feat: 添加自动化部署脚本、Webhook处理器与TDD测试套件

application/common/library/WebhookHandler.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace app\common\library;
+
+/**
+ * Git Webhook 核心处理器
+ */
+class WebhookHandler
+{
+    private $secret;
+    private $targetBranch;
+    private $deployExecutor;
+
+    public function __construct(string $secret, string $targetBranch = 'master', $deployExecutor = null)
+    {
+        $this->secret = $secret;
+        $this->targetBranch = $targetBranch;
+        $this->deployExecutor = $deployExecutor;
+    }
+
+    public function handle(array $server, array $get, string $rawBody): array
+    {
+        // 1. 验证权限 (支持 Header 传 Token、URL Token 以及 HMAC-SHA256 签名)
+        if (!$this->verifyAuth($server, $get, $rawBody)) {
+            return ['code' => 403, 'data' => ['status' => 'error', 'message' => 'Invalid token']];
+        }
+
+        // 2. 验证 HTTP 方式
+        $method = strtoupper($server['REQUEST_METHOD'] ?? 'GET');
+        if ($method !== 'POST') {
+            return ['code' => 405, 'data' => ['status' => 'error', 'message' => 'Method not allowed']];
+        }
+
+        // 3. 响应 Ping / Test 事件
+        $event = strtolower($server['HTTP_X_GITEA_EVENT'] ?? $server['HTTP_X_GIT_EVENT'] ?? $server['HTTP_X_GITHUB_EVENT'] ?? '');
+        if ($event === 'ping') {
+            return ['code' => 200, 'data' => ['status' => 'success', 'message' => 'pong']];
+        }
+
+        // 4. 分支过滤
+        $payload = json_decode($rawBody, true) ?: [];
+        $ref = $payload['ref'] ?? '';
+        $branch = str_replace('refs/heads/', '', $ref);
+
+        if ($branch !== $this->targetBranch) {
+            return [
+                'code' => 200,
+                'data' => [
+                    'status' => 'skipped',
+                    'message' => "Branch {$branch} ignored, target is {$this->targetBranch}"
+                ]
+            ];
+        }
+
+        // 5. 触发部署
+        $output = '';
+        if (is_callable($this->deployExecutor)) {
+            $output = call_user_func($this->deployExecutor, $payload);
+        }
+
+        return [
+            'code' => 200,
+            'data' => [
+                'status' => 'success',
+                'message' => 'Deployment triggered',
+                'branch' => $branch,
+                'output' => $output
+            ]
+        ];
+    }
+
+    private function verifyAuth(array $server, array $get, string $rawBody): bool
+    {
+        // A. 明文 Token 校验
+        $token = $server['HTTP_X_GITEA_TOKEN'] ?? $server['HTTP_X_GIT_TOKEN'] ?? $server['HTTP_X_GITLAB_TOKEN'] ?? ($get['token'] ?? '');
+        if ($token !== '' && hash_equals($this->secret, $token)) {
+            return true;
+        }
+
+        // B. HMAC-SHA256 签名校验 (Gitea / GitHub)
+        $signature = $server['HTTP_X_GITEA_SIGNATURE'] ?? $server['HTTP_X_HUB_SIGNATURE_256'] ?? '';
+        if ($signature !== '') {
+            if (strpos($signature, 'sha256=') === 0) {
+                $signature = substr($signature, 7);
+            }
+            $expected = hash_hmac('sha256', $rawBody, $this->secret);
+            if (hash_equals($expected, $signature)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}