forked from wangziqi/gongxue-base
403 lines
16 KiB
JavaScript
403 lines
16 KiB
JavaScript
import crypto from 'node:crypto';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import process from 'node:process';
|
|
|
|
const repoRoot = process.cwd();
|
|
const taroRoot = path.join(repoRoot, 'apps', 'taro');
|
|
const deployRoot = path.join(taroRoot, 'deploy');
|
|
const distRoot = path.join(taroRoot, 'dist');
|
|
|
|
const portals = [
|
|
{
|
|
portal: 'student',
|
|
buildScript: 'build:taro:h5:student',
|
|
appBuildScript: 'build:h5:student',
|
|
dist: 'h5-student',
|
|
landingPath: '/pages/student/home/index',
|
|
runtimeExample: 'h5-student.runtime-config.example.json',
|
|
deployHint: 'student.example.com -> apps/taro/dist/h5-student',
|
|
},
|
|
{
|
|
portal: 'tenant-admin',
|
|
buildScript: 'build:taro:h5:tenant',
|
|
appBuildScript: 'build:h5:tenant',
|
|
dist: 'h5-tenant-admin',
|
|
landingPath: '/pages/tenant-admin/workbench/index',
|
|
runtimeExample: 'h5-tenant-admin.runtime-config.example.json',
|
|
deployHint: 'admin.example.com -> apps/taro/dist/h5-tenant-admin',
|
|
},
|
|
{
|
|
portal: 'platform-admin',
|
|
buildScript: 'build:taro:h5:platform',
|
|
appBuildScript: 'build:h5:platform',
|
|
dist: 'h5-platform-admin',
|
|
landingPath: '/pages/platform-admin/workbench/index',
|
|
runtimeExample: 'h5-platform-admin.runtime-config.example.json',
|
|
deployHint: 'console.example.com -> apps/taro/dist/h5-platform-admin',
|
|
},
|
|
];
|
|
|
|
const allowedRuntimeConfigKeys = new Set([
|
|
'portal',
|
|
'apiBaseUrl',
|
|
'supabaseUrl',
|
|
'supabasePublishableKey',
|
|
'tenantCode',
|
|
'TARO_APP_PORTAL',
|
|
'TARO_APP_API_BASE_URL',
|
|
'TARO_APP_SUPABASE_URL',
|
|
'TARO_APP_SUPABASE_PUBLISHABLE_KEY',
|
|
'TARO_APP_TENANT_CODE',
|
|
]);
|
|
|
|
const forbiddenRuntimeConfigKeys = new Set([
|
|
'SUPABASE_SERVICE_ROLE_KEY',
|
|
'SUPABASE_SECRET_KEY',
|
|
'DATABASE_URL',
|
|
'ALIYUN_OSS_ACCESS_KEY_SECRET',
|
|
'TENCENT_COS_SECRET_KEY',
|
|
'WECHAT_PAY_PRIVATE_KEY',
|
|
'ALIPAY_APP_PRIVATE_KEY',
|
|
'AUTH_SESSION_SECRET',
|
|
'PLATFORM_ADMIN_API_KEY',
|
|
]);
|
|
|
|
const forbiddenValuePatterns = [
|
|
/postgres(?:ql)?:\/\//i,
|
|
/-----BEGIN [A-Z ]*PRIVATE KEY-----/i,
|
|
/\bAKIA[0-9A-Z]{16}\b/,
|
|
/\bsk_(?:live|test)_[A-Za-z0-9]{10,}\b/,
|
|
/\b(service_role|secret|private_key)\b/i,
|
|
];
|
|
|
|
function parseArgs(argv) {
|
|
const options = {
|
|
json: false,
|
|
requireDist: false,
|
|
requireRuntimeConfig: false,
|
|
writePath: '',
|
|
};
|
|
for (let index = 0; index < argv.length; index += 1) {
|
|
const arg = argv[index];
|
|
if (arg === '--json') options.json = true;
|
|
else if (arg === '--require-dist') options.requireDist = true;
|
|
else if (arg === '--require-runtime-config') {
|
|
options.requireRuntimeConfig = true;
|
|
options.requireDist = true;
|
|
} else if (arg === '--write') {
|
|
options.writePath = path.resolve(repoRoot, argv[index + 1] || '');
|
|
index += 1;
|
|
} else if (arg.startsWith('--write=')) {
|
|
options.writePath = path.resolve(repoRoot, arg.slice('--write='.length));
|
|
}
|
|
}
|
|
return options;
|
|
}
|
|
|
|
function normalizeSlashes(value) {
|
|
return value.replace(/\\/g, '/');
|
|
}
|
|
|
|
function relative(filePath) {
|
|
return normalizeSlashes(path.relative(repoRoot, filePath));
|
|
}
|
|
|
|
function readText(filePath) {
|
|
return fs.readFileSync(filePath, 'utf8').replace(/\r\n/g, '\n');
