ssh-release 1.2.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.4.0 - 2026-06-27
+
+### Added
+
+- 增加真实服务器 dogfood 脚本和文档，固化一次性 `/tmp/ssh-release-dogfood-*` 发布、回滚、校验和清理流程。
+
+## 1.3.0 - 2026-06-26
+
+### Added
+
+- 增加 `ssh-release rollback --json --progress`，回滚时按 NDJSON 输出 `lock`、`switch`、`cleanup`、`verify` 阶段状态。
+- 增强回滚后远端校验，成功结果会输出 `verified` 与 `verification`，确认目标版本目录、`current` 指向和远端锁清理状态。
+
 ## 1.2.0 - 2026-06-26
 
 ### Added

package/README.md

@@ -18,11 +18,13 @@
 - `ssh-release unlock`：查看远端锁，并在显式确认锁路径后删除锁。
 - `--json`：输出单行 JSON，便于 CI/CD 解析。
 - `deploy --json --progress`：发布时输出 NDJSON 阶段进度，便于 CI/CD 展示实时状态。
+- `rollback --json --progress`：回滚时输出 NDJSON 阶段进度，便于 CI/CD 展示实时状态。
 - `deploy --plan`：不连接远端、不修改服务器，预览上传、切换、清理和校验计划。
 - `rollback --plan`：连接远端读取版本状态，但不修改服务器，预览回滚切换计划。
 - 失败下一步提示：常见锁、回滚目标、发布校验和 SSH 错误会提示下一步操作。
 - 发布 manifest：每次发布生成 `manifest.json`，记录版本、发布时间、本地来源、文件清单、文件大小和 SHA-256。
 - 发布后远端校验：确认版本目录或目标目录存在、`current` 已指向新版本、`manifest.json` hash 匹配、远端锁已清理。
+- 回滚后远端校验：确认目标版本目录存在、`current` 已指向目标版本、远端锁已清理。
 - `release` 模式：上传压缩包、远端解压、切换 `current`、清理旧版本。
 - `overwrite` 模式：直接覆盖发布到目标目录。
 - 远端 `tar` 解压失败时回退逐文件上传。
@@ -285,6 +287,7 @@ ssh-release deploy --json --progress
 ssh-release doctor --json
 ssh-release list --json
 ssh-release rollback --json
+ssh-release rollback --json --progress
 ssh-release unlock --json
 ```
 
@@ -300,10 +303,11 @@ ssh-release unlock --json
 {"ok":false,"command":"deploy","error":"错误信息"}
 ```
 
-发布时需要持续读取阶段状态，可以使用：
+发布或回滚时需要持续读取阶段状态，可以使用：
 
 ```bash
 ssh-release deploy --json --progress
+ssh-release rollback --json --progress
 ```
 
 该模式会按行输出 NDJSON。进度事件先输出，最终结果最后输出：
@@ -314,9 +318,11 @@ ssh-release deploy --json --progress
 {"ok":true,"command":"deploy","result":{"mode":"release","version":"20260625-153000","verified":true}}
 ```
 
-`stage` 可能是 `source`、`lock`、`package`、`publish`、`cleanup`，`status` 可能是 `start`、`success`、`fail`。失败事件会包含 `error` 字段。
+`deploy` 的 `stage` 可能是 `source`、`lock`、`package`、`publish`、`cleanup`。
+`rollback` 的 `stage` 可能是 `lock`、`switch`、`cleanup`、`verify`。
+`status` 可能是 `start`、`success`、`fail`。失败事件会包含 `error` 字段。
 
-发布结果中的 `verification` 会列出已通过的远端校验项：
+发布和回滚结果中的 `verification` 会列出已通过的远端校验项：
 
 ```json
 {"verified":true,"verification":[{"name":"发布清单","status":"pass","message":"manifest.json 已上传并校验，文件数 12"}]}
@@ -416,6 +422,8 @@ npm install -g "$PACK_DIR"/ssh-release-"$VERSION".tgz --prefix "$PACK_DIR/prefix
 
 完整发布步骤见 [docs/release-checklist.md](https://github.com/JackEngineer/ssh-release/blob/main/docs/release-checklist.md)。
 
+真实服务器 dogfood 见 [docs/dogfood.md](https://github.com/JackEngineer/ssh-release/blob/main/docs/dogfood.md)。
+
 GitHub Actions 发布模板见 [docs/github-actions.md](https://github.com/JackEngineer/ssh-release/blob/main/docs/github-actions.md)。
 
