From add4315216f526b0e4b41b6bd5f5cec9ad8a83b1 Mon Sep 17 00:00:00 2001
From: hicocos <neko0@foxmail.com>
Date: Tue, 25 Aug 2026 11:22:34 +0800
Subject: [PATCH] [verified] fix: allow Compose builds without source metadata

---
 backend/src/services/reproducibleBuildContract.test.ts | 10 +++++-----
 deploy/DEPLOY.md                                       |  2 +-
 docker-compose.yml                                     |  8 ++++----
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/backend/src/services/reproducibleBuildContract.test.ts b/backend/src/services/reproducibleBuildContract.test.ts
index 488c1e1..de530a7 100644
--- a/backend/src/services/reproducibleBuildContract.test.ts
+++ b/backend/src/services/reproducibleBuildContract.test.ts
@@ -44,11 +44,11 @@ test('release images use locked dependencies, pinned bases, verified yt-dlp and
     assert.match(workflow, /actions\/upload-artifact@[0-9a-f]{40}/);
 });
 
-test('local release builds fail closed without traceable source metadata', () => {
-    assert.equal((compose.match(/\$\{SOURCE_REVISION:\?SOURCE_REVISION is required\}/g) || []).length, 2);
-    assert.equal((compose.match(/\$\{SOURCE_VERSION:\?SOURCE_VERSION is required\}/g) || []).length, 2);
-    assert.doesNotMatch(compose, /SOURCE_REVISION:-unknown/);
-    assert.doesNotMatch(compose, /SOURCE_VERSION:-worktree/);
+test('direct Compose builds use local source metadata fallbacks while production installs stay traceable', () => {
+    assert.equal((compose.match(/\$\{SOURCE_REVISION:-unknown\}/g) || []).length, 2);
+    assert.equal((compose.match(/\$\{SOURCE_VERSION:-worktree\}/g) || []).length, 2);
+    assert.doesNotMatch(compose, /SOURCE_REVISION:\?SOURCE_REVISION is required/);
+    assert.doesNotMatch(compose, /SOURCE_VERSION:\?SOURCE_VERSION is required/);
     assertRequiredBuildMetadata(installScript);
     assert.match(installScript, /IMAGE_VERSION=/);
     assert.match(installScript, /OAUTH_CALLBACK_BASE_URL=/);
diff --git a/deploy/DEPLOY.md b/deploy/DEPLOY.md
index e7c02f8..6417be5 100644
--- a/deploy/DEPLOY.md
+++ b/deploy/DEPLOY.md
@@ -42,7 +42,7 @@ STORAGE_CREDENTIALS_SECRET=至少32字符；可用 openssl rand -hex 32
 
 ## 3. 构建并启动
 
-Compose 会拒绝缺失的 `IMAGE_VERSION`、`SOURCE_REVISION` 或 `SOURCE_VERSION`，避免生成 `unknown/worktree` 标签的不可审计镜像。每次发布前更新：
+直接运行 Compose 时，缺失的 `SOURCE_REVISION` / `SOURCE_VERSION` 会回退为 `unknown` / `worktree`，因此旧 `.env` 和快速部署不会被构建标签阻断。正式发布仍应显式填写 `IMAGE_VERSION`、`SOURCE_REVISION` 和 `SOURCE_VERSION`；`deploy/install.sh` 会拒绝缺失这些值，避免生成不可审计的生产镜像。每次发布前更新：
 
 ```bash
 revision=$(git rev-parse HEAD)
diff --git a/docker-compose.yml b/docker-compose.yml
index a6dbb79..6478643 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,8 +10,8 @@ services:
       provenance: mode=max
       args:
         - VITE_API_URL=${VITE_API_URL:-https://api.example.com}
-        - SOURCE_REVISION=${SOURCE_REVISION:?SOURCE_REVISION is required}
-        - SOURCE_VERSION=${SOURCE_VERSION:?SOURCE_VERSION is required}
+        - SOURCE_REVISION=${SOURCE_REVISION:-unknown}
+        - SOURCE_VERSION=${SOURCE_VERSION:-worktree}
     container_name: tg-vault-frontend
     ports:
       - "127.0.0.1:47832:80"
@@ -41,8 +41,8 @@ services:
       sbom: true
       provenance: mode=max
       args:
-        - SOURCE_REVISION=${SOURCE_REVISION:?SOURCE_REVISION is required}
-        - SOURCE_VERSION=${SOURCE_VERSION:?SOURCE_VERSION is required}
+        - SOURCE_REVISION=${SOURCE_REVISION:-unknown}
+        - SOURCE_VERSION=${SOURCE_VERSION:-worktree}
     container_name: tg-vault-backend
     ports:
       - "127.0.0.1:${PORT:-51947}:${PORT:-51947}"