@xfe-repo/web-app 2.0.0-beta.3 → 2.0.0-beta.5

package/README.md

@@ -122,3 +122,37 @@ SSR `start` 使用与构建一致的隐藏工作目录，使官方 serve 正确
 构建会先加载 `react-app-polyfill/stable`，并在应用原有 browserslist 的基础上，补充 Edge 18、Chrome 64、Firefox 60、Safari/iOS 12 及以上的 JS 编译目标，业务代码和第三方依赖使用同一目标。
 
 这是 JS 兼容基线；具体组件样式和浏览器 Web API 仍需在目标浏览器验证。
+
+
+## 可选的项目部署模板
+
+`xfe-web config` 仅合并并写入 values、复制公共模板，不解析或重建 Drone 步骤。`managed: true` 时写到项目 `deploy/`，不修改共享 npm 包模板；未启用时保持原有行为。
+
+```json
+{
+  "deploy": {
+    "managed": true,
+    "droneConfigPath": "deploy/.drone.yml",
+    "targetK8s": "infra",
+    "targetNamespace": "deployment-prod",
+    "hostsProd": ["app.example.com"],
+    "values": {
+      "nodeVersion": "24.22.1",
+      "buildCommand": "pnpm check && pnpm build && pnpm prune --prod",
+      "environments": {"test": false, "stage": false, "prod": true, "stable": false},
+      "replicas": 1,
+      "strategy": {"type": "Recreate"},
+      "persistence": {"enabled": true, "size": "20Gi", "mountPath": "/data"},
+      "podSecurityContext": {"fsGroup": 1000},
+      "env": [{"name": "DATA_DIR", "value": "/data"}],
+      "envFrom": [{"secretRef": {"name": "application-env"}}]
+    }
+  }
+}
+```
+
+`values` 中的对象递归合并，列表整体替换。默认 Node 22.22.0、`pnpm build` 和所有发布环境开启，保持既有应用行为。公共 Drone 保留固定步骤，每个发布步骤在运行时检查 `environments` 布尔开关，关闭时直接结束，不创建命名空间或发布资源。
+
+构建命令与 Docker 的 Node 参数由 Drone 直接读取生成的 values；实例、更新策略、PVC、环境变量、安全上下文、探针和路由由 Helm 读取。只有运行前就必须确定的 Node 镜像、集群 Secret，以及原有构建目录参数使用简单占位替换，不再有配置脚本中的流水线遍历或筛选。
+
+PVC 默认关闭，支持 `existingClaim`、`storageClass`。`virtualService.timeout` 可配置长连接超时，`corsPolicy: null` 关闭默认跨域策略。应用负责自己的存储与认证业务变量，密钥通过环境来源注入，不写入 values 或构建命令。修改配置后重新生成并提交 Drone 入口。

package/deploy/.drone.yml

@@ -18,7 +18,7 @@ resources:
 steps:
   - name: install
     pull: if-not-exists
-    image: node:22.22.0-bookworm
+    image: node:<<NODE_VERSION>>-bookworm
     volumes:
       - name: node-modules
         path: /drone/src/node_modules
@@ -30,7 +30,7 @@ steps:
 
