From 256840b3e95f3e1a3a982fa50c51c2ebe5eed964 Mon Sep 17 00:00:00 2001
From: pikastech <liang6516@outlook.com>
Date: Tue, 21 Jul 2026 15:59:55 +0200
Subject: [PATCH] =?UTF-8?q?fix(temporal):=20=E8=A1=A5=E9=BD=90=20exact-sou?=
 =?UTF-8?q?rce=20=E8=BF=90=E8=A1=8C=E8=AF=81=E6=8D=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../publish-platform-infra-temporal-gitops.ts |  3 ++-
 scripts/src/platform-infra-temporal.ts        | 20 +++++++++++++------
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/scripts/native/cicd/publish-platform-infra-temporal-gitops.ts b/scripts/native/cicd/publish-platform-infra-temporal-gitops.ts
index 7536b4c3..4a233c3d 100644
--- a/scripts/native/cicd/publish-platform-infra-temporal-gitops.ts
+++ b/scripts/native/cicd/publish-platform-infra-temporal-gitops.ts
@@ -28,9 +28,10 @@ const temporal = readTemporalConfig();
 if (!temporal.delivery.enabled) throw new Error("config/platform-infra/temporal.yaml#delivery.enabled must be true");
 const target = temporal.targets.find((item) => item.id === temporal.defaults.targetId && item.enabled);
 if (target === undefined) throw new Error("Temporal default delivery target is not enabled");
-const manifest = renderTemporalGitOpsManifest(temporal, target);
+const manifest = renderTemporalGitOpsManifest(temporal, target, sourceCommit);
 if (manifest.includes("kind: Secret")) throw new Error("GitOps manifest must not contain Secret payloads");
 if (!manifest.includes("kind: Deployment") || !manifest.includes("kind: Service")) throw new Error("Temporal GitOps renderer did not produce workloads");
+if (!manifest.includes(`unidesk.ai/source-commit: ${sourceCommit}`)) throw new Error("Temporal GitOps renderer did not preserve exact source identity");
 if (dryRun) {
   console.log(JSON.stringify({ ok: true, mutation: false, mode: "dry-run", sourceCommit, branch: temporal.delivery.gitops.branch, manifestPath: temporal.delivery.gitops.manifestPath, objectCount: manifest.split("\n---\n").length, secretValuesPrinted: false, valuesPrinted: false }));
   process.exit(0);
diff --git a/scripts/src/platform-infra-temporal.ts b/scripts/src/platform-infra-temporal.ts
index 270cb9ad..cde2f20c 100644
--- a/scripts/src/platform-infra-temporal.ts
+++ b/scripts/src/platform-infra-temporal.ts
@@ -240,11 +240,18 @@ async function observe(
   };
 }
 
-export function renderTemporalGitOpsManifest(temporal: TemporalConfig, target: TemporalTarget): string {
-  return renderManifest(temporal, target, null, false);
+export function renderTemporalGitOpsManifest(temporal: TemporalConfig, target: TemporalTarget, sourceCommit: string): string {
+  if (!/^[0-9a-f]{40}$/u.test(sourceCommit)) throw new Error("sourceCommit must be a full Git commit SHA");
+  return renderManifest(temporal, target, null, false, sourceCommit);
 }
 
-function renderManifest(temporal: TemporalConfig, target: TemporalTarget, material: DatabaseMaterial | null, includeDatabaseSecret = true): string {
+function renderManifest(
+  temporal: TemporalConfig,
+  target: TemporalTarget,
+  material: DatabaseMaterial | null,
+  includeDatabaseSecret = true,
+  sourceCommit: string | null = null,
+): string {
   const server = temporal.runtime.server;
   const ui = temporal.runtime.ui;
   const secretData = material === null
@@ -252,6 +259,7 @@ function renderManifest(temporal: TemporalConfig, target: TemporalTarget, materi
     : material;
   const encoded = (value: string) => Buffer.from(value, "utf8").toString("base64");
   const namespace = target.namespace;
+  const sourceIdentityLabel = sourceCommit === null ? "" : `\n        unidesk.ai/source-commit: ${sourceCommit}`;
   const logicalNamespaceCommands = temporal.runtime.logicalNamespaces.map((item) => `
               if ! temporal operator namespace describe --address ${server.serviceName}:${server.frontendPort} --namespace ${item.name} >/dev/null 2>&1; then
                 temporal operator namespace create --address ${server.serviceName}:${server.frontendPort} --namespace ${item.name} --retention ${item.retention}
@@ -308,7 +316,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: temporal
-        app.kubernetes.io/part-of: temporal
+        app.kubernetes.io/part-of: temporal${sourceIdentityLabel}
     spec:
       enableServiceLinks: ${server.enableServiceLinks}
       shareProcessNamespace: ${server.shareProcessNamespace}
@@ -395,7 +403,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: temporal-ui
-        app.kubernetes.io/part-of: temporal
+        app.kubernetes.io/part-of: temporal${sourceIdentityLabel}
     spec:
       enableServiceLinks: ${ui.enableServiceLinks}
       containers:
@@ -485,7 +493,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: temporal-logical-namespaces
-        app.kubernetes.io/part-of: temporal
+        app.kubernetes.io/part-of: temporal${sourceIdentityLabel}
     spec:
       restartPolicy: Never
       containers: