From 2b385f08f8cc43994eddebd6c514b5206b8c0002 Mon Sep 17 00:00:00 2001 From: Codex Date: Wed, 15 Jul 2026 08:52:20 +0200 Subject: [PATCH] =?UTF-8?q?fix(cicd):=20=E4=BF=9D=E7=95=99=E7=9C=9F?= =?UTF-8?q?=E5=AE=9E=20PaC=20bootstrap=20=E5=A4=B1=E8=B4=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../R4.1.1_Task_Report.md | 11 +++---- ...-infra-pipelines-as-code-bootstrap.test.ts | 6 ++++ ...platform-infra-pipelines-as-code-remote.sh | 33 +++++++------------ 3 files changed, 22 insertions(+), 28 deletions(-) diff --git a/docs/MDTODO/details/pr-merge-driven-automatic-delivery/R4.1.1_Task_Report.md b/docs/MDTODO/details/pr-merge-driven-automatic-delivery/R4.1.1_Task_Report.md index fcc3135b..a6720ec1 100644 --- a/docs/MDTODO/details/pr-merge-driven-automatic-delivery/R4.1.1_Task_Report.md +++ b/docs/MDTODO/details/pr-merge-driven-automatic-delivery/R4.1.1_Task_Report.md @@ -29,14 +29,13 @@ - CEL、marker、creator 与 ServiceAccount； - queue transition、spec/config SHA、版本与 resource epoch； - 默认 RBAC。 -- 上述观察项不再作为以下入口的阻断条件： +- admission/provenance 观察项不再作为以下入口的阻断条件： - 业务 admission 与 bootstrap； - status、history 与 debug； - 外层 PaC delivery eligibility。 -- admission 与 consumer bootstrap 漂移统一输出结构化字段： - - `blocking: false`； - - `warning: true|false`； - - `warnings` / `reasons`。 +- admission 漂移输出结构化 `blocking: false` warning；真实 consumer bootstrap 缺失不降级： + - runner ServiceAccount、RoleBinding 或 Argo repository credential 未就绪时，status 保持 `ok: false`； + - 顶层 status 继续要求 `bootstrap_ready=true`，避免 false green。 - PaC bootstrap 的 `pac-admission` 阶段在 live identity 或 generation 尚未精确收敛时显示 `state: warning`，整体结果仍可成功。 - 外层 GitHub/Gitea PaC push event 继续作为： - 唯一流水线触发； @@ -57,7 +56,7 @@ - `sh -n scripts/src/platform-infra-pipelines-as-code-remote.sh` - `bun test scripts/src/platform-infra-pac-provenance.test.ts scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts` - - 结果：`23 pass, 0 fail, 234 expect()`。 + - 结果：`23 pass, 0 fail, 239 expect()`。 - `node` 调用 `runPacStatusFixtureChecks()`： - 结果：`ok=true, checks=34`。 - `bun scripts/cli.ts platform-infra pipelines-as-code plan --target NC01` diff --git a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts index e2f89a7a..1a31abba 100644 --- a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts +++ b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts @@ -177,6 +177,12 @@ test("PaC apply checks the Gitea repository before dry-run return and cluster mu expect(remote).toContain('"admission":{"applied":%s,"ready":%s}'); expect(remote).toContain('"admissionProvenance":%s'); expect(remote).toContain('"error":"gitea-repository-missing"'); + const statusAction = remote.slice(remote.indexOf("status_action() {"), remote.indexOf("history_action() {")); + expect(statusAction).toContain('[ "$bootstrap_ready" = "true" ]'); + expect(statusAction).toContain("output.code = 'pac-consumer-bootstrap-not-ready'"); + expect(statusAction).toContain("output.ok = false"); + expect(statusAction).toContain("code: 'pac-admission-provenance-not-ready'"); + expect(statusAction).toContain("blocking: false"); }); test("platform bootstrap help advertises the composite entry before low-level apply", async () => { diff --git a/scripts/src/platform-infra-pipelines-as-code-remote.sh b/scripts/src/platform-infra-pipelines-as-code-remote.sh index 13a6a668..dc8ded1c 100644 --- a/scripts/src/platform-infra-pipelines-as-code-remote.sh +++ b/scripts/src/platform-infra-pipelines-as-code-remote.sh @@ -1612,37 +1612,26 @@ NODE const diagnostics = JSON.parse(process.env.UNIDESK_PAC_DIAGNOSTICS || '{}'); const admissionProvenance = JSON.parse(process.env.UNIDESK_PAC_STATE || '{}'); const consumerBootstrap = JSON.parse(process.env.UNIDESK_PAC_BOOTSTRAP_STATE || '{}'); +const output = { ...diagnostics, admissionProvenance, consumerBootstrap, valuesPrinted: false }; if (process.env.UNIDESK_PAC_DELIVERY_PROVENANCE_REQUIRED === '1' && admissionProvenance.ready !== true) { - process.stdout.write(JSON.stringify({ - ...diagnostics, - warnings: [...(Array.isArray(diagnostics.warnings) ? diagnostics.warnings : []), { + output.warnings = [...(Array.isArray(output.warnings) ? output.warnings : []), { code: 'pac-admission-provenance-not-ready', blocking: false, hint: 'PaC admission policy, binding, desired RBAC, or live default-SA observation is drifted; delivery continues', reasons: Array.isArray(admissionProvenance.reasons) ? admissionProvenance.reasons : [], - }], - admissionProvenance, - valuesPrinted: false, - })); -} else if (consumerBootstrap.configured === true && consumerBootstrap.ready !== true) { - process.stdout.write(JSON.stringify({ - ...diagnostics, - warnings: [...(Array.isArray(diagnostics.warnings) ? diagnostics.warnings : []), { - code: 'pac-consumer-bootstrap-not-ready', - blocking: false, - hint: 'declared runner ServiceAccount/RoleBinding or Argo repository credential is missing or drifted; status remains observable', - }], - admissionProvenance, - consumerBootstrap, - valuesPrinted: false, - })); -} else { - process.stdout.write(JSON.stringify({ ...diagnostics, admissionProvenance, consumerBootstrap, valuesPrinted: false })); + }]; } +if (consumerBootstrap.configured === true && consumerBootstrap.ready !== true) { + output.ok = false; + output.code = 'pac-consumer-bootstrap-not-ready'; + output.phase = 'consumer-bootstrap-not-ready'; + output.hint = 'declared runner ServiceAccount/RoleBinding or Argo repository credential is missing or drifted'; +} +process.stdout.write(JSON.stringify(output)); NODE ) printf '{"ok":%s,"crdPresent":%s,"controllerReady":"%s","admissionProvenance":%s,"consumerBootstrap":%s,"repository":{"name":"%s","repo":"%s/%s","url":"%s","condition":"%s"},"repositoryCondition":"%s","webhooks":%s,"pipelineRuns":%s,"taskRuns":%s,"artifact":%s,"argo":%s,"runtime":%s,"diagnostics":%s,"valuesPrinted":false}\n' \ - "$( [ -n "$crd" ] && [ "$controller_ready" != "0/0" ] && echo true || echo false )" \ + "$( [ -n "$crd" ] && [ "$controller_ready" != "0/0" ] && [ "$bootstrap_ready" = "true" ] && echo true || echo false )" \ "$( [ -n "$crd" ] && echo true || echo false )" \ "$(json_string "$controller_ready")" \ "$UNIDESK_PAC_ADMISSION_STATE_JSON" \