Merge branch 'master' into feat/agc-llm-router-official-chain

scripts/check-preview-deployer.mjs

@@ -139,20 +139,40 @@ assertIncludes(
   'GENARRATIVE_PREVIEW_SECRETS_SHA256',
   '预览构建必须把固定 secrets 文件摘要作为镜像缓存与完整性校验参数。',
 );
+assertIncludes(
+  deployer,
+  'GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256',
+  '预览构建必须把固定 .env.local 文件摘要作为镜像缓存与完整性校验参数。',
+);
 assertIncludes(
   jenkinsfile,
   "GENARRATIVE_PREVIEW_SECRETS_FILE = '/data/jenkins/preview-secrets/.env.secrets.local'",
   'Jenkins 必须从受保护的固定宿主路径读取预览 secrets。',
 );
 assertIncludes(
-  deployer,
-  '[[ "${secrets_mode}" == "600" ]]',
-  '预览构建必须拒绝权限过宽的 secrets 文件。',
+  jenkinsfile,
+  "GENARRATIVE_PREVIEW_ENV_LOCAL_FILE = '/data/jenkins/preview-secrets/.env.local'",
+  'Jenkins 必须从受保护的固定宿主路径读取预览 .env.local。',
 );
 assertIncludes(
   deployer,
-  '[[ "${secrets_owner}" == "${EUID}" ]]',
-  '预览构建必须校验 secrets 文件归 Jenkins 执行用户所有。',
+  '[[ "${file_mode}" == "600" ]]',
+  '预览固定输入文件必须拒绝权限过宽。',
+);
+assertIncludes(
+  deployer,
+  '[[ "${dir_mode}" == "700" ]]',
+  '预览固定输入文件所在目录必须拒绝权限过宽。',
+);
+assertIncludes(
+  deployer,
+  '[[ "${file_owner}" == "${EUID}" ]]',
+  '预览固定输入文件必须校验 owner 归 Jenkins 执行用户所有。',
+);
+assertIncludes(
+  deployer,
+  '[[ "${dir_owner}" == "${EUID}" ]]',
+  '预览固定输入文件所在目录必须校验 owner 归 Jenkins 执行用户所有。',
 );
 assertIncludes(
   deployer,
@@ -165,11 +185,22 @@ assertCount(
   2,
   '预览 secrets 必须且只能提供给 API 和外部生成 worker 两个构建。',
 );
+assertCount(
+  deployer,
+  'target: genarrative_preview_env_local',
+  2,
+  '预览 .env.local 必须且只能提供给 API 和外部生成 worker 两个构建。',
+);
 assertIncludes(
   apiServerDockerfile,
   'ARG GENARRATIVE_PREVIEW_SECRETS_SHA256=',
   'API 镜像必须允许普通构建不提供预览 secrets 摘要。',
 );
+assertIncludes(
+  apiServerDockerfile,
+  'ARG GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256=',
+  'API 镜像必须允许普通构建不提供预览 .env.local 摘要。',
+);
 assertIncludes(
   apiServerDockerfile,
   'RUN --mount=type=secret,id=genarrative_preview_secrets,required=false',
@@ -195,6 +226,16 @@ assertIncludes(
   '/run/secrets/genarrative_preview_secrets /srv/genarrative/.env.secrets.local;',
   '预览 secrets 文件必须安装到 API 启动时读取的固定路径。',
 );
+assertIncludes(
+  apiServerDockerfile,
+  '--mount=type=secret,id=genarrative_preview_env_local,required=false',
+  'API 镜像必须通过可选 BuildKit secret 接收预览 .env.local 文件。',
+);
+assertIncludes(
+  apiServerDockerfile,
+  '/run/secrets/genarrative_preview_env_local /srv/genarrative/.env.local;',
+  '预览 .env.local 文件必须安装到 API 启动时读取的固定路径。',
+);
 assertIncludes(
   deployer,
   'GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED=true',

