104 lines
3.9 KiB
JSON
104 lines
3.9 KiB
JSON
{
|
||
"schema": "guanghu.existing-service-update-request/v1",
|
||
"request_id": "HLCC-HUMAN-MERGE-AUTO-DEPLOY-20260806",
|
||
"target_node": "JD-FD-PRIMARY",
|
||
"status": "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
|
||
"purpose": {
|
||
"what": "把光湖代码频道中由冰朔人工完成的main合并转换为不可变部署事件，交给京东常驻部署Agent执行。",
|
||
"why": "服务器已经具备清单校验、备份、部署、健康检查、回滚和回执能力，但代码频道的合并事件尚未接到部署队列，导致每次合并后仍需再次派发。",
|
||
"success": "仅Forgejo已合并PR且merged_by=bingshuo、目标仓库和分支匹配、改动包含deployment/requests下的有效清单时入队；普通push、关闭未合并、错误签名、其他合并者和重复投递均不产生第二次部署。",
|
||
"out_of_scope": [
|
||
"不因普通Git push自动部署",
|
||
"不执行PR或仓库提供的命令",
|
||
"不允许清单选择目标服务器或扩大权限",
|
||
"不修改光湖OS磁盘、内核、引导或启动状态"
|
||
]
|
||
},
|
||
"module": {
|
||
"unit": "lake-lamp-authz.service",
|
||
"run_user": "guanghu-authz",
|
||
"install_root": "/opt/guanghu/lake-lamp-authz",
|
||
"environment_files": [
|
||
"/etc/guanghu/secrets/lake-lamp/authorization.env"
|
||
],
|
||
"writable_paths": [
|
||
"/var/lib/guanghu/lake-lamp-authz",
|
||
"/var/lib/guanghu/repo-authorizations",
|
||
"/var/lib/guanghu/repo-push-uploads",
|
||
"/var/lib/guanghu/deployment-events",
|
||
"/var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git",
|
||
"/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git",
|
||
"/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/hololake-knowledge-base.git"
|
||
]
|
||
},
|
||
"service_update": {
|
||
"kind": "existing-systemd-service",
|
||
"require_existing_unit": true,
|
||
"required_existing_files": [
|
||
"server.js",
|
||
"deployment-event.js"
|
||
]
|
||
},
|
||
"unit_source": "server-tools/lake-lamp-authz/lake-lamp-authz.service",
|
||
"files": [
|
||
{
|
||
"source": "server-tools/lake-lamp-authz/server.js",
|
||
"destination": "server.js",
|
||
"mode": "0644"
|
||
},
|
||
{
|
||
"source": "server-tools/lake-lamp-authz/deployment-event.js",
|
||
"destination": "deployment-event.js",
|
||
"mode": "0644"
|
||
},
|
||
{
|
||
"source": "server-tools/lake-lamp-authz/forgejo-merge-deployment.js",
|
||
"destination": "forgejo-merge-deployment.js",
|
||
"mode": "0644"
|
||
}
|
||
],
|
||
"runtime_check": {
|
||
"url": "http://127.0.0.1:3921/health",
|
||
"expected": {
|
||
"ok": true,
|
||
"service": "lake-lamp-authz",
|
||
"merge_deployment_gate": {
|
||
"configured": true,
|
||
"mode": "human-merged-pull-request-only"
|
||
}
|
||
}
|
||
},
|
||
"acceptance_checks": [
|
||
{
|
||
"url": "http://127.0.0.1:3921/api/public/capabilities",
|
||
"expected": {
|
||
"schema": "guanghu.lake-lamp-public-workorder/v1"
|
||
}
|
||
}
|
||
],
|
||
"bootstrap": {
|
||
"one_time": true,
|
||
"reason": "本清单合并前合并门尚不存在；首次由当前已授权实例按完整候选提交和同一回滚执行器安装，之后由人工合并自动触发。",
|
||
"webhook_target": "https://guanghulab.com/authz/api/deployment/forgejo-merge",
|
||
"webhook_event": "pull_request",
|
||
"secret_location": "/etc/guanghu/secrets/lake-lamp/authorization.env",
|
||
"secret_committed": false
|
||
},
|
||
"rollback": {
|
||
"automatic_on_failure": true,
|
||
"scope": "恢复server.js、deployment-event.js、原systemd单元并移除新增门模块，然后重启旧服务",
|
||
"receipt_required": true
|
||
},
|
||
"security": {
|
||
"hmac_sha256_required": true,
|
||
"allowed_repository": "bingshuo/guanghu-ice-heart",
|
||
"allowed_branch": "main",
|
||
"allowed_mergers": [
|
||
"bingshuo"
|
||
],
|
||
"max_deployment_manifests_per_merge": 5,
|
||
"delivery_idempotency": true,
|
||
"repository_commands_executed": false,
|
||
"no_secrets": true
|
||
}
|
||
}
|