姚章浩
fa244c447c
界面验收第三遍（PDF）踩到：授权发布被回绝 "production release requests are disabled"。 根因：scripts/deploy-api-web.sh 的 COMPOSE_FILES 默认只叠 compose.yaml，重建 api 时没叠 compose.release-gates.yaml → PRODUCTION_RELEASE_REQUESTS_ENABLED / PRODUCTION_BACKUP_RESTORE_VERIFIED 变 false，生产授权接口被静默关闭（页面只在点击那一刻提示一句，极易误判成功能坏了）。 - 前置保护：正在运行的 api 已开闸、而本次 COMPOSE_FILES 不含门禁文件时直接拒绝 （REFUSED_WOULD_CLOSE_PRODUCTION_GATES，并打印保留门禁的正确命令；确要关闸用 ALLOW_GATE_OFF=1） - 结尾新增 === 7b 打印重建后的两道门禁状态，避免"以为开着" - 已用同一段判定逻辑覆盖三种情形（已开闸+不叠门禁→拒绝 / 已开闸+叠门禁→放行 / 显式 ALLOW_GATE_OFF→放行） 验收第三遍同时确认：PDF→MinerU 解析链路是通的（入库 completed、验收"内容处理：通过"）， 发布首轮 completed/verified（in_scope=8 foreign=8 降级保留正常），回滚 rolled_back、 目标库 enable_status=disabled。证据补进 docs/USER_FLOWS_ACCEPTANCE.md。
50 lines
3.7 KiB
Bash
50 lines
3.7 KiB
Bash
#!/usr/bin/env bash
|
||
# 重建并上线 governance api + web（本机 docker build 需要宿主代理 + --network host）
|
||
set -u
|
||
cd /home/zheromiku/knowledge-governance || exit 1
|
||
TS=$(date +%Y%m%d-%H%M%S)
|
||
PROXY_ARGS=(--build-arg HTTP_PROXY=http://127.0.0.1:7890 --build-arg HTTPS_PROXY=http://127.0.0.1:7890 --build-arg NO_PROXY=localhost,127.0.0.1 --build-arg GOPROXY=https://goproxy.cn,direct)
|
||
|
||
echo "=== 1. 打回滚标签 ($TS)"
|
||
docker tag knowledge-governance-p1-api:latest "knowledge-governance-p1-api:rollback-$TS" || exit 1
|
||
docker tag knowledge-governance-p1-web:latest "knowledge-governance-p1-web:rollback-$TS" || exit 1
|
||
|
||
echo "=== 2. 构建 api"
|
||
docker build --network host "${PROXY_ARGS[@]}" -f Dockerfile -t knowledge-governance-p1-api:latest . || { echo "API_BUILD_FAILED"; exit 1; }
|
||
|
||
echo "=== 3. 构建 web"
|
||
docker build --network host "${PROXY_ARGS[@]}" -f Dockerfile.web -t knowledge-governance-p1-web:latest . || { echo "WEB_BUILD_FAILED"; exit 1; }
|
||
|
||
echo "=== 4. 上线 api + web（不动依赖）"
|
||
# COMPOSE_FILES 让调用方叠加发布接线 / 门禁 override，默认只有基础 compose.yaml。
|
||
# 例：COMPOSE_FILES="-f compose.yaml -f compose.release-sim.yaml" bash scripts/deploy-api-web.sh
|
||
#
|
||
# 注意（2026-10-10 实测踩到）：重建 api 时若不叠加 compose.release-gates.yaml，两道生产门禁会被
|
||
# **静默关掉**（PRODUCTION_RELEASE_REQUESTS_ENABLED/BACKUP_RESTORE_VERIFIED=false），页面只在点击
|
||
# 「授权发布」时回一句 "production release requests are disabled" —— 很容易误判成功能坏了。
|
||
# 因此下面做前置保护：正在运行的 api 若已开闸、而本次没叠加门禁文件，直接拒绝（确要关闸用 ALLOW_GATE_OFF=1）。
|
||
COMPOSE_FILES_EFFECTIVE="${COMPOSE_FILES:--f compose.yaml}"
|
||
GATES_PREV=$(docker exec knowledge-governance-p1-api-1 sh -lc 'printf %s "${PRODUCTION_RELEASE_REQUESTS_ENABLED:-}"' 2>/dev/null || true)
|
||
if [ "${GATES_PREV}" = "true" ] && [[ "${COMPOSE_FILES_EFFECTIVE}" != *compose.release-gates.yaml* ]] && [ "${ALLOW_GATE_OFF:-0}" != "1" ]; then
|
||
echo "REFUSED_WOULD_CLOSE_PRODUCTION_GATES"
|
||
echo " 当前 api 已开闸（PRODUCTION_RELEASE_REQUESTS_ENABLED=true），而本次 COMPOSE_FILES 不含 compose.release-gates.yaml，"
|
||
echo " 继续会用基础 compose 重建 api → 生产授权接口被静默关闭。"
|
||
echo " 保留门禁：COMPOSE_FILES=\"-f compose.yaml -f compose.release-sim.yaml -f compose.release-gates.yaml\" bash scripts/deploy-api-web.sh"
|
||
echo " 确实要关闸：ALLOW_GATE_OFF=1 bash scripts/deploy-api-web.sh"
|
||
exit 1
|
||
fi
|
||
docker compose ${COMPOSE_FILES_EFFECTIVE} up -d --no-build --no-deps api web || { echo "UP_FAILED"; exit 1; }
|
||
|
||
echo "=== 5. 状态"
|
||
docker ps --filter name=knowledge-governance-p1 --format '{{.Names}} {{.Status}} {{.Image}}'
|
||
echo "api image=$(docker inspect -f '{{.Image}}' knowledge-governance-p1-api-1)"
|
||
echo "web image=$(docker inspect -f '{{.Image}}' knowledge-governance-p1-web-1)"
|
||
echo "=== 6. 健康"
|
||
echo "health=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8088/health)"
|
||
echo "=== 7. 生产端点环境变量（只报名字与非空）"
|
||
docker exec knowledge-governance-p1-api-1 sh -lc 'for v in PRODUCTION_WEKNORA_BASE_URL PRODUCTION_WEKNORA_API_KEY_FILE PRODUCTION_WEKNORA_ALLOW_DOCKER_HTTP; do eval "val=\$$v"; if [ -n "$val" ]; then echo "$v=<set>"; else echo "$v=<empty>"; fi; done'
|
||
echo "=== 7b. 生产门禁状态（重建后必须与预期一致）"
|
||
docker exec knowledge-governance-p1-api-1 sh -lc 'for v in PRODUCTION_RELEASE_REQUESTS_ENABLED PRODUCTION_BACKUP_RESTORE_VERIFIED; do eval "val=\$$v"; echo "$v=${val:-<empty>}"; done'
|
||
echo "=== 8. 新包"
|
||
docker exec knowledge-governance-p1-web-1 sh -lc 'grep -o "index-[A-Za-z0-9_-]*\.js" /usr/share/nginx/html/index.html | head -1'
|
||
echo "DONE" |