   - name: build
     pull: if-not-exists
-    image: node:22.22.0-bookworm
+    image: node:<<NODE_VERSION>>-bookworm
     resources:
       limits:
         memory: 8192MiB
@@ -40,13 +40,31 @@ steps:
     commands:
       - corepack enable
       - corepack prepare pnpm@10.30.3 --activate
-      - cp -r node_modules/@xfe-repo/web-app/deploy deploy
+      - |
+          if [ "$(node -p "Boolean(require('./xfe.json').deploy?.managed)")" = true ]; then
+            pnpm exec xfe-web config
+          else
+            cp -r node_modules/@xfe-repo/web-app/deploy deploy
+          fi
       - export NODE_OPTIONS="--max-old-space-size=8192"
-      - export XFE_RELEASE=$DRONE_REPO_NAME@${DRONE_TAG:CI_COMMIT_SHA}
+      - export XFE_RELEASE="$DRONE_REPO_NAME@$DRONE_COMMIT_SHA"
+      - if [ -n "$DRONE_TAG" ]; then export XFE_RELEASE="$DRONE_REPO_NAME@$DRONE_TAG"; fi
       - export REACT_APP_RELEASE=$XFE_RELEASE
       - printf '%s' "$XFE_RELEASE" > deploy/static/release
       - cp deploy/static/release deploy/static/check-update
-      - pnpm build
+      - |
+          node <<'NODE'
+          const fs = require('node:fs');
+          const {createRequire} = require('node:module');
+          const yaml = createRequire(require.resolve('@xfe-repo/web-app/package.json'))('yaml');
+          const values = yaml.parse(fs.readFileSync('deploy/helm/values.yaml', 'utf8'));
+          const dockerfile = fs.readFileSync('deploy/Dockerfile', 'utf8');
+          fs.writeFileSync('deploy/Dockerfile', dockerfile.replace(/^ARG XFE_NODE_VERSION=.*$/m, 'ARG XFE_NODE_VERSION=' + values.nodeVersion));
+          const {spawnSync} = require('node:child_process');
+          const result = spawnSync(values.buildCommand, {shell: true, stdio: 'inherit'});
+          if (result.error) throw result.error;
+          process.exit(result.status ?? 1);
+          NODE
       - cp -a node_modules deploy/modules
 
   - name: image-build
@@ -70,26 +88,31 @@ steps:
   - name: pre-deploy
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
     environment:
-      SAAS_K8S_CONFIG:
-        from_secret: saas-k8s-config
-      INFRA_K8S_CONFIG:
-        from_secret: infra-k8s-config
+      K8S_CONFIG:
+        from_secret: target-k8s-config
     commands:
-      # 判断values.yaml中的targetK8s字段，选择目标集群
-      - export TARGET_K8S=$(cat deploy/helm/values.yaml | grep targetK8s | awk '{print $2}' | sed 's/\"//g')
-      # 将$INFRA_K8S_CONFIG或$SAAS_K8S_CONFIG写入kube_config
-      - echo "$TARGET_K8S" | grep -q "infra" && echo "$INFRA_K8S_CONFIG" > kube_config || echo "$SAAS_K8S_CONFIG" > kube_config
+      # 集群凭据通过生成入口选定，运行流程不再注入其他集群的凭据。
+      - umask 077
+      - printf '%s' "$K8S_CONFIG" > kube_config
       # 将环境类型写入values.yaml
       - appName="`echo ${DRONE_REPO//\//-}`"
       - sed -i "s/<<APP_NAME>>/$appName/g" deploy/helm/values.yaml
       - sed -i "s/<<CI_COMMIT_SHA>>/$CI_COMMIT_SHA/g" deploy/helm/values.yaml
       - sed -i "s/<<TAG_CONTENT>>/$DRONE_TAG/g" deploy/helm/values.yaml
-      # 展示values.yaml 与 TARGET_K8S
-      - cat deploy/helm/values.yaml && echo $TARGET_K8S
+      # 展示非敏感部署配置
+      - cat deploy/helm/values.yaml
 
   - name: deploy-to-test
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
+    environment:
+      DEPLOY_ENV: test
     commands:
+      - &environmentEnabled |
+          test -f deploy/helm/values.yaml || exit 1
+          if ! sed -n '/^environments:/,/^[^ ]/p' deploy/helm/values.yaml | grep -q "^  $DEPLOY_ENV: true$"; then
+            echo "跳过未启用的发布环境：$DEPLOY_ENV"
+            exit 0
+          fi
       - export KUBECONFIG=$PWD/kube_config
       - cp deploy/helm/values.yaml deploy/helm/values.test.yaml
       - sed -i "s/<<ENV_TYPE>>/test/g" deploy/helm/values.test.yaml
@@ -106,7 +129,10 @@ steps:
 
   - name: deploy-to-stage
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
+    environment:
+      DEPLOY_ENV: stage
     commands:
+      - *environmentEnabled
       - cp deploy/helm/values.yaml deploy/helm/values.stage.yaml
       - sed -i "s/<<ENV_TYPE>>/stage/g" deploy/helm/values.stage.yaml
       - sed -i "s/<<APP_SUFFIX>>//g" deploy/helm/values.stage.yaml
@@ -120,13 +146,24 @@ steps:
 
