From a35abd155cec503b3a515cc1a67f1f874c3d2172 Mon Sep 17 00:00:00 2001
From: Xiaoxia AI <xiaoxia@localhost>
Date: Wed, 24 Jun 2026 22:54:55 +0800
Subject: [PATCH] fix(deploy): guard staging builds on business host

---
 docs/V21-UI-ACCEPTANCE-CHECKLIST.md | 7 +++++++
 infra/docker/deploy-staging.sh      | 8 ++++++++
 2 files changed, 15 insertions(+)

diff --git a/docs/V21-UI-ACCEPTANCE-CHECKLIST.md b/docs/V21-UI-ACCEPTANCE-CHECKLIST.md
index 690cfac7d..68a7ea1b8 100644
--- a/docs/V21-UI-ACCEPTANCE-CHECKLIST.md
+++ b/docs/V21-UI-ACCEPTANCE-CHECKLIST.md
@@ -166,3 +166,10 @@ V21 结构：三张套餐 feature 卡片，免费版/专业版/企业版，推
 - Staging Web 构建在拉取 docker.m.daocloud.io/library/node:20 时卡住，属于外网基础镜像依赖问题。
 - deploy-staging.sh 已改为默认复用现有 Web 镜像；如需重建 Web，显式设置 BUILD_WEB=1。
 
+
+## 2026-06-24 服务器职责混淆纠正
+
+- 老大纠正：项目已有两台服务器与职责分离约定，本次问题是执行时再次混淆职责。
+- 已回滚危险 artifact build workflow：b01ae28 Revert "fix(deploy): build staging web artifact"。
+- 已给 deploy-staging.sh 增加硬保护：默认禁止 REBUILD_BACKEND=1 或 BUILD_WEB=1 在业务/staging deploy 路径上构建镜像；只有显式 ALLOW_STAGING_BUILDS=true 才允许在专用构建机执行。
+- 后续正式方案：CI/构建服务器产出 dist/image，业务服务器只接收产物并重启服务。
diff --git a/infra/docker/deploy-staging.sh b/infra/docker/deploy-staging.sh
index 67c8bdd6b..46b76a2b5 100644
--- a/infra/docker/deploy-staging.sh
+++ b/infra/docker/deploy-staging.sh
@@ -35,6 +35,14 @@ export WEB_PORT
 export DOCKER_BUILDKIT=0
 export COMPOSE_DOCKER_CLI_BUILD=0
 
+if [ "${REBUILD_BACKEND:-0}" = "1" ] || [ "${BUILD_WEB:-0}" = "1" ]; then
+  if [ "${ALLOW_STAGING_BUILDS:-false}" != "true" ]; then
+    echo "❌ Staging deploy must not build images on the business server."
+    echo "   Build artifacts/images on the dedicated CI/build server, then deploy with REBUILD_BACKEND=0 BUILD_WEB=0."
+    exit 1
+  fi
+fi
+
 if [ "${REBUILD_BACKEND:-0}" = "1" ]; then
   docker compose build --pull=false api
   docker compose build --pull=false worker