From 442082bfc9599b623f2f7986455cf0ca4229f5f2 Mon Sep 17 00:00:00 2001 From: let5sne Date: Tue, 14 Jul 2026 22:19:52 +0800 Subject: [PATCH] chore(release): verify remote backend artifact --- docs/BRD_IMPLEMENTATION_AUDIT.md | 2 +- docs/DEV_SETUP.md | 2 ++ scripts/release-preflight.sh | 12 ++++++++++++ 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/BRD_IMPLEMENTATION_AUDIT.md b/docs/BRD_IMPLEMENTATION_AUDIT.md index 8d8c2333..b0d0772f 100644 --- a/docs/BRD_IMPLEMENTATION_AUDIT.md +++ b/docs/BRD_IMPLEMENTATION_AUDIT.md @@ -112,7 +112,7 @@ ### 2026-07-14 增量：正式试点导出契约复核 - `GET /api/train/practice/export` 已强制要求 `startDate/endDate`，服务层拒绝缺失日期和反向日期；CSV 契约测试 `5/5`、严格门禁 SQL 测试和 `bash -n scripts/demo-check.sh` 通过，训练/校准统计使用同一租户、日期窗口、在职组织身份和原始分子，不用四舍五入后的比率反推门禁。 -- 仍有一个正式数据契约缺口：`aihr_sop_answer_review` 当前保存评审人和评审时间，但没有提问员工的 `ext_party_id` 或等价正式主体字段；当前 SOP 可用率只能按租户、分类和评审窗口统计，不能证明样本来自正式试点员工。该字段需要业务确认“提问员工主体”与“HR 评审人”的关系后再做 schema/API 迁移，暂不硬编码或用评审人冒充员工。 +- 正式数据证据仍未完成：`aihr_sop_answer_review` 已通过 `requester_ext_party_id` 保存认证 APP 用户的提问员工主体，并由严格门禁要求该主体命中当前租户在职组织快照；当前缺的是正式窗口内真实员工提问与人工评审样本，不能用字段存在或管理员烟测冒充 M5 可用率。 - 管理端三角色对练页的“导出试点 CSV”已提供日期范围选择；日期不完整或反向时按钮不可用，点击后把合法 `startDate/endDate` 传入后端。`frontend/src/views/train/pilot-export.test.ts` 已覆盖空值、非法日期、反向日期和合法窗口，当前无需再补页面逻辑。 ### P2/P3：明确暂缓，不应混入当前修复 diff --git a/docs/DEV_SETUP.md b/docs/DEV_SETUP.md index dbe0bd68..cfd534c6 100644 --- a/docs/DEV_SETUP.md +++ b/docs/DEV_SETUP.md @@ -167,6 +167,8 @@ curl -k -s https://peilian.njzhmj.top/h5/ | sed -n '1,20p' RELEASE_REMOTE_URL=https://peilian.njzhmj.top ./scripts/release-preflight.sh # 发布后核验线上主资源是否与当前本地产物一致 RELEASE_REMOTE_URL=https://peilian.njzhmj.top RELEASE_VERIFY_REMOTE_MATCH=true ./scripts/release-preflight.sh +# 同时通过 SSH 校验线上后端 jar；默认使用本机 SSH alias YCWY +RELEASE_REMOTE_URL=https://peilian.njzhmj.top RELEASE_VERIFY_REMOTE_MATCH=true RELEASE_VERIFY_REMOTE_BACKEND=true ./scripts/release-preflight.sh ``` 带 `RELEASE_REMOTE_URL` 时，预检同时校验租户接口 JSON 的业务 `code=200`；HTTP 200 但业务返回 401/405 会判定失败。 diff --git a/scripts/release-preflight.sh b/scripts/release-preflight.sh index f747b56e..f485c663 100755 --- a/scripts/release-preflight.sh +++ b/scripts/release-preflight.sh @@ -120,6 +120,18 @@ if [[ -n "${RELEASE_REMOTE_URL:-}" ]]; then [[ "$remote_frontend_sha256" == "$local_frontend_sha256" ]] || fail "remote frontend asset does not match local build" [[ "$remote_mobile_sha256" == "$local_mobile_sha256" ]] || fail "remote mobile H5 asset does not match local build" echo "remote_asset_match=true" + + if [[ "${RELEASE_VERIFY_REMOTE_BACKEND:-false}" == "true" ]]; then + command -v ssh >/dev/null 2>&1 || fail "ssh is required for remote backend verification" + remote_ssh="${RELEASE_REMOTE_SSH:-YCWY}" + remote_backend_path="/opt/wygj/app/ruoyi-admin.jar" + remote_backend_sha256="$(ssh -o BatchMode=yes -o ConnectTimeout=10 "$remote_ssh" "sha256sum '$remote_backend_path'" | awk '{print $1}')" || fail "remote backend hash check failed: $remote_ssh:$remote_backend_path" + [[ "$remote_backend_sha256" =~ ^[0-9a-f]{64}$ ]] || fail "remote backend hash is invalid: $remote_ssh:$remote_backend_path" + local_backend_sha256="$(sha256 "$backend_jar")" + echo "remote_backend_sha256=$remote_backend_sha256" + [[ "$remote_backend_sha256" == "$local_backend_sha256" ]] || fail "remote backend jar does not match local build" + echo "remote_backend_match=true" + fi fi fi