   - name: deploy-to-prod
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
+    environment:
+      DEPLOY_ENV: prod
     commands:
+      - *environmentEnabled
       - cp deploy/helm/values.yaml deploy/helm/values.prod.yaml
       - sed -i "s/<<ENV_TYPE>>/prod/g" deploy/helm/values.prod.yaml
       - sed -i "s/<<APP_SUFFIX>>//g" deploy/helm/values.prod.yaml
       - sed -i "s/<<HOST_PREFIX>>//g" deploy/helm/values.prod.yaml
       - helm template deploy/helm --values deploy/helm/values.prod.yaml
-      - helm template deploy/helm --values deploy/helm/values.prod.yaml | kubectl --kubeconfig=kube_config apply -f -
+      - |
+          if grep -q '^managed: true$' deploy/helm/values.yaml; then
+            namespace=$(awk '$1 == "namespace:" { gsub(/[\047\042]/, "", $2); print $2 }' deploy/helm/values.yaml)
+            if [ -z "$namespace" ]; then namespace=deployment-prod; fi
+            chart_name=$(printf '%s' "$DRONE_REPO" | tr '/' '-')
+            helm upgrade --install "$chart_name" deploy/helm --values deploy/helm/values.prod.yaml --namespace "$namespace" --create-namespace --kubeconfig=kube_config --atomic --wait --timeout 5m
+          else
+            helm template deploy/helm --values deploy/helm/values.prod.yaml | kubectl --kubeconfig=kube_config apply -f -
+          fi
     when:
       ref:
         include:
@@ -135,7 +172,10 @@ steps:
   - name: deploy-to-stable
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
     failure: ignore
+    environment:
+      DEPLOY_ENV: stable
     commands:
+      - *environmentEnabled
       - cp deploy/helm/values.yaml deploy/helm/values.test.yaml
       - sed -i "s/<<ENV_TYPE>>/test/g" deploy/helm/values.test.yaml
       - sed -i "s/<<APP_SUFFIX>>/-stable/g" deploy/helm/values.test.yaml
@@ -150,11 +190,13 @@ steps:
   - name: push-helm-chart
     image: xhj-prod-registry-vpc.cn-hangzhou.cr.aliyuncs.com/xhj-image-common/deploy-helm:latest
     environment:
+      DEPLOY_ENV: prod
       USERNAME:
         from_secret: username
       PASSWORD:
         from_secret: password
     commands:
+      - *environmentEnabled
       - chartName="${DRONE_REPO//\//-}"
       - chartVersion="0.0.0-$DRONE_TAG"
       - cp deploy/helm/values.prod.yaml deploy/helm/values.yaml
@@ -183,15 +225,9 @@ image_pull_secrets:
 
 ---
 kind: secret
-name: saas-k8s-config
-get:
-  path: saas-k8s-config
-  name: config
----
-kind: secret
-name: infra-k8s-config
+name: target-k8s-config
 get:
-  path: infra-k8s-config
+  path: <<TARGET_K8S>>-k8s-config
   name: config
 ---
 kind: secret

package/deploy/Dockerfile

@@ -1,4 +1,5 @@
-FROM node:22.22.0-bookworm-slim
+ARG XFE_NODE_VERSION=22.22.0
+FROM node:${XFE_NODE_VERSION}-bookworm-slim
 
 WORKDIR /app
 

package/deploy/Dockerfile.dockerignore

@@ -0,0 +1,10 @@
+# 构建产物和 deploy/modules 是运行镜像输入，不能排除。
+node_modules/*
+.env*
+.git
+.idea
+.data
+.impeccable
+design
+coverage
+*.tsbuildinfo

package/deploy/helm/Chart.yaml

@@ -1,4 +1,4 @@
-apiVersion: v1
+apiVersion: v2
 name: deployment
 description: A Helm chart for xfe
 

