部署(HEL-235): 固化 git 归档流式构建为唯一安全构建入口

Co-authored-by: multica-agent <github@multica.ai>
2026-08-29 13:43:04 +08:00
parent cefc86917d
commit a50d48e5d4
3 changed files with 132 additions and 3 deletions
@@ -17,6 +17,12 @@ registry, and verification tools.
  `backend/features/*/routes.py` owners.
 - `python tools/build_architecture_inventory.py [--check]`: generate or verify
  `config/architecture-inventory.json` from the current source tree.
+- `bash tools/build_image.sh <commit> <tag>`: the only sanctioned way to build the
+  production Docker image. Streams `git archive <commit>` to the deploy host over SSH
+  (default `moxiaobai@192.168.200.11`), refuses tags that do not end with the commit
+  short SHA, verifies the revision label after the build, and appends a record to
+  `~/xiaobai-build/BUILD_LOG.tsv` on the host. Building from any server-side working
+  tree is forbidden; see `DOCKER_DEPLOY.md`.

 `verify_baseline.py` does not inspect a parent checkout or skip tests according to files outside
 this application. Historical comparison scripts were retired after final standalone acceptance;