[verified] fix: allow Compose builds without source metadata

backend/src/services/reproducibleBuildContract.test.ts

@@ -44,11 +44,11 @@ test('release images use locked dependencies, pinned bases, verified yt-dlp and
     assert.match(workflow, /actions\/upload-artifact@[0-9a-f]{40}/);
 });
 
-test('local release builds fail closed without traceable source metadata', () => {
-    assert.equal((compose.match(/\$\{SOURCE_REVISION:\?SOURCE_REVISION is required\}/g) || []).length, 2);
-    assert.equal((compose.match(/\$\{SOURCE_VERSION:\?SOURCE_VERSION is required\}/g) || []).length, 2);
-    assert.doesNotMatch(compose, /SOURCE_REVISION:-unknown/);
-    assert.doesNotMatch(compose, /SOURCE_VERSION:-worktree/);
+test('direct Compose builds use local source metadata fallbacks while production installs stay traceable', () => {
+    assert.equal((compose.match(/\$\{SOURCE_REVISION:-unknown\}/g) || []).length, 2);
+    assert.equal((compose.match(/\$\{SOURCE_VERSION:-worktree\}/g) || []).length, 2);
+    assert.doesNotMatch(compose, /SOURCE_REVISION:\?SOURCE_REVISION is required/);
+    assert.doesNotMatch(compose, /SOURCE_VERSION:\?SOURCE_VERSION is required/);
     assertRequiredBuildMetadata(installScript);
     assert.match(installScript, /IMAGE_VERSION=/);
     assert.match(installScript, /OAUTH_CALLBACK_BASE_URL=/);

deploy/DEPLOY.md

@@ -42,7 +42,7 @@ STORAGE_CREDENTIALS_SECRET=至少32字符；可用 openssl rand -hex 32
 
 ## 3. 构建并启动
 
-Compose 会拒绝缺失的 `IMAGE_VERSION`、`SOURCE_REVISION` 或 `SOURCE_VERSION`，避免生成 `unknown/worktree` 标签的不可审计镜像。每次发布前更新：
+直接运行 Compose 时，缺失的 `SOURCE_REVISION` / `SOURCE_VERSION` 会回退为 `unknown` / `worktree`，因此旧 `.env` 和快速部署不会被构建标签阻断。正式发布仍应显式填写 `IMAGE_VERSION`、`SOURCE_REVISION` 和 `SOURCE_VERSION`；`deploy/install.sh` 会拒绝缺失这些值，避免生成不可审计的生产镜像。每次发布前更新：
 
 ```bash
 revision=$(git rev-parse HEAD)

docker-compose.yml

@@ -10,8 +10,8 @@ services:
       provenance: mode=max
       args:
         - VITE_API_URL=${VITE_API_URL:-https://api.example.com}
-        - SOURCE_REVISION=${SOURCE_REVISION:?SOURCE_REVISION is required}
-        - SOURCE_VERSION=${SOURCE_VERSION:?SOURCE_VERSION is required}
+        - SOURCE_REVISION=${SOURCE_REVISION:-unknown}
+        - SOURCE_VERSION=${SOURCE_VERSION:-worktree}
     container_name: tg-vault-frontend
     ports:
       - "127.0.0.1:47832:80"
@@ -41,8 +41,8 @@ services:
       sbom: true
       provenance: mode=max
       args:
-        - SOURCE_REVISION=${SOURCE_REVISION:?SOURCE_REVISION is required}
-        - SOURCE_VERSION=${SOURCE_VERSION:?SOURCE_VERSION is required}
+        - SOURCE_REVISION=${SOURCE_REVISION:-unknown}
+        - SOURCE_VERSION=${SOURCE_VERSION:-worktree}
     container_name: tg-vault-backend
     ports:
       - "127.0.0.1:${PORT:-51947}:${PORT:-51947}"