Merge pull request #2756 from pikasTech/fix/2755-migration-job-immutable

fix: 修复外部 PostgreSQL 迁移 Job 不可变漂移

scripts/gitops-render.test.ts

@@ -762,7 +762,10 @@ test("v03 render keeps node identity as data instead of generated structure", as
     assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /uselibpqcompat/u);
     assert.match(externalPostgresMigrationConfig?.data?.["run.mjs"] ?? "", /hwlab-runtime-migration-started/u);
     assert.equal(externalPostgresMigrationConfig?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-2");
-    assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "-1");
+    assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["argocd.argoproj.io/sync-wave"], "1");
+    assert.equal(externalPostgresMigrationJob?.metadata?.annotations?.["hwlab.pikastech.local/migration-contract-version"], "external-postgres-migration-v2");
+    assert.equal(externalPostgresMigrationJob?.metadata?.labels?.["hwlab.pikastech.local/source-commit"], sourceRevision);
+    assert.equal(externalPostgresMigrationJob?.spec?.template?.metadata?.labels?.["hwlab.pikastech.local/source-commit"], undefined);
     assert.equal(
       externalPostgresMigrationJob?.spec?.template?.spec?.containers?.[0]?.image,
       `127.0.0.1:5000/hwlab/hwlab-cloud-api-env@sha256:${"1".repeat(64)}`

scripts/src/gitops-render/runtime-manifests.mjs

@@ -754,6 +754,7 @@ function externalPostgresManifest({ profile = "v03", config, source, deploy = nu
   const migrationData = Object.fromEntries(migrationSources.map((migration) => [path.basename(migration.path), migration.sql]));
   const migrationSha256 = createHash("sha256").update(migrationSources.map((migration) => migration.sql).join("\n")).digest("hex");
   const migrationRunner = externalPostgresMigrationRunner();
+  const migrationContractVersion = "external-postgres-migration-v2";
   const migrationImage = runtimeImageForService({
     catalog,
     deploy,
@@ -764,18 +765,24 @@ function externalPostgresManifest({ profile = "v03", config, source, deploy = nu
     digestPin: true,
     envReuseServiceIds: envReuseServiceIdsForLane(deploy, profile)
   });
-  const executionSha256 = createHash("sha256").update(`${migrationSha256}\n${migrationImage}\n${migrationRunner}`).digest("hex");
+  const executionSha256 = createHash("sha256").update(`${migrationContractVersion}\n${migrationSha256}\n${migrationImage}\n${migrationRunner}`).digest("hex");
   const migrationName = `${namespace}-external-postgres-migrate-${executionSha256.slice(0, 12)}`;
-  const labels = {
+  const stableLabels = {
     "app.kubernetes.io/name": config.serviceName,
     "app.kubernetes.io/part-of": "hwlab",
     "hwlab.pikastech.local/component": "platform-db-bridge",
     "hwlab.pikastech.local/environment": profile,
     "hwlab.pikastech.local/gitops-target": profile,
-    "hwlab.pikastech.local/profile": profile,
+    "hwlab.pikastech.local/profile": profile
+  };
+  const labels = {
+    ...stableLabels,
     "hwlab.pikastech.local/source-commit": source.full
   };
-  const annotations = { "hwlab.pikastech.local/rendered-by": "scripts/gitops-render.mjs" };
+  const annotations = {
+    "hwlab.pikastech.local/rendered-by": "scripts/gitops-render.mjs",
+    "hwlab.pikastech.local/migration-contract-version": migrationContractVersion
+  };
   return {
     apiVersion: "v1",
     kind: "List",
@@ -807,14 +814,14 @@ function externalPostgresManifest({ profile = "v03", config, source, deploy = nu
           labels,
           annotations: {
             ...annotations,
-            "argocd.argoproj.io/sync-wave": "-1",
+            "argocd.argoproj.io/sync-wave": "1",
             "hwlab.pikastech.local/migration-sha256": migrationSha256
           }
         },
         spec: {
           backoffLimit: 2,
           template: {
-            metadata: { labels: { ...labels, "app.kubernetes.io/name": migrationName } },
+            metadata: { labels: { ...stableLabels, "app.kubernetes.io/name": migrationName } },
             spec: {
               restartPolicy: "Never",
               containers: [{