261 lines
12 KiB
JavaScript
261 lines
12 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
|
|
import { existsSync } from 'node:fs'
|
|
import { tmpdir } from 'node:os'
|
|
import { delimiter, join, resolve } from 'node:path'
|
|
import { spawnSync } from 'node:child_process'
|
|
import test from 'node:test'
|
|
|
|
const repositoryRoot = resolve(import.meta.dirname, '..')
|
|
const deployScript = resolve(repositoryRoot, 'deploy/scripts/deploy-built-service.sh')
|
|
const shell = process.platform === 'win32'
|
|
? 'C:/Program Files/Git/bin/bash.exe'
|
|
: '/bin/sh'
|
|
|
|
const mockDocker = `#!/usr/bin/env sh
|
|
set -eu
|
|
printf '%s\\n' "$*" >> "$MOCK_LOG"
|
|
command="$1"
|
|
shift
|
|
case "$command" in
|
|
login|logout|pull)
|
|
exit 0
|
|
;;
|
|
compose)
|
|
action=''
|
|
for argument in "$@"; do
|
|
case "$argument" in
|
|
ps|up) action="$argument" ;;
|
|
esac
|
|
done
|
|
case "$action" in
|
|
ps)
|
|
echo mock-container
|
|
;;
|
|
up)
|
|
service=''
|
|
for argument in "$@"; do service="$argument"; done
|
|
if [ "$IMAGE_TAG" = "\${MOCK_FAIL_UP_TAG:-never}" ]; then
|
|
exit 3
|
|
fi
|
|
printf '%s\\n' "$IMAGE_REPOSITORY/$service:$IMAGE_TAG" > "$MOCK_CURRENT_IMAGE"
|
|
if [ "$IMAGE_TAG" = "\${MOCK_FAIL_TAG:-never}" ]; then
|
|
printf '%s\\n' unhealthy > "$MOCK_HEALTH_STATE"
|
|
elif [ "$IMAGE_TAG" = "\${MOCK_RESTART_TAG:-never}" ]; then
|
|
printf '%s\\n' starting > "$MOCK_HEALTH_STATE"
|
|
printf '%s\\n' restarting > "$MOCK_RUNTIME_STATE"
|
|
else
|
|
printf '%s\\n' "\${MOCK_HEALTH_SUCCESS:-healthy}" > "$MOCK_HEALTH_STATE"
|
|
printf '%s\\n' running > "$MOCK_RUNTIME_STATE"
|
|
fi
|
|
;;
|
|
esac
|
|
;;
|
|
inspect)
|
|
case "$2" in
|
|
*Config.Image*) cat "$MOCK_CURRENT_IMAGE" ;;
|
|
*State.Health*) cat "$MOCK_HEALTH_STATE" ;;
|
|
*State.Status*) cat "$MOCK_RUNTIME_STATE" ;;
|
|
*) exit 2 ;;
|
|
esac
|
|
;;
|
|
logs)
|
|
echo 'mock startup failure'
|
|
;;
|
|
*)
|
|
echo "unexpected docker command: $command $*" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
`
|
|
|
|
async function runDeployment({ imageTag, failingTag, failingStartTag, restartingTag, allowRollback = true, environment = 'test', service = 'audit-service', missingHealth = false, topicPrefix = `${environment}-`, remote = false }) {
|
|
const temporaryDirectory = await mkdtemp(join(tmpdir(), 'firstleg-rollback-'))
|
|
const mockBin = join(temporaryDirectory, 'bin')
|
|
const dockerPath = join(mockBin, 'docker')
|
|
const envFile = join(temporaryDirectory, 'deployment.env')
|
|
const logFile = join(temporaryDirectory, 'docker.log')
|
|
const currentImageFile = join(temporaryDirectory, 'current-image')
|
|
const healthStateFile = join(temporaryDirectory, 'health-state')
|
|
const runtimeStateFile = join(temporaryDirectory, 'runtime-state')
|
|
|
|
await mkdir(mockBin)
|
|
await writeFile(dockerPath, mockDocker, 'utf8')
|
|
await chmod(dockerPath, 0o755)
|
|
if (remote) {
|
|
await writeFile(join(mockBin, 'ssh'), `#!/usr/bin/env sh
|
|
set -eu
|
|
for argument in "$@"; do command="$argument"; done
|
|
printf '%s\\n' "$command" >> "$MOCK_SSH_LOG"
|
