fix(deploy): publish unified services to temporary gray environment

scripts/test-environment-pipeline-contract.test.mjs

@@ -28,7 +28,8 @@ test('test compilation is preserved even when execution is explicitly skipped',
 
 test('coordinator and service jobs enforce their own deployment environments', () => {
  assert.match(coordinatorPipeline, /case 'backend-java':[\s\S]*?return 'test'/)
- assert.doesNotMatch(coordinatorPipeline,/return 'production'|return 'development'/)
+ assert.match(coordinatorPipeline,/case 'backend-java-prod':[\s\S]*?return 'production'/)
+ assert.doesNotMatch(coordinatorPipeline,/return 'development'/)
  assert.match(pipeline,/startsWith\('baiyue-firstleg-'\)/)
  assert.match(pipeline,/!jobBaseName.startsWith\('baiyue-firstleg-dev-'\)/)
  assert.match(pipeline,/!jobBaseName.startsWith\('baiyue-firstleg-prod-'\)/)
@@ -63,7 +64,7 @@ test('AUTO maps shared modules to their real consumers instead of rebuilding eve
 })
 
 test('TEST builds respect explicit test execution controls', () => {
- assert.doesNotMatch(coordinatorPipeline,/backend-java-prod|return 'production'/)
+ assert.match(coordinatorPipeline,/case 'backend-java-prod':[\s\S]*?return 'production'/)
  assert.match(coordinatorPipeline,/!params.SKIP_TESTS/)
  assert.match(pipeline,/boolean skipTestExecution = params.SKIP_TESTS/)
 })
@@ -74,7 +75,7 @@ test('Java builds use the shared builder pool and serialize incremental target d
  assert.match(pipeline,/lock\(resource: "firstleg-test-\$\{env.RESOLVED_SERVICE\}-deploy"/)
  assert.match(pipeline,/'TARGET_IS_LOCAL=true'/)
  assert.match(directDeployScript,/up -d --no-deps --pull never/)
- assert.doesNotMatch(directDeployScript,/--remove-orphans|run_ssh|docker save/)
+ assert.doesNotMatch(directDeployScript,/--remove-orphans|docker save/)
 })
 
 test('downstream skips tests only by explicit flag and keeps test compilation',()=>{
@@ -137,7 +138,7 @@ test('TEST deployments use explicit local env and Compose files', () => {
  assert.match(directDeployScript,/TEST deploy must run on the target host/)
  assert.match(directDeployScript,/--env-file "\$ENV_FILE"/)
  assert.match(directDeployScript,/-f "\$COMPOSE_FILE"/)
- assert.doesNotMatch(directDeployScript,/scp|run_ssh/)
+ assert.match(directDeployScript,/if \[ "\$DEPLOY_ENV" = "test" \] && \[ "\$\{TARGET_IS_LOCAL:-false\}" != "true" \]/)
 })
 
 test('shared builders use a reachable public Maven mirror instead of the retired private proxy', () => {
@@ -178,3 +179,14 @@ test('retired bridge jobs cannot be dispatched', () => {
  assert.doesNotMatch(pipeline,/EVENT_BRIDGE|event-bridge-service|gateway-overseas/)
  assert.doesNotMatch(coordinatorPipeline,/EVENT_BRIDGE|event-bridge-service|gateway-overseas/)
 })
+
+
+test('gray publication reuses verified SSH credentials and the unified health executor', () => {
+  for (const credential of ['firstleg-production-env', 'gitea-production-pull-token', 'firstleg-production-ssh', 'firstleg-production-host', 'firstleg-production-known-hosts']) assert.ok(pipeline.includes(credential))
+  assert.match(pipeline, /git merge-base --is-ancestor "\$RESOLVED_SOURCE_COMMIT" origin\/main/)
+  assert.match(directDeployScript, /StrictHostKeyChecking=yes/)
+  assert.match(directDeployScript, /trap cleanup_remote EXIT HUP INT TERM/)
+  assert.match(serviceCompose, /name: firstleg-\$\{DEPLOY_ENV:-test\}-network/)
+  assert.match(serviceCompose, /SPRING_PROFILES_ACTIVE: \$\{DEPLOY_ENV:-test\},cn/)
+  assert.doesNotMatch(directDeployScript, /deploy-blue-green|worker|StrictHostKeyChecking=no/)
+})