Codex Release Bot
79 lines
3.2 KiB
Markdown
79 lines
3.2 KiB
Markdown
# Phase 1 Delta 审计 — Wave D7（Deploy / 本地验证脚本）
|
||
|
||
**日期**: 2026-06-04
|
||
**范围**: 门控脚本 + 本地 dev/verify + docker-compose
|
||
**标准**: 变更审查（运维/门控；非业务 API 8 步，沿用 Closure 表格式）
|
||
|
||
## 登记
|
||
|
||
| # | 文件 | 语言 | 行数 N | Read 范围 |
|
||
|---|------|------|--------|-----------|
|
||
| 1 | `deploy/pre_deploy_check.sh` | Bash | 299 | 1–299 全文 |
|
||
| 2 | `scripts/local_verify.sh` | Bash | 25 | 1–25 全文 |
|
||
| 3 | `scripts/local_integration_smoke.sh` | Bash | 91 | 1–91 全文 |
|
||
| 4 | `scripts/start-dev.sh` | Bash | 90 | 1–90 全文 |
|
||
| 5 | `docker-compose.yml` | YAML | 89 | 1–89 全文 |
|
||
|
||
## Step 3 — 规则扫描 H（摘要）
|
||
|
||
| 文件 | H 命中 |
|
||
|------|--------|
|
||
| pre_deploy_check.sh | H-Gate, H-Secret, H-Git |
|
||
| local_verify.sh | H-Chain |
|
||
| local_integration_smoke.sh | H-Health, H-Auth |
|
||
| start-dev.sh | H-DevBind, H-Env |
|
||
| docker-compose.yml | H-Port, H-DefaultCreds |
|
||
|
||
## 入口表（脚本调用链）
|
||
|
||
```
|
||
local_verify.sh
|
||
→ start-dev.sh (docker mysql+redis, uvicorn :8600)
|
||
→ local_integration_smoke.sh (/health, JWT 401, unit tests)
|
||
→ tests/test_api.py
|
||
→ ruff check server/ -F
|
||
|
||
pre_deploy_check.sh (独立 L3 门控，7+2 pre-flight)
|
||
```
|
||
|
||
## Closure 表
|
||
|
||
| H | 文件:行号 | 判定 | 理由 |
|
||
|---|-----------|------|------|
|
||
| H-Gate | pre_deploy_check.sh:50-74 | SAFE | Changelog 日期+≥10 行 |
|
||
| H-Gate | pre_deploy_check.sh:76-105 | RISK | 审计路径 `docs/audit/`；delta 报告在 `docs/reports/` 不自动过 Gate2 |
|
||
| H-Gate | pre_deploy_check.sh:107-131 | SAFE | test_api 必须存在且通过 |
|
||
| H-Gate | pre_deploy_check.sh:134-160 | SAFE | ruff F；未装则 SKIP |
|
||
| H-Gate | pre_deploy_check.sh:194-218 | RISK | bandit `-ll` 仅 HIGH；文档写 HIGH/MEDIUM 有漂移 |
|
||
| H-Gate | pre_deploy_check.sh:221-258 | RISK | Gate7 用 `HEAD~1` diff；未 commit 改动可能漏检 |
|
||
| H-Gate | pre_deploy_check.sh:261-284 | SAFE | shell/text EOL pre-flight |
|
||
| H-Chain | local_verify.sh:10-22 | SAFE | 固定顺序 smoke→test_api→ruff |
|
||
| H-Health | local_integration_smoke.sh:67-70 | SAFE | /health 200 |
|
||
| H-Auth | local_integration_smoke.sh:72-75 | SAFE | /api/servers/ 无 JWT → 401 |
|
||
| H-DevBind | start-dev.sh:75-76 | RISK | uvicorn `--host 0.0.0.0` 仅本地 dev |
|
||
| H-Env | start-dev.sh:29-32 | SAFE | 无 .env 时 generate_env，不写 git |
|
||
| H-Port | docker-compose.yml:40-41 | SAFE | Redis publish 6379 修复本机 uvicorn 连 Redis |
|
||
| H-Port | docker-compose.yml:26-27 | RISK | MySQL 3306 暴露主机；dev 惯例 |
|
||
| H-DefaultCreds | docker-compose.yml:14-17 | RISK | 默认 dev 密码；非生产 compose |
|
||
| H-Secret | docker-compose.yml:68-70 | SAFE | SECRET/API/ENCRYPTION 从 env 注入，无硬编码 |
|
||
|
||
**len(H)=16, Closure=16**
|
||
|
||
## FINDING
|
||
|
||
无 P0/P1 新 FINDING。
|
||
|
||
**运维备注（非阻塞）**：
|
||
- Phase1 delta 报告在 `docs/reports/audit-delta-*.md`；部署前若只跑 pre_deploy，需另备 `docs/audit/YYYY-MM-DD-*.md` 或调整 Gate2 路径。
|
||
- 生产部署仍走 SSH + handoff，不依赖本 compose 默认密码。
|
||
|
||
## DoD
|
||
|
||
- [x] len(H) == Closure
|
||
- [x] 五文件全文 Read
|
||
- [x] local_verify 链路可复现
|
||
|
||
## 验证
|
||
|
||
`bash scripts/local_verify.sh` — 全绿
|