|
|
}
|
|
|
|
function readJson(filePath) {
|
|
return JSON.parse(readText(filePath));
|
|
}
|
|
|
|
function walkFiles(dir) {
|
|
if (!fs.existsSync(dir)) return [];
|
|
const result = [];
|
|
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
|
|
const entryPath = path.join(dir, entry.name);
|
|
if (entry.isDirectory()) result.push(...walkFiles(entryPath));
|
|
else result.push(entryPath);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function parseAssetUrls(indexHtml) {
|
|
const urls = new Set();
|
|
for (const match of indexHtml.matchAll(/<script\b[^>]*\bsrc=["']([^"']+)["'][^>]*>/gi)) urls.add(match[1]);
|
|
for (const match of indexHtml.matchAll(/<link\b[^>]*\bhref=["']([^"']+)["'][^>]*>/gi)) {
|
|
if (/rel=["']stylesheet["']/i.test(match[0])) urls.add(match[1]);
|
|
}
|
|
return [...urls];
|
|
}
|
|
|
|
function hashFile(filePath) {
|
|
const hash = crypto.createHash('sha256');
|
|
hash.update(fs.readFileSync(filePath));
|
|
return hash.digest('hex');
|
|
}
|
|
|
|
function createCollector() {
|
|
const checks = [];
|
|
function push(status, id, message, details = {}) {
|
|
checks.push({ status, id, message, details });
|
|
}
|
|
return {
|
|
checks,
|
|
pass: (id, message, details) => push('pass', id, message, details),
|
|
warn: (id, message, details) => push('warn', id, message, details),
|
|
fail: (id, message, details) => push('fail', id, message, details),
|
|
};
|
|
}
|
|
|
|
function summarize(checks, portalResults) {
|
|
const statusCounts = checks.reduce(
|
|
(summary, item) => {
|
|
summary[item.status] += 1;
|
|
return summary;
|
|
},
|
|
{ fail: 0, warn: 0, pass: 0 },
|
|
);
|
|
return {
|
|
...statusCounts,
|
|
portals: portals.length,
|
|
distReady: portalResults.filter(item => item.dist?.exists && item.dist?.indexHtml).length,
|
|
runtimeConfigs: portalResults.filter(item => item.runtimeConfig?.exists).length,
|
|
};
|
|
}
|
|
|
|
function looksSecretish(value) {
|
|
const text = String(value || '');
|
|
return forbiddenValuePatterns.some(pattern => pattern.test(text));
|
|
}
|
|
|
|
function publicRuntimeConfig(config) {
|
|
return {
|
|
portal: config.portal || config.TARO_APP_PORTAL || '',
|
|
apiBaseUrl: config.apiBaseUrl || config.TARO_APP_API_BASE_URL || '',
|
|
supabaseUrl: config.supabaseUrl || config.TARO_APP_SUPABASE_URL || '',
|
|
supabasePublishableKey: config.supabasePublishableKey || config.TARO_APP_SUPABASE_PUBLISHABLE_KEY || '',
|
|
tenantCode: config.tenantCode || config.TARO_APP_TENANT_CODE || '',
|
|
};
|
|
}
|
|
|
|
function validateRuntimeConfig(filePath, expectedPortal, collector, options = {}) {
|
|
const required = Boolean(options.required);
|
|
const allowPlaceholderKey = Boolean(options.allowPlaceholderKey);
|
|
const result = {
|
|
exists: fs.existsSync(filePath),
|
|
file: relative(filePath),
|
|
portal: '',
|
|
apiBaseUrl: '',
|
|
supabaseUrl: '',
|
|
hasPublishableKey: false,
|
|
tenantCodeMode: '',
|
|
};
|
|
|
|
if (!result.exists) {
|
|
if (required) collector.fail(`runtime.${expectedPortal}.exists`, 'runtime-config.json is required for production release', { file: result.file });
|
|
else collector.warn(`runtime.${expectedPortal}.exists`, 'runtime-config.json is not present; deploy must provide it beside index.html', { file: result.file });
|
|
return result;
|
|
}
|
|
|
|
let config;
|
|
try {
|
|
config = readJson(filePath);
|
|
} catch (error) {
|
|
