bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(deploy): source immutable packages from current code channel

Browse source
This commit is contained in:
冰朔 2026-07-27 15:46:55 +08:00
commit 0bf220c917
9 changed files with 41 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

2
server-tools/lake-lamp-authz/architecture-provision-broker.js
View file

@ -8,7 +8,7 @@ const { execFile } = require("node:child_process");
const SOCKET_PATH = process.env.LAKE_LAMP_ARCHITECTURE_PROVISION_SOCKET || "/run/guanghu-architecture-provision/provision.sock";
const REPO_DIR = process.env.ARCHITECTURE_PROVISION_REPO_DIR || "/var/lib/guanghu/architecture-provision/repo";
const REPO_URL = process.env.ARCHITECTURE_PROVISION_REPO_URL || "https://guanghulab.com/fifth-domain/bingshuo/fifth-domain.git";
const REPO_URL = process.env.ARCHITECTURE_PROVISION_REPO_URL || "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git";
const RELEASES_DIR = process.env.ARCHITECTURE_PROVISION_RELEASES_DIR || "/opt/guanghu/architecture-releases";
const UNIT_DIR = process.env.ARCHITECTURE_PROVISION_UNIT_DIR || "/etc/systemd/system";
const RECEIPTS_DIR = process.env.ARCHITECTURE_PROVISION_RECEIPTS_DIR || "/var/lib/guanghu/architecture-provision/receipts";

8
server-tools/lake-lamp-authz/architecture-provision-broker.test.js
View file

@ -27,6 +27,14 @@ test("resource and manifest are immutable and path constrained", () => {
assert.equal(validateManifest(manifest(), { requestId, commit }).unit, "example.service");
});
test("architecture deployment defaults to the current Fifth Domain code channel", () => {
const source = fs.readFileSync(path.join(__dirname, "architecture-provision-broker.js"), "utf8");
const environment = fs.readFileSync(path.join(__dirname, "authorization.env.example"), "utf8");
assert.match(source, /https:\/\/guanghulab\.com\/code\/bingshuo\/guanghu-ice-heart\.git/);
assert.match(environment, /^ARCHITECTURE_PROVISION_REPO_URL=https:\/\/guanghulab\.com\/code\/bingshuo\/guanghu-ice-heart\.git$/m);
assert.doesNotMatch(source, /ARCHITECTURE_PROVISION_REPO_URL \|\| "https:\/\/guanghulab\.com\/fifth-domain\//);
});
test("unit requires non-root systemd hardening and release placeholder", () => {
const unit = "[Service]\nUser=guanghu\nGroup=guanghu\nNoNewPrivileges=true\nPrivateTmp=true\nProtectSystem=strict\nProtectHome=true\nExecStart=/usr/bin/node __RELEASE_ROOT__/server.js\n";
assert.equal(validateUnit(unit), unit);

2
server-tools/lake-lamp-authz/authorization.env.example
View file

@ -21,7 +21,7 @@ SMTP_PORT=465
SMTP_USER=SET_IN_PRIVATE_SERVER_FILE
QQ_SMTP_AUTH_CODE=SET_IN_PRIVATE_SERVER_FILE
LAKE_LAMP_ARCHITECTURE_PROVISION_SOCKET=/run/guanghu-architecture-provision/provision.sock
ARCHITECTURE_PROVISION_REPO_URL=https://guanghulab.com/fifth-domain/bingshuo/fifth-domain.git
ARCHITECTURE_PROVISION_REPO_URL=https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git
ARCHITECTURE_PROVISION_REPO_DIR=/var/lib/guanghu/architecture-provision/repo
ARCHITECTURE_PROVISION_RELEASES_DIR=/opt/guanghu/architecture-releases
ARCHITECTURE_PROVISION_UNIT_DIR=/etc/systemd/system