修复Jenkins Web构建npm版本漂移

新增 Jenkins 用户级 npm 10.9.7 版本隔离引导
在 Web Build 各独立 shell 复用固定 npm 后执行 workspace 安装与门禁
收紧生产运维检查并同步 npm workspaces 文档与共享决策

scripts/check-production-ops-guardrails.mjs

@@ -7582,6 +7582,10 @@ const webBuildContent = readFileSync(
   'jenkins/Jenkinsfile.production-web-build',
   'utf8',
 );
+const webNpmPrepareContent = readFileSync(
+  'scripts/jenkins-prepare-npm-env.sh',
+  'utf8',
+);
 const webBuildStageOffset = webBuildContent.indexOf("stage('Build Web')");
 const webArchiveStageOffset = webBuildContent.indexOf(
   "stage('Archive')",
@@ -7592,7 +7596,13 @@ const webBuildStageContent =
     ? webBuildContent.slice(webBuildStageOffset, webArchiveStageOffset)
     : '';
 const webNpmCiBlock = `if (params.RUN_NPM_CI) {
-            sh 'bash -lc "npm ci"'
+            sh '''
+              bash -lc '
+                set -euo pipefail
+                source scripts/jenkins-prepare-npm-env.sh
+                npm ci
+              '
+            '''
           }`;
 const webNpmCiBlockOffset = webBuildStageContent.indexOf(webNpmCiBlock);
 const webTestOffset = webBuildStageContent.indexOf('npm run test');
@@ -7600,18 +7610,31 @@ const webNpmCiCalls = webBuildStageContent.match(/\bnpm ci(?:\s|["'])/gu);
 const webNpmVersionCheckOffset = webBuildStageContent.indexOf(
   'actual_npm_version="$(npm --version)"',
 );
+const webNpmPrepareOffset = webBuildStageContent.indexOf(
+  'source scripts/jenkins-prepare-npm-env.sh',
+);
+const webNpmPrepareCalls = webBuildStageContent.match(
+  /source scripts\/jenkins-prepare-npm-env\.sh/gu,
+);
 if (
   !webBuildContent.includes("GENARRATIVE_NPM_VERSION = '10.9.7'") ||
+  !webNpmPrepareContent.includes(
+    '"${bootstrap_npm}" install --global --prefix "${npm_prefix}" "npm@${expected_version}" --ignore-scripts --no-audit --no-fund',
+  ) ||
+  !webNpmPrepareContent.includes('export PATH="${npm_prefix}/bin:${PATH}"') ||
+  webNpmPrepareOffset < 0 ||
   webNpmVersionCheckOffset < 0 ||
+  webNpmPrepareOffset >= webNpmVersionCheckOffset ||
   webNpmCiBlockOffset < 0 ||
   webTestOffset < 0 ||
   webNpmVersionCheckOffset >= webNpmCiBlockOffset ||
   webNpmCiBlockOffset >= webTestOffset ||
+  (webNpmPrepareCalls?.length ?? 0) !== 3 ||
   (webNpmCiCalls?.length ?? 0) !== 1
 ) {
   failed = true;
   console.error(
-    '[check:production-ops] Web Build 必须先精确校验 npm 10.9.7，再在 RUN_NPM_CI 条件块内按根 workspace lockfile 执行唯一一次 npm ci，并在 npm run test 前完成；RUN_NPM_CI=false 时必须跳过该安装。',
+    '[check:production-ops] Web Build 必须先为每个独立 shell 准备并加载 npm 10.9.7，再精确校验版本，然后在 RUN_NPM_CI 条件块内按根 workspace lockfile 执行唯一一次 npm ci，并在 npm run test 前完成；RUN_NPM_CI=false 时必须跳过该安装。',
   );
 }
 

scripts/jenkins-prepare-npm-env.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+expected_version="${GENARRATIVE_NPM_VERSION:?GENARRATIVE_NPM_VERSION 不能为空}"
+if [[ ! "${expected_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "[jenkins-npm] 非法 npm 版本: ${expected_version}" >&2
+  return 1 2>/dev/null || exit 1
+fi
+
+if [[ -n "${GENARRATIVE_JENKINS_NPM_PREFIX:-}" ]]; then
+  npm_prefix="${GENARRATIVE_JENKINS_NPM_PREFIX}"
+else
+  npm_home="${HOME:?HOME 不能为空}"
+  npm_prefix="${npm_home}/.local/share/genarrative/npm-${expected_version}"
+fi
+
+pinned_npm="${npm_prefix}/bin/npm"
+actual_version=""
+if [[ -x "${pinned_npm}" ]]; then
+  actual_version="$("${pinned_npm}" --version 2>/dev/null || true)"
+fi
+
+if [[ "${actual_version}" != "${expected_version}" ]]; then
+  bootstrap_npm="$(command -v npm || true)"
+  if [[ -z "${bootstrap_npm}" ]]; then
+    echo "[jenkins-npm] 缺少用于引导固定版本的 npm" >&2
+    return 1 2>/dev/null || exit 1
+  fi
+
+  echo "[jenkins-npm] 准备 npm ${expected_version} (bootstrap=${bootstrap_npm})"
+  mkdir -p "${npm_prefix}"
+  "${bootstrap_npm}" install --global --prefix "${npm_prefix}" "npm@${expected_version}" --ignore-scripts --no-audit --no-fund
+fi
+
+export PATH="${npm_prefix}/bin:${PATH}"
+actual_version="$(npm --version)"
+if [[ "${actual_version}" != "${expected_version}" ]]; then
+  echo "[jenkins-npm] npm 版本不匹配：期望 ${expected_version}，实际 ${actual_version}" >&2
+  return 1 2>/dev/null || exit 1
+fi
+
+echo "[jenkins-npm] npm=$(command -v npm) version=${actual_version}"