leefer/xiaobai-review
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

部署(HEL-235B): 补严分叉与镜像标签校验

Browse Source 
Co-authored-by: multica-agent <github@multica.ai>
This commit is contained in:
总管
2026-08-29 23:27:18 +08:00
co-authored by multica-agent
parent 51f410d942
commit 1e8da5fee2
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DOCKER_DEPLOY.md
+1 -1
View File
@@ -202,7 +202,7 @@ docker compose down
`compose.yaml` 的镜像名与 revision 标签同样做了强校验：直接 `docker compose up -d --build` `compose.yaml` 的镜像名与 revision 标签同样做了强校验：直接 `docker compose up -d --build`
会因缺少 `XIAOBAI_GIT_REV` / `XIAOBAI_GIT_SHORT` 变量而拒绝执行，避免再出现构建进 会因缺少 `XIAOBAI_GIT_REV` / `XIAOBAI_GIT_SHORT` 变量而拒绝执行，避免再出现构建进
`latest` 的模糊版本。需要用 compose 时先 `export` 这两个变量（值以 `latest` 的模糊版本。需要用 compose 时先 `export` 这两个变量（值以
`~/xiaobai-git rev-parse HEAD` 为准），或直接用上面的脚本。 `~/xiaobai-build/xiaobai-git rev-parse HEAD` 为准），或直接用上面的脚本。
### 智能体高级入口：Git 归档流式构建 ### 智能体高级入口：Git 归档流式构建
tools/update_from_main.sh
+4
View File
@@ -33,6 +33,8 @@ $DIRTY"
LOCAL_HEAD="$(g rev-parse HEAD)" LOCAL_HEAD="$(g rev-parse HEAD)"
REMOTE_HEAD="$(g rev-parse origin/main)" REMOTE_HEAD="$(g rev-parse origin/main)"
if [ "$LOCAL_HEAD" != "$REMOTE_HEAD" ]; then if [ "$LOCAL_HEAD" != "$REMOTE_HEAD" ]; then
g merge-base --is-ancestor "$LOCAL_HEAD" "$REMOTE_HEAD" \
|| refuse "本地 main 与 origin/main 历史分叉，停止（未改写工作目录）"
TOP_AD="$(g diff --name-status HEAD origin/main | grep -E "^[AD][[:space:]]+[^/]+$" || true)" TOP_AD="$(g diff --name-status HEAD origin/main | grep -E "^[AD][[:space:]]+[^/]+$" || true)"
[ -z "$TOP_AD" ] || refuse "main 相比本地新增/删除了顶层文件，目录顶层归 root，需管理员执行： [ -z "$TOP_AD" ] || refuse "main 相比本地新增/删除了顶层文件，目录顶层归 root，需管理员执行：
$TOP_AD" $TOP_AD"
@@ -54,6 +56,8 @@ echo "==> 校验通过：本地 HEAD = origin/main = ${LOCAL_HEAD}（${SHORT}）
if [ "$MODE" = "verify-tag" ]; then if [ "$MODE" = "verify-tag" ]; then
TAG="${2:?用法: update-from-main.sh verify-tag <tag>}" TAG="${2:?用法: update-from-main.sh verify-tag <tag>}"
[ "$TAG" = "main-${SHORT}" ] \
|| refuse "镜像标签必须是当前 main 对应的 main-${SHORT}，收到：${TAG}"
LABEL="$(docker image inspect "${IMAGE_REPO}:${TAG}" \ LABEL="$(docker image inspect "${IMAGE_REPO}:${TAG}" \
--format '{{index .Config.Labels "org.opencontainers.image.revision"}}' 2>/dev/null)" \ --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' 2>/dev/null)" \
|| refuse "镜像 ${IMAGE_REPO}:${TAG} 不存在" || refuse "镜像 ${IMAGE_REPO}:${TAG} 不存在"