Merge remote-tracking branch 'web/master' into feat/five_min_design

jenkins/Jenkinsfile.production-full-build-and-deploy

@@ -22,7 +22,7 @@ pipeline {
     string(name: 'SOURCE_BRANCH', defaultValue: 'master', description: '源码分支，默认 master 最新提交')
     string(name: 'COMMIT_HASH', defaultValue: '', description: '可选，指定属于 SOURCE_BRANCH 的 Git commit')
     string(name: 'BUILD_VERSION', defaultValue: '', description: '发布版本号，留空则使用 Jenkins BUILD_NUMBER')
-    booleanParam(name: 'RUN_NPM_CI', defaultValue: true, description: 'Web 构建前是否执行 npm ci')
+    booleanParam(name: 'RUN_NPM_CI', defaultValue: true, description: 'Web 构建前是否按根 lockfile 与 AGC 独立 lockfile 执行 npm ci')
     string(name: 'NOTIFICATION_EMAILS', defaultValue: '', description: '本次运行追加通知邮箱；会与 Jenkins Secret Text 凭据 genarrative-notification-emails 合并发送')
     string(name: 'MIGRATION_BOOTSTRAP_SECRET_CREDENTIAL_ID', defaultValue: 'genarrative-spacetime-bootstrap-secret-dev-file', description: '必填：Stdb module 构建与发布共用的 Jenkins Secret File 凭据 ID')
     booleanParam(name: 'INCLUDE_PINGORA_GATEWAY', defaultValue: true, description: 'API release 是否构建、归档并部署 Pingora 影子网关；release 默认必须包含')

jenkins/Jenkinsfile.production-web-build

@@ -22,7 +22,7 @@ pipeline {
     string(name: 'COMMIT_HASH', defaultValue: '', description: '可选，指定属于 SOURCE_BRANCH 的 Git commit')
     string(name: 'BUILD_VERSION', defaultValue: '', description: '发布版本号，留空则使用 Jenkins BUILD_NUMBER')
     string(name: 'NOTIFICATION_EMAILS', defaultValue: '', description: '本次运行追加通知邮箱；会与 Jenkins Secret Text 凭据 genarrative-notification-emails 合并发送')
-    booleanParam(name: 'RUN_NPM_CI', defaultValue: true, description: '构建前是否执行 npm ci')
+    booleanParam(name: 'RUN_NPM_CI', defaultValue: true, description: '构建前是否按根 lockfile 与 AGC 独立 lockfile 执行 npm ci')
     booleanParam(name: 'PUBLISH_AFTER_BUILD', defaultValue: false, description: '构建成功后是否触发 Web 发布')
     string(name: 'DEPLOY_JOB_NAME', defaultValue: 'Genarrative-Web-Deploy', description: 'Web 发布流水线作业名')
     choice(name: 'DEPLOY_TARGET', choices: ['development', 'release'], description: 'PUBLISH_AFTER_BUILD=true 时的逻辑部署目标；development 使用当前 Linux 开发/构建/开发部署 agent')
@@ -91,6 +91,7 @@ pipeline {
         script {
           if (params.RUN_NPM_CI) {
             sh 'bash -lc "npm ci"'
+            sh 'bash -lc "npm ci --prefix apps/ai-game-creator-shell"'
           }
         }
         sh '''

scripts/check-production-ops-guardrails.mjs

@@ -7376,6 +7376,38 @@ if ((fullPipelineMaintenanceHoldCalls?.length ?? 0) !== 2) {
   );
 }
 
+const webBuildContent = readFileSync(
+  'jenkins/Jenkinsfile.production-web-build',
+  'utf8',
+);
+const webBuildStageOffset = webBuildContent.indexOf("stage('Build Web')");
+const webArchiveStageOffset = webBuildContent.indexOf(
+  "stage('Archive')",
+  webBuildStageOffset,
+);
+const webBuildStageContent =
+  webBuildStageOffset >= 0 && webArchiveStageOffset > webBuildStageOffset
+    ? webBuildContent.slice(webBuildStageOffset, webArchiveStageOffset)
+    : '';
+const webNpmCiBlock = `if (params.RUN_NPM_CI) {
+            sh 'bash -lc "npm ci"'
+            sh 'bash -lc "npm ci --prefix apps/ai-game-creator-shell"'
+          }`;
+const webNpmCiBlockOffset = webBuildStageContent.indexOf(webNpmCiBlock);
+const webTestOffset = webBuildStageContent.indexOf('npm run test');
+const webNpmCiCalls = webBuildStageContent.match(/\bnpm ci(?:\s|["'])/gu);
+if (
+  webNpmCiBlockOffset < 0 ||
+  webTestOffset < 0 ||
+  webNpmCiBlockOffset >= webTestOffset ||
+  (webNpmCiCalls?.length ?? 0) !== 2
+) {
+  failed = true;
+  console.error(
+    '[check:production-ops] Web Build 必须在 RUN_NPM_CI 条件块内依次安装根 lockfile 与 apps/ai-game-creator-shell 独立 lockfile，并在 npm run test 前完成；RUN_NPM_CI=false 时两次安装必须一起跳过。',
+  );
+}
+
 const exitMaintenanceStageOffset = fullPipelineContent.indexOf(
   "stage('Exit Maintenance')",
 );