Merge branch 'master' into feat/video-BGfilter

scripts/check-production-api-deploy.mjs

@@ -39,6 +39,7 @@ function main() {
   assertDeployRestartsActivePingoraWhenArtifactIncluded();
   assertDeployStartsInactivePingoraWhenArtifactIncluded();
   assertDeployRejectsPingoraDirectEntryWhenArtifactIncluded();
+  assertDeployStopsAfterPingoraSystemdReadFailure();
   assertDeployRejectsPingoraPublicListenWhenArtifactIncluded();
   assertDeployRejectsPingoraArtifactMissingManifestEntry();
   assertDeployRejectsPingoraManifestEntryMissingArtifact();
@@ -416,6 +417,24 @@ function assertDeployRejectsPingoraDirectEntryWhenArtifactIncluded() {
     'Pingora systemd 已包含 CAP_NET_BIND_SERVICE',
     'direct-entry capability 存在时必须给出明确错误。',
   );
+  if (
+    result.stderr.includes(
+      'Pingora systemd 配置缺少包含 GENARRATIVE_PINGORA_GATEWAY_LISTEN 的 EnvironmentFile',
+    )
+  ) {
+    failures.push(
+      'direct-entry capability 已被识别后不应继续误报 Pingora EnvironmentFile 缺失。',
+    );
+  }
+  if (
+    result.stderr.includes(
+      'Pingora 自动启动只允许 shadow 监听 127.0.0.1:18081',
+    )
+  ) {
+    failures.push(
+      'direct-entry capability 已被识别后不应继续用空 env 误报 shadow listen。',
+    );
+  }
   const commandsLog = readOptionalCommandsLog(fixture);
   if (
     commandsLog.includes(
@@ -431,6 +450,47 @@ function assertDeployRejectsPingoraDirectEntryWhenArtifactIncluded() {
   );
 }
 
+function assertDeployStopsAfterPingoraSystemdReadFailure() {
+  const fixture = prepareFixture('with-unreadable-pingora-systemd');
+  addPingoraGatewayArtifact(fixture);
+  const result = runDeploy(fixture, { pingoraSystemctlCatFails: true });
+
+  if (result.status === 0) {
+    failures.push('包含 Pingora 但无法读取 systemd 最终配置时部署必须失败。');
+  }
+  assertIncludes(
+    result.stderr,
+    '无法读取 Pingora systemd 最终配置',
+    'systemctl cat 失败时必须保留权威错误。',
+  );
+  if (
+    result.stderr.includes(
+      'Pingora systemd 配置缺少包含 GENARRATIVE_PINGORA_GATEWAY_LISTEN 的 EnvironmentFile',
+    )
+  ) {
+    failures.push(
+      'systemctl cat 失败后不应继续误报 Pingora EnvironmentFile 缺失。',
+    );
+  }
+  if (
+    result.stderr.includes(
+      'Pingora 自动启动只允许 shadow 监听 127.0.0.1:18081',
+    )
+  ) {
+    failures.push('systemctl cat 失败后不应继续用空 env 误报 shadow listen。');
+  }
+  const commandsLog = readOptionalCommandsLog(fixture);
+  if (
+    commandsLog.includes(
+      'systemctl restart genarrative-pingora-gateway.service',
+    )
+  ) {
+    failures.push('systemctl cat 失败后不能自动 restart Pingora。');
+  }
+  assertMaintenanceCleared(fixture, '读取 Pingora systemd 配置失败');
+  assertNoReleasePromoted(fixture, '读取 Pingora systemd 配置失败时');
+}
+
 function assertDeployRejectsPingoraPublicListenWhenArtifactIncluded() {
   const fixture = prepareFixture('with-public-listen-pingora-artifact');
   addPingoraGatewayArtifact(fixture);
@@ -1414,6 +1474,9 @@ function prepareFixture(name) {
       'worker_state_file="${FAKE_WORKER_STATE_FILE}"',
       'pingora_state_file="${FAKE_PINGORA_STATE_FILE}"',
       'if [[ "$1" == "cat" && "${2:-}" == "genarrative-pingora-gateway.service" ]]; then',
+      '  if [[ "${FAKE_PINGORA_SYSTEMCTL_CAT_FAIL:-false}" == "true" ]]; then',
+      '    exit 1',
+      '  fi',
       '  printf "[Service]\\n"',
       '  printf "EnvironmentFile=%s\\n" "${FAKE_PINGORA_ENV_FILE}"',
       '  printf "ExecStart=/opt/genarrative/current/pingora-gateway\\n"',
@@ -1616,6 +1679,8 @@ function runDeploy(fixture, options = {}) {
         FAKE_PINGORA_ACTIVE: options.pingoraActive === false ? 'false' : 'true',
         FAKE_PINGORA_DIRECT_ENTRY:
           options.pingoraDirectEntry === true ? 'true' : 'false',
+        FAKE_PINGORA_SYSTEMCTL_CAT_FAIL:
+          options.pingoraSystemctlCatFails === true ? 'true' : 'false',
         FAKE_PINGORA_ENV_FILE: fixture.pingoraEnvFile,
         FAKE_PINGORA_STATE_FILE: fixture.pingoraStateFile,
         FAKE_CURL_FAIL: options.curlFails === true ? 'true' : 'false',

scripts/deploy/production-api-deploy.sh

@@ -319,19 +319,25 @@ extract_pingora_env_files_from_unit() {
 
 find_pingora_gateway_env_file() {
   local service_name="$1"
-  local env_file listen
+  local env_file listen unit_env_files
 
-  while IFS= read -r env_file; do
-    if [[ "${env_file}" != /* ]]; then
-      echo "[production-api-deploy] Pingora EnvironmentFile 必须使用绝对路径: ${env_file}" >&2
-      exit 1
-    fi
-    listen="$(read_env_value "${env_file}" "GENARRATIVE_PINGORA_GATEWAY_LISTEN")"
-    if [[ -n "${listen}" ]]; then
-      printf "%s\n" "${env_file}"
-      return
-    fi
-  done < <(extract_pingora_env_files_from_unit "${service_name}")
+  if ! unit_env_files="$(extract_pingora_env_files_from_unit "${service_name}")"; then
+    return 1
+  fi
+
+  if [[ -n "${unit_env_files}" ]]; then
+    while IFS= read -r env_file; do
+      if [[ "${env_file}" != /* ]]; then
+        echo "[production-api-deploy] Pingora EnvironmentFile 必须使用绝对路径: ${env_file}" >&2
+        exit 1
+      fi
+      listen="$(read_env_value "${env_file}" "GENARRATIVE_PINGORA_GATEWAY_LISTEN")"
+      if [[ -n "${listen}" ]]; then
+        printf "%s\n" "${env_file}"
+        return
+      fi
+    done <<< "${unit_env_files}"
+  fi
 
   echo "[production-api-deploy] Pingora systemd 配置缺少包含 GENARRATIVE_PINGORA_GATEWAY_LISTEN 的 EnvironmentFile: ${service_name}" >&2
   exit 1
@@ -363,7 +369,9 @@ check_pingora_shadow_service_config() {
   local service_name="$1"
   local env_file
 
-  env_file="$(find_pingora_gateway_env_file "${service_name}")"
+  if ! env_file="$(find_pingora_gateway_env_file "${service_name}")"; then
+    return 1
+  fi
   require_pingora_shadow_env "${env_file}"
   printf "%s\n" "${env_file}"
 }