From 51158007b4ba2fd5ceb88d8524522b42135caca5 Mon Sep 17 00:00:00 2001 From: youfak Date: Fri, 7 Aug 2026 21:04:08 +0800 Subject: [PATCH] ci: validate local deployment configuration --- .github/workflows/ci.yml | 4 ++++ deploy/ci_test.go | 2 ++ docs/development/implementation-plan.md | 3 ++- findings.md | 6 ++++++ progress.md | 2 ++ 5 files changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 102eeb2..2e41b6e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,6 +49,10 @@ jobs: cache: true - name: Render Compose configuration run: docker compose -f deploy/docker-compose.yml config --quiet + - name: Render integration Compose configuration + run: docker compose -f deploy/docker-compose.test.yml config --quiet + - name: Validate local Compose configuration + run: go run ./deploy/tools/configcheck deploy/config/local.yaml - name: Render Kubernetes base run: kubectl kustomize deploy/kubernetes/base > /dev/null - name: Render Kubernetes development mTLS overlay diff --git a/deploy/ci_test.go b/deploy/ci_test.go index 9fc086f..9d49c40 100644 --- a/deploy/ci_test.go +++ b/deploy/ci_test.go @@ -31,6 +31,8 @@ func TestCIValidatesProtocolAndDeploymentAssets(t *testing.T) { "./scripts/verify-openapi.ps1", "./scripts/verify-proto.ps1", "docker compose -f deploy/docker-compose.yml config --quiet", + "docker compose -f deploy/docker-compose.test.yml config --quiet", + "go run ./deploy/tools/configcheck deploy/config/local.yaml", "kubectl kustomize deploy/kubernetes/base", "kubectl kustomize deploy/kubernetes/overlays/development-mtls", "go run ./deploy/tools/configcheck deploy/kubernetes/overlays/development-mtls/config.yaml", diff --git a/docs/development/implementation-plan.md b/docs/development/implementation-plan.md index ccea966..dc9ac38 100644 --- a/docs/development/implementation-plan.md +++ b/docs/development/implementation-plan.md @@ -375,7 +375,8 @@ OpenAPI 结构契约由 Go 测试在双平台 CI 执行；`scripts/verify-openap Gateway 热路径。`platform/logging` 以 JSON `slog` 输出进程级致命错误，字段、URL 用户信息、查询 Secret 和错误对象均经过脱敏，且不在请求热路径逐条写日志。 CI 另有独立 Deployment job，在占位凭据下渲染 Compose，并使用 `kubectl kustomize` -渲染 Kubernetes base 和单副本 development mTLS Overlay；它不启动容器、不访问真实存储或密钥。 +渲染 Kubernetes base 和单副本 development mTLS Overlay；该 job 同时展开测试 Compose、 +校验本地 Compose 配置。它不启动容器、不访问真实存储或密钥。 development Overlay 已挂载独立 Controller/Gateway/Checker TLS Secret、启用 Checker 和最小 网络策略，并从固定开发证书派生 `gateway-a`、`checker-a` 身份且 HPA 锁为单副本，不能代替生产证书轮换。 控制面 TLS 叶证书和信任根已在每次新握手时从文件加载，短暂文件不一致时保留最后一次有效材料； diff --git a/findings.md b/findings.md index 8bfbcca..92d6262 100644 --- a/findings.md +++ b/findings.md @@ -274,3 +274,9 @@ Routing 自上而下匹配，首条命中停止；支持 Gateway 与 Extract 两 - Dockerfile 构建阶段需要 `COPY . .`，因此根 `.dockerignore` 是隔离本地工作区与镜像上下文的 必要边界。它显式排除 Git 元数据、环境文件、本地配置、控制面证书/私钥、PEM/CRT/KEY 文件及 构建和测试产物；部署测试会在清单被删除或放宽时失败。 + +## 部署静态门禁审计（2026-08-07） + +- GitHub Actions 的 Deployment job 在同一组无敏感值 fixture 下渲染生产 Compose、测试 Compose + 以及 Kubernetes base/development mTLS Overlay，并对两份配置运行严格校验；它仍不替代 + 需要镜像网络和真实服务的容器端到端测试。 diff --git a/progress.md b/progress.md index 25db441..d1dcbde 100644 --- a/progress.md +++ b/progress.md @@ -2,6 +2,8 @@ ## 2026-08-07 +- GitHub Actions Deployment job 现同时静态展开生产与测试 Compose，并对本地 Compose 配置和 + 开发 mTLS 配置执行严格校验，避免仅检查 Kubernetes 覆盖层。 - Docker 构建上下文现由根 `.dockerignore` 保护：本地控制面证书/私钥、环境文件、凭据文件、 Git 元数据和构建产物不会被 `COPY . .` 发送到镜像构建器；部署测试固定该清单。 - OpenAPI 标准验证已固定为 `@redocly/cli@2.25.4`：`verify-openapi.ps1` 对两份 OpenAPI