package/deploy/helm/templates/deployment.yaml

@@ -7,11 +7,15 @@ metadata:
     kubernetes.io/change-cause: {{ or $.Values.tagContent $.Values.commitSHA }}
 spec:
   strategy:
+    {{- if .Values.strategy }}
+    {{- toYaml .Values.strategy | nindent 4 }}
+    {{- else }}
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 2
       maxUnavailable: 50%
-  replicas: {{ if eq $.Values.envType "prod" }} 2 {{ else }} 1 {{ end }}
+    {{- end }}
+  replicas: {{ if hasKey .Values "replicas" }}{{ .Values.replicas }}{{ else if eq $.Values.envType "prod" }} 2 {{ else }} 1 {{ end }}
   selector:
     matchLabels:
       app: {{ $.Values.app }}
@@ -20,6 +24,13 @@ spec:
       labels:
         app: {{ $.Values.app }}
     spec:
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ . }}
+      {{- end }}
       imagePullSecrets:
         - name: {{ $.Values.imagePullSecret }}
       containers:
@@ -27,9 +38,17 @@ spec:
           imagePullPolicy: Always
           image: "{{ $.Values.image }}"
           resources:
+            {{- if .Values.resources }}
+            {{- toYaml .Values.resources | nindent 12 }}
+            {{- else }}
             requests:
               cpu: "0.01"
               memory: "100Mi"
+            {{- end }}
+          {{- with .Values.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           env:
             - name: HOST
               value: "0.0.0.0"
@@ -39,9 +58,37 @@ spec:
             - name: HOST_PREFIX
               value: "{{ $.Values.hostPrefix }}"
           {{end}}
-          {{- if eq $.Values.targetK8s "saas" }}
+          {{- with .Values.env }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if hasKey .Values "envFrom" }}
+          envFrom:
+            {{- toYaml .Values.envFrom | nindent 12 }}
+          {{- else if eq $.Values.targetK8s "saas" }}
           envFrom:
             - configMapRef:
                 name: "app-common-config"
           {{- end }}
----
+          {{- with .Values.startupProbe }}
+          startupProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if .Values.persistence.enabled }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath | quote }}
+          {{- end }}
+      {{- if .Values.persistence.enabled }}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ default (printf "%s-data" .Values.app) .Values.persistence.existingClaim }}
+      {{- end }}

package/deploy/helm/templates/pvc.yaml

@@ -0,0 +1,17 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Values.app }}-data
+  namespace: {{ include "template.namespace" . }}
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes: [ReadWriteOnce]
+  {{- with .Values.persistence.storageClass }}
+  storageClassName: {{ . | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

package/deploy/helm/templates/virtualService.yaml

@@ -19,14 +19,16 @@ spec:
     - match:
         - uri:
             prefix: /
+      {{- with .Values.virtualService.timeout }}
+      timeout: {{ . }}
+      {{- end }}
       route:
         - destination:
             host: {{ .Values.app }}
             port:
               number: 80
+          {{- with .Values.virtualService.corsPolicy }}
           corsPolicy:
-            allowOrigin:
-              - "*"
-            allowMethods:
-              - "*"
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
 {{- end }}

package/deploy/helm/values.yaml

@@ -7,6 +7,9 @@ envType: '<<ENV_TYPE>>'
 hostPrefix: '<<HOST_PREFIX>>'
 namespace: ''
 virtualService:
+  corsPolicy:
+    allowOrigin: ['*']
+    allowMethods: ['*']
   enabled: true
   hosts:
     test:
@@ -18,3 +21,21 @@ virtualService:
   gateways:
     - 'common-gateway-eshetang'
 targetK8s: 'saas'
+
+# 可选持久卷；省略时保持现有无状态 Web 应用的部署行为。
+persistence:
+  enabled: false
+  mountPath: /data
+  size: 20Gi
+  existingClaim: ''
+  storageClass: ''
+
+# 构建与发布配置由 Drone 在运行时读取，默认保持原有发布范围。
+managed: false
+nodeVersion: '22.22.0'
+buildCommand: pnpm build
+environments:
+  test: true
+  stage: true
+  prod: true
+  stable: true

