdyy-deployment-standard/templates/Dockerfile.template

@@ -7,9 +7,14 @@ RUN pnpm build
 
 FROM node:24-bookworm-slim AS runtime
 WORKDIR /app
+ARG RELEASE_VERSION
+ARG BACKEND_CONTAINER_PORT
 ENV NODE_ENV=production
+ENV RELEASE_VERSION="${RELEASE_VERSION}"
+ENV PORT="${BACKEND_CONTAINER_PORT}"
+LABEL org.opencontainers.image.version="${RELEASE_VERSION}"
 COPY --from=build /app/package.json ./
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist
-EXPOSE 3000
+EXPOSE ${BACKEND_CONTAINER_PORT}
 CMD ["node", "dist/main.js"]