fix(GOV-009): 完成最终复审整改

2026-08-13 18:51:14 +08:00
parent 3a8120a33a
commit cb550e3d5c
15 changed files with 197 additions and 8 deletions
@@ -0,0 +1,26 @@
+import process from 'node:process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const IMMUTABLE_IMAGE_PATTERN = /^\S+@sha256:[a-f0-9]{64}$/;
+
+/**
+ * Compose 变量语法只能阻断空值，无法拒绝 latest 或普通 tag；发布前必须先通过
+ * 该校验器，确保 Web/Server 都使用包含仓库名的内容摘要引用。
+ */
+export function assertImmutableImageReferences(environment) {
+  for (const key of ['A_SHARE_WEB_IMAGE', 'A_SHARE_SERVER_IMAGE']) {
+    const value = environment[key] ?? '';
+    if (!IMMUTABLE_IMAGE_PATTERN.test(value)) {
+      throw new Error(`${key} 必须使用仓库名@sha256摘要`);
+    }
+  }
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))
+) {
+  assertImmutableImageReferences(process.env);
+  process.stdout.write('生产镜像引用验证通过\n');
+}