package/dist/cli.js

@@ -30,6 +30,16 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/config.ts
+function mergeDeployValues(base, overrides) {
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  ));
+}
 var import_node_fs, import_node_path, import_node_url, import_yaml, import_meta, DEFAULT_BUILD_DIRECTORY, BUILD_DIRECTORY_ARGUMENT, protectedDirectories, loadXfeConfig, getBuildDirectory, getServerEntry, configDeploy, getJwtEnv;
 var init_config = __esm({
   "src/config.ts"() {
@@ -98,39 +108,40 @@ var init_config = __esm({
     };
     configDeploy = () => {
       const xfeConfig = loadXfeConfig();
-      if (!xfeConfig?.deploy) return;
+      const deployment = xfeConfig.deploy;
+      if (!deployment) return;
       const configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
       const projectRoot = process.cwd();
+      const source = import_node_path.default.resolve(configDirectory, "../deploy");
+      const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
       const buildDirectory = import_node_path.default.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(import_node_path.default.sep, "/");
-      const droneConfigFilePath = import_node_path.default.resolve(configDirectory, "../deploy/.drone.yml");
-      const droneTarget = import_node_path.default.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-      const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-      const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-      const droneConfig = import_node_fs.default.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+      const droneTarget = import_node_path.default.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+      const defaults = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
+      const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+      defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+      defaults.targetK8s = deployment.targetK8s || "saas";
+      defaults.namespace = deployment.targetNamespace || "";
+      const values = mergeDeployValues(defaults, deployment.values || {});
+      values.managed = Boolean(deployment.managed);
+      values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+      if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+      if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+      if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+        /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+        (enabled) => typeof enabled !== "boolean"
+      )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+      if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+        /** 不生成没有配置域名的环境条目。 */
+        ([, hosts]) => Array.isArray(hosts) && hosts.length
+      ));
+      const drone = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+      if (deployment.managed) {
+        if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+        import_node_fs.default.cpSync(source, target, { recursive: true });
+      }
       import_node_fs.default.mkdirSync(import_node_path.default.dirname(droneTarget), { recursive: true });
-      import_node_fs.default.writeFileSync(droneTarget, droneConfig);
-      const valuesYamlFilePath = import_node_path.default.resolve(configDirectory, "../deploy/helm/values.yaml");
-      const valuesYamlFile = import_node_fs.default.readFileSync(valuesYamlFilePath, "utf8");
-      const valuesYaml = import_yaml.default.parse(valuesYamlFile);
-      if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-      if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-      const {
-        virtualServiceEnabled = true,
-        hostsProd = [],
-        hostsStage = [],
-        hostsTest = [],
-        gateways = ["common-gateway-eshetang"]
-      } = xfeConfig.deploy;
-      const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-      valuesYaml.virtualService.enabled = virtualServiceEnabled;
-      valuesYaml.virtualService.gateways = gateways;
-      valuesYaml.virtualService.hosts.prod = hostsProd;
-      valuesYaml.virtualService.hosts.stage = hostsStage;
-      valuesYaml.virtualService.hosts.test = hostsTest;
-      valuesYaml.targetK8s = targetK8s;
-      valuesYaml.namespace = targetNamespace;
-      const valuesYamlStr = import_yaml.default.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-      import_node_fs.default.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+      import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+      import_node_fs.default.writeFileSync(droneTarget, drone);
     };
     getJwtEnv = async () => {
       const xfeConfig = loadXfeConfig();

