Merge remote-tracking branch 'origin/test' into dev

# Conflicts:
#	scripts/admin-test-env-modules/phase4-overseas-pda.mjs

README.md

@@ -35,15 +35,17 @@ GitLab 在独立 Node 镜像中自动执行拓扑合同，随后才允许服务
 
 ## 容器日志
 
-所有服务只向标准输出和标准错误写日志，不在容器内生成应用日志文件，也不把应用日志目录挂载到宿主机。国内、海外 Compose 统一使用 Docker `local` 日志驱动；仍可通过 `docker logs` 排查。文件服务的 `/data/files` 是业务文件目录，不属于日志目录，必须继续持久化。
+所有服务只向标准输出和标准错误写日志，不在容器内生成应用日志文件，也不把应用日志目录挂载到宿主机。国内、海外及基础设施 Compose 默认使用宝塔可见的 Docker `json-file` 日志驱动，并设置强制轮转；仍可通过 `docker logs` 排查。文件服务的 `/data/files` 是业务文件目录，不属于日志目录，必须继续持久化。
 
 单容器默认保留 `50m × 3`，可在各环境部署变量中覆盖：
 
-| 环境 | `DOCKER_LOG_MAX_SIZE` | `DOCKER_LOG_MAX_FILE` | 长期留存 |
-|---|---:|---:|---|
-| 开发 | `20m` | `2` | 不要求 |
-| 测试 | `50m` | `3` | 不要求 |
-| 生产 | `100m` | `5` | 必须由集中日志系统负责，Docker 本机日志只作短期缓冲 |
+| 环境 | `DOCKER_LOG_DRIVER` | `DOCKER_LOG_MAX_SIZE` | `DOCKER_LOG_MAX_FILE` | 长期留存 |
+|---|---|---:|---:|---|
+| 开发 | `json-file` | `20m` | `2` | 不要求 |
+| 测试 | `json-file` | `50m` | `3` | 不要求 |
+| 生产前期 | `json-file` | `100m` | `5` | 宝塔与 `docker logs` 提供短期排障能力 |
+
+当前优先保证宝塔可观测性，因此不启用 `json-file` 压缩或非阻塞投递，避免面板无法读取轮转文件或在日志压力下静默丢弃。接入集中日志系统后，可通过 `DOCKER_LOG_DRIVER` 切换驱动，并由集中系统承担长期检索与留存。
 
 调整日志策略后必须重新创建容器；只重启既有容器不会改变其日志驱动。历史 `/data/logs/baiyue-firstleg` 文件和旧容器日志不自动删除，确认无需保留后再单独清理。
 

deploy/docker-compose.overseas.yml

@@ -26,8 +26,8 @@ x-overseas-common: &overseas-common
     SPRING_SQL_INIT_MODE: never
     TZ: Asia/Shanghai
   logging:
-    # 应用只写 stdout/stderr；local 驱动负责单份本机日志与轮转。
-    driver: local
+    # 应用只写 stdout/stderr；json-file 兼容宝塔查看，大小与数量均受控。
+    driver: ${DOCKER_LOG_DRIVER:-json-file}
     options:
       max-size: ${DOCKER_LOG_MAX_SIZE:-50m}
       max-file: "${DOCKER_LOG_MAX_FILE:-3}"

deploy/docker-compose.rocketmq.yml

@@ -1,10 +1,17 @@
 name: firstleg-${DEPLOY_ENV:-test}-rocketmq
 
+x-bounded-logging: &bounded-logging
+  driver: ${DOCKER_LOG_DRIVER:-json-file}
+  options:
+    max-size: ${DOCKER_LOG_MAX_SIZE:-50m}
+    max-file: "${DOCKER_LOG_MAX_FILE:-3}"
+
 services:
   rocketmq-namesrv:
     image: apache/rocketmq:5.3.1
     restart: unless-stopped
     command: sh mqnamesrv
+    logging: *bounded-logging
     networks: [infra-network]
 
   rocketmq-broker:
@@ -17,6 +24,7 @@ services:
       - ./rocketmq:/config:ro
       - ${ROCKETMQ_DATA_DIR:-/data/firstleg/rocketmq/store}:/home/rocketmq/store
     command: sh /config/render-broker-config.sh
+    logging: *bounded-logging
     networks: [infra-network]
 
   rocketmq-topic-init:
@@ -46,6 +54,7 @@ services:
       -t "%DLQ%$${MQ_TOPIC_PREFIX}baiyue-audit-consumer-v1" -r 1 -w 1 -p 6'
     # Broker 注册较慢或任一初始化命令失败时整组重试；所有命令均幂等。
     restart: on-failure
+    logging: *bounded-logging
     networks: [infra-network]
 
 networks:

