perf(ci): acquire deploy lock before target agent

Jenkinsfile.service

@@ -165,37 +165,37 @@ pipeline {
                 beforeAgent true
                 expression { params.DEPLOY && ['development', 'test'].contains(params.ENVIRONMENT) }
             }
-            agent {
+            agent none
-                label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'java-test'}"
-            }
             steps {
-                deleteDir()
-                unstash 'deployment-files'
                 script {
                     String deployLock = "firstleg-${params.ENVIRONMENT}-deploy"
                     String credentialId = "firstleg-${params.ENVIRONMENT}-env"
+                    String targetLabel = params.ENVIRONMENT == 'development' ? 'java-dev' : 'java-test'
                     lock(resource: deployLock, inversePrecedence: true) {
-                        echo "在目标节点 ${env.NODE_NAME} 本机部署到 ${params.ENVIRONMENT}"
+                        node(targetLabel) {
-                        withEnv([
+                            deleteDir()
-                            'TARGET_IS_LOCAL=true',
+                            try {
-                            "EVENT_BRIDGE_REGION_OVERRIDE=${params.EVENT_BRIDGE_REGION}"
+                                unstash 'deployment-files'
-                        ]) {
+                                echo "在目标节点 ${env.NODE_NAME} 本机部署到 ${params.ENVIRONMENT}"
-                            withCredentials([
+                                withEnv([
-                                file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE'),
+                                    'TARGET_IS_LOCAL=true',
-                                usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS,
+                                    "EVENT_BRIDGE_REGION_OVERRIDE=${params.EVENT_BRIDGE_REGION}"
-                                    usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')
+                                ]) {
-                            ]) {
+                                    withCredentials([
-                                sh "sh deploy/scripts/deploy-built-service.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
+                                        file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE'),
+                                        usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS,
+                                            usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')
+                                    ]) {
+                                        sh "sh deploy/scripts/deploy-built-service.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
+                                    }
+                                }
+                            } finally {
+                                cleanWs(deleteDirs: true, notFailBuild: true)
                             }
                         }
                     }
                 }
             }
-            post {
-                always {
-                    cleanWs(deleteDirs: true, notFailBuild: true)
-                }
-            }
         }
 
         stage('部署单个服务') {

scripts/test-environment-pipeline-contract.test.mjs

@@ -49,6 +49,21 @@ test('Java builds use the shared builder pool and serialize incremental target d
   assert.match(directDeployScript, /--pull never/)
 })
 
+test('development and test deployment locks are acquired before target executors', () => {
+  const directDeployStage = pipeline.slice(
+    pipeline.indexOf("stage('部署开发或测试环境')"),
+    pipeline.indexOf("stage('部署单个服务')")
+  )
+  const lockIndex = directDeployStage.indexOf('lock(resource: deployLock')
+  const nodeIndex = directDeployStage.indexOf('node(targetLabel)')
+
+  assert.match(directDeployStage, /agent none/)
+  assert.match(directDeployStage, /String targetLabel = params\.ENVIRONMENT == 'development' \? 'java-dev' : 'java-test'/)
+  assert.ok(lockIndex >= 0, 'deployment lock must exist')
+  assert.ok(nodeIndex >= 0, 'target node allocation must exist')
+  assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
+})
+
 test('parallel remote deployments keep env and compose assets isolated by project', () => {
   assert.match(directDeployScript, /REMOTE_ENV_NAME="\.env\.\$PROJECT_NAME"/)
   assert.match(directDeployScript, /REMOTE_COMPOSE_NAME="docker-compose\.\$PROJECT_NAME\.yml"/)