package/dist/cli.mjs

@@ -19,6 +19,16 @@ import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import yaml from "yaml";
+function mergeDeployValues(base, overrides) {
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  ));
+}
 var DEFAULT_BUILD_DIRECTORY, BUILD_DIRECTORY_ARGUMENT, protectedDirectories, loadXfeConfig, getBuildDirectory, getServerEntry, configDeploy, getJwtEnv;
 var init_config = __esm({
   "src/config.ts"() {
@@ -82,39 +92,40 @@ var init_config = __esm({
     };
     configDeploy = () => {
       const xfeConfig = loadXfeConfig();
-      if (!xfeConfig?.deploy) return;
+      const deployment = xfeConfig.deploy;
+      if (!deployment) return;
       const configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
       const projectRoot = process.cwd();
+      const source = path.resolve(configDirectory, "../deploy");
+      const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
       const buildDirectory = path.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(path.sep, "/");
-      const droneConfigFilePath = path.resolve(configDirectory, "../deploy/.drone.yml");
-      const droneTarget = path.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-      const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-      const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-      const droneConfig = fs.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+      const droneTarget = path.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+      const defaults = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
+      const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+      defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+      defaults.targetK8s = deployment.targetK8s || "saas";
+      defaults.namespace = deployment.targetNamespace || "";
+      const values = mergeDeployValues(defaults, deployment.values || {});
+      values.managed = Boolean(deployment.managed);
+      values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+      if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+      if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+      if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+        /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+        (enabled) => typeof enabled !== "boolean"
+      )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+      if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+        /** 不生成没有配置域名的环境条目。 */
+        ([, hosts]) => Array.isArray(hosts) && hosts.length
+      ));
+      const drone = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+      if (deployment.managed) {
+        if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+        fs.cpSync(source, target, { recursive: true });
+      }
       fs.mkdirSync(path.dirname(droneTarget), { recursive: true });
-      fs.writeFileSync(droneTarget, droneConfig);
-      const valuesYamlFilePath = path.resolve(configDirectory, "../deploy/helm/values.yaml");
-      const valuesYamlFile = fs.readFileSync(valuesYamlFilePath, "utf8");
-      const valuesYaml = yaml.parse(valuesYamlFile);
-      if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-      if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-      const {
-        virtualServiceEnabled = true,
-        hostsProd = [],
-        hostsStage = [],
-        hostsTest = [],
-        gateways = ["common-gateway-eshetang"]
-      } = xfeConfig.deploy;
-      const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-      valuesYaml.virtualService.enabled = virtualServiceEnabled;
-      valuesYaml.virtualService.gateways = gateways;
-      valuesYaml.virtualService.hosts.prod = hostsProd;
-      valuesYaml.virtualService.hosts.stage = hostsStage;
-      valuesYaml.virtualService.hosts.test = hostsTest;
-      valuesYaml.targetK8s = targetK8s;
-      valuesYaml.namespace = targetNamespace;
-      const valuesYamlStr = yaml.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-      fs.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+      fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+      fs.writeFileSync(droneTarget, drone);
     };
     getJwtEnv = async () => {
       const xfeConfig = loadXfeConfig();

package/dist/config.d.mts

@@ -26,7 +26,7 @@ declare const loadXfeConfig: (root?: string) => XfeConfig;
 declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
 /** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
 declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
-/** 将输出目录传给 Docker 构建，并沿用现有的集群、域名与 Helm 配置。 */
+/** 合并部署 values 并生成公共模板，不改写流水线步骤或执行逻辑。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 

package/dist/config.d.ts

@@ -26,7 +26,7 @@ declare const loadXfeConfig: (root?: string) => XfeConfig;
 declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
 /** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
 declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
-/** 将输出目录传给 Docker 构建，并沿用现有的集群、域名与 Helm 配置。 */
+/** 合并部署 values 并生成公共模板，不改写流水线步骤或执行逻辑。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 

