fix: 非运行态提交跳过 Todo 发布

scripts/native/cicd/publish-unidesk-host-gitops.mjs

@@ -37,10 +37,47 @@ function safeManifestPath(value) {
   return path;
 }
 
+function safeReleaseStatePath(value) {
+  const path = required(value, "delivery.gitops.releaseStatePath");
+  if (path.startsWith("/") || path.split("/").includes("..")) throw new Error("delivery.gitops.releaseStatePath must be a safe relative path");
+  return path;
+}
+
+function releaseValue(releaseDir, name) {
+  return required(readFileSync(resolve(releaseDir, name), "utf8").trim(), `${releaseDir}/${name}`);
+}
+
+function removeFile(path) {
+  try {
+    unlinkSync(path);
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+}
+
+function readReleaseState(path, serviceRef) {
+  let value;
+  try {
+    value = record(JSON.parse(readFileSync(path, "utf8")), path);
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+  if (value.kind !== "UniDeskHostReleaseState") throw new Error(`${path}.kind must be UniDeskHostReleaseState`);
+  if (value.serviceRef !== serviceRef) throw new Error(`${path}.serviceRef must match delivery.serviceRef`);
+  const sourceCommit = required(value.sourceCommit, `${path}.sourceCommit`);
+  const digest = required(value.digest, `${path}.digest`);
+  const digestRef = required(value.digestRef, `${path}.digestRef`);
+  if (!/^[0-9a-f]{40}$/u.test(sourceCommit)) throw new Error(`${path}.sourceCommit must be a full Git commit SHA`);
+  if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) throw new Error(`${path}.digest must be sha256:<64 hex>`);
+  return { sourceCommit, digest, digestRef };
+}
+
 function main() {
 const configPath = resolve(option("--config") ?? "config/unidesk-host-k8s.yaml");
 const sourceRoot = resolve(option("--source-root") ?? process.cwd());
 const metadataPath = resolve(required(option("--metadata"), "--metadata"));
+const releaseDir = resolve(required(option("--release-dir"), "--release-dir"));
 const sourceCommit = required(option("--source-commit"), "--source-commit");
 const worktree = resolve(option("--worktree") ?? "/workspace/unidesk-host-gitops");
 if (!/^[0-9a-f]{40}$/u.test(sourceCommit)) throw new Error("--source-commit must be a full Git commit SHA");
@@ -49,6 +86,11 @@ const config = record(Bun.YAML.parse(readFileSync(configPath, "utf8")), configPa
 const delivery = record(config.delivery, "delivery");
 if (delivery.enabled !== true && delivery.enabled !== false) throw new Error("delivery.enabled must be boolean");
 const enabled = delivery.enabled === true;
+const action = releaseValue(releaseDir, "action");
+const reason = releaseValue(releaseDir, "reason");
+const baselineSourceCommit = readFileSync(resolve(releaseDir, "baseline-source-commit"), "utf8").trim() || null;
+if (!new Set(["build", "skip", "disabled"]).has(action)) throw new Error(`${releaseDir}/action must be build, skip, or disabled`);
+if ((enabled && action === "disabled") || (!enabled && action !== "disabled")) throw new Error("release action does not match delivery.enabled");
 const serviceRef = required(delivery.serviceRef, "delivery.serviceRef");
 const imageConfig = record(delivery.image, "delivery.image");
 const gitops = record(delivery.gitops, "delivery.gitops");
@@ -57,15 +99,18 @@ const readUrl = required(gitops.readUrl, "delivery.gitops.readUrl");
 const writeUrl = required(gitops.writeUrl, "delivery.gitops.writeUrl");
 const branch = required(gitops.branch, "delivery.gitops.branch");
 const manifestPath = safeManifestPath(gitops.manifestPath);
+const releaseStatePath = safeReleaseStatePath(gitops.releaseStatePath);
 let digest = null;
 let digestRef = null;
 let manifest = null;
+let runtimeSourceCommit = null;
 
-if (enabled) {
+if (action === "build") {
   const metadata = record(JSON.parse(readFileSync(metadataPath, "utf8")), metadataPath);
   digest = required(metadata["containerimage.digest"], `${metadataPath}.containerimage.digest`);
   if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) throw new Error("containerimage.digest must be sha256:<64 hex>");
   digestRef = `${required(imageConfig.repository, "delivery.image.repository")}@${digest}`;
+  runtimeSourceCommit = sourceCommit;
   const render = run("bun", [
     "scripts/native/deploy/render-unidesk-host-service.mjs",
     "--config",
@@ -92,16 +137,30 @@ if (fetched) {
 }
 
 const targetPath = resolve(worktree, manifestPath);
+const statePath = resolve(worktree, releaseStatePath);
 if (!targetPath.startsWith(`${worktree}/`)) throw new Error("resolved manifest path escaped the GitOps worktree");
-if (enabled && manifest !== null) {
+if (!statePath.startsWith(`${worktree}/`)) throw new Error("resolved release state path escaped the GitOps worktree");
+const existingState = readReleaseState(statePath, serviceRef);
+if (action === "skip") {
+  if (existingState === null) throw new Error("skip requires an existing GitOps release state");
+  digest = existingState.digest;
+  digestRef = existingState.digestRef;
+  runtimeSourceCommit = existingState.sourceCommit;
+} else if (action === "build" && manifest !== null) {
   mkdirSync(dirname(targetPath), { recursive: true });
   writeFileSync(targetPath, manifest, "utf8");
+  mkdirSync(dirname(statePath), { recursive: true });
+  writeFileSync(statePath, `${JSON.stringify({
+    version: 1,
+    kind: "UniDeskHostReleaseState",
+    serviceRef,
+    sourceCommit,
+    digest,
+    digestRef,
+  }, null, 2)}\n`, "utf8");
 } else {
-  try {
-    unlinkSync(targetPath);
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw error;
-  }
+  removeFile(targetPath);
+  removeFile(statePath);
 }
 
 run("git", ["config", "user.name", required(author.name, "delivery.gitops.author.name")], worktree);
@@ -109,8 +168,8 @@ run("git", ["config", "user.email", required(author.email, "delivery.gitops.auth
 run("git", ["add", "-A"], worktree);
 const changed = run("git", ["diff", "--cached", "--quiet"], worktree, true).status !== 0;
 if (changed) {
-  const action = enabled ? "deploy" : "remove";
-  run("git", ["commit", "-m", `unidesk-host: ${action} ${serviceRef} ${sourceCommit.slice(0, 12)}`], worktree);
+  const commitAction = action === "build" ? "deploy" : "remove";
+  run("git", ["commit", "-m", `unidesk-host: ${commitAction} ${serviceRef} ${sourceCommit.slice(0, 12)}`], worktree);
 }
 
 run("git", ["remote", "set-url", "origin", writeUrl], worktree);
@@ -139,9 +198,13 @@ const gitopsCommit = head.status === 0 ? head.stdout.trim() : null;
 process.stdout.write(`${JSON.stringify({
   ok: true,
   phase: "gitops-publish",
-  status: enabled ? (changed ? "built" : "reused") : "disabled",
-  imageStatus: enabled ? (changed ? "built" : "reused") : "disabled",
+  action,
+  reason,
+  status: action === "build" ? "built" : action === "skip" ? "skipped" : "disabled",
+  imageStatus: action === "build" ? "built" : action === "skip" ? "skipped" : "disabled",
   sourceCommit,
+  baselineSourceCommit,
+  runtimeSourceCommit,
   digest,
   digestRef,
   gitopsCommit,