fix(release): 按服务核验 Compose 固定镜像并保留线上修复

2026-10-15 03:09:51 +08:00
parent 9a801ea3d5
commit dbb6bbce02
4 changed files with 77 additions and 7 deletions
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Exercise Bash and PowerShell image verification with real Compose config.
+
+No images are pulled and no containers are created. Fixture settings are fake.
+"""
+import argparse
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import time
+
+parser = argparse.ArgumentParser()
+parser.add_argument('--source', type=Path, default=Path(__file__).resolve().parent.parent)
+args = parser.parse_args()
+source = args.source.resolve()
+started = time.monotonic()
+version = '1.0.0.20261014'
+image = 'registry.cn-shanghai.aliyuncs.com/comfy-ai/comfy-server'
+secret = 'synthetic-config-value-must-not-be-printed'
+
+with tempfile.TemporaryDirectory(prefix='easyai-image-config-') as temporary:
+    root = Path(temporary)
+    (root / '.env').write_text(f'SERVER_VERSION={version}\nFIXTURE_SECRET={secret}\n')
+    binaries = root / 'bin'
+    binaries.mkdir()
+    sudo = binaries / 'sudo'
+    sudo.write_text('#!/bin/sh\nexec "$@"\n')
+    sudo.chmod(0o755)
+    env = {**os.environ, 'PATH': str(binaries) + os.pathsep + os.environ['PATH'], 'UPDATE_SERVICES': 'easyai-server'}
+    reports = []
+    for correct in (True, False):
+        selected = f'{image}:${{SERVER_VERSION}}' if correct else f'{image}:latest'
+        # On the negative case a dependency deliberately has the expected image;
+        # checking membership in --images output would wrongly approve it.
+        dependency = 'redis:7-alpine' if correct else f'{image}:${{SERVER_VERSION}}'
+        (root / 'compose.yml').write_text(f'services:\n  dependency:\n    image: {dependency}\n  easyai-server:\n    image: {selected}\n    depends_on:\n      - dependency\n    environment:\n      FIXTURE_SECRET: ${{FIXTURE_SECRET}}\n')
+        config = subprocess.run(['docker','compose','config','--format','json','easyai-server'], cwd=root, env=env, text=True, capture_output=True, check=True)
+        assert json.loads(config.stdout)['services']['easyai-server']['image'] == (f'{image}:{version}' if correct else f'{image}:latest')
+        images = subprocess.run(['docker','compose','config','--images','easyai-server'], cwd=root, env=env, text=True, capture_output=True, check=True)
+        assert len(images.stdout.splitlines()) > 1, 'Compose fixture must include dependency images'
+        bash = ['bash','-c', '. "$1/scripts/init-security-env.sh"; . "$1/scripts/init-application-version-env.sh"; verify_application_version_images .env "docker compose"', 'fixture', str(source)]
+        powershell = ['pwsh','-NoProfile','-NonInteractive','-Command', f". '{source}/scripts/Initialize-ApplicationVersions.ps1'; Test-ApplicationVersionImages @([pscustomobject]@{{Service='easyai-server';Image='{image}';Version='{version}'}}) @('docker','compose')"]
+        for name, command in [('bash', bash), ('powershell', powershell)]:
+            result = subprocess.run(command, cwd=root, env=env, text=True, errors='backslashreplace', capture_output=True, timeout=30)
+            assert (result.returncode == 0) == correct, f'{name} incorrect verification: {result.stdout} {result.stderr}'
+            assert secret not in result.stdout + result.stderr, 'configuration leaked'
+            reports.append({'shell':name, 'correctImage':correct, 'expectedExitObserved':True})
+
+print(json.dumps({'cases':reports,'seconds':round(time.monotonic()-started,3)}))