package/dist/config.js

@@ -101,40 +101,51 @@ var getServerEntry = (projectRoot, webapp = {}) => {
 };
 var configDeploy = () => {
   const xfeConfig = loadXfeConfig();
-  if (!xfeConfig?.deploy) return;
+  const deployment = xfeConfig.deploy;
+  if (!deployment) return;
   const configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
   const projectRoot = process.cwd();
+  const source = import_node_path.default.resolve(configDirectory, "../deploy");
+  const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
   const buildDirectory = import_node_path.default.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(import_node_path.default.sep, "/");
-  const droneConfigFilePath = import_node_path.default.resolve(configDirectory, "../deploy/.drone.yml");
-  const droneTarget = import_node_path.default.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-  const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-  const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-  const droneConfig = import_node_fs.default.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+  const droneTarget = import_node_path.default.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+  const defaults = import_yaml.default.parse(import_node_fs.default.readFileSync(import_node_path.default.join(source, "helm/values.yaml"), "utf8"));
+  const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+  defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+  defaults.targetK8s = deployment.targetK8s || "saas";
+  defaults.namespace = deployment.targetNamespace || "";
+  const values = mergeDeployValues(defaults, deployment.values || {});
+  values.managed = Boolean(deployment.managed);
+  values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+  if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+  if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+    /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+    (enabled) => typeof enabled !== "boolean"
+  )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+  if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+    /** 不生成没有配置域名的环境条目。 */
+    ([, hosts]) => Array.isArray(hosts) && hosts.length
+  ));
+  const drone = import_node_fs.default.readFileSync(import_node_path.default.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+  if (deployment.managed) {
+    if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+    import_node_fs.default.cpSync(source, target, { recursive: true });
+  }
   import_node_fs.default.mkdirSync(import_node_path.default.dirname(droneTarget), { recursive: true });
-  import_node_fs.default.writeFileSync(droneTarget, droneConfig);
-  const valuesYamlFilePath = import_node_path.default.resolve(configDirectory, "../deploy/helm/values.yaml");
-  const valuesYamlFile = import_node_fs.default.readFileSync(valuesYamlFilePath, "utf8");
-  const valuesYaml = import_yaml.default.parse(valuesYamlFile);
-  if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-  if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-  const {
-    virtualServiceEnabled = true,
-    hostsProd = [],
-    hostsStage = [],
-    hostsTest = [],
-    gateways = ["common-gateway-eshetang"]
-  } = xfeConfig.deploy;
-  const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-  valuesYaml.virtualService.enabled = virtualServiceEnabled;
-  valuesYaml.virtualService.gateways = gateways;
-  valuesYaml.virtualService.hosts.prod = hostsProd;
-  valuesYaml.virtualService.hosts.stage = hostsStage;
-  valuesYaml.virtualService.hosts.test = hostsTest;
-  valuesYaml.targetK8s = targetK8s;
-  valuesYaml.namespace = targetNamespace;
-  const valuesYamlStr = import_yaml.default.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-  import_node_fs.default.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+  import_node_fs.default.writeFileSync(import_node_path.default.join(target, "helm/values.yaml"), import_yaml.default.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+  import_node_fs.default.writeFileSync(droneTarget, drone);
 };
+function mergeDeployValues(base, overrides) {
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  ));
+}
 var getJwtEnv = async () => {
   const xfeConfig = loadXfeConfig();
   if (!xfeConfig?.jwt) return {};