collector.fail(`runtime.${expectedPortal}.json`, 'runtime config must be valid JSON', { file: result.file, error: error.message });
|
|
return result;
|
|
}
|
|
|
|
const keys = Object.keys(config);
|
|
const unknownKeys = keys.filter(key => !allowedRuntimeConfigKeys.has(key));
|
|
const forbiddenKeys = keys.filter(key => forbiddenRuntimeConfigKeys.has(key));
|
|
if (unknownKeys.length) collector.fail(`runtime.${expectedPortal}.keys`, 'runtime config has unknown keys', { file: result.file, unknownKeys });
|
|
else collector.pass(`runtime.${expectedPortal}.keys`, 'runtime config uses only approved public keys', { file: result.file });
|
|
if (forbiddenKeys.length) collector.fail(`runtime.${expectedPortal}.secrets`, 'runtime config includes forbidden server secret keys', { file: result.file, forbiddenKeys });
|
|
else collector.pass(`runtime.${expectedPortal}.secrets`, 'runtime config contains no forbidden server secret keys', { file: result.file });
|
|
|
|
const publicConfig = publicRuntimeConfig(config);
|
|
result.portal = publicConfig.portal;
|
|
result.apiBaseUrl = publicConfig.apiBaseUrl;
|
|
result.supabaseUrl = publicConfig.supabaseUrl;
|
|
result.hasPublishableKey = Boolean(publicConfig.supabasePublishableKey);
|
|
result.tenantCodeMode = publicConfig.tenantCode ? 'fixed' : 'domain-resolved';
|
|
|
|
if (publicConfig.portal !== expectedPortal) collector.fail(`runtime.${expectedPortal}.portal`, 'runtime config portal does not match the H5 artifact', { file: result.file, expectedPortal, portal: publicConfig.portal });
|
|
else collector.pass(`runtime.${expectedPortal}.portal`, 'runtime config portal matches the H5 artifact', { file: result.file });
|
|
|
|
if (!String(publicConfig.apiBaseUrl || '').startsWith('https://')) collector.fail(`runtime.${expectedPortal}.api_https`, 'apiBaseUrl must be HTTPS for production H5 release', { file: result.file, apiBaseUrl: publicConfig.apiBaseUrl });
|
|
else collector.pass(`runtime.${expectedPortal}.api_https`, 'apiBaseUrl is HTTPS', { file: result.file });
|
|
|
|
if (!String(publicConfig.supabaseUrl || '').startsWith('https://')) collector.fail(`runtime.${expectedPortal}.supabase_https`, 'supabaseUrl must be HTTPS for production H5 release', { file: result.file, supabaseUrl: publicConfig.supabaseUrl });
|
|
else collector.pass(`runtime.${expectedPortal}.supabase_https`, 'supabaseUrl is HTTPS', { file: result.file });
|
|
|
|
const publishableKey = String(publicConfig.supabasePublishableKey || '');
|
|
if (!publishableKey) collector.fail(`runtime.${expectedPortal}.publishable_key`, 'supabasePublishableKey is required', { file: result.file });
|
|
else if (publishableKey === 'replace-with-supabase-publishable-key' && allowPlaceholderKey) collector.pass(`runtime.${expectedPortal}.publishable_key`, 'runtime example uses explicit publishable-key placeholder', { file: result.file });
|
|
else if (publishableKey === 'replace-with-supabase-publishable-key') collector.fail(`runtime.${expectedPortal}.publishable_key`, 'production runtime config still contains placeholder publishable key', { file: result.file });
|
|
else collector.pass(`runtime.${expectedPortal}.publishable_key`, 'supabase publishable key is present', { file: result.file });
|
|
|
|
const secretValues = Object.entries(config).filter(([, value]) => looksSecretish(value));
|
|
if (secretValues.length) {
|
|
