fix: YAML-first 治理 CI/CD target (#919)

* docs: specify cicd yaml target governance

* fix: resolve cicd targets from yaml

---------

Co-authored-by: Codex <codex@noreply.local>

scripts/src/deploy/entry.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. entry module for scripts/src/deploy.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/deploy.ts:3528-3700 for #903.
 
@@ -27,6 +28,7 @@ import {
   type DeployJsonExecutorMirror,
   type DeployJsonServiceContract,
 } from "../deploy-json-contract";
+import { resolveArtifactRegistryTarget } from "../ops/targets";
 
 import type { DeployAction } from "./types";
 import { applyJob, devArtifactApplyJob, prodArtifactApplyJob, runApplyNow, runArtifactConsumerApplyNow, runProdArtifactApplyNow } from "./artifact-jobs";
@@ -108,7 +110,9 @@ export async function runDeployCommand(config: UniDeskConfig | null, args: strin
 
 export async function runCodeQueueDeployCompatCommand(_config: UniDeskConfig, args: string[]): Promise<unknown> {
   if (args.includes("--skip-build")) throw new Error("codex deploy is disabled; --skip-build is not supported");
-  const providerId = optionValue(args, ["--provider-id", "--provider"]) ?? "D601";
-  if (providerId !== "D601") throw new Error(`codex deploy compatibility path only supports D601; got ${providerId}`);
+  const selectedTarget = optionValue(args, ["--target", "--provider-id", "--provider"]);
+  if (selectedTarget === undefined) throw new Error("codex deploy compatibility path is a legacy adapter and requires explicit --target D601; it no longer falls back to a hidden provider default");
+  const target = resolveArtifactRegistryTarget(selectedTarget);
+  if (target.providerId !== "D601") throw new Error(`codex deploy compatibility path only supports D601; got ${target.providerId}`);
   throw new Error("codex deploy is disabled because D601 maintenance-channel direct deployment must not deploy Code Queue. Use the dev-only artifact consumer with deploy apply --env dev --service code-queue or artifact-registry deploy-service --env dev --service code-queue; production Code Queue artifact deployment is unsupported.");
 }

scripts/src/deploy/options.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. options module for scripts/src/deploy.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/deploy.ts:213-535 for #903.
 
@@ -27,6 +28,7 @@ import {
   type DeployJsonExecutorMirror,
   type DeployJsonServiceContract,
 } from "../deploy-json-contract";
+import { resolveArtifactRegistryTarget } from "../ops/targets";
 
 import type { DeployEnvironment, DeployManifest, DeployManifestService, DeployOptions } from "./types";
 import { step } from "./remote";
@@ -44,7 +46,7 @@ export function deployHelp(action: string | undefined = undefined): Record<strin
     usage: {
       check: "bun scripts/cli.ts deploy check [--file deploy.json | --env dev|prod] [--service id]",
       plan: "bun scripts/cli.ts deploy plan [--file deploy.json | --env dev|prod] [--service id]",
-      apply: "bun scripts/cli.ts deploy apply [--file deploy.json | --env dev|prod] [--service id] [--commit full-sha] [--dry-run] [--force] [--timeout-ms N] [--provider-id D601|local] [--run-now]",
+      apply: "bun scripts/cli.ts deploy apply [--file deploy.json | --env dev|prod] [--service id] [--commit full-sha] [--dry-run] [--force] [--timeout-ms N] [--target D601|local] [--run-now]",
       guard: "bun scripts/cli.ts deploy guard code-queue-source [--root /home/ubuntu/cq-deploy]",
     },
     actions: {
@@ -67,7 +69,7 @@ export function deployHelp(action: string | undefined = undefined): Record<strin
       { name: "--dry-run", description: "Prepare and validate without mutating the target service." },
       { name: "--force", description: "Redeploy even when the live commit appears up to date." },
       { name: "--timeout-ms <n>", default: defaultTimeoutMs, description: "Per-step timeout budget where supported." },
-      { name: "--provider-id <id>", default: "D601", description: "Provider used by artifact-registry consumers; use local only from the D601 host CLI." },
+      { name: "--target <id>", default: "config/artifact-registry.yaml#defaults.targetId", description: "Artifact-registry consumer target. --provider-id is accepted as a legacy alias." },
       { name: "--run-now", description: "Run apply in the foreground worker process; omit it for fire-and-forget async job mode." },
       { name: "guard code-queue-source --root <path>", description: "Validate Code Queue hostPath source relative imports before any scheduler rollout; failures report degradedReason and missing import targets." },
     ],
@@ -342,12 +344,13 @@ export function parseOptions(args: string[]): DeployOptions {
   if (commitOverride !== undefined && environment === null) throw new Error("deploy --commit is only supported for --env dev|prod artifact consumer apply");
   if (commitOverride !== undefined && !isFullGitSha(commitOverride)) throw new Error("deploy --commit must be a full 40-character commit SHA");
   if (commitOverride !== undefined && serviceId === null) throw new Error("deploy --commit requires --service so artifact consumer apply is unambiguous");
+  const artifactTarget = resolveArtifactRegistryTarget(optionValue(args, ["--target", "--provider-id", "--provider"]) ?? null);
   return {
     file: optionValue(args, ["--file"]) ?? defaultDeployFile,
     environment,
     serviceId,
     commitOverride: commitOverride?.toLowerCase() ?? null,
-    providerId: optionValue(args, ["--provider-id", "--provider"]) ?? "D601",
+    providerId: artifactTarget.providerId,
     runNow: args.includes("--run-now"),
     dryRun: args.includes("--dry-run"),
     force: args.includes("--force"),