 失败恢复指南见 [docs/recovery.md](https://github.com/JackEngineer/ssh-release/blob/main/docs/recovery.md)。

package/dist/cli.js

@@ -6,7 +6,7 @@ import { CONFIG_FILE_NAME, loadConfigFile, writeConfigTemplate } from './config.
 import { runDoctorFromFile } from './doctor.js';
 import { listReleases } from './list.js';
 import { createDeployPlan, deploy, } from './release.js';
-import { createRollbackPlan, rollback } from './rollback.js';
+import { createRollbackPlan, rollback, } from './rollback.js';
 import { createRemoteClient } from './ssh.js';
 import { unlock } from './unlock.js';
 export function isCliEntrypoint(moduleUrl, argvEntry) {
@@ -73,7 +73,13 @@ export async function runCli(argv = process.argv.slice(2), options = {}) {
             return 0;
         }
         if (command === 'rollback') {
-            const result = await handlers.rollback(args[0], { dryRun: parsed.dryRun });
+            const rollbackOptions = {
+                dryRun: parsed.dryRun,
+            };
+            if (parsed.json && parsed.progress) {
+                rollbackOptions.onProgress = (event) => printJsonProgress('rollback', event, io);
+            }
+            const result = await handlers.rollback(args[0], rollbackOptions);
             if (parsed.json) {
                 printJsonResult('rollback', result, 0, io);
                 return 0;
@@ -192,8 +198,8 @@ function parseCliArgs(argv) {
     if (progress && !json) {
         return createParsedError('--progress 需要配合 --json 使用', configPath, json);
     }
-    if (progress && args[0] && args[0] !== 'deploy') {
-        return createParsedError('--progress 仅支持 deploy 命令', configPath, json);
+    if (progress && args[0] && args[0] !== 'deploy' && args[0] !== 'rollback') {
+        return createParsedError('--progress 仅支持 deploy 或 rollback 命令', configPath, json);
     }
     return {
         args: args.slice(1),
@@ -236,7 +242,9 @@ function createDefaultHandlers(configPath) {
             if (options?.dryRun) {
                 return createRollbackPlan(config, createRemoteClient(config), version);
             }
-            return rollback(config, createRemoteClient(config), version);
+            return rollback(config, createRemoteClient(config), version, {
+                onProgress: options?.onProgress,
+            });
         },
         list: async () => {
             const config = await loadConfigFile(configPath);
@@ -317,6 +325,12 @@ function printRollbackResult(result, io) {
     }
     io.log(`已回滚到版本: ${result.version}`);
     io.log(`当前指向: ${result.currentSymlink}`);
+    if (result.verified) {
+        io.log('回滚校验通过');
+        for (const check of result.verification ?? []) {
+            io.log(`校验: ${check.name} - ${check.message}`);
+        }
+    }
     for (const warning of result.warnings) {
         io.log(`警告: ${warning}`);
     }
@@ -410,6 +424,7 @@ function createUsageText() {
   ssh-release rollback [version] [--config <path>]
   ssh-release rollback [version] --dry-run [--config <path>]
   ssh-release rollback [version] --plan [--config <path>]
+  ssh-release rollback [version] --json --progress [--config <path>]
   ssh-release unlock [--confirm <lock-path>] [--config <path>]
   ssh-release <command> --json
   ssh-release --help

package/dist/exclude.js

@@ -0,0 +1,22 @@
+import path from 'node:path';
+export function toPosixPath(value) {
+    return value.split(path.sep).join(path.posix.sep);
+}
+export function isExcludedPath(relativePath, exclude) {
+    const normalizedPath = toPosixPath(relativePath);
+    const pathSegments = normalizedPath.split('/');
+    return exclude.some((pattern) => {
+        const normalizedPattern = toPosixPath(pattern);
+        if (!normalizedPattern.includes('/')) {
+            return pathSegments.includes(normalizedPattern);
+        }
+        return wildcardMatch(normalizedPath, normalizedPattern)
+            || wildcardMatch(`./${normalizedPath}`, normalizedPattern);
+    });
+}
+function wildcardMatch(value, pattern) {
+    const escapedPattern = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replaceAll('*', '[^/]*');
+    return new RegExp(`^${escapedPattern}$`).test(value);
+}