|
exec sh -c "$command"
|
|
`)
|
|
await writeFile(join(mockBin, 'scp'), `#!/usr/bin/env sh
|
|
set -eu
|
|
while [ "$#" -gt 2 ]; do shift; done
|
|
cp "$1" "\${2#*:}"
|
|
`)
|
|
await chmod(join(mockBin, 'ssh'), 0o755)
|
|
await chmod(join(mockBin, 'scp'), 0o755)
|
|
await writeFile(join(temporaryDirectory, 'key'), 'fixture')
|
|
await writeFile(join(temporaryDirectory, 'known-hosts'), 'fixture')
|
|
}
|
|
|
|
await writeFile(envFile, ['NACOS_SERVER_ADDR=nacos:8848','NACOS_NAMESPACE=test-id','NACOS_USERNAME=fixture','NACOS_PASSWORD=fixture','REDIS_HOST=redis','REDIS_PORT=6379','REDIS_DATABASE=0','REDIS_TOKEN_KEY_PREFIX=baiyue:auth','INTERNAL_SERVICE_TOKEN=fixture','JWT_RSA_JWK_SET=fixture','JWT_CURRENT_KID=fixture','ROCKETMQ_NAME_SERVER=namesrv:9876',`MQ_TOPIC_PREFIX=${topicPrefix}`,'AUDIT_DB_URL=jdbc:mysql://mysql/audit','AUDIT_DB_USERNAME=fixture','AUDIT_DB_PASSWORD=fixture',''].join('\n'), 'utf8')
|
|
await writeFile(logFile, '', 'utf8')
|
|
await writeFile(currentImageFile, 'registry.local/group/firstleg/audit-service:oldgood\n', 'utf8')
|
|
await writeFile(healthStateFile, 'healthy\n', 'utf8')
|
|
await writeFile(runtimeStateFile, 'running\n', 'utf8')
|
|
|
|
const result = spawnSync(shell, [
|
|
'-c', 'PATH="$MOCK_BIN:$PATH"; export PATH; exec sh "$@"', 'fixture',
|
|
deployScript.replaceAll('\\', '/'),
|
|
environment,
|
|
'registry.local/group/firstleg',
|
|
imageTag,
|
|
service,
|
|
envFile.replaceAll('\\', '/')
|
|
], {
|
|
cwd: repositoryRoot,
|
|
encoding: 'utf8',
|
|
env: {
|
|
...process.env,
|
|
PATH: `${mockBin}${delimiter}${process.env.PATH ?? ''}`,
|
|
MOCK_BIN: mockBin.replaceAll('\\', '/').replace(/^([A-Za-z]):/, (_, drive) => `/${drive.toLowerCase()}`),
|
|
TARGET_IS_LOCAL: remote ? 'false' : 'true',
|
|
TARGET_SSH_TARGET: 'fixture@fixture',
|
|
TARGET_SSH_KEY: join(temporaryDirectory, 'key').replaceAll('\\', '/'),
|
|
TARGET_SSH_KNOWN_HOSTS: join(temporaryDirectory, 'known-hosts').replaceAll('\\', '/'),
|
|
MOCK_SSH_LOG: join(temporaryDirectory, 'ssh.log').replaceAll('\\', '/'),
|
|
ALLOW_SAME_CONTRACT_ROLLBACK: String(allowRollback),
|
|
REGISTRY_USER: 'ci-user',
|
|
REGISTRY_PASSWORD: 'ci-password',
|
|
DEPLOY_HEALTH_TIMEOUT_SECONDS: '2',
|
|
DEPLOY_HEALTH_POLL_SECONDS: '1',
|
|
MOCK_HEALTH_SUCCESS: missingHealth ? 'no-health:running' : 'healthy',
|
|
MOCK_LOG: logFile,
|
|
MOCK_CURRENT_IMAGE: currentImageFile,
|
|
MOCK_HEALTH_STATE: healthStateFile,
|
|
MOCK_FAIL_TAG: failingTag ?? 'never',
|
|
MOCK_FAIL_UP_TAG: failingStartTag ?? 'never',
|
|
MOCK_RESTART_TAG: restartingTag ?? 'never',
|
|
MOCK_RUNTIME_STATE: runtimeStateFile
|
|
}
|
|
})
|
|
|
|
const dockerLog = await readFile(logFile, 'utf8')
|
|
const currentImage = (await readFile(currentImageFile, 'utf8')).trim()
|
|
const sshLog = remote ? await readFile(join(temporaryDirectory, 'ssh.log'), 'utf8').catch(() => '') : ''
|
|
await rm(temporaryDirectory, { recursive: true, force: true })
|
|
return { ...result, dockerLog, currentImage, sshLog }
|
|
}
|
|
|
|
test('successful deployment keeps the new healthy image', async (context) => {
|
|
