feat: 增加 Admin 安全生产部署脚本 (#309)

2026-08-26 15:51:23 +08:00
parent ce780dd8db
commit c6f9a80095
5 changed files with 710 additions and 0 deletions
@@ -0,0 +1,71 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func readDeployScript(t *testing.T, path string) string {
+	t.Helper()
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(raw)
+}
+
+func TestDeployAdminPowerShell_固定提交隔离构建且支持WhatIf(t *testing.T) {
+	source := readDeployScript(t, "deploy/deploy-admin.ps1")
+	for _, want := range []string{
+		"SupportsShouldProcess = $true",
+		"\"archive\", \"--format=tar\"",
+		"$env:GOTOOLCHAIN = \"go1.23.0\"",
+		"$env:GOOS = \"linux\"",
+		"$env:GOARCH = \"amd64\"",
+		"$env:CGO_ENABLED = \"0\"",
+		"BatchMode=yes",
+		"StrictHostKeyChecking=yes",
+		"AllowSchemaMigration",
+	} {
+		if !strings.Contains(source, want) {
+			t.Errorf("本地部署脚本缺少关键安全步骤 %q", want)
+		}
+	}
+}
+
+func TestDeployAdminRemote_备份预检原子切换和失败回退(t *testing.T) {
+	source := readDeployScript(t, "deploy/deploy-admin-remote.sh")
+	for _, want := range []string{
+		"check_active_jobs",
+		"mysqldump --defaults-extra-file=",
+		"gzip -t",
+		"preflight_port=\"18083\"",
+		"current_schema < target_schema",
+		"allow_migration",
+		"mv -Tf \"$temporary_link\" \"$stable_binary\"",
+		"restore_previous_release",
+		"数据库迁移不会自动回滚",
+		"nginx -t",
+	} {
+		if !strings.Contains(source, want) {
+			t.Errorf("远端部署脚本缺少关键安全步骤 %q", want)
+		}
+	}
+}
+
+func TestDeployScripts_不降低传输安全或写死凭据(t *testing.T) {
+	source := readDeployScript(t, "deploy/deploy-admin.ps1") + "\n" +
+		readDeployScript(t, "deploy/deploy-admin-remote.sh")
+	for _, forbidden := range []string{
+		"StrictHostKeyChecking=no",
+		"--no-check-certificate",
+		"curl -k",
+		"CMAUTOBUY_DB_PASSWORD=",
+		"Authorization:",
+	} {
+		if strings.Contains(source, forbidden) {
+			t.Errorf("部署脚本包含禁止内容 %q", forbidden)
+		}
+	}
+}