chore: add cicd legacy cleanup precheck

scripts/src/artifact-registry.ts

@@ -71,6 +71,7 @@ const defaultOptions: ArtifactRegistryOptions = {
 };
 const supportedArtifactConsumerServices = ["backend-core", "baidu-netdisk", "decision-center", "frontend"] as const;
 type SupportedArtifactConsumerService = typeof supportedArtifactConsumerServices[number];
+const legacyDeployBackendCoreDisabled = true;
 
 interface ArtifactConsumerSpec {
   serviceId: SupportedArtifactConsumerService;
@@ -1108,6 +1109,20 @@ function deployBackendCoreJob(args: string[], options: ArtifactRegistryOptions):
   };
 }
 
+function legacyDeployBackendCoreResult(options: ArtifactRegistryOptions): Record<string, unknown> {
+  return {
+    ok: false,
+    supported: false,
+    deprecated: true,
+    action: "deploy-backend-core",
+    replacement: "bun scripts/cli.ts deploy apply --env prod --service backend-core --commit <full-sha>",
+    serviceId: "backend-core",
+    environment: options.environment ?? "prod",
+    commit: options.commit,
+    policy: "backend-core production CD must enter through deploy apply --env prod so the standard artifact-consumer guardrails run before any mutation; the legacy artifact-registry deploy-backend-core entry is retained only as a documented compatibility name.",
+  };
+}
+
 function dryRunArtifactConsumerPlan(options: ArtifactRegistryOptions, spec: ArtifactConsumerSpec, target: ArtifactConsumerTarget, commit: string): Record<string, unknown> {
   const environment = options.environment ?? "prod";
   const sourceImage = artifactImageRef(options, spec, commit);
@@ -1458,7 +1473,6 @@ function localHelp(): Record<string, unknown> {
       "bun scripts/cli.ts artifact-registry status [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry health [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry install [--provider-id D601]",
-      "bun scripts/cli.ts artifact-registry deploy-backend-core --commit <full-sha> [--run-now] [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry deploy-service --service baidu-netdisk --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry deploy-service --service frontend --env prod --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry deploy-service --service frontend --env dev --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
@@ -1482,6 +1496,13 @@ function localHelp(): Record<string, unknown> {
       ],
       rollbackShape: "rerun the same artifact consumer with a previous commit-pinned image",
     },
+    legacyEntrypoints: {
+      "deploy-backend-core": {
+        deprecated: true,
+        enabled: !legacyDeployBackendCoreDisabled,
+        replacement: "bun scripts/cli.ts deploy apply --env prod --service backend-core --commit <full-sha>",
+      },
+    },
     defaults: defaultOptions,
   };
 }
@@ -1503,6 +1524,7 @@ export async function runArtifactRegistryCommand(args: string[]): Promise<unknow
   }
   if (action === "deploy-backend-core") {
     if (options.commit === null) throw new Error("artifact-registry deploy-backend-core requires --commit <full-sha>");
+    if (legacyDeployBackendCoreDisabled) return legacyDeployBackendCoreResult(options);
     return options.runNow ? await deployBackendCoreNow(options) : deployBackendCoreJob(args, options);
   }
   if (action === "deploy-service") {

scripts/src/ci.ts

@@ -204,6 +204,9 @@ function requireSupportedUserService(config: UniDeskConfig, serviceId: string):
   }
   const service = config.microservices.find((item) => item.id === serviceId);
   if (service === undefined) throw new Error(`unknown user service: ${serviceId}`);
+  if (service.repository.artifactSource?.kind === "upstream-image") {
+    throw new Error(`ci publish-user-service does not build ${serviceId}: it is an upstream image consumer (${service.repository.artifactSource.imageRef}). Use the upstream-image digest/mirror governance path; do not add it to Dockerfile CI artifacts.`);
+  }
   const isD601K3sService = service.providerId === d601ProviderId
     && service.development.providerId === d601ProviderId
     && service.deployment.mode === "k3sctl-managed";
@@ -1123,7 +1126,7 @@ async function publishBackendCoreArtifact(config: UniDeskConfig, options: CiPubl
     condition,
     next: [
       `bun scripts/cli.ts ci logs ${name}`,
-      `bun scripts/cli.ts artifact-registry deploy-backend-core --commit ${options.commit}`,
+      `bun scripts/cli.ts deploy apply --env prod --service backend-core --commit ${options.commit}`,
     ],
   };
 }
@@ -1473,7 +1476,7 @@ export function ciHelp(): Record<string, unknown> {
     backendCoreArtifact: {
       producer: "D601 CI",
       registry: "127.0.0.1:5000/unidesk/backend-core:<commit>",
-      cdCommand: "bun scripts/cli.ts artifact-registry deploy-backend-core --commit <full-sha>",
+      cdCommand: "bun scripts/cli.ts deploy apply --env prod --service backend-core --commit <full-sha>",
     },
     userServiceArtifact: {
       producer: "D601 CI",

