fix: 对齐 HWLAB consumer 发布计划信封

.tekton/hwlab-nc01-v03-pac.yaml

@@ -6,7 +6,7 @@ metadata:
   annotations:
     pipelinesascode.tekton.dev/on-event: "[push]"
     pipelinesascode.tekton.dev/on-target-branch: "[v0.3]"
-    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'v0.3' && node == 'NC01'"
+    pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'v0.3' && node == 'NC01' && body.head_commit.message.startsWith('unidesk-release-plan-v1.hwlab-nc01-v03.')"
     pipelinesascode.tekton.dev/max-keep-runs: "8"
     unidesk.ai/owning-config-ref: "config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01"
     unidesk.ai/effective-config-sha256: sha256:f42181ba9c079806968bb8374967a2bc710c7a87b56030d512cc00c004be126b

scripts/ci-plan-identity.test.mjs

@@ -47,11 +47,17 @@ test("reviewed plan admission rejects scope additions before build", () => {
 test("reviewed plan envelope round trips without a second authority", () => {
   const plan = identifiedPlan({ rolloutServices: ["api"], affectedServices: ["api"] });
   const expected = envelope(plan);
-  const encoded = `unidesk-release-plan-v1.${Buffer.from(JSON.stringify(expected)).toString("base64url")}`;
-  assert.deepEqual(decodeReviewedPlan(encoded), expected);
+  const encoded = `unidesk-release-plan-v1.hwlab-nc01-v03.${Buffer.from(JSON.stringify(expected)).toString("base64url")}`;
+  assert.deepEqual(decodeReviewedPlan(encoded, "hwlab-nc01-v03"), expected);
   assert.equal(compareReviewedPlan(expected, plan).ok, true);
 });
 
+test("reviewed plan decoder rejects another consumer", () => {
+  const plan = identifiedPlan({ rolloutServices: ["api"], affectedServices: ["api"] });
+  const encoded = `unidesk-release-plan-v1.hwlab-nc01-production.${Buffer.from(JSON.stringify(envelope(plan))).toString("base64url")}`;
+  assert.throws(() => decodeReviewedPlan(encoded, "hwlab-nc01-v03"), /another consumer/u);
+});
+
 function identifiedPlan(overrides = {}) {
   return attachCiPlanIdentity({
     sourceCommitId: sourceCommit,

scripts/ci/verify-reviewed-plan.mjs

@@ -5,15 +5,17 @@ import { pathToFileURL } from "node:url";
 if (import.meta.url === pathToFileURL(process.argv[1]).href) {
   const args = parseArgs(process.argv.slice(2));
   const actual = JSON.parse(await readFile(args.actualPlan, "utf8"));
-  const expected = decodeReviewedPlan(args.reviewedPlan);
+  const expected = decodeReviewedPlan(args.reviewedPlan, actual?.planIdentity?.inputs?.consumer);
   const result = compareReviewedPlan(expected, actual);
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (!result.ok) process.exit(42);
 }
 
-export function decodeReviewedPlan(value) {
-  const prefix = "unidesk-release-plan-v1.";
-  if (!String(value).startsWith(prefix)) throw new Error("reviewed plan envelope is missing or unsupported");
+export function decodeReviewedPlan(value, consumer) {
+  const normalizedConsumer = text(consumer);
+  if (!normalizedConsumer) throw new Error("actual plan consumer is missing");
+  const prefix = `unidesk-release-plan-v1.${normalizedConsumer}.`;
+  if (!String(value).startsWith(prefix)) throw new Error("reviewed plan envelope is missing, unsupported, or belongs to another consumer");
   const decoded = Buffer.from(String(value).slice(prefix.length), "base64url").toString("utf8");
   const plan = JSON.parse(decoded);
   if (plan?.version !== "v1") throw new Error("reviewed plan version is unsupported");