78 lines
2.9 KiB
Bash
78 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
SCRIPT="$ROOT_DIR/scripts/release-backend.sh"
|
|
DEV_SETUP="$ROOT_DIR/docs/DEV_SETUP.md"
|
|
|
|
bash -n "$SCRIPT"
|
|
|
|
for remote_block in \
|
|
REMOTE_INSPECT \
|
|
REMOTE_BACKUP \
|
|
REMOTE_ACTIVATE \
|
|
REMOTE_RESTORE \
|
|
REMOTE_ROLLBACK_INSPECT \
|
|
REMOTE_ROLLBACK_SAFETY; do
|
|
awk -v marker="$remote_block" '
|
|
index($0, "<<" SQ marker SQ) { capture = 1; next }
|
|
capture && $0 == marker { exit }
|
|
capture { print }
|
|
' SQ="'" "$SCRIPT" | bash -n
|
|
done
|
|
|
|
grep -Fq 'REMOTE_SSH="YCWY"' "$SCRIPT"
|
|
grep -Fq 'REMOTE_PATH="/opt/wygj/app/ruoyi-admin.jar"' "$SCRIPT"
|
|
grep -Fq 'REMOTE_SERVICE="wygj-aihr.service"' "$SCRIPT"
|
|
grep -Fq 'mode="${1:-plan}"' "$SCRIPT"
|
|
grep -Fq 'plan and rollback-plan are read-only' "$SCRIPT"
|
|
grep -Fq 'require_approval "DEPLOY_BACKEND:$expected_sha256"' "$SCRIPT"
|
|
grep -Fq 'require_approval "ROLLBACK_BACKEND:$expected_sha256"' "$SCRIPT"
|
|
grep -Fq 'deploy and rollback require a clean Git worktree' "$SCRIPT"
|
|
grep -Fq 'run_post_deploy_preflight' "$SCRIPT"
|
|
grep -Fq 'post-deploy preflight failed; restoring' "$SCRIPT"
|
|
grep -Fq 'rollback health failed; restoring safety copy' "$SCRIPT"
|
|
grep -Fq 'expected_target_sha="$5"' "$SCRIPT"
|
|
grep -Fq 'concurrent target change' "$SCRIPT"
|
|
grep -Fq 'remote backend release requires the fixed root deployment account' "$SCRIPT"
|
|
grep -Fq 'cp -a "$target" "$backup_dir/ruoyi-admin.jar"' "$SCRIPT"
|
|
grep -Fq 'mv -T "$staging" "$target"' "$SCRIPT"
|
|
grep -Fq 'RELEASE_VERIFY_REMOTE_BACKEND=true' "$SCRIPT"
|
|
grep -Fq 'RELEASE_VERIFY_REMOTE_SCHEMA=true' "$SCRIPT"
|
|
|
|
if grep -Eq '(^|[[:space:]])rm([[:space:]]|$)' "$SCRIPT"; then
|
|
echo 'FAIL: backend release script must not delete release or backup files' >&2
|
|
exit 1
|
|
fi
|
|
|
|
deploy_without_approval="$(
|
|
bash "$SCRIPT" deploy \
|
|
--artifact missing.jar \
|
|
--artifact-commit HEAD \
|
|
--expected-sha256 0000000000000000000000000000000000000000000000000000000000000000 \
|
|
2>&1 || true
|
|
)"
|
|
grep -Fq 'explicit approval required' <<<"$deploy_without_approval"
|
|
if grep -Fq 'release JAR not found' <<<"$deploy_without_approval"; then
|
|
echo 'FAIL: deploy touched artifact or remote planning before approval' >&2
|
|
exit 1
|
|
fi
|
|
|
|
rollback_without_approval="$(
|
|
bash "$SCRIPT" rollback \
|
|
--backup-dir /opt/wygj/backups/backend-20260729000000-000000000000 \
|
|
--expected-sha256 0000000000000000000000000000000000000000000000000000000000000000 \
|
|
2>&1 || true
|
|
)"
|
|
grep -Fq 'explicit approval required' <<<"$rollback_without_approval"
|
|
if grep -Fq 'read-only rollback inspection failed' <<<"$rollback_without_approval"; then
|
|
echo 'FAIL: rollback contacted the remote before approval' >&2
|
|
exit 1
|
|
fi
|
|
|
|
grep -Fq './scripts/release-backend.sh plan' "$DEV_SETUP"
|
|
grep -Fq './scripts/release-backend.sh deploy' "$DEV_SETUP"
|
|
grep -Fq './scripts/release-backend.sh rollback-plan' "$DEV_SETUP"
|
|
|
|
echo 'PASS: backend release and rollback require explicit approval and preserve recoverable backups'
|