scripts/jenkins-preview-deployer.sh

@@ -11,6 +11,7 @@ RESULT_FILE="${RESULT_FILE:-${WORKSPACE:-$(pwd)}/preview-result.json}"
 DESCRIPTION_FILE="${DESCRIPTION_FILE:-${WORKSPACE:-$(pwd)}/.jenkins-preview-description}"
 STATE_ROOT="${GENARRATIVE_PREVIEW_STATE_ROOT:-/data/jenkins/preview-deployments}"
 PREVIEW_SECRETS_FILE="${GENARRATIVE_PREVIEW_SECRETS_FILE:-/data/jenkins/preview-secrets/.env.secrets.local}"
+PREVIEW_ENV_LOCAL_FILE="${GENARRATIVE_PREVIEW_ENV_LOCAL_FILE:-/data/jenkins/preview-secrets/.env.local}"
 WEB_HOST="${GENARRATIVE_PREVIEW_WEB_HOST:-}"
 LOCK_FILE="${GENARRATIVE_PREVIEW_LOCK_FILE:-${STATE_ROOT}/.lock}"
 
@@ -20,6 +21,7 @@ PROJECT_NAME=""
 SCRIPT_ROOT=""
 SCRIPT_FAILED=1
 PREVIEW_SECRETS_SHA256=""
+PREVIEW_ENV_LOCAL_SHA256=""
 
 fail() {
   echo "[preview-deployer] $*" >&2
@@ -246,25 +248,39 @@ allocate_port() {
   fail "端口范围 ${start}-${end} 已无可用端口。"
 }
 
-validate_preview_secrets_file() {
-  local secrets_dir secrets_mode secrets_owner canonical_secrets canonical_source
-  [[ "${PREVIEW_SECRETS_FILE}" == /* ]] || fail "预览 secrets 文件必须使用绝对路径。"
-  [[ -f "${PREVIEW_SECRETS_FILE}" && ! -L "${PREVIEW_SECRETS_FILE}" && -r "${PREVIEW_SECRETS_FILE}" ]] || \
-    fail "预览 secrets 文件必须是 Jenkins 可读的非符号链接普通文件: ${PREVIEW_SECRETS_FILE}"
-  secrets_dir="$(dirname "${PREVIEW_SECRETS_FILE}")"
-  [[ -d "${secrets_dir}" && ! -L "${secrets_dir}" ]] || \
-    fail "预览 secrets 目录必须是非符号链接目录: ${secrets_dir}"
-  secrets_mode="$(stat -c '%a' "${PREVIEW_SECRETS_FILE}")"
-  [[ "${secrets_mode}" == "600" ]] || fail "预览 secrets 文件权限必须是 0600: ${PREVIEW_SECRETS_FILE}"
-  secrets_owner="$(stat -c '%u' "${PREVIEW_SECRETS_FILE}")"
-  [[ "${secrets_owner}" == "${EUID}" ]] || fail "预览 secrets 文件必须归当前 Jenkins 执行用户所有。"
-  canonical_secrets="$(realpath -e "${PREVIEW_SECRETS_FILE}")"
+validate_preview_input_file() {
+  local file="$1"
+  local label="$2"
+  local file_dir file_mode file_owner dir_mode dir_owner canonical_file canonical_source
+  [[ "${file}" == /* ]] || fail "${label}必须使用绝对路径。"
+  [[ -f "${file}" && ! -L "${file}" && -r "${file}" ]] || \
+    fail "${label}必须是 Jenkins 可读的非符号链接普通文件: ${file}"
+  file_dir="$(dirname "${file}")"
+  [[ -d "${file_dir}" && ! -L "${file_dir}" ]] || \
+    fail "${label}所在目录必须是非符号链接目录: ${file_dir}"
+  dir_mode="$(stat -c '%a' "${file_dir}")"
+  [[ "${dir_mode}" == "700" ]] || fail "${label}所在目录权限必须是 0700: ${file_dir}"
+  dir_owner="$(stat -c '%u' "${file_dir}")"
+  [[ "${dir_owner}" == "${EUID}" ]] || fail "${label}所在目录必须归当前 Jenkins 执行用户所有。"
+  file_mode="$(stat -c '%a' "${file}")"
+  [[ "${file_mode}" == "600" ]] || fail "${label}权限必须是 0600: ${file}"
+  file_owner="$(stat -c '%u' "${file}")"
+  [[ "${file_owner}" == "${EUID}" ]] || fail "${label}必须归当前 Jenkins 执行用户所有。"
+  canonical_file="$(realpath -e "${file}")"
   canonical_source="$(realpath -e "${SOURCE_DIR}")"
-  [[ "${canonical_secrets}" != "${canonical_source}"/* ]] || \
-    fail "预览 secrets 文件不能位于目标分支源码上下文内。"
+  [[ "${canonical_file}" != "${canonical_source}"/* ]] || \
+    fail "${label}不能位于目标分支源码上下文内。"
+}
+
+validate_preview_secrets_file() {
+  validate_preview_input_file "${PREVIEW_SECRETS_FILE}" '预览 secrets 文件'
+  validate_preview_input_file "${PREVIEW_ENV_LOCAL_FILE}" '预览 .env.local 文件'
   PREVIEW_SECRETS_SHA256="$(sha256sum "${PREVIEW_SECRETS_FILE}")"
   PREVIEW_SECRETS_SHA256="${PREVIEW_SECRETS_SHA256%% *}"
   [[ "${PREVIEW_SECRETS_SHA256}" =~ ^[0-9a-f]{64}$ ]] || fail "无法计算预览 secrets 文件摘要。"
+  PREVIEW_ENV_LOCAL_SHA256="$(sha256sum "${PREVIEW_ENV_LOCAL_FILE}")"
+  PREVIEW_ENV_LOCAL_SHA256="${PREVIEW_ENV_LOCAL_SHA256%% *}"
+  [[ "${PREVIEW_ENV_LOCAL_SHA256}" =~ ^[0-9a-f]{64}$ ]] || fail "无法计算预览 .env.local 文件摘要。"
 }
 