if (!existsSync(shell)) context.skip(`shell unavailable: ${shell}`)
|
|
|
|
const result = await runDeployment({ imageTag: 'newgood' })
|
|
|
|
assert.equal(result.status, 0, result.stderr)
|
|
assert.match(result.stdout, /部署前运行镜像: registry\.local\/group\/firstleg\/audit-service:oldgood/)
|
|
assert.match(result.stdout, /新镜像健康检查通过: registry\.local\/group\/firstleg\/audit-service:newgood/)
|
|
assert.equal(result.currentImage, 'registry.local/group/firstleg/audit-service:newgood')
|
|
})
|
|
|
|
test('unhealthy deployment restores the previous healthy image and still fails the job', async (context) => {
|
|
if (!existsSync(shell)) context.skip(`shell unavailable: ${shell}`)
|
|
|
|
const result = await runDeployment({ imageTag: 'newbad', failingTag: 'newbad' })
|
|
const output = `${result.stdout}\n${result.stderr}`
|
|
|
|
assert.equal(result.status, 1, output)
|
|
assert.match(output, /新镜像健康检查失败: registry\.local\/group\/firstleg\/audit-service:newbad/)
|
|
assert.match(output, /新镜像容器最近日志（最多 200 行）:/)
|
|
assert.match(output, /mock startup failure/)
|
|
assert.match(result.dockerLog, /logs --tail 200 mock-container/)
|
|
assert.match(output, /开始自动回滚到: registry\.local\/group\/firstleg\/audit-service:oldgood/)
|
|
assert.match(output, /自动回滚成功: registry\.local\/group\/firstleg\/audit-service:oldgood/)
|
|
assert.match(result.dockerLog, /pull registry\.local\/group\/firstleg\/audit-service:oldgood/)
|
|
assert.equal(result.currentImage, 'registry.local/group/firstleg/audit-service:oldgood')
|
|
})
|
|
|
|
test('failed compose start also restores the previous healthy image', async (context) => {
|
|
if (!existsSync(shell)) context.skip(`shell unavailable: ${shell}`)
|
|
|
|
const result = await runDeployment({ imageTag: 'newbroken', failingStartTag: 'newbroken' })
|
|
const output = `${result.stdout}\n${result.stderr}`
|
|
|
|
assert.equal(result.status, 1, output)
|
|
assert.match(output, /新镜像启动命令失败: registry\.local\/group\/firstleg\/audit-service:newbroken/)
|
|
assert.match(output, /自动回滚成功: registry\.local\/group\/firstleg\/audit-service:oldgood/)
|
|
assert.equal(result.currentImage, 'registry.local/group/firstleg/audit-service:oldgood')
|
|
})
|
|
|
|
test('restart loops fail fast and restore the previous image', async (context) => {
|
|
if (!existsSync(shell)) context.skip(`shell unavailable: ${shell}`)
|
|
|
|
const result = await runDeployment({ imageTag: 'restarting', restartingTag: 'restarting' })
|
|
const output = `${result.stdout}\n${result.stderr}`
|
|
|
|
assert.equal(result.status, 1, output)
|
|
assert.match(output, /容器未保持运行，立即停止等待: restarting/)
|
|
assert.match(output, /自动回滚成功: registry\.local\/group\/firstleg\/audit-service:oldgood/)
|
|
assert.equal(result.currentImage, 'registry.local/group/firstleg/audit-service:oldgood')
|
|
})
|
|
|
|
test('architecture switch failure does not roll back one old service', async () => {
|
|
const result = await runDeployment({imageTag:'newbad', failingTag:'newbad', allowRollback:false})
|
|
assert.equal(result.status,1)
|
|
assert.doesNotMatch(result.dockerLog,/pull .*:oldgood/)
