From a312ee20b5cbdaa312861dab763f82fab45ca718 Mon Sep 17 00:00:00 2001
From: kdletters <kdletters@qq.com>
Date: Sat, 15 Aug 2026 18:17:21 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E9=A2=84=E8=A7=88=E6=B5=81?=
 =?UTF-8?q?=E6=B0=B4=E7=BA=BF=E7=A9=BA=E6=8F=90=E4=BA=A4=E5=8F=82=E6=95=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

允许 Jenkins 检出阶段安全读取未导出的可选参数

显式使用 bash 执行源码检出脚本

增加空提交参数与脚本执行方式防回归检查
---
 jenkins/Jenkinsfile.preview-deployer |  8 ++++----
 scripts/check-preview-deployer.mjs   | 15 +++++++++++++++
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/jenkins/Jenkinsfile.preview-deployer b/jenkins/Jenkinsfile.preview-deployer
index 3f4e5961e..3d187edc4 100644
--- a/jenkins/Jenkinsfile.preview-deployer
+++ b/jenkins/Jenkinsfile.preview-deployer
@@ -93,13 +93,13 @@ pipeline {
           withCredentials([sshUserPrivateKey(credentialsId: env.GIT_REMOTE_CREDENTIAL_ID, keyFileVariable: 'GENARRATIVE_GIT_SSH_KEY')]) {
             sh '''
               set -euo pipefail
-              SOURCE_BRANCH="${SOURCE_BRANCH}" \
-              COMMIT_HASH="${COMMIT_HASH}" \
-              GIT_REMOTE_URL="${GIT_REMOTE_URL}" \
+              SOURCE_BRANCH="${SOURCE_BRANCH:-}" \
+              COMMIT_HASH="${COMMIT_HASH:-}" \
+              GIT_REMOTE_URL="${GIT_REMOTE_URL:-}" \
               SOURCE_COMMIT_FILE=".jenkins-source-commit" \
               GENARRATIVE_JENKINS_REUSE_EXISTING_CHECKOUT="true" \
               GIT_SSH_COMMAND="ssh -i ${GENARRATIVE_GIT_SSH_KEY} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" \
-              "${WORKSPACE}/scripts/jenkins-checkout-source.sh"
+              bash "${WORKSPACE}/scripts/jenkins-checkout-source.sh"
             '''
           }
         }
diff --git a/scripts/check-preview-deployer.mjs b/scripts/check-preview-deployer.mjs
index 32d1b0497..472f472fa 100644
--- a/scripts/check-preview-deployer.mjs
+++ b/scripts/check-preview-deployer.mjs
@@ -70,6 +70,21 @@ assertIncludes(
   'disableConcurrentBuilds()',
   'Jenkins Job 必须禁止并发构建。',
 );
+assertIncludes(
+  jenkinsfile,
+  'COMMIT_HASH="${COMMIT_HASH:-}"',
+  'Jenkins Checkout 阶段必须允许 COMMIT_HASH 未导出或为空。',
+);
+assertIncludes(
+  jenkinsfile,
+  'bash "${WORKSPACE}/scripts/jenkins-checkout-source.sh"',
+  'Jenkins Checkout 阶段必须显式使用 bash 执行源码检出脚本。',
+);
+assertExcludes(
+  jenkinsfile,
+  'COMMIT_HASH="${COMMIT_HASH}"',
+  'Jenkins Checkout 阶段不得在 set -u 下直接展开未导出的 COMMIT_HASH。',
+);
 assertIncludes(deployer, 'flock -x 9', '部署脚本必须使用跨进程独占锁。');
 assertIncludes(
   deployer,