fix(v2): lock current Server/Hub bundle CI; retire historical triggers and block legacy release on dev

.github/workflows/cf-edit-native.yml

@@ -1,16 +1,7 @@
 name: CF-EDIT pinned native compile (feature)
 on:
-  push:
-    branches: [feature/v2-rust-guard-only, dev]
-    paths:
-      - "build/v2/source-set.json"
-      - ".github/workflows/cf-edit-native.yml"
-  pull_request:
-    branches: [dev]
-    paths:
-      - "build/v2/source-set.json"
-      - ".github/workflows/cf-edit-native.yml"
   workflow_dispatch:
+
 permissions:
   contents: read
 jobs:

.github/workflows/dev.yml

@@ -1,53 +1,62 @@
-name: CloudFile development checks
+name: CloudFile quick source checks
 
+# Routine dev and PR changes must never trigger a cross-repository build,
+# native compilation, DB integration or deployment. Run those separately via
+# reviewed workflow_dispatch jobs when the relevant change needs them.
 on:
   push:
     branches: [dev]
+    paths-ignore:
+      - '**/*.md'
+      - '**/*.markdown'
+      - 'README*'
+      - 'AGENTS.md'
+      - 'docs/**'
+  pull_request:
+    branches: [dev]
+    paths-ignore:
+      - '**/*.md'
+      - '**/*.markdown'
+      - 'README*'
+      - 'AGENTS.md'
+      - 'docs/**'
+  workflow_dispatch:
 
-concurrency:
-  group: dev-checks-${{ github.ref }}
-  cancel-in-progress: true
+permissions:
+  contents: read
 
 jobs:
-  checks:
+  static:
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
         with:
-          path: cloudfile-docker
-          fetch-depth: 0
-
-      - uses: actions/checkout@v4
-        with:
-          repository: eaopen/cloudfile-server
-          ref: dev
-          path: cloudfile-server
-          fetch-depth: 0
-
-      - uses: actions/checkout@v4
-        with:
-          repository: eaopen/cloudfile-hub
-          ref: dev
-          path: cloudfile-hub
-          fetch-depth: 0
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: cloudfile-server/fileserver/go.mod
-          cache-dependency-path: cloudfile-server/fileserver/go.sum
-
-      - name: Install C test dependencies
+          fetch-depth: 2
+      - name: Check changed files
+        shell: bash
         run: |
-          sudo apt-get update -qq
-          # Native directory paging tests compile the real Vala objects and JSON RPC.
-          sudo apt-get install -y -qq libglib2.0-dev libjansson-dev valac pkg-config
-
-      - name: Install isolated check dependencies
-        run: pip install --quiet -r cloudfile-docker/tools/check-requirements.txt
-
-      - name: Run development checks
-        run: ./cloudfile-docker/tools/run-checks.sh
+          set -euo pipefail
+          git diff --check HEAD^ HEAD
+          python3 - <<'PY'
+          from pathlib import Path
+          import subprocess
+
+          changed = subprocess.check_output(
+              ['git', 'diff', '--name-only', '-z', 'HEAD^', 'HEAD']
+          ).split(b'\0')
+          for raw in changed:
+              if not raw:
+                  continue
+              path = Path(raw.decode('utf-8'))
+              if path.is_file() and path.suffix == '.py':
+                  compile(path.read_bytes(), str(path), 'exec')
+          PY
+          while IFS= read -r path; do
+            [[ ! -f "$path" ]] || bash -n "$path"
+          done < <(git diff --name-only HEAD^ HEAD -- '*.sh')
+
+      - name: Test source selection rules without building images
+        run: |
+          python3 -m unittest discover -s tests -p test_v2_source_assembly.py -q
+          python3 -m unittest discover -s tests -p test_v2_build_policy.py -q

.github/workflows/prod.yml

@@ -112,18 +112,28 @@ jobs:
           path: cloudfile-docker
           fetch-depth: 1
 