|
|
assert.match(result.stderr,/Automatic rollback disabled/)
|
|
})
|
|
test('unsupported environments and retired services fail before Docker', async () => {
|
|
for(const options of [{environment:'development'},{service:'event-bridge-service'},{service:'gateway-overseas'}]){
|
|
const result=await runDeployment({imageTag:'newgood',...options})
|
|
assert.equal(result.status,2)
|
|
assert.equal(result.dockerLog,'')
|
|
}
|
|
})
|
|
|
|
test('running without HEALTHCHECK cannot be counted as deployed',async()=>{
|
|
const result=await runDeployment({imageTag:'newgood',missingHealth:true,allowRollback:false})
|
|
assert.equal(result.status,1)
|
|
assert.match(result.stderr,/Missing HEALTHCHECK/)
|
|
})
|
|
test('SQL initializer rejects absent authorization before any Docker call',()=>{
|
|
const result=spawnSync(shell,[resolve(repositoryRoot,'deploy/scripts/initialize-test-databases.sh').replaceAll('\\','/')],{encoding:'utf8',env:{...process.env,ALLOW_TEST_SCHEMA_INITIALIZATION:'false'}})
|
|
assert.equal(result.status,2)
|
|
assert.match(result.stderr,/Explicit TEST SQL authorization required/)
|
|
})
|
|
|
|
|
|
test('gray deploy preserves health checks and uses an isolated Compose project', async () => {
|
|
const result = await runDeployment({ imageTag: 'graygood', environment: 'production', allowRollback: false })
|
|
assert.equal(result.status, 0, result.stderr)
|
|
assert.match(result.dockerLog, /--project-name firstleg-production/)
|
|
assert.doesNotMatch(result.dockerLog, /--project-name firstleg-test/)
|
|
})
|
|
|
|
test('gray deployment rejects TEST message scope before any Docker operation', async () => {
|
|
const result = await runDeployment({ imageTag: 'graygood', environment: 'production', topicPrefix: 'test-' })
|
|
assert.equal(result.status, 2)
|
|
assert.equal(result.dockerLog, '')
|
|
assert.match(result.stderr, /MQ_TOPIC_PREFIX must be production-/)
|
|
})
|
|
|
|
|
|
test('SSH gray delivery executes the same health gate and cleans its unique temporary bundle', async () => {
|
|
const result = await runDeployment({ imageTag: 'remotegray', environment: 'production', allowRollback: false, remote: true })
|
|
assert.equal(result.status, 0, result.stderr)
|
|
assert.equal(result.currentImage, 'registry.local/group/firstleg/audit-service:remotegray')
|
|
assert.match(result.dockerLog, /--project-name firstleg-production/)
|
|
assert.match(result.sshLog, /rm -rf -- '\/tmp\/firstleg-production-release\.[A-Za-z0-9]+'/)
|
|
assert.doesNotMatch(result.sshLog, /ci-password/)
|
|
})
|
|
|
|
test('SSH gray health failure remains failed and still removes the uploaded credential bundle', async () => {
|
|
const result = await runDeployment({ imageTag: 'remotebad', failingTag: 'remotebad', environment: 'production', allowRollback: false, remote: true })
|
|
assert.equal(result.status, 1, result.stderr)
|
|
assert.match(result.stderr, /Automatic rollback disabled/)
|
|
assert.match(result.sshLog, /rm -rf -- '\/tmp\/firstleg-production-release\.[A-Za-z0-9]+'/)
|
|
assert.doesNotMatch(result.sshLog, /ci-password/)
|
|
})
|