package/dist/config.mjs

@@ -62,40 +62,51 @@ var getServerEntry = (projectRoot, webapp = {}) => {
 };
 var configDeploy = () => {
   const xfeConfig = loadXfeConfig();
-  if (!xfeConfig?.deploy) return;
+  const deployment = xfeConfig.deploy;
+  if (!deployment) return;
   const configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const projectRoot = process.cwd();
+  const source = path.resolve(configDirectory, "../deploy");
+  const target = deployment.managed ? getBuildDirectory(projectRoot, { buildDirectory: "deploy" }) : source;
   const buildDirectory = path.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(path.sep, "/");
-  const droneConfigFilePath = path.resolve(configDirectory, "../deploy/.drone.yml");
-  const droneTarget = path.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-  const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
-  const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
-  const droneConfig = fs.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+  const droneTarget = path.resolve(projectRoot, deployment.droneConfigPath || "./.drone.yml");
+  const defaults = yaml.parse(fs.readFileSync(path.join(source, "helm/values.yaml"), "utf8"));
+  const { virtualServiceEnabled = true, hostsProd = [], hostsStage = [], hostsTest = [], gateways = ["common-gateway-eshetang"] } = deployment;
+  defaults.virtualService = { ...defaults.virtualService, enabled: virtualServiceEnabled, hosts: { prod: hostsProd, stage: hostsStage, test: hostsTest }, gateways };
+  defaults.targetK8s = deployment.targetK8s || "saas";
+  defaults.namespace = deployment.targetNamespace || "";
+  const values = mergeDeployValues(defaults, deployment.values || {});
+  values.managed = Boolean(deployment.managed);
+  values.nodeVersion = deployment.values?.nodeVersion || "22.22.0";
+  if (!/^\d+\.\d+\.\d+$/.test(values.nodeVersion)) throw new Error("deploy.values.nodeVersion \u5FC5\u987B\u662F\u5B8C\u6574 Node \u7248\u672C\u53F7");
+  if (!["saas", "infra"].includes(values.targetK8s)) throw new Error("deploy.targetK8s \u53EA\u80FD\u4E3A saas \u6216 infra");
+  if (!values.environments || typeof values.environments !== "object" || Array.isArray(values.environments) || Object.values(values.environments).some(
+    /** 发布开关必须是布尔值，避免误执行未启用环境。 */
+    (enabled) => typeof enabled !== "boolean"
+  )) throw new Error("deploy.values.environments \u5FC5\u987B\u662F\u5E03\u5C14\u5F00\u5173\u5BF9\u8C61");
+  if (deployment.managed) values.virtualService.hosts = Object.fromEntries(Object.entries(values.virtualService.hosts).filter(
+    /** 不生成没有配置域名的环境条目。 */
+    ([, hosts]) => Array.isArray(hosts) && hosts.length
+  ));
+  const drone = fs.readFileSync(path.join(source, ".drone.yml"), "utf8").replaceAll("<<NODE_VERSION>>", values.nodeVersion).replaceAll("<<TARGET_K8S>>", values.targetK8s).replace(JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`), JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`));
+  if (deployment.managed) {
+    if (target === source) throw new Error("managed \u90E8\u7F72\u8F93\u51FA\u4E0D\u80FD\u8986\u76D6\u6846\u67B6\u6A21\u677F\u76EE\u5F55");
+    fs.cpSync(source, target, { recursive: true });
+  }
   fs.mkdirSync(path.dirname(droneTarget), { recursive: true });
-  fs.writeFileSync(droneTarget, droneConfig);
-  const valuesYamlFilePath = path.resolve(configDirectory, "../deploy/helm/values.yaml");
-  const valuesYamlFile = fs.readFileSync(valuesYamlFilePath, "utf8");
-  const valuesYaml = yaml.parse(valuesYamlFile);
-  if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
-  if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
-  const {
-    virtualServiceEnabled = true,
-    hostsProd = [],
-    hostsStage = [],
-    hostsTest = [],
-    gateways = ["common-gateway-eshetang"]
-  } = xfeConfig.deploy;
-  const { targetK8s = "saas", targetNamespace = "" } = xfeConfig.deploy;
-  valuesYaml.virtualService.enabled = virtualServiceEnabled;
-  valuesYaml.virtualService.gateways = gateways;
-  valuesYaml.virtualService.hosts.prod = hostsProd;
-  valuesYaml.virtualService.hosts.stage = hostsStage;
-  valuesYaml.virtualService.hosts.test = hostsTest;
-  valuesYaml.targetK8s = targetK8s;
-  valuesYaml.namespace = targetNamespace;
-  const valuesYamlStr = yaml.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-  fs.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+  fs.writeFileSync(path.join(target, "helm/values.yaml"), yaml.stringify(values, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" }));
+  fs.writeFileSync(droneTarget, drone);
 };
+function mergeDeployValues(base, overrides) {
+  return Object.fromEntries(Object.entries({ ...base, ...overrides }).map(
+    /** 仅合并普通对象，列表保持声明的顺序。 */
+    ([key, value]) => {
+      const previous = base[key];
+      const mergeable = value && previous && typeof value === "object" && typeof previous === "object" && !Array.isArray(value) && !Array.isArray(previous);
+      return [key, mergeable ? mergeDeployValues(previous, value) : value];
+    }
+  ));
+}
 var getJwtEnv = async () => {
   const xfeConfig = loadXfeConfig();
   if (!xfeConfig?.jwt) return {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfe-repo/web-app",
-  "version": "2.0.0-beta.3",
+  "version": "2.0.0-beta.5",
   "bin": {
     "xfe-web": "./bin/index.js"
   },
@@ -30,8 +30,8 @@
     "yaml": "^2.4.2",
     "tsx": "4.23.15",
     "@xfe-repo/eslint-config": "2.0.0-beta.1",
-    "@xfe-repo/web-router": "2.0.0-beta.1",
-    "@xfe-repo/typescript-config": "2.0.0-beta.1"
+    "@xfe-repo/typescript-config": "2.0.0-beta.1",
+    "@xfe-repo/web-router": "2.0.0-beta.1"
   },
   "devDependencies": {
     "@types/express": "5.0.6"