+      - name: Restrict the historical release recipe to explicit maintenance refs
+        shell: bash
+        run: |
+          if [[ "$GITHUB_REF_NAME" != maintenance/v0.9/* ]]; then
+            echo "::error::Historical packaging is allowed only from an explicitly approved maintenance/v0.9/* ref; never from CloudFile dev or a detached feature snapshot."
+            exit 2
+          fi
+
       - name: Read release refs
         id: refs
         working-directory: cloudfile-docker
         run: |
-          server_ref=$(python3 build/cloudfile_14.0/read-manifest.py release.yaml server_commit || true)
-          hub_ref=$(python3 build/cloudfile_14.0/read-manifest.py release.yaml hub_commit || true)
-          if [[ -z $server_ref ]]; then
-            server_ref=$(python3 build/cloudfile_14.0/read-manifest.py release.yaml forks.cloudfile_server.ref)
-          fi
-          if [[ -z $hub_ref ]]; then
-            hub_ref=$(python3 build/cloudfile_14.0/read-manifest.py release.yaml forks.cloudfile_hub.ref)
-          fi
+          server_ref=$(python3 build/cloudfile_14.0/read-manifest.py release.yaml server_commit)
+          hub_ref=$(python3 build/cloudfile_14.0/read-manifest.py release.yaml hub_commit)
+          # Never fall back to floating dev; the Docker commit is recorded
+          # from the checked-out workflow SHA, not self-pinned in this file.
+          for pin in "$server_ref" "$hub_ref"; do
+            if [[ ! $pin =~ ^[0-9a-f]{40}$ ]]; then
+              echo "::error::Historical release requires immutable server_commit and hub_commit pins"
+              exit 2
+            fi
+          done
           echo "server_ref=$server_ref" >> "$GITHUB_OUTPUT"
           echo "hub_ref=$hub_ref" >> "$GITHUB_OUTPUT"
 

.github/workflows/v2-clean.yml

@@ -1,10 +1,7 @@
-name: CloudFile V2 clean CE14 isolated checks
+name: CloudFile frozen V2 source-set (historical manual check)
 
+# Explicitly frozen 2026-10-16 source snapshot; this does NOT prove current dev.
 on:
-  push:
-    branches: [dev, dev2-clean, feature/v2-rust-guard-only, feature/v2-checkout-default-on]
-  pull_request:
-    branches: [dev]
   workflow_dispatch:
 
 permissions:
@@ -84,7 +81,7 @@ jobs:
           CF_TEST_REDIS_PORT: '6379'
         run: |
           python3 -m unittest discover -s cloudfile-docker/tests -p test_v2_source_assembly.py -v
-          python3 cloudfile-docker/tools/prepare-v2-source.py --workspace . --output /tmp/cfv2-clean
+          python3 cloudfile-docker/tools/prepare-v2-source.py --workspace . --source-set cloudfile-docker/build/v2/source-set.json --output /tmp/cfv2-clean
           python3 cloudfile-docker/tools/check-v2-fresh.py --source /tmp/cfv2-clean
 
   native-ce14-runtime:
@@ -147,7 +144,7 @@ jobs:
           python3 -m pip install --quiet 'pymysql>=1.1,<2' 'redis>=5,<8' 'PyJWT>=2.8,<3' 'requests>=2.31,<3' 'Django>=5.2,<5.3' 'requests>=2.31,<3' 'PyJWT>=2,<3'
       - name: Assemble exact selected native source
         run: |
-          python3 cloudfile-docker/tools/prepare-v2-source.py --workspace . --output /tmp/cfv2-clean
+          python3 cloudfile-docker/tools/prepare-v2-source.py --workspace . --source-set cloudfile-docker/build/v2/source-set.json --output /tmp/cfv2-clean
           test ! -e /tmp/cfv2-clean/seahub/cloudfile_extensions
           test ! -e /tmp/cfv2-clean/seafile-server/server/cloudfile-policy.c
       - name: Check routed and native Go storage

