From 6d8bea70defa78081c4b5d64eff2bc5738df139e Mon Sep 17 00:00:00 2001 From: pikastech Date: Tue, 21 Jul 2026 10:43:38 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=94=B6=E6=95=9B=20HWLAB=20Argo=20?= =?UTF-8?q?=E8=87=AA=E5=8A=A8=E5=90=8C=E6=AD=A5=E5=A3=B0=E6=98=8E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .agents/skills/unidesk-cicd/SKILL.md | 5 +++++ config/platform-infra/pipelines-as-code.yaml | 7 +++++++ .../platform-infra-pipelines-as-code-bootstrap.test.ts | 8 ++++++++ 3 files changed, 20 insertions(+) diff --git a/.agents/skills/unidesk-cicd/SKILL.md b/.agents/skills/unidesk-cicd/SKILL.md index a984f3f7..4891e52c 100644 --- a/.agents/skills/unidesk-cicd/SKILL.md +++ b/.agents/skills/unidesk-cicd/SKILL.md @@ -74,6 +74,11 @@ bun scripts/cli.ts hwlab nodes control-plane legacy-cicd --help - artifact catalog 必须从 owning YAML 声明、且与 Argo/promotion 相同的 GitOps read URL 与 branch 恢复；禁止用 source mirror 中的同名 branch 代替 GitOps authority； - 审阅通过后运行 `release trigger --confirm`；该命令只向 PaC 发送 webhook，由 PaC 创建 PipelineRun； - 禁止裸创建 PipelineRun、由 CLI 直建 PipelineRun，或恢复 Gitea 自动 hook； + - PaC migrated consumer 的 Argo downstream： + - owning YAML 的 `argoBootstrap` 必须声明 GitOps repo、branch、path、namespace 与 `automated=true`； + - Argo 只自动消费手动 PipelineRun 生成的 GitOps commit，不构成第二发布触发入口； + - 配置缺失或漂移时先通过 bootstrap dry-run/confirm 收敛控制面，再由新的 plan/trigger 验收； + - 禁止人工 Argo sync。 - L3 继续要求对应 L2 已通过和用户对当次生产发布的明确授权。 - 每次修改发布入口后，必须复核 `pipelines-as-code --help`、`release --help`、`release plan --help`、`release trigger --help` 与一条动态 `next`：帮助必须完整展示 plan/trigger 的参数、范围审阅字段和 `--confirm` 边界；动态 `next` 只能在范围准确时指向 trigger，范围扩大或触发失败时必须指向修复后重新 plan，不得遗漏或引导自动交付。 - release plan 的 changed paths、domain plan 和 webhook payload 等可增长结构化数据必须通过临时文件或 stdin 传递，禁止放入环境变量或命令行参数；默认/`--json` 输出必须有界保留 env reuse、build、rollout、affected 与 scopeReview，完整 changed-path 明细只在显式 `--full|--raw` 披露。 diff --git a/config/platform-infra/pipelines-as-code.yaml b/config/platform-infra/pipelines-as-code.yaml index cb054067..1b9107bb 100644 --- a/config/platform-infra/pipelines-as-code.yaml +++ b/config/platform-infra/pipelines-as-code.yaml @@ -1079,3 +1079,10 @@ templates: deliveryObservation: runtimeEvidence: required closeoutGitOpsMirrorFlush: true + argoBootstrap: + project: hwlab-v03 + repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git + targetRevision: v0.3-gitops + path: "deploy/gitops/node/${nodeLower}/runtime-v03" + destinationNamespace: hwlab-v03 + automated: true diff --git a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts index 465621a3..40369310 100644 --- a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts +++ b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts @@ -95,6 +95,14 @@ test("HWLAB v0.3 and production share one NC01 PaC Repository while keeping lane expect(development?.repositoryRef).toBe("hwlab-nc01-v03"); expect(production?.repositoryRef).toBe("hwlab-nc01-v03"); expect((nc01Repositories[0]?.params as Record).source_branch).toBe("v0.3"); + expect(development?.argoBootstrap).toEqual({ + project: "hwlab-v03", + repoUrl: "http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git", + targetRevision: "v0.3-gitops", + path: "deploy/gitops/node/nc01/runtime-v03", + destinationNamespace: "hwlab-v03", + automated: true, + }); expect((production?.params as Record).source_branch).toBe("release"); expect((production?.params as Record).gitops_branch).toBe("release-gitops"); expect((production?.params as Record).pipeline_name).toBe("hwlab-nc01-production-ci-image-publish");