ssh-release 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.8.0 - 2026-06-25
+
+### Added
+
+- 增加 GitHub Actions 发布模板文档，覆盖 Pull Request 预检、生产发布、`--json --progress` 输出、环境保护和 Secrets 使用方式。
+
+## 0.7.0 - 2026-06-25
+
+### Added
+
+- 增加发布后远端状态校验，`deploy` 成功后会确认目标目录、`current` 指向和远端锁清理状态，并在结果中输出 `verified` 与 `verification`。
+
 ## 0.6.0 - 2026-06-25
 
 ### Added

package/README.md

@@ -18,6 +18,7 @@
 - `ssh-release unlock`：查看远端锁，并在显式确认锁路径后删除锁。
 - `--json`：输出单行 JSON，便于 CI/CD 解析。
 - `deploy --json --progress`：发布时输出 NDJSON 阶段进度，便于 CI/CD 展示实时状态。
+- 发布后远端校验：确认版本目录或目标目录存在、`current` 已指向新版本、远端锁已清理。
 - `release` 模式：上传压缩包、远端解压、切换 `current`、清理旧版本。
 - `overwrite` 模式：直接覆盖发布到目标目录。
 - 远端 `tar` 解压失败时回退逐文件上传。
@@ -188,6 +189,8 @@ ssh-release deploy
 
 `release` 模式发布成功后会输出版本号、版本目录和 `current` 软链接路径。只有压缩包上传和解压完成后才切换 `current`。
 
+发布命令返回成功前会执行远端状态校验。`release` 模式会确认新版本目录存在、`current` 已指向新版本、远端锁已清理；`overwrite` 模式会确认目标目录存在、远端锁已清理。校验失败时发布命令返回失败，不会把结果标记为成功。
+
 如果远端已有 `.ssh-release.lock`，说明同一目标目录可能正在发布或回滚，工具会停止在修改远端状态之前。
 
 查看锁状态：
@@ -242,7 +245,7 @@ ssh-release unlock --json
 成功时输出单行 JSON：
 
 ```json
-{"ok":true,"command":"deploy","result":{"dryRun":true,"mode":"release"}}
+{"ok":true,"command":"deploy","result":{"mode":"release","version":"20260625-153000","verified":true}}
 ```
 
 命令执行失败时输出：
@@ -262,11 +265,17 @@ ssh-release deploy --json --progress
 ```json
 {"ok":true,"command":"deploy","event":"progress","stage":"package","status":"start"}
 {"ok":true,"command":"deploy","event":"progress","stage":"package","status":"success"}
-{"ok":true,"command":"deploy","result":{"mode":"release","version":"20260625-153000"}}
+{"ok":true,"command":"deploy","result":{"mode":"release","version":"20260625-153000","verified":true}}
 ```
 
 `stage` 可能是 `source`、`lock`、`package`、`publish`、`cleanup`，`status` 可能是 `start`、`success`、`fail`。失败事件会包含 `error` 字段。
 
+发布结果中的 `verification` 会列出已通过的远端校验项：
+
+```json
+{"verified":true,"verification":[{"name":"当前版本","status":"pass","message":"current 已指向新版本"}]}
+```
+
 `doctor` 检查失败、`unlock` 发现锁但未删除时会返回非零退出码，并在 JSON 的 `result` 中保留检查结果。
 
 ## 安全边界
@@ -354,6 +363,8 @@ npm install -g "$PACK_DIR"/ssh-release-"$VERSION".tgz --prefix "$PACK_DIR/prefix
 
 完整发布步骤见 [docs/release-checklist.md](https://github.com/JackEngineer/ssh-release/blob/main/docs/release-checklist.md)。
 
+GitHub Actions 发布模板见 [docs/github-actions.md](https://github.com/JackEngineer/ssh-release/blob/main/docs/github-actions.md)。
+
 版本变更见 [CHANGELOG.md](https://github.com/JackEngineer/ssh-release/blob/main/CHANGELOG.md)。
 
