refactor: remove legacy artifact publish entrypoint

AGENTS.md

@@ -6,7 +6,7 @@ HWLAB 是硬件实验室运行面和控制面项目。本文是 agent、指挥
 
 - G14 是当前 HWLAB DEV/PROD 原生 k8s 与 GitOps 运行面真相；`hwlab-dev` 与 `hwlab-prod` 均由 G14 k3s、Tekton、`G14-gitops` 和 Argo CD 管理，详见 [docs/reference/g14-gitops-cicd.md](docs/reference/g14-gitops-cicd.md)。
 - G14 GitOps render 若改变 Argo Application、AppProject、runtime path 或 DEV/PROD 拆分目录，必须同步应用 `deploy/gitops/g14/argocd/project.yaml`、`application-dev.yaml` 和 `application-prod.yaml`；只推 `G14-gitops` 分支不等于 Argo 已切到新 path。
-- D601 HWLAB DEV、D601 `dev-cd-apply`、`ci-publish` 和旧 `main` JS 脚本式 CI/CD 只作为 legacy 迁移来源和事故参考；新开发、发布、验收、文档和运行面实验不得把 D601 当作当前 HWLAB runtime source-of-truth。
+- D601 HWLAB DEV、D601 `dev-cd-apply`、`ci-publish` 和旧 `main` JS 脚本式 CI/CD 已退出 G14 发布入口；G14 Tekton 只能通过 `scripts/g14-artifact-publish.mjs` 作为集群内 build/push helper，再由 GitOps/Argo CD rollout，新开发、发布、验收、文档和运行面实验不得把 D601 或 legacy 脚本 CD 当作当前 HWLAB runtime source-of-truth。
 - G14 k3s 操作必须通过 UniDesk route `G14:k3s` 执行；不得用 D601 kubeconfig、Docker Desktop Kubernetes、master server 本地 check/build 或旧 JS CD 结果作为 G14 DEV/PROD 通过证据。
 
 ## P0 GitHub Issue 写入纪律
@@ -70,11 +70,10 @@ HWLAB 是硬件实验室运行面和控制面项目。本文是 agent、指挥
 - Cloud Web 构建：`npm run web:build`
 - Cloud Web M3 只读护栏：`npm run web:m3-readonly`
 - Cloud Workbench 布局/遮挡 smoke：`npm run web:layout`；local-build 用 `npm run web:layout:build`；DEV deploy 后用 `npm run web:layout:live`。
-- DEV artifact 发布预检：`npm run dev-artifact:preflight`
-- DEV artifact CI 发布：`node tools/hwlab-cli/bin/hwlab-cli.mjs cicd submit --kind ci-publish --concurrency 4`
+- G14 artifact build helper：`node scripts/g14-artifact-publish.mjs --publish ...`，只能由 G14 Tekton task 携带 CI artifact identity 调用；人工发布走 G14 poller/GitOps，不走 legacy `ci-publish`。
 - G14 GitOps 渲染：`npm run g14:gitops:render`；检查已生成 Tekton/Argo CD manifests：`npm run g14:gitops:check`
 - DEV 依赖 runtime base 构建：`npm run dev-runtime-base:build`
-- DEV CD 单事务发布/应用/验证：`node tools/hwlab-cli/bin/hwlab-cli.mjs cicd submit --kind dev-cd-apply --confirm-dev --confirmed-non-production --concurrency 4`
+- Legacy D601 DEV CD：`dev-cd-apply`/`ci-publish` 仅供迁移事故回放，不作为 G14 DEV/PROD 发布入口。
 - CI/CD job 查询：`node tools/hwlab-cli/bin/hwlab-cli.mjs cicd status|logs|report <jobId>`
 - runner GitHub 可见性预检：`npm run runner:issue-visibility:preflight`
 - D601 k3s 只读观测：legacy 回溯入口，仅在确认需要 D601 事故复盘时使用；当前 G14 运行面观察使用 UniDesk route `G14:k3s`。

