fix: 保留 runtime GitOps codeAgentRuntime overlay

scripts/native/hwlab/runtime-gitops-verify.mjs

@@ -2,8 +2,12 @@
 // SPEC: PJ2026-01060703 CI/CD branch follower runtime GitOps verify.
 // Responsibility: fail publish before Argo when rendered runtime GitOps violates UniDesk overlay gates.
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
 import path from "node:path";
 
+const requireFromScript = createRequire(import.meta.url);
+const requireFromCwd = createRequire(path.join(process.cwd(), "package.json"));
+const YAML = requireYaml();
 const repoDir = process.cwd();
 const overlay = readOverlay();
 const runtimePath = requiredOverlayString("runtimePath");
@@ -20,6 +24,11 @@ if (overlay?.observability?.prometheusOperator === false) {
   const refs = findPrometheusOperatorResources();
   if (refs.length > 0) fail("prometheus-operator-resource-present", { runtimePath, refs: refs.slice(0, 12), refCount: refs.length });
 }
+if (overlay?.codeAgentRuntime?.enabled && overlay.codeAgentRuntime.kafkaEventBridge?.enabled) {
+  checks.push("code-agent-runtime-kafka-event-bridge-enabled");
+  verifyTransactionalProjectionAuthority(overlay.codeAgentRuntime.kafkaEventBridge);
+  verifyCodeAgentRuntimeWorkloads();
+}
 
 console.error(JSON.stringify({ event: "unidesk-runtime-gitops-verify", ok: true, runtimePath, checks }));
 
@@ -34,6 +43,63 @@ function findPrometheusOperatorResources() {
   return refs;
 }
 
+function verifyTransactionalProjectionAuthority(kafka) {
+  const expected = {
+    directPublish: false,
+    liveKafkaSse: false,
+    kafkaRefreshReplay: false,
+    transactionalProjector: true,
+    projectionOutboxRelay: true,
+    projectionRealtime: true,
+  };
+  const actual = Object.fromEntries(Object.keys(expected).map((name) => [name, kafka.features?.[name]]));
+  const invalid = Object.entries(expected).filter(([name, value]) => actual[name] !== value).map(([name]) => name);
+  if (invalid.length > 0) fail("kafka-event-bridge-authority-invalid", { invalid, expected, actual });
+}
+
+function verifyCodeAgentRuntimeWorkloads() {
+  const expectedByWorkload = {
+    "hwlab-cloud-api": {
+      HWLAB_KAFKA_ENABLED: "true",
+      HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED: "true",
+      HWLAB_KAFKA_DIRECT_PUBLISH_ENABLED: "false",
+      HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED: "false",
+      HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED: "false",
+      HWLAB_KAFKA_TRANSACTIONAL_PROJECTOR_ENABLED: "true",
+      HWLAB_KAFKA_PROJECTION_OUTBOX_RELAY_ENABLED: "true",
+      HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED: "true",
+    },
+    "hwlab-cloud-web": {
+      HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED: "false",
+      HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED: "false",
+      HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED: "true",
+    },
+  };
+  const found = new Set();
+  for (const file of listYamlFiles(runtimeDir)) {
+    const rel = path.relative(repoDir, file);
+    for (const document of parseStructuredDocuments(readFileSync(file, "utf8"), file)) {
+      const items = isKubernetesList(document) ? document.items : [document];
+      for (const item of items) {
+        const workloadName = String(item?.metadata?.labels?.["app.kubernetes.io/name"] ?? item?.metadata?.name ?? "");
+        const expected = expectedByWorkload[workloadName];
+        if (!expected) continue;
+        const container = item?.spec?.template?.spec?.containers?.find((candidate) => candidate?.name === workloadName);
+        if (!container) fail("code-agent-runtime-container-missing", { file: rel, workload: workloadName, container: workloadName });
+        if (!Array.isArray(container.env)) fail("code-agent-runtime-env-missing", { file: rel, workload: workloadName, container: workloadName });
+        const actual = Object.fromEntries(container.env.filter((item) => typeof item?.name === "string").map((item) => [item.name, item.value]));
+        const invalid = Object.entries(expected)
+          .filter(([name, value]) => actual[name] !== value)
+          .map(([name, value]) => ({ name, expected: value, actual: actual[name] ?? null }));
+        if (invalid.length > 0) fail("code-agent-runtime-capability-env-invalid", { file: rel, workload: workloadName, container: workloadName, invalid });
+        found.add(workloadName);
+      }
+    }
+  }
+  const missing = Object.keys(expectedByWorkload).filter((workloadName) => !found.has(workloadName));
+  if (missing.length > 0) fail("code-agent-runtime-workload-missing", { runtimePath, missing });
+}
+
 function splitYamlDocuments(text) {
   return text.split(/^---[ \t]*(?:#.*)?$/mu).map((doc) => doc.trim()).filter(Boolean);
 }
@@ -87,6 +153,15 @@ function parseJsonDocument(text) {
   }
 }
 
+function parseStructuredDocuments(text, file) {
+  const json = parseJsonDocument(text);
+  if (json !== null) return [json];
+  const documents = YAML.parseAllDocuments(text);
+  const errors = documents.flatMap((document) => document.errors);
+  if (errors.length > 0) fail("runtime-yaml-invalid", { file: path.relative(repoDir, file), errors: errors.map((error) => error.message) });
+  return documents.map((document) => document.toJS()).filter((document) => document !== null);
+}
+
 function listYamlFiles(root) {
   const out = [];
   for (const name of readdirSync(root)) {
@@ -109,6 +184,14 @@ function readOverlay() {
   return JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
 }
 
+function requireYaml() {
+  try {
+    return requireFromScript("yaml");
+  } catch {
+    return requireFromCwd("yaml");
+  }
+}
+
 function requiredOverlayString(name) {
   const value = overlay[name];
   if (typeof value !== "string" || value.length === 0) throw new Error(`overlay.${name} is required`);