feat(deploy): 增加受控更新与环境配置迁移

scripts/test-deployment-public-url.sh

@@ -144,10 +144,66 @@ watchtower = services["watchtower"]
 command = " ".join(watchtower.get("command") or [])
 assert "http-api-update" not in command, command
 assert "WATCHTOWER_HTTP_API_TOKEN" not in (watchtower.get("environment") or {}), watchtower.get("environment")
+watchtower_mounts = {(item.get("source"), item.get("target")) for item in watchtower.get("volumes") or []}
+assert any(target == "/config.json" for _, target in watchtower_mounts), watchtower_mounts
 assert services["dozzle"]["environment"]["DOZZLE_ENABLE_DOWNLOAD"] == "false", services["dozzle"]["environment"]
 '
 }
 
+assert_managed_update_contract() {
+    docker compose config --format json | python3 -c '
+import json, sys
+services = json.load(sys.stdin)["services"]
+updater = services["easyai-updater"]
+server = services["easyai-server"]
+watchtower = services["watchtower"]
+
+assert updater.get("ports") in (None, []), updater.get("ports")
+assert updater.get("read_only") is True, updater.get("read_only")
+assert set(updater.get("cap_drop") or []) == {"ALL"}, updater.get("cap_drop")
+assert "no-new-privileges:true" in (updater.get("security_opt") or []), updater.get("security_opt")
+mounts = {(item.get("source"), item.get("target")) for item in updater.get("volumes") or []}
+assert ("/var/run/docker.sock", "/var/run/docker.sock") in mounts, mounts
+assert any(target == "/var/lib/easyai-updater" for _, target in mounts), mounts
+assert any(target == "/run/secrets/docker-config.json" for _, target in mounts), mounts
+
+server_env = server.get("environment") or {}
+updater_env = updater.get("environment") or {}
+token = str(server_env.get("SYSTEM_UPDATE_INTERNAL_TOKEN") or "")
+assert len(token.encode()) >= 32, "managed updater token is missing or too short"
+assert token == str(updater_env.get("SYSTEM_UPDATE_INTERNAL_TOKEN") or ""), "server/updater tokens differ"
+assert server_env.get("SYSTEM_UPDATE_MODE") == "managed", server_env.get("SYSTEM_UPDATE_MODE")
+assert str(server_env.get("EASYAI_DEPLOYMENT_SCHEMA_VERSION")) == "2"
+assert str(updater_env.get("UPDATE_HEALTH_TIMEOUT_MS")) == "300000"
+assert updater_env.get("DOCKER_CONFIG_FILE") == "/run/secrets/docker-config.json"
+assert updater.get("labels", {}).get("com.centurylinklabs.watchtower.enable") == "true"
+assert watchtower.get("environment", {}).get("WATCHTOWER_POLL_INTERVAL") == "86400"
+assert watchtower.get("environment", {}).get("WATCHTOWER_CLEANUP") == "true"
+assert "easyai-updater" in (watchtower.get("command") or []), watchtower.get("command")
+
+for service in ("easyai-server", "ws-gateway", "easyai-web"):
+    labels = services[service].get("labels") or {}
+    assert labels.get("com.centurylinklabs.watchtower.enable") == "false", (service, labels)
+'
+}
+
+assert_legacy_update_contract() {
+    local legacy_env="$TMP_DIR/.env.legacy"
+    grep -Ev '^(SYSTEM_UPDATE_MODE|COMPOSE_PROFILES|WATCHTOWER_CORE_UPDATE_ENABLED|WATCHTOWER_UPDATE_TARGET|SYSTEM_UPDATER_UPDATE_INTERVAL_SECONDS|WATCHTOWER_CLEANUP|UPDATE_HEALTH_TIMEOUT_MS|DOCKER_CONFIG_FILE|SYSTEM_UPDATE_INTERNAL_TOKEN|EASYAI_DEPLOYMENT_SCHEMA_VERSION)=' .env > "$legacy_env"
+    docker compose --env-file "$legacy_env" config --format json 2>/dev/null | python3 -c '
+import json, sys
+services = json.load(sys.stdin)["services"]
+assert "easyai-updater" not in services, sorted(services)
+server_env = services["easyai-server"].get("environment") or {}
+assert server_env.get("SYSTEM_UPDATE_MODE") == "legacy_watchtower", server_env.get("SYSTEM_UPDATE_MODE")
+assert str(server_env.get("EASYAI_DEPLOYMENT_SCHEMA_VERSION")) == "1"
+assert "easyai-updater" not in (services["watchtower"].get("command") or []), services["watchtower"].get("command")
+for service in ("easyai-server", "ws-gateway", "easyai-web"):
+    labels = services[service].get("labels") or {}
+    assert labels.get("com.centurylinklabs.watchtower.enable") == "true", (service, labels)
+'
+}
+
 sed -i.bak 's/^SERVER_HTTP_PORT=.*/SERVER_HTTP_PORT=4100/' .env.sample
 rm -f .env.sample.bak
 DEPLOY_NON_INTERACTIVE=1 \
@@ -202,6 +258,8 @@ if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1;
     assert_canvas_ws_auth_config
     assert_compose_security
     assert_redis_startup_contract
+    assert_managed_update_contract
+    assert_legacy_update_contract
 fi
 
 reset_case