CI.json

@@ -8,12 +8,12 @@
       "run": "node scripts/repo-reports-guard.mjs"
     },
     {
-      "name": "contract-check",
-      "run": "npm run check"
+      "name": "g14-contract-check",
+      "run": "node --check scripts/g14-gitops-render.mjs && node scripts/g14-gitops-render.mjs --check && node --check scripts/artifact-publish.mjs && node --check scripts/g14-artifact-publish.mjs"
     },
     {
-      "name": "dev-artifact-publish-static-check",
-      "run": "node --check scripts/dev-artifact-publish.mjs"
+      "name": "g14-artifact-publish-static-check",
+      "run": "node --check scripts/artifact-publish.mjs && node --check scripts/g14-artifact-publish.mjs"
     },
     {
       "name": "parse-deploy-json",

docs/reference/g14-gitops-cicd.md

@@ -18,6 +18,7 @@ G14 是 HWLAB 当前 DEV/PROD 原生 k8s 与 GitOps 运行面目标。G14 CI/CD
 
 - 读取 `CI.json`，生成 Tekton Pipeline 和 PipelineRun 样板。
 - 读取 `deploy/deploy.json` 与 `deploy/k8s/*`，生成 Argo CD 可消费的 G14 runtime Kustomize path。
+- G14 Tekton 的镜像构建发布入口必须是 `scripts/g14-artifact-publish.mjs`；它只是集群内 Task 的 build/push helper，不做 rollout、不写 D601、不获取 legacy DEV CD Lease。旧 `scripts/dev-artifact-publish.mjs` 入口已删除；`dev-cd-apply`、`ci-publish` 和旧 `main` JS CD 入口禁止出现在 G14 Pipeline 生成脚本和 G14 验收证据中。
 - 生成 `hwlab-g14-branch-poller` CronJob：它使用 G14 集群内的 Git SSH Secret 轮询 `G14` 分支，按 source commit 创建确定命名的 Tekton PipelineRun。
 - 生成 `hwlab-g14-control-plane-reconciler` CronJob：它使用同一个 Git SSH Secret 轮询 `G14`，运行 repo 内 `scripts/g14-gitops-render.mjs`，并 server-side apply 生成的 Tekton RBAC、Pipeline、Poller 和 Reconciler manifests；因此 CI 控制面变化应自动进入 G14 k3s，不需要人工长期执行 render/apply。
 - 默认输出到 `deploy/gitops/g14/`。

scripts/artifact-publish.mjs

@@ -26,6 +26,7 @@ import { inspectCloudWebDistFreshness } from "../web/hwlab-cloud-web/scripts/dis
 import { ensureNotRepoReportsPath, tempReportPath } from "./src/report-paths.mjs";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const cliEntrypoint = process.env.HWLAB_ARTIFACT_PUBLISH_ENTRYPOINT || "scripts/artifact-publish.mjs";
 const defaultRegistryPrefix =
   process.env.HWLAB_DEV_REGISTRY_PREFIX || process.env.HWLAB_DEV_REGISTRY || "127.0.0.1:5000/hwlab";
 const defaultBaseImage = process.env.HWLAB_DEV_BASE_IMAGE || null;
@@ -109,9 +110,9 @@ function parseConcurrency(value, fallback) {
 
 function printHelp() {
   console.log([
-    "usage: node scripts/dev-artifact-publish.mjs [--preflight|--build|--publish]",
+    `usage: node ${cliEntrypoint} [--preflight|--build|--publish]`,
     "",
-    "DEV-only artifact workflow for the D601 local/internal registry.",
+    "Commit-pinned artifact build/publish helper for controlled CI execution.",
     "",
     "options:",
     "  --registry-prefix PREFIX  default: 127.0.0.1:5000/hwlab",
@@ -1057,7 +1058,7 @@ async function buildService({ args, repo, commitId, shortCommit, service, buildC
     ["HWLAB_IMAGE_DIGEST", "unknown"],
     ["HWLAB_BUILD_CREATED_AT", buildCreatedAt],
     ["HWLAB_BUILD_SOURCE", buildSource],
-    ["HWLAB_BUILD_PROVENANCE", "scripts/dev-artifact-publish.mjs"],
+    ["HWLAB_BUILD_PROVENANCE", cliEntrypoint],
     ["PORT", String(port)],
     ["HWLAB_PORT", String(port)]
   ];
@@ -1314,11 +1315,11 @@ function createReport({ args, repo, commitId, shortCommit, mode, services, artif
   const builtCount = requiredArtifacts.filter((artifact) => ["built", "published", "published_unverified_digest"].includes(artifact.status)).length;
 
