企业项目：私网高可用 SQL、异步投影与受控发布

export SOURCE_REPO=$(git rev-parse --show-toplevel)
export WORKDIR=$(mktemp -d /tmp/gcp-orders.XXXXXX)
git -C "$SOURCE_REPO" worktree add --detach "$WORKDIR" HEAD
cd "$WORKDIR/static/examples/enterprise-orders"
git rev-parse HEAD
export GOOGLE_CLOUD_PROJECT=REPLACE_ISOLATED_PROJECT
export REGION=REPLACE_REGION
export TF_VAR_project="$GOOGLE_CLOUD_PROJECT"
export TF_VAR_region="$REGION"
export TF_VAR_invoker='user:REPLACE_CORPORATE_EMAIL'
export TF_VAR_notification_email='REPLACE_APPROVED_ONCALL_EMAIL'
gcloud config set project "$GOOGLE_CLOUD_PROJECT"
gcloud auth application-default login

export ARTIFACT_REPO=orders-build
export STATE_BUCKET="${GOOGLE_CLOUD_PROJECT}-orders-tfstate"
export BUILD_SA='REPLACE_BUILD_SA_EMAIL'
gcloud services enable artifactregistry.googleapis.com cloudkms.googleapis.com storage.googleapis.com
gcloud artifacts repositories create "$ARTIFACT_REPO" --location="$REGION" --repository-format=docker --immutable-tags
gcloud storage buckets create "gs://$STATE_BUCKET" --location="$REGION" --uniform-bucket-level-access --public-access-prevention
gcloud storage buckets update "gs://$STATE_BUCKET" --versioning
gcloud kms keyrings create orders-signing --location="$REGION"
gcloud kms keys create image-signing --keyring=orders-signing --location="$REGION" --purpose=asymmetric-signing --default-algorithm=ec-sign-p256-sha256
gcloud artifacts repositories add-iam-policy-binding "$ARTIFACT_REPO" --location="$REGION" --member="serviceAccount:$BUILD_SA" --role=roles/artifactregistry.writer
gcloud kms keys add-iam-policy-binding image-signing --keyring=orders-signing --location="$REGION" --member="serviceAccount:$BUILD_SA" --role=roles/cloudkms.signerVerifier
export KMS_KEY_URI="gcpkms://projects/$GOOGLE_CLOUD_PROJECT/locations/$REGION/keyRings/orders-signing/cryptoKeys/image-signing/cryptoKeyVersions/1"
export PUBLIC_KEY_FILE="$PWD/image-signing.pub"
gcloud kms keys versions get-public-key 1 --key=image-signing --keyring=orders-signing --location="$REGION" --output-file="$PUBLIC_KEY_FILE"
gcloud auth configure-docker "$REGION-docker.pkg.dev"

export IMAGE='REPLACE_REGION-docker.pkg.dev/REPLACE_PROJECT/REPLACE_REPO/orders@sha256:REPLACE_DIGEST'
export TF_VAR_image="$IMAGE"
terraform -chdir=gcp init -backend-config="bucket=$STATE_BUCKET" -backend-config='prefix=orders-enterprise'
terraform -chdir=gcp plan -out=foundation.tfplan
terraform -chdir=gcp apply foundation.tfplan

export ZONE=REPLACE_REGION_ZONE
export DB_IP=$(terraform -chdir=gcp output -raw database_ip)
gcloud compute firewall-rules create orders-iap-ssh --network=orders-enterprise --allow=tcp:22 --source-ranges=35.235.240.0/20 --target-tags=orders-migration
gcloud compute instances create orders-migration --zone="$ZONE" --subnet=orders-enterprise --no-address --no-service-account --no-scopes --machine-type=e2-small --image-family=debian-12 --image-project=debian-cloud --metadata=enable-oslogin=TRUE --tags=orders-migration
# 保持运行，另一个终端继续初始化。
gcloud compute ssh orders-migration --zone="$ZONE" --tunnel-through-iap -- -N -L "127.0.0.1:15432:$DB_IP:5432"

python3 -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt
export CONFIRM_NEW_INSTANCE="$GOOGLE_CLOUD_PROJECT/orders-enterprise"
python3 gcp/bootstrap.py

terraform -chdir=gcp plan -var=deploy_services=true -out=runtime.tfplan
terraform -chdir=gcp apply runtime.tfplan
export BASE_URL=$(terraform -chdir=gcp output -raw api_url)
# 服务保持 IAM 私有；调用者只具备该服务的 run.invoker。
umask 077
gcloud auth print-identity-token > secrets/cloud-run-id-token
export CLOUD_RUN_ID_TOKEN_FILE=secrets/cloud-run-id-token
export TOKEN_FILE=secrets/token
# 先启动一次 worker；后续 Scheduler 每分钟启动，事务锁防止重复领取。
gcloud run jobs execute orders-worker --region="$REGION" --async
python3 tests/acceptance.py
gcloud run jobs execute orders-projector --region="$REGION" --wait

export ORDER_ID=REPLACE_ACCEPTANCE_OUTPUT_ID
gcloud storage cat "gs://$GOOGLE_CLOUD_PROJECT-orders-enterprise-archive/orders/$ORDER_ID.json"
curl --fail -H "Authorization: Bearer $(gcloud auth print-access-token)" "https://firestore.googleapis.com/v1/projects/$GOOGLE_CLOUD_PROJECT/databases/orders-projection/documents/orders/$ORDER_ID"
# 用只读运维连接检查待投影数；SQL 应最终返回 0。
# SELECT count(*) FROM cloud_projection WHERE NOT done;

export OLD_REVISION=REPLACE_CURRENT_SERVING_REVISION
export NEW_IMAGE=REPLACE_APPROVED_IMAGE_AT_DIGEST
gcloud run deploy orders-enterprise --region="$REGION" --image="$NEW_IMAGE" --no-traffic --tag=candidate
# 查询 tagged URL，重签发适用身份令牌，执行完整业务验收。
gcloud run services describe orders-enterprise --region="$REGION" --format='yaml(status.traffic)'
# 候选通过并完成指标观察后，按实际候选 revision 提升。
export NEW_REVISION=REPLACE_CANDIDATE_REVISION
gcloud run services update-traffic orders-enterprise --region="$REGION" --to-revisions="$OLD_REVISION=95,$NEW_REVISION=5"

# 观察窗口内业务错误或对账不一致，恢复先前记录的版本。
gcloud run services update-traffic orders-enterprise --region="$REGION" --to-revisions="$OLD_REVISION=100"