scripts/src/config.ts

@@ -51,6 +51,14 @@ export interface UniDeskMicroserviceConfig {
     url: string;
     commitId: string;
     dockerfile: string;
+    artifactSource?: {
+      kind: "upstream-image";
+      imageRef: string;
+      digestPinRequired: boolean;
+      mirrorRepository: string;
+      ciDockerfileBuild: boolean;
+      pullOnlyCd: boolean;
+    };
     composeFile: string;
     composeService: string;
     containerName: string;
@@ -150,6 +158,22 @@ function stringArrayField(obj: Record<string, unknown>, key: string, path: strin
   return value as string[];
 }
 
+function optionalArtifactSource(repository: Record<string, unknown>, path: string): UniDeskMicroserviceConfig["repository"]["artifactSource"] {
+  const value = repository.artifactSource;
+  if (value === undefined) return undefined;
+  const source = asRecord(value, `${path}.artifactSource`);
+  const kind = stringField(source, "kind", `${path}.artifactSource`);
+  if (kind !== "upstream-image") throw new Error(`${path}.artifactSource.kind must be upstream-image`);
+  return {
+    kind,
+    imageRef: stringField(source, "imageRef", `${path}.artifactSource`),
+    digestPinRequired: booleanField(source, "digestPinRequired", `${path}.artifactSource`),
+    mirrorRepository: stringField(source, "mirrorRepository", `${path}.artifactSource`),
+    ciDockerfileBuild: booleanField(source, "ciDockerfileBuild", `${path}.artifactSource`),
+    pullOnlyCd: booleanField(source, "pullOnlyCd", `${path}.artifactSource`),
+  };
+}
+
 function optionalRestrictedHostAccess(network: Record<string, unknown>): UniDeskConfig["network"]["restrictedHostAccess"] {
   const value = network.restrictedHostAccess;
   if (value === undefined) return undefined;
@@ -182,6 +206,7 @@ function microserviceConfig(item: Record<string, unknown>, index: number): UniDe
       url: stringField(repository, "url", `${path}.repository`),
       commitId: stringField(repository, "commitId", `${path}.repository`),
       dockerfile: stringField(repository, "dockerfile", `${path}.repository`),
+      artifactSource: optionalArtifactSource(repository, `${path}.repository`),
       composeFile: stringField(repository, "composeFile", `${path}.repository`),
       composeService: stringField(repository, "composeService", `${path}.repository`),
       containerName: stringField(repository, "containerName", `${path}.repository`),

scripts/src/deploy.ts

@@ -138,6 +138,7 @@ const d601MaintenanceDeployAllowedServiceIds = new Set<string>(["backend-core",
 const devApplySupportedServiceIds = new Set<string>(["backend-core"]);
 const devArtifactConsumerServiceIds = new Set<string>(["baidu-netdisk", "decision-center", "frontend"]);
 const prodArtifactConsumerServiceIds = new Set<string>(["backend-core", "baidu-netdisk", "decision-center", "frontend"]);
+const prodForbiddenTargetSideBuildServiceIds = prodArtifactConsumerServiceIds;
 const deployEnvironmentTargets: Record<DeployEnvironment, DeployEnvironmentTarget> = {
   dev: {
     environment: "dev",
@@ -2671,6 +2672,23 @@ function prodArtifactUnsupportedResult(services: DeployManifestService[]): Recor
   };
 }
 
