fix(jenkins): support pipeline upstream cause gate

jenkins/Jenkinsfile.deploy

@@ -22,13 +22,22 @@ pipeline {
 
       steps {
         script {
-          // 使用 RunWrapper 白名单方法读取触发原因，避免触发 Jenkins Script Security 审批。
-          def upstreamCauses = currentBuild.getBuildCauses('hudson.model.Cause$UpstreamCause')
-          if (!upstreamCauses || upstreamCauses.isEmpty()) {
+          // Pipeline 的 build 步骤通常会把下游触发原因记录成 BuildUpstreamCause，
+          // 直接只查经典 UpstreamCause 会把真实的上游触发误判成“人工执行”。
+          def pipelineUpstreamCauses = currentBuild.getBuildCauses('org.jenkinsci.plugins.workflow.support.steps.build.BuildUpstreamCause')
+          def classicUpstreamCauses = currentBuild.getBuildCauses('hudson.model.Cause$UpstreamCause')
+          def upstreamCause = null
+
+          if (pipelineUpstreamCauses && !pipelineUpstreamCauses.isEmpty()) {
+            upstreamCause = pipelineUpstreamCauses[0]
+          } else if (classicUpstreamCauses && !classicUpstreamCauses.isEmpty()) {
+            upstreamCause = classicUpstreamCauses[0]
+          }
+
+          if (!upstreamCause) {
             error('部署流水线禁止人工直接执行，只允许由上游构建并部署流水线触发。')
           }
 
-          def upstreamCause = upstreamCauses[0]
           def actualUpstreamJob = upstreamCause?.upstreamProject ?: ''
           def expectedUpstreamJob = params.EXPECTED_UPSTREAM_JOB?.trim()
           def allowedUpstreamJob = env.GENARRATIVE_ALLOWED_UPSTREAM_JOB?.trim()
@@ -45,6 +54,10 @@ pipeline {
             error('SOURCE_NODE_NAME 不能为空。')
           }
 
+          if (!actualUpstreamJob?.trim()) {
+            error('无法从上游触发原因中解析作业名，请检查 Jenkins Pipeline Build Step 插件版本与触发链。')
+          }
+
           if (expectedUpstreamJob && actualUpstreamJob != expectedUpstreamJob) {
             error("上游作业校验失败，期望 ${expectedUpstreamJob}，实际 ${actualUpstreamJob}")
           }