ci: 收口生产 main 分支部署流程

Jenkinsfile

@@ -170,8 +170,8 @@ pipeline {
         choice(name: 'ENVIRONMENT', choices: environmentChoicesForJob(env.JOB_BASE_NAME), description: '部署环境')
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '各服务构建成功后是否独立部署')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选')
-        string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库地址')
-        string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像')
+        string(name: 'IMAGE_REPOSITORY', defaultValue: 'git.buggoglobal.com/java-project/baiyue-firstleg', description: '共享镜像仓库地址')
+        string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
         choice(name: 'DOWNSTREAM_JOB_PREFIX', choices: downstreamJobPrefixChoicesForJob(env.JOB_BASE_NAME), description: '由当前总控 Job 固定的单服务 Job 前缀')
     }
 
@@ -192,6 +192,17 @@ pipeline {
                     env.RESOLVED_ENVIRONMENT = resolvedEnvironment
                     echo "Job ${env.JOB_BASE_NAME} 使用部署环境: ${env.RESOLVED_ENVIRONMENT}"
 
+                    if (env.RESOLVED_ENVIRONMENT == 'production') {
+                        sh '''
+                            set -eu
+                            git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+                            test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" || {
+                              echo "生产构建只允许 origin/main 当前提交；请先通过 Pull Request 合并到 main 后再部署" >&2
+                              exit 1
+                            }
+                        '''
+                    }
+
                     String requestedRepository = params.IMAGE_REPOSITORY?.trim()
                     if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') {
                         error('必须填写真实镜像仓库地址')