bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix: separate Fifth Domain source deployment identities

Browse source
This commit is contained in:
冰朔 2026-07-26 17:56:47 +08:00
commit 83589aa2c2
27 changed files with 620 additions and 73 deletions
Download patch file Download diff file Expand all files Collapse all files

5
server-tools/lake-lamp-authz/deployment-event-worker.js
View file

@ -6,6 +6,7 @@
const fs = require("node:fs");
const path = require("node:path");
const { provision } = require("./architecture-provision-broker");
const { validateDeploymentSource } = require("./deployment-source-policy");
const QUEUE_DIR = process.env.LAKE_LAMP_DEPLOYMENT_EVENT_DIR || "/var/lib/guanghu/deployment-events";
const RECEIPTS_DIR = process.env.LAKE_LAMP_DEPLOYMENT_RECEIPTS_DIR || "/var/lib/guanghu/deployment-events/receipts";
@ -30,7 +31,7 @@ async function processOne(options = {}) {
event = JSON.parse(fs.readFileSync(processing, "utf8"));
const checked = validateEvent(event, options.registry || loadRegistry(options.registryFile));
if (checked) throw new Error(checked);
const result = await (options.provisionFn || provision)({ target: "JD-FD-PRIMARY", action: "provision-approved-architecture", resource: event.resource }, { repoUrl: options.registry ? options.registry[event.repo].repo_url : loadRegistry(options.registryFile)[event.repo].repo_url });
const result = await (options.provisionFn || provision)({ target: event.target, action: "provision-approved-architecture", resource: event.resource }, { repoUrl: options.registry ? options.registry[event.repo].repo_url : loadRegistry(options.registryFile)[event.repo].repo_url });
const receipt = { schema: "guanghu.deployment-agent-receipt/v1", event_id: event.event_id, workorder_id: event.workorder_id, repo: event.repo, branch: event.branch, commit_sha: event.commit_sha, resource: event.resource, result: result.ok ? "DEPLOYED_AND_VERIFIED" : "FAILED_OR_ROLLED_BACK", diagnostic_code: result.ok ? "deployment_succeeded" : String(result.error || "deployment_failed"), evidence: result, recorded_at: new Date().toISOString() };
writeAtomic(path.join(receiptsDir, `${event.event_id}.json`), `${JSON.stringify(receipt, null, 2)}\n`);
fs.renameSync(processing, `${processing}.${result.ok ? "done" : "failed"}`);
@ -47,7 +48,7 @@ function validateEvent(event, registry) {
if (!registry[event.repo] || !/^bingshuo\/[a-z0-9._-]+$/.test(event.repo) || event.branch !== "main" || !/^[0-9a-f]{40}$/.test(event.commit_sha || "")) return "deployment_event_binding_invalid";
if (!/^[A-Z0-9][A-Z0-9._-]{5,119}@[0-9a-f]{40}$/.test(event.resource || "") || !event.resource.endsWith(`@${event.commit_sha}`)) return "deployment_event_resource_invalid";
if (!/^deployment\/requests\/[A-Za-z0-9._/-]{1,180}\.json$/.test(event.manifest || "")) return "deployment_event_manifest_invalid";
return "";
return validateDeploymentSource(event, registry);
}
function writeAtomic(file, content) { const temp = `${file}.${process.pid}.tmp`; fs.writeFileSync(temp, content, { mode: 0o600 }); fs.renameSync(temp, file); }