package/dist/lock.js

@@ -41,9 +41,30 @@ export async function acquireRemoteLock(config, client, options = {}) {
 export async function removeRemoteLock(config, client) {
     await client.exec(`rm -rf ${shellQuote(getRemoteLockPath(config))}`);
 }
+export async function waitForRemoteLockReleased(config, client, options = {}) {
+    const label = options.label ?? '远端锁';
+    const attempts = Math.max(1, options.attempts ?? 4);
+    const delayMs = Math.max(0, options.delayMs ?? 50);
+    let lockStatus = await readRemoteLockStatus(config, client);
+    for (let attempt = 1; attempt < attempts && lockStatus.locked; attempt += 1) {
+        await delay(delayMs);
+        lockStatus = await readRemoteLockStatus(config, client);
+    }
+    if (lockStatus.locked) {
+        throw new Error(`${label}未清理: ${lockStatus.lockPath}`);
+    }
+}
 function parseRemoteLockValue(lines, fieldName) {
     const prefix = `${fieldName}=`;
     const line = lines.find((entry) => entry.startsWith(prefix));
     const value = line?.slice(prefix.length).trim();
     return value || undefined;
 }
+async function delay(ms) {
+    if (ms === 0) {
+        return;
+    }
+    await new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}

package/dist/manifest.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { mkdtemp, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { isExcludedPath, toPosixPath } from './exclude.js';
 export async function createReleaseManifest(options) {
     const sourceStat = await stat(options.sourcePath);
     const files = sourceStat.isDirectory()
@@ -41,7 +42,7 @@ async function collectDirectoryFiles(sourcePath, exclude, relativeDirectory = ''
     const files = [];
     for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
         const relativePath = toPosixPath(path.join(relativeDirectory, entry.name));
-        if (isExcluded(relativePath, exclude)) {
+        if (isExcludedPath(relativePath, exclude)) {
             continue;
         }
         const localPath = path.join(sourcePath, relativePath);
@@ -63,24 +64,3 @@ async function createManifestFileEntry(localPath, relativePath) {
         sha256: createHash('sha256').update(content).digest('hex'),
     };
 }
-function isExcluded(relativePath, exclude) {
-    const normalizedPath = toPosixPath(relativePath);
-    const pathSegments = normalizedPath.split('/');
-    return exclude.some((pattern) => {
-        const normalizedPattern = toPosixPath(pattern);
-        if (!normalizedPattern.includes('/')) {
-            return pathSegments.includes(normalizedPattern);
-        }
-        return wildcardMatch(normalizedPath, normalizedPattern)
-            || wildcardMatch(`./${normalizedPath}`, normalizedPattern);
-    });
-}
-function wildcardMatch(value, pattern) {
-    const escapedPattern = pattern
-        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-        .replaceAll('*', '[^/]*');
-    return new RegExp(`^${escapedPattern}$`).test(value);
-}
-function toPosixPath(value) {
-    return value.split(path.sep).join(path.posix.sep);
-}

package/dist/release.js

@@ -28,12 +28,28 @@ export function selectReleasesToDelete(releases, currentVersion, keepReleases) {
 function pad(value) {
     return value.toString().padStart(2, '0');
 }
+const maxVersionSuffixAttempts = 1000;
+export async function resolveUniqueReleaseVersion(config, client, baseVersionName) {
+    const releasesPath = remoteJoin(config.target.path, config.target.releasesDir);
+    for (let attempt = 1; attempt <= maxVersionSuffixAttempts; attempt += 1) {
+        const candidate = attempt === 1 ? baseVersionName : `${baseVersionName}-${attempt}`;
+        const candidatePath = remoteJoin(releasesPath, candidate);
+        const result = await client.exec(`test -e ${shellQuote(candidatePath)} && echo exists || true`);
+        if (result.stdout.trim() !== 'exists') {
+            return candidate;
+        }
+    }
+    throw new Error(`无法为版本 ${baseVersionName} 生成唯一目录名，已尝试 ${maxVersionSuffixAttempts} 次`);
+}
 export async function deploy(config, client, options = {}) {
     await withDeployProgress(options, 'source', () => ensureSourceExists(config.source.path));
     const releaseDate = options.now ?? new Date();
-    const versionName = createVersionName(releaseDate);
+    let versionName = createVersionName(releaseDate);
     const packageFactory = options.createPackage ?? createReleasePackage;
     const releaseLock = await withDeployProgress(options, 'lock', () => acquireRemoteLock(config, client));
+    if (config.deploy.mode === 'release') {
+        versionName = await resolveUniqueReleaseVersion(config, client, versionName);
+    }
     let releasePackage;
     let manifest;
     let manifestFile;