+function prodArtifactConsumerLocalManifestResult(services: DeployManifestService[]): Record<string, unknown> {
+  return {
+    ok: false,
+    supported: false,
+    error: "prod-artifact-consumer-local-manifest-blocked",
+    services: services.map((service) => ({
+      id: service.id,
+      repo: service.repo,
+      commitId: service.commitId,
+      supported: true,
+      reason: "This service has a reviewed artifact consumer; production source-build deploy from a local manifest is blocked.",
+    })),
+    policy: "prod artifact consumers must enter through deploy apply --env prod so CD consumes an existing commit-pinned registry image and never falls back to source build or a dirty worktree",
+    commandShape: "bun scripts/cli.ts deploy apply --env prod --service <service-id> --commit <full-sha>",
+  };
+}
+
 async function runArtifactConsumerApplyNow(
   manifest: DeployManifest,
   options: DeployOptions,
@@ -2830,6 +2848,9 @@ export async function runDeployCommand(config: UniDeskConfig | null, args: strin
   if (config === null) throw new Error("deploy local manifest mode requires config.json");
   const manifest = resolveManifestCommits(await readDeployManifest(options.file), options.serviceId);
   if (action === "check" || action === "plan") return await checkOrPlan(config, manifest, options, action);
+  const prodArtifactConsumers = selectedEnvironmentServices(manifest, options.serviceId)
+    .filter((service) => manifest.environment !== "dev" && prodForbiddenTargetSideBuildServiceIds.has(service.id));
+  if (prodArtifactConsumers.length > 0) return prodArtifactConsumerLocalManifestResult(prodArtifactConsumers);
   if (!options.dryRun) {
     const blocked = blockedD601MaintenanceDeployServices(config, manifest, options.serviceId);
     if (blocked.length > 0) throw new Error(d601MaintenanceDeployBlockMessage(blocked));

scripts/src/help.ts

@@ -38,7 +38,7 @@ export function rootHelp(): unknown {
       { command: "decision show <id>", description: "Show one Decision Center record." },
       { command: "deploy check|plan|apply [--file deploy.json|--env dev|prod] [--service id] [--commit full-sha] [--dry-run] [--force]", description: "Reconcile services from a repo+commit manifest; --env reads origin/master:deploy.json environments and can apply supported dev target-side builds plus decision-center's dev artifact consumer, or supported prod artifact consumers." },
       { command: "dev-env validate|prewarm-images", description: "Validate D601 unidesk-dev guardrails or prewarm dev foundation images into native k3s containerd through a bounded async job." },
-      { command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service", description: "Manage the D601 host-managed CNCF Distribution registry and run pull-only artifact CD for supported services, including decision-center dev/prod artifact consumers." },
+      { command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service", description: "Manage the D601 host-managed CNCF Distribution registry and run pull-only artifact CD for supported services; deploy-backend-core is a deprecated compatibility name." },
       { command: "schedule list|get|runs|run|delete", description: "Manage backend-core scheduled tasks and run history; schedule run <id> supports --wait-ms N." },
       { command: "schedule upsert-pgdata-backup [--time HH:MM] [--remote-base /SERVER_DATA/UNIDESK_PG_DATA]", description: "Create or update the daily PGDATA physical backup task that uploads monthly rotated archives to Baidu Netdisk." },
       { command: "codex deploy <commitId> [--provider-id D601] [--timeout-ms N]", description: "Compatibility wrapper for deploy apply --service code-queue with a temporary repo+commit manifest." },
@@ -260,7 +260,6 @@ function artifactRegistryHelp(): unknown {
       "bun scripts/cli.ts artifact-registry status [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry health [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry install [--provider-id D601]",
-      "bun scripts/cli.ts artifact-registry deploy-backend-core --commit <full-sha> [--run-now] [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry deploy-service --service baidu-netdisk --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry deploy-service --service frontend --env prod --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
       "bun scripts/cli.ts artifact-registry deploy-service --service frontend --env dev --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
@@ -271,10 +270,17 @@ function artifactRegistryHelp(): unknown {
       "registry endpoint is D601 loopback 127.0.0.1:5000 only",
       "service is host-managed by systemd + Docker Compose, not k3s-managed",
       "install writes the rendered host unit/config and starts the registry",
-      "deploy-backend-core only pulls commit-pinned backend-core artifacts and does not build backend-core on the master server",
+      "deploy-backend-core is a deprecated compatibility name; use deploy apply --env prod --service backend-core so standard artifact-consumer guardrails run first",
       "deploy-service currently supports backend-core, baidu-netdisk, prod/dev frontend, and decision-center as standardized consumers",
       "status and health use provider-gateway Host SSH readonly checks",
     ],
+    legacyEntrypoints: {
+      "deploy-backend-core": {
+        deprecated: true,
+        enabled: false,
+        replacement: "bun scripts/cli.ts deploy apply --env prod --service backend-core --commit <full-sha>",
+      },
+    },
   };
 }