deploy/docker-compose.yml

@@ -28,8 +28,8 @@ x-common: &common
     DATA_RESIDENCY: ${DATA_RESIDENCY:-CN}
     TZ: Asia/Shanghai
   logging:
-    # 应用只写 stdout/stderr；local 驱动负责单份本机日志与轮转。
-    driver: local
+    # 应用只写 stdout/stderr；json-file 兼容宝塔查看，大小与数量均受控。
+    driver: ${DOCKER_LOG_DRIVER:-json-file}
     options:
       max-size: ${DOCKER_LOG_MAX_SIZE:-50m}
       max-file: "${DOCKER_LOG_MAX_FILE:-3}"

docker-compose-infra.yml

@@ -1,5 +1,11 @@
 name: firstleg-test-infra
 
+x-bounded-logging: &bounded-logging
+  driver: ${DOCKER_LOG_DRIVER:-json-file}
+  options:
+    max-size: ${DOCKER_LOG_MAX_SIZE:-50m}
+    max-file: "${DOCKER_LOG_MAX_FILE:-3}"
+
 services:
   nacos:
     image: docker.m.daocloud.io/nacos/nacos-server:v2.3.2
@@ -22,6 +28,7 @@ services:
       retries: 20
       start_period: 30s
     restart: unless-stopped
+    logging: *bounded-logging
     networks: [baiyue]
 
   mysql:
@@ -46,6 +53,7 @@ services:
       retries: 20
       start_period: 30s
     restart: unless-stopped
+    logging: *bounded-logging
     networks: [baiyue]
 
   redis:
@@ -62,6 +70,7 @@ services:
       timeout: 5s
       retries: 10
     restart: unless-stopped
+    logging: *bounded-logging
     networks: [baiyue]
 
 volumes:

scripts/README.md

@@ -133,7 +133,7 @@ node scripts/create-pending-review-orders.mjs
 | Mapper 注册静态合同 | `node scripts/mapper-scan-contract.mjs`、`node --test scripts/mapper-scan-contract.test.mjs`；自动核对全部持久化模块的 `@Mapper`、服务根包注解过滤扫描和唯一扫描入口，不启动 Spring、不连接数据库；`backend-full-regression.ps1` 在 Maven 前强制执行 |
 | Java 质量聚合摘要 | `node --test scripts/java-quality-summary.test.mjs`、`node scripts/java-quality-summary.mjs --output target/java-quality-summary.json`；聚合 Maven/服务拓扑、OpenAPI 覆盖、JaCoCo 和 SpotBugs 报告，默认只报告存量缺口，CI 用显式 `--require-jacoco --require-spotbugs` 检查报告完整性且当前允许失败 |
 | 单服务部署失败回滚合同 | `scripts/deploy-built-service-rollback.test.mjs`；模拟成功、健康失败和启动失败，确认仅恢复同服务先前健康镜像且部署任务仍失败 |
-| 容器日志单写合同 | `scripts/container-logging-contract.test.mjs`；离线确认应用只写标准输出、Compose 使用有界 `local` 驱动且不挂载应用日志目录 |
+| 容器日志单写合同 | `scripts/container-logging-contract.test.mjs`；离线确认应用只写标准输出、Compose 默认使用宝塔可见的有界 `json-file` 驱动且不挂载应用日志目录 |
 
 Admin/Client HTTP 脚本的离线合同只验证脚本结构、参数和模块边界，不访问测试环境：
 

scripts/admin-test-env-modules/phase4-overseas-pda-contract.test.mjs

@@ -98,6 +98,8 @@ test('PDA module covers the container-number receiving contract and excludes out
   assert.match(source, /item\?\.shippingReady === false/)
   assert.match(source, /!expectedSet\.has\(id\(item\?\.containerNo\)\)/)
   assert.match(source, /unexpectedAwaiting=/)
+  assert.match(source, /candidatesByContainer\.get\(containerNo\)\?\.operable === true/)
+  assert.match(source, /candidatesByContainer\.get\(containerNo\)\?\.operable !== true/)
   assert.match(source, /missingPickupReady\.length === 0 && unexpectedAwaiting\.length === 0/)
   assert.doesNotMatch(source, /shippingReady == null|shippingReady !== true/)
   assert.match(source, /nonBlank\(item\?\.resourceKey\)/)

