From 2ef6cefeda86392f8ea24a3fef097885d836d327 Mon Sep 17 00:00:00 2001
From: john <cynell@139.com>
Date: Tue, 21 Jul 2026 17:03:17 +0800
Subject: [PATCH] fix: reject runtime files in release candidates

---
 .gitignore                  |  1 +
 .h5-server.pid              |  1 -
 scripts/.releaseignore-prod |  1 +
 scripts/check-gray-ready.sh | 11 +++++++++--
 4 files changed, 11 insertions(+), 3 deletions(-)
 delete mode 100644 .h5-server.pid

diff --git a/.gitignore b/.gitignore
index dfb8c3a..a3d7b57 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,4 +12,5 @@ logs/
 .adm-api.pid
 .adm-dev.pid
 .adm-preview.pid
+*.pid
 release-candidates/
diff --git a/.h5-server.pid b/.h5-server.pid
deleted file mode 100644
index 729db50..0000000
--- a/.h5-server.pid
+++ /dev/null
@@ -1 +0,0 @@
-41863
diff --git a/scripts/.releaseignore-prod b/scripts/.releaseignore-prod
index 902fe9d..40b252e 100644
--- a/scripts/.releaseignore-prod
+++ b/scripts/.releaseignore-prod
@@ -7,6 +7,7 @@
 .adm-api.pid
 .adm-dev.pid
 .adm-preview.pid
+*.pid
 .claude
 .mindops
 node_modules
diff --git a/scripts/check-gray-ready.sh b/scripts/check-gray-ready.sh
index b58ec3e..b999869 100755
--- a/scripts/check-gray-ready.sh
+++ b/scripts/check-gray-ready.sh
@@ -53,8 +53,9 @@ fi
 
 manifest="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.manifest.txt' -print -quit)"
 sha_file="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.sha256' -print -quit)"
-[[ -n "${manifest}" && -n "${sha_file}" ]] || {
-  echo "Candidate manifest or checksum file missing in ${CANDIDATE_DIR}" >&2
+bundle="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.tar.gz' -print -quit)"
+[[ -n "${manifest}" && -n "${sha_file}" && -n "${bundle}" ]] || {
+  echo "Candidate bundle, manifest, or checksum file missing in ${CANDIDATE_DIR}" >&2
   exit 1
 }
 
@@ -63,6 +64,12 @@ sha_file="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.sha256' -print
   shasum -a 256 -c "$(basename "${sha_file}")"
 )
 
+if tar -tzf "${bundle}" | grep -Eq '(^|/)(\.env($|\.)|[^/]*\.pid$|src/|release-candidates/)'; then
+  echo "Candidate contains forbidden runtime or development assets" >&2
+  tar -tzf "${bundle}" | grep -E '(^|/)(\.env($|\.)|[^/]*\.pid$|src/|release-candidates/)' >&2 || true
+  exit 1
+fi
+
 manifest_value() {
   local key="$1"
   sed -n "s/^${key}=//p" "${manifest}" | head -n 1