From 810cf44d3d10df0b23796f035a35e012945fe86a Mon Sep 17 00:00:00 2001
From: wait4xx <X@alumni.nudt.edu.cn>
Date: Sun, 25 Oct 2026 21:12:48 +0800
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20receiver=20=E6=94=B9=E8=B0=83?=
 =?UTF-8?q?=E6=9E=84=E5=BB=BA=E4=BB=93=E8=87=AA=E5=B7=B1=E7=9A=84=20build.?=
 =?UTF-8?q?sh=E2=80=94=E2=80=94=E5=8F=91=E5=B8=83=E9=93=BE=E6=89=A7?=
 =?UTF-8?q?=E8=A1=8C=E6=BA=90=E5=BD=92=E4=B8=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 架构债（20:31 事故根因层）：receiver 此前执行工作树
  infra/deploy/build.sh，车道在途半成品状态可断生产链——改为
  build-repo/infra/deploy/build.sh（origin/main 硬跟版本），
  构建仓缺失时首克引导（匿名 clone）
- 双副本纪律入档头注：仓内源与 ~/docker_apps/blog/ 运行副本改一
  须同步二并 restart（systemd 跑的是运行副本，漂移即事故）
- 深意：构建脚本演化自此走 git 评审流，main=可部署铁律闭环

验证: 签名 POST 端到端实测（HMAC 构造无 git 污染）：202 queued →
      90s 后 stamp=1fdd0cc；healthz 200；单元 active

Spec: none (发布链架构修正：单执行源切换+端到端实测)

Co-authored-by: GLM-5.3
---
 infra/deploy/webhook_receiver.py | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/infra/deploy/webhook_receiver.py b/infra/deploy/webhook_receiver.py
index ca8cdf5..176f5ca 100644
--- a/infra/deploy/webhook_receiver.py
+++ b/infra/deploy/webhook_receiver.py
@@ -8,6 +8,8 @@
   ESA 只代理 80/443 vhost，该端口不对公网；HMAC 是硬门槛。
 
 触发链：gitea push(main) → 本接收器验签 → build.sh → www-staging 更新。
+部署形态：systemd 运行副本 ~/docker_apps/blog/webhook_receiver.py——改本文件
+必须同步两份（仓内源 + 运行副本）并 restart 单元，漂移即事故。
 常驻方式：systemd --user（blog-webhook.service）；reboot 自启需一次性
 `sudo loginctl enable-linger wait4x`（已列入上线检查单）。
 """
@@ -21,9 +23,21 @@ from pathlib import Path
 
 PORT = 13021
 SECRET_FILE = Path.home() / "docker_apps/gitea/webhook-secret.txt"
-BUILD = Path.home() / "Code/Github/my-blog/infra/deploy/build.sh"
+BUILD_REPO = Path.home() / "docker_apps/blog/build-repo"
 BUILD_LOCK = threading.Lock()
 
+# 构建脚本 = 构建仓自己的 origin/main 版本（架构修正 2026-10-25：此前指向
+# 工作树副本，车道在途半成品状态会断生产链——20:31 事故实锤）。构建仓缺失时
+# 首克引导（blog 仓公开，匿名 clone）。
+def build_script() -> Path:
+    s = BUILD_REPO / "infra/deploy/build.sh"
+    if not s.exists():
+        subprocess.run(
+            ["git", "clone", "https://git.wait4x.online/wait4x/blog.git", str(BUILD_REPO)],
+            check=True, capture_output=True,
+        )
+    return s
+
 
 def read_secret() -> bytes:
     return SECRET_FILE.read_text().strip().encode()
@@ -72,9 +86,9 @@ class Handler(BaseHTTPRequestHandler):
     def _run_build(self) -> None:
         with BUILD_LOCK:
             subprocess.run(
-                ["bash", str(BUILD)],
+                ["bash", str(build_script())],
                 capture_output=True, timeout=1200,
-                cwd=str(BUILD.parent),
+                cwd=str(BUILD_REPO),
             )
 
     def log_message(self, fmt: str, *args: object) -> None: