refactor: split control-plane cli modules

2026-06-25 16:16:00 +00:00
parent cca855daa3
commit e0af0f85ac
147 changed files with 63967 additions and 59999 deletions
@@ -0,0 +1,114 @@
+// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. entry module for scripts/src/deploy.ts.
+
+// Moved mechanically from scripts/src/deploy.ts:3528-3700 for #903.
+
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { runCommand } from "../command";
+import { type UniDeskConfig, type UniDeskMicroserviceConfig, repoRoot, rootPath } from "../config";
+import { ensureGithubSshIdentityForProvider } from "../deploy-ssh-identity";
+import { baiduNetdiskRuntimeSecretRequirements, runtimeSecretContractFromEnvText, type RuntimeSecretContract, runArtifactRegistryCommand } from "../artifact-registry";
+import { startJob } from "../jobs";
+import { coreInternalFetch } from "../microservices";
+import { codeQueueSourceImportPreflight, codeQueueSourceSubdir } from "../code-queue-source-guard";
+import { d601K3sGuardShellLines, d601NativeKubeconfig } from "../d601-k3s-guard";
+import { composeRuntimeEnvValue } from "../runtime-env";
+import {
+  compareDeployJsonExecutorMirrors,
+  deployJsonCommitImage,
+  deployJsonDriftResult,
+  deployJsonSourceOfTruth,
+  encodeDeployJsonServiceContract,
+  hasDeployJsonExecutorContract,
+  k3sManifestExecutorMirror,
+  parseDeployJsonServiceContract,
+  type DeployJsonExecutorMirror,
+  type DeployJsonServiceContract,
+} from "../deploy-json-contract";
+
+import type { DeployAction } from "./types";
+import { applyJob, devArtifactApplyJob, prodArtifactApplyJob, runApplyNow, runArtifactConsumerApplyNow, runProdArtifactApplyNow } from "./artifact-jobs";
+import { blockedD601MaintenanceDeployServices, checkOrPlan, commitOverrideArtifactConsumerError, d601MaintenanceDeployBlockMessage, devArtifactLiveApplyBlockedResult, environmentDryRunPlan, prodArtifactConsumerLocalManifestResult, prodArtifactUnsupportedResult, prodArtifactUnsupportedServices, selectedDevArtifactServicesWithProdFallback, selectedDevTargetServices, selectedEnvironmentServices, unsupportedDevApplyServices } from "./check-plan";
+import { readDeployManifest, readEnvironmentDeployManifest } from "./manifest";
+import { deployHelp, isHelpArg, optionValue, parseOptions, resolveManifestCommits } from "./options";
+import { devArtifactLiveApplyBlockedServiceIds, prodForbiddenTargetSideBuildServiceIds } from "./types";
+
+export function runDeployGuardCommand(args: string[]): unknown {
+  const [guardName] = args;
+  if (guardName !== "code-queue-source") {
+    return {
+      ok: false,
+      supported: false,
+      error: "unsupported-deploy-guard",
+      guard: guardName ?? null,
+      supportedGuards: ["code-queue-source"],
+    };
+  }
+  const root = optionValue(args.slice(1), ["--root"]) ?? repoRoot;
+  return codeQueueSourceImportPreflight(root);
+}
+
+export async function runDeployCommand(config: UniDeskConfig | null, args: string[]): Promise<unknown> {
+  const [actionRaw = "check"] = args;
+  if (isHelpArg(actionRaw) || args.slice(1).some(isHelpArg)) return deployHelp(isHelpArg(actionRaw) ? undefined : actionRaw);
+  if (actionRaw === "guard") return runDeployGuardCommand(args.slice(1));
+  if (!["check", "plan", "apply"].includes(actionRaw)) throw new Error("deploy command must be one of: check, plan, apply, guard");
+  const action = actionRaw as DeployAction;
+  const options = parseOptions(args.slice(1));
+  if (options.environment !== null) {
+    const commitOverrideError = commitOverrideArtifactConsumerError(options);
+    if (commitOverrideError !== null) throw new Error(commitOverrideError);
+    const { manifest, source } = readEnvironmentDeployManifest(options.environment);
+    if (action === "check" || action === "plan") return environmentDryRunPlan(config, manifest, source, options, action);
+    if (options.environment === "prod") {
+      const unsupported = prodArtifactUnsupportedServices(manifest, options.serviceId);