scripts/admin-test-env-modules/phase4-overseas-pda.mjs

@@ -350,22 +350,23 @@ async function awaitPickupReadyCandidates(context, token, producers, allProducer
   const known = new Set(allProducers.map((item) => id(item?.containerNo)).filter(nonBlank))
   if (!expected.length) return false
   let response = null
-  let seen = new Set()
+  let candidatesByContainer = new Map()
   for (let attempt = 1; attempt <= 30; attempt += 1) {
     response = await context.requestOverseas('GET',
       '/api/pda/v1/last-leg/receiving-containers/candidates', undefined, {}, token)
     const candidateRows = success(response) && Array.isArray(response.body?.data) ? response.body.data : []
-    seen = new Set(candidateRows.map((item) => id(item?.containerNo)).filter(nonBlank))
-    if (expected.every((containerNo) => seen.has(containerNo))
-        && awaiting.every((containerNo) => !seen.has(containerNo))) break
+    candidatesByContainer = new Map(candidateRows
+      .map((item) => [id(item?.containerNo), item]).filter(([containerNo]) => nonBlank(containerNo)))
+    if (expected.every((containerNo) => candidatesByContainer.get(containerNo)?.operable === true)
+        && awaiting.every((containerNo) => candidatesByContainer.get(containerNo)?.operable !== true)) break
     await new Promise((resolve) => setTimeout(resolve, 1000))
   }
-  const seenExpected = expected.filter((containerNo) => seen.has(containerNo))
-  const missingPickupReady = expected.filter((containerNo) => !seen.has(containerNo))
-  const unexpectedAwaiting = awaiting.filter((containerNo) => seen.has(containerNo))
-  const unexpectedHistorical = [...seen].filter((containerNo) => !known.has(containerNo))
+  const seenExpected = expected.filter((containerNo) => candidatesByContainer.has(containerNo))
+  const missingPickupReady = expected.filter((containerNo) => candidatesByContainer.get(containerNo)?.operable !== true)
+  const unexpectedAwaiting = awaiting.filter((containerNo) => candidatesByContainer.get(containerNo)?.operable === true)
+  const unexpectedHistorical = [...candidatesByContainer.keys()].filter((containerNo) => !known.has(containerNo))
   const targetCorrelated = producers.every((item) => nonBlank(item?.resourceKey)
-    && item?.shippingReady !== false && seen.has(id(item?.containerNo)))
+    && item?.shippingReady !== false && candidatesByContainer.get(id(item?.containerNo))?.operable === true)
   const ready = missingPickupReady.length === 0 && unexpectedAwaiting.length === 0 && targetCorrelated
   context.addStep(MODULE, '实际处理柜全部达到PICKUP_READY并进入PDA候选', response, ready,
     `targetCorrelated=${targetCorrelated}, expected=${expected.join('|')}, awaiting=${awaiting.join('|') || 'none'}, seenExpected=${seenExpected.join('|') || 'none'}, missingPickupReady=${missingPickupReady.join('|') || 'none'}, unexpectedAwaiting=${unexpectedAwaiting.join('|') || 'none'}, unexpectedHistorical=${unexpectedHistorical.join('|') || 'none'}; ${trace(response)}`, OPTIONS)

scripts/container-logging-contract.test.mjs

@@ -28,6 +28,11 @@ const composeFiles = [
   'deploy/docker-compose.overseas.yml',
 ];
 
+const infrastructureComposeFiles = [
+  ['deploy/docker-compose.rocketmq.yml', 3],
+  ['docker-compose-infra.yml', 3],
+];
+
 test('deployable applications log only to stdout and stderr', () => {
   for (const path of applicationConfigs) {
     const source = readFileSync(path, 'utf8');
@@ -35,10 +40,10 @@ test('deployable applications log only to stdout and stderr', () => {
   }
 });
 
-test('Compose uses one bounded local log stream without application log mounts', () => {
+test('Compose uses one bounded BaoTa-compatible log stream without application log mounts', () => {
   for (const path of composeFiles) {
     const source = readFileSync(path, 'utf8');
-    assert.match(source, /driver:\s+local/, path);
+    assert.match(source, /driver:\s+\$\{DOCKER_LOG_DRIVER:-json-file\}/, path);
     assert.match(source, /DOCKER_LOG_MAX_SIZE/, path);
     assert.match(source, /DOCKER_LOG_MAX_FILE/, path);
     assert.doesNotMatch(source, /LOG_PATH|LOG_ROOT|\/app\/logs/, path);
@@ -52,3 +57,19 @@ test('runtime image does not prepare an application log directory', () => {
   const dockerfile = readFileSync('deploy/docker/Dockerfile', 'utf8');
   assert.doesNotMatch(dockerfile, /\/app\/logs/);
 });
+
+test('infrastructure containers also use bounded BaoTa-compatible logs', () => {
+  for (const [path, expectedServiceCount] of infrastructureComposeFiles) {
+    const source = readFileSync(path, 'utf8');
+    assert.match(source, /x-bounded-logging:\s+&bounded-logging/, path);
+    assert.match(source, /driver:\s+\$\{DOCKER_LOG_DRIVER:-json-file\}/, path);
+    assert.match(source, /DOCKER_LOG_MAX_SIZE/, path);
+    assert.match(source, /DOCKER_LOG_MAX_FILE/, path);
+    assert.equal(
+      source.match(/logging:\s+\*bounded-logging/g)?.length,
+      expectedServiceCount,
+      path,
+    );
+    assert.doesNotMatch(source, /driver:\s+local/, path);
+  }
+});