package/dist/rollback.js

@@ -1,5 +1,5 @@
 import { readCurrentVersion, readRemoteReleaseNames, remoteJoin, shellQuote, } from './remote.js';
-import { acquireRemoteLock, readRemoteLockStatus } from './lock.js';
+import { acquireRemoteLock, readRemoteLockStatus, waitForRemoteLockReleased } from './lock.js';
 export function selectRollbackTarget(selection) {
     const releases = [...new Set(selection.releases)].sort();
     if (selection.requestedVersion) {
@@ -61,32 +61,35 @@ export async function createRollbackPlan(config, client, requestedVersion) {
         ],
     };
 }
-export async function rollback(config, client, requestedVersion) {
+export async function rollback(config, client, requestedVersion, options = {}) {
     if (config.deploy.mode === 'overwrite') {
         throw new Error('overwrite 模式不支持回滚');
     }
-    const releaseLock = await acquireRemoteLock(config, client, { createTargetPath: false });
+    const releaseLock = await withRollbackProgress(options, 'lock', () => acquireRemoteLock(config, client, { createTargetPath: false }));
     let result;
     let rollbackError;
+    let cleanupError;
     try {
-        const releasesPath = remoteJoin(config.target.path, config.target.releasesDir);
-        const currentSymlinkPath = remoteJoin(config.target.path, config.target.currentSymlink);
-        const releases = await readRemoteReleaseNames(client, releasesPath);
-        const currentVersion = await readCurrentVersion(client, currentSymlinkPath);
-        if (!currentVersion) {
-            throw new Error('当前版本不存在');
-        }
-        const targetVersion = selectRollbackTarget({
-            releases,
-            currentVersion,
-            requestedVersion,
+        result = await withRollbackProgress(options, 'switch', async () => {
+            const releasesPath = remoteJoin(config.target.path, config.target.releasesDir);
+            const currentSymlinkPath = remoteJoin(config.target.path, config.target.currentSymlink);
+            const releases = await readRemoteReleaseNames(client, releasesPath);
+            const currentVersion = await readCurrentVersion(client, currentSymlinkPath);
+            if (!currentVersion) {
+                throw new Error('当前版本不存在');
+            }
+            const targetVersion = selectRollbackTarget({
+                releases,
+                currentVersion,
+                requestedVersion,
+            });
+            await client.exec(`ln -sfn ${shellQuote(remoteJoin(config.target.releasesDir, targetVersion))} ${shellQuote(currentSymlinkPath)}`);
+            return {
+                version: targetVersion,
+                currentSymlink: currentSymlinkPath,
+                warnings: [],
+            };
         });
-        await client.exec(`ln -sfn ${shellQuote(remoteJoin(config.target.releasesDir, targetVersion))} ${shellQuote(currentSymlinkPath)}`);
-        result = {
-            version: targetVersion,
-            currentSymlink: currentSymlinkPath,
-            warnings: [],
-        };
         return result;
     }
     catch (error) {
@@ -94,20 +97,101 @@ export async function rollback(config, client, requestedVersion) {
         throw error;
     }
     finally {
-        try {
-            await releaseLock();
-        }
-        catch (error) {
-            const message = `远程发布锁清理失败: ${formatError(error)}`;
-            if (result) {
-                result.warnings.push(message);
+        await withRollbackProgress(options, 'cleanup', async () => {
+            try {
+                await releaseLock();
+                await waitForRemoteLockReleased(config, client, { label: '回滚锁' });
+            }
+            catch (error) {
+                const message = `远程回滚锁清理失败: ${formatError(error)}`;
+                if (result) {
+                    result.warnings.push(message);
+                }
+                if (!rollbackError) {
+                    cleanupError = error;
+                }
             }
-            else if (!rollbackError) {
-                throw error;
+            if (cleanupError && !rollbackError) {
+                throw cleanupError;
             }
+        });
+        const rollbackResult = result;
+        if (rollbackResult && !rollbackError && !cleanupError) {
+            await withRollbackProgress(options, 'verify', async () => {
+                rollbackResult.verification = await verifyRollbackResult(config, client, rollbackResult);
+                rollbackResult.verified = true;
+            });
         }
     }
 }
+async function verifyRollbackResult(config, client, result) {
+    return [
+        await verifyRemoteDirectory(client, remoteJoin(config.target.path, config.target.releasesDir, result.version), '目标版本', '目标版本目录存在'),
+        await verifyCurrentSymlink(client, result.currentSymlink, remoteJoin(config.target.releasesDir, result.version)),
+        await verifyRemoteLockReleased(config, client),
+    ];
+}
+async function verifyRemoteDirectory(client, remotePath, name, successMessage) {
+    try {
+        await client.exec(`test -d ${shellQuote(remotePath)}`);
+    }
+    catch (error) {
+        throw new Error(`${name}校验失败: ${formatError(error)}`);
+    }
+    return {
+        name,
+        status: 'pass',
+        message: successMessage,
+    };
+}
+async function verifyCurrentSymlink(client, currentSymlinkPath, expectedTarget) {
+    let actualTarget;
+    try {
+        const result = await client.exec(`readlink ${shellQuote(currentSymlinkPath)}`);
+        actualTarget = result.stdout.trim();
+    }
+    catch (error) {
+        throw new Error(`current 校验失败: ${formatError(error)}`);
+    }
+    if (actualTarget !== expectedTarget) {
+        throw new Error(`current 未指向目标版本: 期望 ${expectedTarget}，实际 ${actualTarget || '空'}`);
+    }
+    return {
+        name: '当前版本',
+        status: 'pass',
+        message: 'current 已指向目标版本',
+    };
+}
+async function verifyRemoteLockReleased(config, client) {
+    const lockStatus = await readRemoteLockStatus(config, client);
+    if (lockStatus.locked) {
+        throw new Error(`回滚锁未清理: ${lockStatus.lockPath}`);
+    }
+    return {
+        name: '远端锁',
+        status: 'pass',
+        message: '回滚锁已清理',
+    };
+}
+async function withRollbackProgress(options, stage, run) {
+    await emitRollbackProgress(options, { stage, status: 'start' });
+    try {
+        const result = await run();
+        await emitRollbackProgress(options, { stage, status: 'success' });
+        return result;
+    }
+    catch (error) {
+        await emitRollbackProgress(options, {
+            stage,
+            status: 'fail',
+            error: formatError(error),
+        });
+        throw error;
+    }
+}
+async function emitRollbackProgress(options, event) {
+    await options.onProgress?.(event);
+}
 function formatError(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/ssh.js

