fix(deploy): publish unified services to temporary gray environment

Jenkinsfile.service

@@ -20,6 +20,7 @@ def serviceJars = [
 ]
 
 def fixedEnvironmentForServiceJob(String jobBaseName) {
+    if (jobBaseName?.startsWith('baiyue-firstleg-prod-')) return 'production'
     if (jobBaseName?.startsWith('baiyue-firstleg-') && !jobBaseName.startsWith('baiyue-firstleg-dev-') && !jobBaseName.startsWith('baiyue-firstleg-prod-')) {
         return 'test'
     }
@@ -89,7 +90,7 @@ pipeline {
                                 error("未配置单服务 Job ${env.JOB_BASE_NAME} 的固定部署环境，拒绝继续")
                             }
                             if (params.ENVIRONMENT != resolvedEnvironment) {
-                                error('当前单服务流水线仅允许 TEST')
+                                error('部署环境必须与当前单服务 Job 固定映射一致')
                             }
                             if (!sourceCommit || !(sourceCommit ==~ /(?i)[0-9a-f]{7,40}/)) {
                                 error('SOURCE_COMMIT 必须是 7 到 40 位十六进制 Git commit')
@@ -120,6 +121,13 @@ pipeline {
                             git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}"
                             git checkout --detach "${RESOLVED_SOURCE_COMMIT}"
                             test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")"
+                            if [ "$RESOLVED_ENVIRONMENT" = "production" ]; then
+                              git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+                              git merge-base --is-ancestor "$RESOLVED_SOURCE_COMMIT" origin/main || {
+                                echo "灰度发布提交必须已经合并到 main" >&2
+                                exit 1
+                              }
+                            fi
                         '''
 
 
@@ -188,7 +196,7 @@ pipeline {
         }
 
         stage('部署 TEST') {
-            when { expression { params.DEPLOY } }
+            when { expression { params.DEPLOY && env.RESOLVED_ENVIRONMENT == 'test' } }
             agent none
             steps {
                 script {
@@ -209,6 +217,34 @@ pipeline {
                 }
             }
         }
+
+        stage('部署临时灰度') {
+            when { expression { params.DEPLOY && env.RESOLVED_ENVIRONMENT == 'production' } }
+            agent none
+            steps {
+                script {
+                    lock(resource: "firstleg-production-${env.RESOLVED_SERVICE}-deploy", inversePrecedence: true) {
+                        node('java-builder') {
+                            deleteDir()
+                            unstash 'deployment-files'
+                            withCredentials([
+                                file(credentialsId: 'firstleg-production-env', variable: 'DEPLOY_ENV_FILE'),
+                                usernamePassword(credentialsId: 'gitea-production-pull-token', usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD'),
+                                sshUserPrivateKey(credentialsId: 'firstleg-production-ssh', keyFileVariable: 'TARGET_SSH_KEY', usernameVariable: 'TARGET_SSH_USER'),
+                                string(credentialsId: 'firstleg-production-host', variable: 'TARGET_SSH_HOST'),
+                                file(credentialsId: 'firstleg-production-known-hosts', variable: 'TARGET_SSH_KNOWN_HOSTS')
+                            ]) {
+                                withEnv(['TARGET_IS_LOCAL=false', 'TARGET_SSH_TARGET=' + env.TARGET_SSH_USER + '@' + env.TARGET_SSH_HOST,
+                                    "ALLOW_SAME_CONTRACT_ROLLBACK=${params.ALLOW_SAME_CONTRACT_ROLLBACK}"]) {
+                                    sh 'sh deploy/scripts/deploy-built-service.sh production "$RESOLVED_IMAGE_REPOSITORY" "$RESOLVED_IMAGE_TAG" "$RESOLVED_SERVICE" "$DEPLOY_ENV_FILE"'
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
     }
 
     post {