scripts/src/deploy/service-plan.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. service-plan module for scripts/src/deploy.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/deploy.ts:634-1236 for #903.
 
@@ -30,7 +31,7 @@ import {
 
 import type { ArtifactConsumerPlanKind, DeployEnvironment, DeployEnvironmentTarget, DeployManifest, DeployManifestService } from "./types";
 import { targetIsMain, targetWorkDir } from "./paths";
-import { artifactConsumerDryRunBlockedServiceIds, d601MaintenanceDeployAllowedServiceIds, devApplySupportedServiceIds, devArtifactConsumerServiceIds, k8sNamespace, prodArtifactConsumerServiceIds, prodArtifactLiveApplyBlockedServiceIds, unideskRepoUrl } from "./types";
+import { artifactConsumerDryRunBlockedServiceIds, d601DeployNodeId, d601DeployProviderId, d601MaintenanceDeployAllowedServiceIds, devApplySupportedServiceIds, devArtifactConsumerServiceIds, k8sNamespace, prodArtifactConsumerServiceIds, prodArtifactLiveApplyBlockedServiceIds, unideskRepoUrl } from "./types";
 
 export function frontendCoreDeployService(config: UniDeskConfig): UniDeskMicroserviceConfig {
   return {
@@ -178,7 +179,7 @@ export function devK3sDeployService(id: string): UniDeskMicroserviceConfig | und
   return {
     id,
     name: spec.name,
-    providerId: "D601",
+    providerId: d601DeployProviderId,
     description: spec.description,
     repository: {
       url: spec.repoUrl ?? unideskRepoUrl,
@@ -205,11 +206,11 @@ export function devK3sDeployService(id: string): UniDeskMicroserviceConfig | und
       adapterServiceId: "k3sctl-adapter",
       k3sServiceId: spec.composeService,
       namespace: "unidesk-dev",
-      expectedNodeIds: ["D601"],
-      activeNodeId: "D601",
+      expectedNodeIds: [d601DeployNodeId],
+      activeNodeId: d601DeployNodeId,
     },
     development: {
-      providerId: "D601",
+      providerId: d601DeployProviderId,
       sshPassthrough: true,
       worktreePath: id === "code-queue"
         ? "/home/ubuntu/unidesk-dev-code-queue-deploy/code-queue"

scripts/src/deploy/types.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. types module for scripts/src/deploy.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/deploy.ts:1-212 for #903.
 
@@ -15,6 +16,7 @@ import { coreInternalFetch } from "../microservices";
 import { codeQueueSourceImportPreflight, codeQueueSourceSubdir } from "../code-queue-source-guard";
 import { d601K3sGuardShellLines, d601NativeKubeconfig } from "../d601-k3s-guard";
 import { composeRuntimeEnvValue } from "../runtime-env";
+import { resolveArtifactRegistryTarget } from "../ops/targets";
 import {
   compareDeployJsonExecutorMirrors,
   deployJsonCommitImage,
@@ -151,6 +153,12 @@ export const shortRemoteTimeoutMs = 20_000;
 
 export const providerDispatchCompletionLagMs = 45_000;
 
+const d601ArtifactRegistryTarget = resolveArtifactRegistryTarget("D601");
+
+export const d601DeployProviderId = d601ArtifactRegistryTarget.providerId;
+
+export const d601DeployNodeId = d601ArtifactRegistryTarget.targetId;
+
 export const pollIntervalMs = 5_000;
 
 export const remoteDeployRoot = "/home/ubuntu/.unidesk/deploy";
@@ -235,8 +243,8 @@ export const deployEnvironmentTargets: Record<DeployEnvironment, DeployEnvironme
       name: "unidesk",
     },
     provider: {
-      providerId: "D601",
-      nodeId: "D601",
+      providerId: d601DeployProviderId,
+      nodeId: d601DeployNodeId,
       credentialScope: "prod",
     },
   },