补齐 API 发布 checksum 入包

部署脚本将 api-server 与 Pingora checksum 一起复制到 current release

部署自测覆盖 current release checksum 自审依赖

同步 Pingora 正式发布链路文档和共享排障记忆

scripts/check-production-api-deploy.mjs

@@ -157,6 +157,10 @@ function assertDeployCopiesPingoraDirectReleaseDependencies() {
     path.join(releaseDir, 'release-manifest.api-server.json'),
     'current release 必须包含 API release manifest 副本。',
   );
+  assertFileExists(
+    path.join(releaseDir, 'api-server.sha256'),
+    'current release 必须包含 api-server checksum，供随包 current release 自审校验。',
+  );
   assertFileExists(
     path.join(releaseDir, 'deploy/systemd/genarrative-pingora-gateway.service'),
     'current release 必须包含 systemd 主 service 模板。',
@@ -254,6 +258,10 @@ function assertDeployRestartsActivePingoraWhenArtifactIncluded() {
     path.join(releaseDir, 'pingora-gateway'),
     '包含 Pingora 的发布包部署后 current release 必须包含网关二进制。',
   );
+  assertFileExists(
+    path.join(releaseDir, 'pingora-gateway.sha256'),
+    '包含 Pingora 的发布包部署后 current release 必须包含网关 checksum。',
+  );
 
   const commandsLog = readFileSync(fixture.commandsLog, 'utf8');
   assertIncludes(

scripts/deploy/production-api-deploy.sh

@@ -598,9 +598,11 @@ mkdir -p "${RELEASE_ROOT}"
 mkdir "${STAGING_RELEASE_DIR}"
 RELEASE_CONTENT_DIR="${STAGING_RELEASE_DIR}"
 cp "${SOURCE_DIR}/api-server" "${RELEASE_CONTENT_DIR}/api-server"
+cp "${SOURCE_DIR}/api-server.sha256" "${RELEASE_CONTENT_DIR}/api-server.sha256"
 chmod +x "${RELEASE_CONTENT_DIR}/api-server"
 if [[ -f "${SOURCE_DIR}/pingora-gateway" ]]; then
   cp "${SOURCE_DIR}/pingora-gateway" "${RELEASE_CONTENT_DIR}/pingora-gateway"
+  cp "${SOURCE_DIR}/pingora-gateway.sha256" "${RELEASE_CONTENT_DIR}/pingora-gateway.sha256"
   chmod +x "${RELEASE_CONTENT_DIR}/pingora-gateway"
   echo "[production-api-deploy] 已复制 Pingora 影子网关；current 链接切换后将复核并重启已运行的 ${PINGORA_SERVICE_NAME}"
 fi