@@ -1,5 +1,6 @@
 import { readdir, stat } from 'node:fs/promises';
 import path from 'node:path';
+import { isExcludedPath, toPosixPath } from './exclude.js';
 import { runProcess } from './process.js';
 import { remoteJoin, shellQuote } from './remote.js';
 export class ShellRemoteClient {
@@ -119,17 +120,18 @@ async function uploadDirectoryContents(client, localPath, remotePath, exclude) {
     }
     await walkDirectory(client, localPath, remotePath, exclude);
 }
-async function walkDirectory(client, localDirectory, remoteDirectory, exclude) {
+export async function walkDirectory(client, localDirectory, remoteDirectory, exclude, relativeDirectory = '') {
     await client.exec(`mkdir -p ${shellQuote(remoteDirectory)}`);
     const entries = await readdir(localDirectory, { withFileTypes: true });
     for (const entry of entries) {
-        if (exclude.includes(entry.name)) {
+        const relativeEntryPath = toPosixPath(path.join(relativeDirectory, entry.name));
+        if (isExcludedPath(relativeEntryPath, exclude)) {
             continue;
         }
         const localEntryPath = path.join(localDirectory, entry.name);
         const remoteEntryPath = remoteJoin(remoteDirectory, entry.name);
         if (entry.isDirectory()) {
-            await walkDirectory(client, localEntryPath, remoteEntryPath, exclude);
+            await walkDirectory(client, localEntryPath, remoteEntryPath, exclude, relativeEntryPath);
             continue;
         }
         if (entry.isFile()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ssh-release",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "A general-purpose SSH file release CLI.",
   "type": "module",
   "bin": {