From 8d319fb34e2c7be34fccf4bd004bfb23f85ff1ad Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Wed, 16 Sep 2026 15:21:08 +0800 Subject: [PATCH] Validate candidate pages before public ingress and deployment checks --- README.md | 2 +- deploy/default.conf.template | 2 ++ deploy/deploy.sh | 3 +++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 17b6d6b..f1fcabf 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ React + TypeScript + Vite，独立 AdCloud 品牌的广告主网站。前后端 - Docker 多阶段构建：Node 22 执行 `npm ci`、TypeScript 检查和 Vite 打包；Nginx 提供页面与同源广告主 API 代理。 - Playwright 测试镜像运行在 runner，访问真实部署的 `BASE_URL`。覆盖注册登录、主子账户 URL、六步项目创建、修改、深链接刷新、前进后退、重新登录返回、错误账户和移动端工作台。 - 独立容器 `adcloud-advertiser-console`、并发组与默认端口 `18081`，后端继续使用 `18080`。 -- 先验证候选容器和认证 API，再替换前端；公开端口或浏览器验证失败恢复上一个前端容器。 +- 先在候选容器网络内完成浏览器验收（仅回环监听 5173，未发布宿主机端口），再替换前端；公开端口或浏览器验证失败恢复上一个前端容器。 - 同仓库 PR 只构建；外部 fork PR 不在拥有 Docker socket 的 runner 执行。 仓库变量：`ADCLOUD_ADVERTISER_PORT`（18081）、`ADCLOUD_ADVERTISER_API_UPSTREAM`（`http://host.docker.internal:18080`）、`ADCLOUD_ADVERTISER_PUBLIC_URL`（`http://47.76.92.159:18081`）。拉取源码优先使用现有 `GITEA_TOKEN` secret，否则使用 Actions 自动提供的短期仓库 token。无需把密码写入仓库。 diff --git a/deploy/default.conf.template b/deploy/default.conf.template index a590283..2f00cde 100644 --- a/deploy/default.conf.template +++ b/deploy/default.conf.template @@ -1,5 +1,7 @@ server { listen 80; + # Loopback-only listener for the CI browser sharing this container network. + listen 127.0.0.1:5173; server_name _; root /usr/share/nginx/html; add_header X-Content-Type-Options nosniff always; diff --git a/deploy/deploy.sh b/deploy/deploy.sh index 38e771d..e020372 100644 --- a/deploy/deploy.sh +++ b/deploy/deploy.sh @@ -18,6 +18,9 @@ done [[ "$ready" == true ]] || { echo 'Candidate failed health check'; exit 1; } # Auth endpoint should exist and reject unauthenticated requests, rather than 404/502. docker exec "$candidate" sh -c 'wget -S -O /dev/null http://127.0.0.1/v1/advertiser/me 2>&1 | grep "401 Unauthorized"' +# Validate functionality on the runner before changing the published service. +# This loopback origin is already permitted by the API's development CORS policy. +docker run --rm --network "container:$candidate" --shm-size=256m -e BASE_URL=http://localhost:5173 "adcloud-advertiser:$SOURCE_REVISION-tests" old=false if docker container inspect "$name" >/dev/null 2>&1; then docker stop "$name"