 remove_project_resources() {
@@ -298,6 +314,8 @@ compose() {
     GENARRATIVE_PREVIEW_CONTROLLER_ROOT="${SCRIPT_ROOT}/.." \
     GENARRATIVE_PREVIEW_SECRETS_FILE="${PREVIEW_SECRETS_FILE}" \
     GENARRATIVE_PREVIEW_SECRETS_SHA256="${PREVIEW_SECRETS_SHA256}" \
+    GENARRATIVE_PREVIEW_ENV_LOCAL_FILE="${PREVIEW_ENV_LOCAL_FILE}" \
+    GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256="${PREVIEW_ENV_LOCAL_SHA256}" \
     GENARRATIVE_CONTAINER_API_ENV_FILE="${STATE_DIR}/api-server.env" \
     GENARRATIVE_CONTAINER_HTTP_PORT="${WEB_PORT}" \
     GENARRATIVE_CONTAINER_SPACETIME_PORT="${SPACETIME_PORT}" \
@@ -319,18 +337,24 @@ services:
       dockerfile: ${GENARRATIVE_PREVIEW_CONTROLLER_ROOT}/deploy/container/api-server.Dockerfile
       args:
         GENARRATIVE_PREVIEW_SECRETS_SHA256: ${GENARRATIVE_PREVIEW_SECRETS_SHA256}
+        GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256: ${GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256}
       secrets:
         - source: preview_runtime_env
           target: genarrative_preview_secrets
+        - source: preview_runtime_env_local
+          target: genarrative_preview_env_local
   external-generation-worker:
     build:
       context: ${GENARRATIVE_PREVIEW_SOURCE_DIR}
       dockerfile: ${GENARRATIVE_PREVIEW_CONTROLLER_ROOT}/deploy/container/api-server.Dockerfile
       args:
         GENARRATIVE_PREVIEW_SECRETS_SHA256: ${GENARRATIVE_PREVIEW_SECRETS_SHA256}
+        GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256: ${GENARRATIVE_PREVIEW_ENV_LOCAL_SHA256}
       secrets:
         - source: preview_runtime_env
           target: genarrative_preview_secrets
+        - source: preview_runtime_env_local
+          target: genarrative_preview_env_local
     restart: on-failure
   nginx:
     build:
@@ -344,6 +368,8 @@ services:
 secrets:
   preview_runtime_env:
     file: ${GENARRATIVE_PREVIEW_SECRETS_FILE}
+  preview_runtime_env_local:
+    file: ${GENARRATIVE_PREVIEW_ENV_LOCAL_FILE}
 YAML
   chmod 0600 "${override_file}"
 }