军工软件工厂的总分厂架构：用分层治理驯服巨型代码丛林

# software-factory-contract.yaml
# 总厂发布的治理契约——分厂必须遵守，内部实现自由选择

factory:
  name: "军工软件工厂-XX体系"
  total_factory:
    # 总厂提供的技术基座
    base_components:
      - name: "common-security-framework"
        version: "2.1.0"
        repo: "https://internal.git/base/security-framework"
        compatibility: "semver"  # 语义化版本，2.x 兼容 2.0
      - name: "build-toolchain"
        version: "3.0.2"
        repo: "https://internal.git/base/build-toolchain"
        compatibility: "semver"
      - name: "data-model-registry"
        version: "1.4.0"
        repo: "https://internal.git/base/data-models"

    # 契约定义
    contracts:
      interface_protocol:
        format: "protobuf"          # 接口描述统一用 protobuf
        versioning: "semver"
        deprecation_grace_period: "6months"  # 庤弃接口保留6个月过渡
        registry: "https://internal.api/contract-registry"

      artifact_standard:
        format: "OCI-image"         # 制品统一为 OCI 容器镜像格式
        metadata_required:
          - "factory.branch_id"     # 分厂标识
          - "security.level"        # 等保级别
          - "build.toolchain_version"
          - "scan.result_hash"      # 安全扫描结果哈希
        signing: "cosign"           # 用 cosign 签名制品

      security_compliance:
        levels: ["C1", "C2", "C3", "C4"]  # 四个等保等级
        scan_on_push: true
        audit_log_retention: "10years"
        vulnerability_threshold:
          C1: "medium"
          C2: "low"
          C3: "none_known"
          C4: "none_known"

      release_process:
        environments: ["dev", "test", "staging", "production"]
        approval_gates:
          staging_to_production:
            approvers: ["total_factory.release_board", "branch.quality_lead"]
            auto_approve_if: "all_scans_pass AND contract_tests_pass"

  branch_factories:
    - id: "branch-radar"
      domain: "雷达信号处理"
      allowed_frameworks: ["C++17", "Python3.9+"]  # 分厂可自由选择，但限定语言版本范围
      security_level: "C3"
      max_cycle_days: 14              # 分厂内部迭代周期上限
      contract_compliance: "strict"   # 必须严格遵守契约

    - id: "branch-fire-control"
      domain: "火控计算"
      allowed_frameworks: ["C++17", "MATLAB-runtime"]
      security_level: "C4"
      max_cycle_days: 7               # 火控迭代更频繁
      contract_compliance: "strict"

    - id: "branch-comm"
      domain: "战术通信"
      allowed_frameworks: ["C++17", "Rust1.60+", "Python3.9+"]
      security_level: "C2"
      max_cycle_days: 21
      contract_compliance: "strict"

#!/bin/bash
# branch-submit-artifact.sh
# 分厂提交制品到总厂制品仓库的标准化流程

set -euo pipefail

BRANCH_ID="branch-radar"
ARTIFACT_PATH="./build/output/radar-processor-v2.3.1.tar"
CONTRACT_REPO="https://internal.git/base/factory-contract"
ARTIFACT_REGISTRY="https://internal.registry/artifacts"

echo "=== 分厂制品提交流程 ==="

# 1. 拉取最新契约，校验本地制品是否符合标准
echo "[1/5] 拉取治理契约..."
git clone --depth 1 "$CONTRACT_REPO" /tmp/contract
CONTRACT_FILE="/tmp/contract/software-factory-contract.yaml"

echo "[2/5] 校验制品元数据..."
# 检查制品是否包含必需元数据字段
REQUIRED_FIELDS=("factory.branch_id" "security.level" "build.toolchain_version" "scan.result_hash")
for field in "${REQUIRED_FIELDS[@]}"; do
  if ! tar xf "$ARTIFACT_PATH" "./metadata/$field" 2>/dev/null; then
    echo "ERROR: 制品缺少必需元数据字段: $field"
    exit 1
  fi
  echo "  ✓ $field 存在"
done

echo "[3/5] 运行安全扫描..."
# 使用总厂指定的扫描工具
SCAN_TOOL="/tmp/contract/tools/security-scanner"
SCAN_RESULT=$( "$SCAN_TOOL" --level C3 --target "$ARTIFACT_PATH" 2>&1 )
SCAN_HASH=$( echo "$SCAN_RESULT" | sha256sum | cut -d' ' -f1 )
echo "  扫描结果哈希: $SCAN_HASH"

# 将扫描哈希写入制品元数据
tar rf "$ARTIFACT_PATH" --transform="s,^,metadata/," \
  >( echo "$SCAN_HASH" )  # 实际项目中用正式文件写入

echo "[4/5] 用 cosign 签名制品..."
cosign sign --key /tmp/contract/cosign-key.pem \
  --annotations "branch=$BRANCH_ID" \
  --annotations "scan_hash=$SCAN_HASH" \
  "$ARTIFACT_REGISTRY/$BRANCH_ID/radar-processor:v2.3.1"

echo "[5/5] 推送制品到总厂仓库..."
# 推送并触发总厂侧的契约校验流水线
curl -X POST "$ARTIFACT_REGISTRY/api/v1/submit" \
  -H "Content-Type: application/json" \
  -d "{\"branch_id\": \"$BRANCH_ID\", \
       \"artifact\": \"radar-processor:v2.3.1\", \
       \"contract_version\": \"$(yq '.factory.total_factory.contracts.artifact_standard.version' $CONTRACT_FILE)\"}"

echo "=== 提交完成，等待总厂契约校验流水线结果 ==="