 ## 项目结构
@@ -394,6 +405,7 @@ tests/
 └── validate.test.ts
 
 docs/
+├── github-actions.md
 ├── release-checklist.md
 └── superpowers/specs/2026-06-25-ssh-release-design.md
 ```

package/dist/cli.js

@@ -268,6 +268,12 @@ function printDeployResult(result, io) {
     if (result.usedFallback) {
         io.log('远端 tar 不可用或解压失败，已使用逐文件上传');
     }
+    if (result.verified) {
+        io.log('远端校验通过');
+        for (const check of result.verification ?? []) {
+            io.log(`校验: ${check.name} - ${check.message}`);
+        }
+    }
     for (const warning of result.warnings) {
         io.log(`警告: ${warning}`);
     }

package/dist/release.js

@@ -1,6 +1,6 @@
 import { access } from 'node:fs/promises';
 import { createReleasePackage, } from './package.js';
-import { acquireRemoteLock } from './lock.js';
+import { acquireRemoteLock, readRemoteLockStatus } from './lock.js';
 import { readRemoteReleaseNames, remoteJoin, shellQuote, } from './remote.js';
 export function createVersionName(date = new Date()) {
     return [
@@ -75,6 +75,10 @@ export async function deploy(config, client, options = {}) {
                     cleanupError = error;
                 }
             }
+            if (result && !deployError && !cleanupError) {
+                result.verification = await verifyDeployResult(config, client, result);
+                result.verified = true;
+            }
             if (cleanupError && !deployError) {
                 throw cleanupError;
             }
@@ -182,6 +186,64 @@ async function cleanupOldReleases(config, client, releasesPath, currentVersion,
         warnings.push(`旧版本清理失败: ${formatError(error)}`);
     }
 }
+async function verifyDeployResult(config, client, result) {
+    if (result.mode === 'overwrite') {
+        return [
+            await verifyRemoteDirectory(client, result.targetPath, '目标目录', '远端目标目录存在'),
+            await verifyRemoteLockReleased(config, client),
+        ];
+    }
+    if (!result.version || !result.currentSymlink) {
+        throw new Error('release 发布结果缺少版本号或 current 路径，无法校验远端状态');
+    }
+    return [
+        await verifyRemoteDirectory(client, result.targetPath, '版本目录', '远端版本目录存在'),
+        await verifyCurrentSymlink(client, result.currentSymlink, remoteJoin(config.target.releasesDir, result.version)),
+        await verifyRemoteLockReleased(config, client),
+    ];
+}
+async function verifyRemoteDirectory(client, remotePath, name, successMessage) {
+    try {
+        await client.exec(`test -d ${shellQuote(remotePath)}`);
+    }
+    catch (error) {
+        throw new Error(`${name}校验失败: ${formatError(error)}`);
+    }
+    return {
+        name,
+        status: 'pass',
+        message: successMessage,
+    };
+}
+async function verifyCurrentSymlink(client, currentSymlinkPath, expectedTarget) {
+    let actualTarget;
+    try {
+        const result = await client.exec(`readlink ${shellQuote(currentSymlinkPath)}`);
+        actualTarget = result.stdout.trim();
+    }
+    catch (error) {
+        throw new Error(`current 校验失败: ${formatError(error)}`);
+    }
+    if (actualTarget !== expectedTarget) {
+        throw new Error(`current 未指向新版本: 期望 ${expectedTarget}，实际 ${actualTarget || '空'}`);
+    }
+    return {
+        name: '当前版本',
+        status: 'pass',
+        message: 'current 已指向新版本',
+    };
+}
+async function verifyRemoteLockReleased(config, client) {
+    const lockStatus = await readRemoteLockStatus(config, client);
+    if (lockStatus.locked) {
+        throw new Error(`发布锁未清理: ${lockStatus.lockPath}`);
+    }
+    return {
+        name: '远端锁',
+        status: 'pass',
+        message: '发布锁已清理',
+    };
+}
 async function ensureSourceExists(sourcePath) {
     try {
         await access(sourcePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ssh-release",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "A general-purpose SSH file release CLI.",
   "type": "module",
   "bin": {