collector.fail(`runtime.${expectedPortal}.secret_values`, 'runtime config contains secret-looking values', {
|
|
file: result.file,
|
|
keys: secretValues.map(([key]) => key),
|
|
});
|
|
} else {
|
|
collector.pass(`runtime.${expectedPortal}.secret_values`, 'runtime config values look public-only', { file: result.file });
|
|
}
|
|
|
|
return result;
|
|
}
|
|
|
|
function validatePackageScript(portal, collector) {
|
|
const rootPackageJson = readJson(path.join(repoRoot, 'package.json'));
|
|
const appPackageJson = readJson(path.join(taroRoot, 'package.json'));
|
|
const rootScript = rootPackageJson.scripts?.[portal.buildScript] || '';
|
|
const appScript = appPackageJson.scripts?.[portal.appBuildScript] || '';
|
|
if (!rootScript) {
|
|
collector.fail(`build.${portal.portal}.script`, 'Root H5 portal build script is missing', { script: portal.buildScript });
|
|
return '';
|
|
}
|
|
if (!rootScript.includes('@tiku-saas/taro') || !rootScript.includes(portal.appBuildScript)) {
|
|
collector.fail(`build.${portal.portal}.root_script`, 'Root H5 build script must delegate to the Taro workspace portal script', {
|
|
script: portal.buildScript,
|
|
command: rootScript,
|
|
appBuildScript: portal.appBuildScript,
|
|
});
|
|
} else {
|
|
collector.pass(`build.${portal.portal}.root_script`, 'Root H5 build script delegates to the Taro workspace portal script', {
|
|
script: portal.buildScript,
|
|
command: rootScript,
|
|
appBuildScript: portal.appBuildScript,
|
|
});
|
|
}
|
|
if (!appScript) {
|
|
collector.fail(`build.${portal.portal}.app_script`, 'Taro workspace H5 portal build script is missing', { script: portal.appBuildScript });
|
|
} else if (!appScript.includes('TARO_APP_PORTAL') || !appScript.includes(portal.portal)) {
|
|
collector.fail(`build.${portal.portal}.portal_env`, 'Taro workspace H5 build script must pin TARO_APP_PORTAL', { script: portal.appBuildScript, command: appScript });
|
|
} else {
|
|
collector.pass(`build.${portal.portal}.portal_env`, 'Taro workspace H5 build script pins TARO_APP_PORTAL', { script: portal.appBuildScript, command: appScript });
|
|
}
|
|
return `npm run ${portal.buildScript}`;
|
|
}
|
|
|
|
function inspectDist(portal, collector, options) {
|
|
const dir = path.join(distRoot, portal.dist);
|
|
const indexPath = path.join(dir, 'index.html');
|
|
const result = {
|
|
exists: fs.existsSync(dir),
|
|
dir: relative(dir),
|
|
indexHtml: fs.existsSync(indexPath),
|
|
indexSha256: '',
|
|
files: 0,
|
|
totalBytes: 0,
|
|
assetReferences: 0,
|
|
};
|
|
|
|
if (!result.exists) {
|
|
if (options.requireDist) collector.fail(`dist.${portal.portal}.exists`, 'H5 dist directory is required for production release', { dir: result.dir });
|
|
else collector.warn(`dist.${portal.portal}.exists`, 'H5 dist directory not found; run the portal build before deployment', { dir: result.dir });
|
|
return result;
|
|
}
|
|
|
|
collector.pass(`dist.${portal.portal}.exists`, 'H5 dist directory exists', { dir: result.dir });
|
|
const files = walkFiles(dir);
|
|
result.files = files.length;
|
|
result.totalBytes = files.reduce((sum, filePath) => sum + fs.statSync(filePath).size, 0);
|
|
|
|
if (!result.indexHtml) {
|
|
if (options.requireDist) collector.fail(`dist.${portal.portal}.index`, 'H5 index.html is missing', { file: relative(indexPath) });
|
|
else collector.warn(`dist.${portal.portal}.index`, 'H5 index.html is missing; run the portal build before deployment', { file: relative(indexPath) });