   return {
-    $schema: "https://hwlab.pikastech.local/schemas/dev-artifact-publish.schema.json",
-    $id: "https://hwlab.pikastech.local/dev-cd/dev-artifacts.json",
+    $schema: "https://hwlab.pikastech.local/schemas/artifact-publish.schema.json",
+    $id: "https://hwlab.pikastech.local/g14-cicd/artifacts.json",
     reportVersion: "v1",
     issue: "pikasTech/HWLAB#35",
-    taskId: "dev-artifact-publish",
+    taskId: "g14-artifact-publish",
     commitId: shortCommit,
     acceptanceLevel: "dev_artifact_publish",
     devOnly: true,
@@ -1336,7 +1337,8 @@ function createReport({ args, repo, commitId, shortCommit, mode, services, artif
       summary: "DEV artifact publish evidence for pikasTech/HWLAB#35, stored in the DEV gate report envelope."
     },
     validationCommands: [
-      "node --check scripts/dev-artifact-publish.mjs",
+      "node --check scripts/artifact-publish.mjs",
+      "node --check scripts/g14-artifact-publish.mjs",
       "node --check scripts/src/dev-artifact-services.mjs",
       "node --check scripts/src/registry-capabilities.mjs",
       "node --check scripts/preflight-dev-base-image.mjs",
@@ -1344,7 +1346,7 @@ function createReport({ args, repo, commitId, shortCommit, mode, services, artif
       "node --check scripts/dev-runtime-base-image.mjs",
       "node --test scripts/refresh-artifact-catalog.test.mjs",
       "node scripts/preflight-dev-base-image.mjs",
-      "node scripts/dev-artifact-publish.mjs --preflight --no-report",
+      "node scripts/g14-artifact-publish.mjs --preflight --no-report",
       "node --check scripts/validate-dev-gate-report.mjs",
       "node scripts/validate-dev-gate-report.mjs"
     ],
@@ -1457,7 +1459,7 @@ async function main() {
   }
   if (args.mode === "publish") {
     const identityGuard = requireDevArtifactPublishIdentity({
-      script: "scripts/dev-artifact-publish.mjs",
+      script: cliEntrypoint,
       mode: "--publish"
     });
     if (identityGuard) {

scripts/g14-artifact-publish.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+process.env.HWLAB_ARTIFACT_PUBLISH_ENTRYPOINT ||= "scripts/g14-artifact-publish.mjs";
+process.env.HWLAB_ARTIFACT_PUBLISH_PROFILE ||= "g14";
+await import("./artifact-publish.mjs");

scripts/g14-gitops-render.mjs

@@ -545,7 +545,7 @@ if [ -n "\${HWLAB_DEV_BASE_IMAGE:-}" ]; then
 fi
 cd /workspace/source/repo
 test "$(git rev-parse HEAD)" = "$(params.revision)"
-node scripts/dev-artifact-publish.mjs --publish --registry-prefix "$(params.registry-prefix)" --report /workspace/source/dev-artifacts.json --quiet-build --concurrency "$(params.concurrency)" --services "$(params.services)"
+node scripts/g14-artifact-publish.mjs --publish --registry-prefix "$(params.registry-prefix)" --report /workspace/source/dev-artifacts.json --quiet-build --concurrency "$(params.concurrency)" --services "$(params.services)"
 node scripts/refresh-artifact-catalog.mjs --target-ref HEAD --publish-report /workspace/source/dev-artifacts.json --no-write
 `;
 }

scripts/src/dev-cd-transaction-guard.mjs

@@ -93,8 +93,8 @@ export function devArtifactPublishIdentityGuardFailure({
     mode,
     requiredEnv,
     acceptedEnv: artifactPublishIdentityEnvNames,
-    entrypoint: `HWLAB_CI_ARTIFACT_RUN_ID=<run-id> node scripts/dev-artifact-publish.mjs --publish --report ${tempReportPath("dev-artifacts.json")}`,
-    summary: `${script} ${mode} is a DEV artifact publish side-effect step and must run under CI artifact identity, or the legacy DEV CD transaction path.`,
+    entrypoint: `HWLAB_CI_ARTIFACT_RUN_ID=<run-id> node scripts/artifact-publish.mjs --publish --report ${tempReportPath("dev-artifacts.json")}`,
+    summary: `${script} ${mode} is an artifact publish side-effect step and must run under CI artifact identity.`,
     devOnly: true,
     prodTouched: false,
     cdLockRequired: false,