build: 使用兼容生产环境的前端构建流程

deploy/production/build-frontend.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+FRONTEND_DIR="$REPO_DIR/frontend"
+SOURCE_GIT_FULL_SHA="$(git -C "$REPO_DIR" rev-parse HEAD)"
+SOURCE_GIT_SHA="$(git -C "$REPO_DIR" rev-parse --short HEAD)"
+SOURCE_GIT_REF="$(git -C "$REPO_DIR" branch --show-current 2>/dev/null || true)"
+SOURCE_GIT_REF="${SOURCE_GIT_REF:-main}"
+
+test -f "$FRONTEND_DIR/package-lock.json" || {
+  echo 'frontend/package-lock.json 不存在，停止构建' >&2
+  exit 1
+}
+
+docker run --rm \
+  -e "SOURCE_GIT_SHA=$SOURCE_GIT_SHA" \
+  -e "SOURCE_GIT_FULL_SHA=$SOURCE_GIT_FULL_SHA" \
+  -e "SOURCE_GIT_REF=$SOURCE_GIT_REF" \
+  -v "$FRONTEND_DIR:/host-frontend" \
+  node:22-bookworm-slim \
+  sh -lc '
+    set -eu
+    mkdir -p /workspace
+    tar -C /host-frontend --exclude=node_modules --exclude=dist -cf - . | tar -C /workspace -xf -
+    cd /workspace
+    npm ci --no-audit --no-fund
+    npm run build
+    mkdir -p /host-frontend/dist
+    find /host-frontend/dist -mindepth 1 -delete
+    cp -a /workspace/dist/. /host-frontend/dist/
+  '
+
+node - "$FRONTEND_DIR/dist/__build_version__.json" "$SOURCE_GIT_FULL_SHA" <<'NODE'
+const fs = require('node:fs');
+const [versionPath, expectedSha] = process.argv.slice(2);
+const metadata = JSON.parse(fs.readFileSync(versionPath, 'utf8'));
+if (metadata.sourceGitFullSha !== expectedSha) {
+  throw new Error(`前端构建 SHA 不匹配：${metadata.sourceGitFullSha} != ${expectedSha}`);
+}
+process.stdout.write(`前端构建已验证：${metadata.version}\n`);
+NODE

frontend/package.json

@@ -37,9 +37,6 @@
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.4.24",
     "globals": "^16.5.0",
-    "vite": "npm:rolldown-vite@7.2.5"
+    "vite": "7.2.7"
-  },
-  "overrides": {
-    "vite": "npm:rolldown-vite@7.2.5"
   }
 }

服务器部署规范.md

@@ -119,11 +119,7 @@ test "$(git rev-parse HEAD)" = "$DEPLOY_SHA" || {
   exit 1
 }
 
-docker run --rm \
+bash deploy/production/build-frontend.sh
-  -v /opt/cangku/app/frontend:/workspace \
-  -w /workspace \
-  node:22-bookworm-slim \
-  sh -lc 'npm ci && npm run build'
 if grep -q '^SOURCE_GIT_SHA=' /opt/cangku/shared/backend.env; then
   sed -i "s/^SOURCE_GIT_SHA=.*/SOURCE_GIT_SHA=$DEPLOY_SHA/" /opt/cangku/shared/backend.env
 else