deploy: normalize release metadata and check route metadata only

deploy/query-summary/check-ready.py

@@ -32,10 +32,13 @@ assert '20261017-summary8' in get('/')[1]
 for path,marker in [('/static/js/health-views.js','fromSummary'),('/static/js/health-ui.js','/api/views/'),('/static/js/app.js','/api/overview')]:
     status,body=get(path);assert status==200 and marker in body
 assert json.loads(get('/api/proxy_status')[1])['backend_reachable']
-for path in ['/proxy/api/views/stress','/proxy/api/views/stress/records','/proxy/api/views/stress/export','/proxy/api/overview']:
-    assert get(path+'?start_date=invalid&end_date=invalid')[0]==422
+status,schema=get('/proxy/openapi.json')
+assert status==200
+paths=json.loads(schema)['paths']
+for path in ['/api/views/{kind}','/api/views/{kind}/records','/api/views/{kind}/export','/api/overview']:
+    assert 'get' in paths.get(path,{})
 assert os.environ.get('MI_FITNESS_CALENDAR_DIR')=='/calendar'
 assert json.loads(get('/api/calendar?start=2026&end=2026')[1])['years']['2026']['days']
-print('backend/web资源、代理、匿名拒绝和新路由就绪；未查询健康记录。')
+print('backend/web资源、代理、匿名拒绝和OpenAPI路由元数据就绪；未请求健康查询或导出。')
 '''
 subprocess.run(['docker', 'exec', '-i', 'mi-fitness-health-web-1', 'python', '-'], input=probe.encode('utf-8'), check=True)

deploy/query-summary/prepare-release.py

@@ -0,0 +1,59 @@
+"""为现有summary8离线tar生成LF发布元数据；不构建镜像或连接NAS。"""
+import hashlib
+import json
+import re
+import tarfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+RELEASE = ROOT / 'artifacts/query-summary/release'
+TAG = 'local/mi-fitness-nas:20261017-summary8'
+BASE_IMAGE_ID = 'sha256:f4cbe187a98e3d3223e28e79b6edd115446ba62a78931f54f3bb0a6991a9395d'
+# 部署前只读快照；实际更新脚本仍会再次比对，漂移则停止。
+EXPECTED_CURRENT = '3cdbdc882b169f5785d6d1c3c46ceb159e209c567d6e28ceb31b15d4280fcdd8'
+
+
+def sha256(path):
+    digest = hashlib.sha256()
+    with path.open('rb') as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b''):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def write_lf(name, value):
+    assert '\r' not in value and not value.startswith('\ufeff')
+    (RELEASE / name).write_bytes((value.rstrip('\n') + '\n').encode('utf-8'))
+
+
+def main():
+    tar = RELEASE / 'health-summary8.tar'
+    # 仅读取索引/配置元数据，不展开镜像层，也不修改tar。
+    with tarfile.open(tar) as archive:
+        manifest = json.load(archive.extractfile('manifest.json'))
+        assert len(manifest) == 1 and manifest[0]['RepoTags'] == [TAG]
+        index = json.load(archive.extractfile('index.json'))
+        assert len(index['manifests']) == 1
+        image_id = index['manifests'][0]['digest']
+        assert re.fullmatch(r'sha256:[0-9a-f]{64}', image_id)
+        index_blob = archive.extractfile('blobs/sha256/' + image_id.split(':')[1]).read()
+        assert hashlib.sha256(index_blob).hexdigest() == image_id.split(':')[1]
+        config = archive.extractfile(manifest[0]['Config']).read()
+        config_id = 'sha256:' + hashlib.sha256(config).hexdigest()
+        assert manifest[0]['Config'] == 'blobs/sha256/' + config_id.split(':')[1]
+    for name in ['compose.override.yml', 'update-health.sh', 'check-ready.py', 'Update-Nas.ps1']:
+        content = (Path(__file__).resolve().parent / name).read_bytes()
+        assert b'\r' not in content and not content.startswith(b'\xef\xbb\xbf'), name
+        (RELEASE / name).write_bytes(content)
+    for name, value in [('image-id.txt', image_id), ('image-config-id.txt', config_id),
+            ('base-image-id.txt', BASE_IMAGE_ID), ('expected-current.sha256', EXPECTED_CURRENT)]:
+        write_lf(name, value)
+    files = sorted(path for path in RELEASE.iterdir() if path.is_file() and path.name != 'manifest.sha256')
+    assert len(files) == 9, '发布目录包含非预期文件，停止生成清单'
+    write_lf('manifest.sha256', ''.join(sha256(path) + '  ' + path.name + '\n' for path in files))
+    print(json.dumps(dict(image_id=image_id, config_id=config_id, tar_sha256=sha256(tar),
+        manifest_sha256=sha256(RELEASE / 'manifest.sha256')), ensure_ascii=False))
+
+
+if __name__ == '__main__':
+    main()

deploy/query-summary/update-health.sh

@@ -22,8 +22,18 @@ cp compose.override.yml "$backup"
 docker inspect --format '{{.Config.Image}} {{.Image}}' mi-fitness-health-backend-1 mi-fitness-health-web-1 > "$backup.images"
 # 不清理旧镜像；覆盖配置和镜像ID均保留以便回退。
 docker load -i "$package/health-summary8.tar"
-expected=$(cat "$package/image-id.txt")
-config_id=$(cat "$package/image-config-id.txt")
+read_image_id() {
+  python3 - "$1" <<'PY'
+import re,sys
+from pathlib import Path
+value=Path(sys.argv[1]).read_bytes().rstrip(b'\r\n')
+if re.fullmatch(rb'sha256:[0-9a-f]{64}',value) is None:
+    raise SystemExit('镜像身份文件格式无效')
+sys.stdout.write(value.decode('ascii'))
+PY
+}
+expected=$(read_image_id "$package/image-id.txt")
+config_id=$(read_image_id "$package/image-config-id.txt")
 actual=$(docker image inspect --format '{{.Id}}' local/mi-fitness-nas:20261017-summary8)
 [ "$actual" = "$expected" ] || [ "$actual" = "$config_id" ] || { echo '导入镜像ID不符。'; exit 1; }
 docker compose --project-name mi-fitness-health --env-file .env -f compose.yml -f "$package/compose.override.yml" config --quiet