|
|
return result;
|
|
}
|
|
|
|
const indexHtml = readText(indexPath);
|
|
result.indexSha256 = hashFile(indexPath);
|
|
result.assetReferences = parseAssetUrls(indexHtml).length;
|
|
if (!/<div id=["']app["']/.test(indexHtml) || !/<script\b/i.test(indexHtml)) {
|
|
collector.fail(`dist.${portal.portal}.index`, 'H5 index.html must contain the app root and script tags', { file: relative(indexPath) });
|
|
} else {
|
|
collector.pass(`dist.${portal.portal}.index`, 'H5 index.html is deployable', {
|
|
file: relative(indexPath),
|
|
sha256: result.indexSha256,
|
|
assetReferences: result.assetReferences,
|
|
});
|
|
}
|
|
|
|
if (result.assetReferences < 2) {
|
|
collector.warn(`dist.${portal.portal}.assets`, 'H5 index.html has few asset references; verify the build output manually', { assetReferences: result.assetReferences });
|
|
} else {
|
|
collector.pass(`dist.${portal.portal}.assets`, 'H5 index.html references JS/CSS assets', { assetReferences: result.assetReferences });
|
|
}
|
|
|
|
return result;
|
|
}
|
|
|
|
function buildManifest(options) {
|
|
const collector = createCollector();
|
|
const portalResults = portals.map(portal => {
|
|
const buildCommand = validatePackageScript(portal, collector);
|
|
const runtimeExample = validateRuntimeConfig(path.join(deployRoot, portal.runtimeExample), portal.portal, collector, {
|
|
required: true,
|
|
allowPlaceholderKey: true,
|
|
});
|
|
const dist = inspectDist(portal, collector, options);
|
|
const runtimeConfig = validateRuntimeConfig(path.join(distRoot, portal.dist, 'runtime-config.json'), portal.portal, collector, {
|
|
required: options.requireRuntimeConfig,
|
|
allowPlaceholderKey: false,
|
|
});
|
|
|
|
return {
|
|
portal: portal.portal,
|
|
buildCommand,
|
|
landingPath: portal.landingPath,
|
|
deployHint: portal.deployHint,
|
|
dist,
|
|
runtimeExample,
|
|
runtimeConfig,
|
|
};
|
|
});
|
|
|
|
const summary = summarize(collector.checks, portalResults);
|
|
return {
|
|
schemaVersion: 1,
|
|
generatedAt: new Date().toISOString(),
|
|
summary,
|
|
portals: portalResults,
|
|
checks: collector.checks,
|
|
};
|
|
}
|
|
|
|
function printHuman(manifest) {
|
|
const { summary } = manifest;
|
|
console.log(`Taro H5 release manifest: ${summary.fail} fail(s), ${summary.warn} warning(s), ${summary.pass} pass(es)`);
|
|
for (const portal of manifest.portals) {
|
|
console.log(`[${portal.portal}] ${portal.buildCommand}`);
|
|
console.log(` dist=${portal.dist.dir} files=${portal.dist.files} bytes=${portal.dist.totalBytes} runtime=${portal.runtimeConfig.exists ? 'present' : 'missing'}`);
|
|
console.log(` landing=${portal.landingPath}`);
|
|
}
|
|
for (const item of manifest.checks.filter(check => check.status !== 'pass')) {
|
|
const marker = item.status === 'fail' ? 'FAIL' : 'WARN';
|
|
console.log(`[${marker}] ${item.id}: ${item.message}`);
|
|
}
|
|
}
|
|
|
|
function main() {
|
|
const options = parseArgs(process.argv.slice(2));
|
|
const manifest = buildManifest(options);
|
|
|
|
if (options.writePath) {
|
|
fs.mkdirSync(path.dirname(options.writePath), { recursive: true });
|
|
fs.writeFileSync(options.writePath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
|
|
}
|
|
|
|
if (options.json) console.log(JSON.stringify(manifest, null, 2));
|
|
else printHuman(manifest);
|
|
|
|
if (manifest.summary.fail > 0) process.exitCode = 1;
|
|
}
|
|
|
|
main();
|