+      if (unsupported.length > 0) return prodArtifactUnsupportedResult(unsupported);
+      if (options.dryRun || options.runNow) return await runProdArtifactApplyNow(manifest, options);
+      return prodArtifactApplyJob(args, options);
+    }
+    const unsupported = unsupportedDevApplyServices(manifest, options.serviceId);
+    if (unsupported.length > 0) {
+      throw new Error(`deploy apply --env dev currently supports auth-broker/backend-core/frontend/baidu-netdisk/decision-center/mdtodo/claudeqq/code-queue/project-manager/oa-event-flow/code-queue-mgr/todo-note/findjob/pipeline/met-nonlinear artifact consumers; unsupported selected services: ${unsupported.join(", ")}. Use ci run-dev-e2e for smoke verification.`);
+    }
+    const devArtifactServices = selectedDevArtifactServicesWithProdFallback(manifest, options.serviceId);
+    const devTargetServices = selectedDevTargetServices(manifest, options.serviceId);
+    if (devArtifactServices.length > 0 && devTargetServices.length > 0) {
+      throw new Error("deploy apply --env dev cannot mix artifact consumer services with target-side rollout services in one invocation; pass --service");
+    }
+    if (devArtifactServices.length > 0) {
+      const blocked = devArtifactServices.filter((service) => devArtifactLiveApplyBlockedServiceIds.has(service.id));
+      if (!options.dryRun && blocked.length > 0) return devArtifactLiveApplyBlockedResult(blocked);
+      if (options.dryRun || options.runNow) return await runArtifactConsumerApplyNow(manifest, options, "dev", devArtifactServices);
+      return devArtifactApplyJob(args, options);
+    }
+    if (config === null) throw new Error("deploy apply --env dev requires config.json");
+    if (!options.dryRun) {
+      const blocked = blockedD601MaintenanceDeployServices(config, manifest, options.serviceId).filter((serviceId) => serviceId !== "decision-center");
+      if (blocked.length > 0) throw new Error(d601MaintenanceDeployBlockMessage(blocked));
+    }
+    if (options.dryRun || options.runNow) return await runApplyNow(config, manifest, options);
+    return applyJob(config, args, options);
+  }
+  if (config === null) throw new Error("deploy local manifest mode requires config.json");
+  const rawManifest = await readDeployManifest(options.file);
+  if (action === "apply") {
+    const blocked = blockedD601MaintenanceDeployServices(config, rawManifest, options.serviceId);
+    if (blocked.length > 0) throw new Error(d601MaintenanceDeployBlockMessage(blocked));
+  }
+  const manifest = resolveManifestCommits(rawManifest, options.serviceId);
+  if (action === "check" || action === "plan") return await checkOrPlan(config, manifest, options, action);
+  const prodArtifactConsumers = selectedEnvironmentServices(manifest, options.serviceId)
+    .filter((service) => manifest.environment !== "dev" && prodForbiddenTargetSideBuildServiceIds.has(service.id));
+  if (prodArtifactConsumers.length > 0) return prodArtifactConsumerLocalManifestResult(prodArtifactConsumers);
+  if (options.dryRun || options.runNow) return await runApplyNow(config, manifest, options);
+  return applyJob(config, args, options);
+}
+
+export async function runCodeQueueDeployCompatCommand(_config: UniDeskConfig, args: string[]): Promise<unknown> {
+  if (args.includes("--skip-build")) throw new Error("codex deploy is disabled; --skip-build is not supported");
+  const providerId = optionValue(args, ["--provider-id", "--provider"]) ?? "D601";
+  if (providerId !== "D601") throw new Error(`codex deploy compatibility path only supports D601; got ${providerId}`);
+  throw new Error("codex deploy is disabled because D601 maintenance-channel direct deployment must not deploy Code Queue. Use the dev-only artifact consumer with deploy apply --env dev --service code-queue or artifact-registry deploy-service --env dev --service code-queue; production Code Queue artifact deployment is unsupported.");
+}