.github/workflows/v2-dev-bundle.yml

@@ -0,0 +1,124 @@
+name: CloudFile V2 current dev source bundle
+
+# Run this integration snapshot only after the selected changes are ready.
+# Ordinary commits and documentation edits must not trigger compilation or
+# runtime test infrastructure; native builds remain separately approved.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: v2-current-source-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  current-v2-source:
+    runs-on: ubuntu-24.04
+    services:
+      mariadb:
+        image: mariadb:11.4
+        env:
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: '1'
+        ports: ['3306:3306']
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=5s --health-timeout=5s --health-retries=20
+      redis:
+        image: redis:7-alpine
+        ports: ['6379:6379']
+        options: >-
+          --health-cmd="redis-cli ping"
+          --health-interval=5s --health-timeout=5s --health-retries=10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: cloudfile-docker
+          fetch-depth: 0
+
+      - name: Freeze current peer commits once
+        shell: bash
+        id: peers
+        run: |
+          set -euo pipefail
+          server=$(git ls-remote https://github.com/eaopen/cloudfile-server.git refs/heads/dev | awk '{print $1}')
+          hub=$(git ls-remote https://github.com/eaopen/cloudfile-hub.git refs/heads/dev | awk '{print $1}')
+          [[ $server =~ ^[a-f0-9]{40}$ && $hub =~ ^[a-f0-9]{40}$ ]]
+          echo "server_sha=$server" >> "$GITHUB_OUTPUT"
+          echo "hub_sha=$hub" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@v4
+        with:
+          repository: eaopen/cloudfile-server
+          ref: ${{ steps.peers.outputs.server_sha }}
+          path: cloudfile-server
+          fetch-depth: 0
+
+      - uses: actions/checkout@v4
+        with:
+          repository: eaopen/cloudfile-hub
+          ref: ${{ steps.peers.outputs.hub_sha }}
+          path: cloudfile-hub
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install isolated V2 contract dependencies
+        run: pip install --quiet 'pymysql>=1.1,<2' 'redis>=5,<8' 'PyJWT>=2.8,<3' 'requests>=2.31,<3' 'Django>=5.2,<5.3'
+
+      - name: Prepare and test exact current V2 source snapshot
+        env:
+          SERVER_SHA: ${{ steps.peers.outputs.server_sha }}
+          HUB_SHA: ${{ steps.peers.outputs.hub_sha }}
+          CF_TEST_DB_PORT: '3306'
+          CF_TEST_REDIS_PORT: '6379'
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          manifest = json.loads(Path('cloudfile-docker/build/v2/source-set.json').read_text())
+          manifest['components']['cloudfile-server']['overlay_commit'] = os.environ['SERVER_SHA']
+          manifest['components']['cloudfile-hub']['overlay_commit'] = os.environ['HUB_SHA']
+          # The Go filesystem backend is an execution seam, not an additive
+          # V2 module. Without it a current-dev image can silently retain the
+          # upstream tempfiles EXDEV behavior even after Server's fix merges.
+          native = manifest['components']['cloudfile-server']['native_patches']
+          if 'fileserver/objstore/backend_fs.go' not in native:
+              native.append('fileserver/objstore/backend_fs.go')
+          Path('/tmp/current-v2-source-set.json').write_text(json.dumps(manifest, indent=2) + '\n')
+          PY
+          python3 cloudfile-docker/tools/prepare-v2-source.py \
+            --workspace . --source-set /tmp/current-v2-source-set.json \
+            --output /tmp/cloudfile-v2-current
+          python3 cloudfile-docker/tools/check-v2-fresh.py --source /tmp/cloudfile-v2-current
+          python3 -m compileall -q /tmp/cloudfile-v2-current/seahub/cloudfile_ext/v2
+
+      - name: Record independently checkable V2 bundle
+        if: always()
+        shell: bash
+        env:
+          SERVER_SHA: ${{ steps.peers.outputs.server_sha }}
+          HUB_SHA: ${{ steps.peers.outputs.hub_sha }}
+        run: |
+          {
+            echo '### V2 current DEV source snapshot'
+            echo "- Docker: `$(git -C cloudfile-docker rev-parse HEAD)`"
+            echo "- Server: `$SERVER_SHA`"
+            echo "- Hub: `$HUB_SHA`"
+            echo 'V2 source assembly, schema and isolated contracts only; not a live Etech or native CE runtime acceptance.'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: v2-source-receipt-${{ github.run_id }}
+          path: /tmp/cloudfile-v2-current/v2-source-receipt.json
+          if-no-files-found: ignore
+          retention-days: 14

build/v2/Dockerfile.dev

@@ -23,7 +23,9 @@ RUN --mount=type=cache,id=cfv2-gomod,from=cf-cache,source=gomodcache,target=/go/
     go mod download
 
 FROM go-dependencies AS native
-COPY v2-source-receipt.json /source/v2-source-receipt.json
+# The combined receipt also changes on Hub-only commits; do not invalidate the
+# expensive native C/Go layer with unrelated Hub source. The exact receipt is
+# checked before the build and copied into the final runtime image below.
 COPY seafile-server /source/seafile-server
 RUN --mount=type=cache,id=cfv2-gomod,from=cf-cache,source=gomodcache,target=/go/pkg/mod \
     --mount=type=cache,id=cfv2-gobuild-${TARGETARCH},from=cf-cache,source=gocache,target=/root/.cache/go-build \

build/v2/README.md

@@ -1,7 +1,44 @@
 # Native V2 DEV Runtime
 
-Prepare the pinned CE14 source with `tools/prepare-v2-source.py`, then use the
-existing CE14 dependency images and cache directory:
+> Server/Hub/Docker `dev` is the only default development source. Source assembly
+> resolves the local Server/Hub `dev` refs to exact SHAs before reading files;
+> update the local `dev` refs first. The pinned `source-set.json` is retained
+> only as an explicitly selected historical snapshot with `--source-set`.
+> Cross-repository integration checks run on manual `workflow_dispatch`, not
+> on every code or documentation change. Neither source check publishes an image.
+
+### Current CI and incremental-build policy (2026-10-20)
+
+- Ordinary Server/Hub/Docker pull requests and `dev` pushes perform cheap
+  changed-source syntax/format checks only; pure Markdown changes skip CI.
+  Search/OIDC probes retain narrow path filters.
+- Full Seahub, C/Go/native, database, cross-repository and image builds are
+  **manual**. Reuse previous test evidence if its source SHA, prerequisites and
+  runner environment are unchanged. Neither CI nor release performs a deployment
+  or an automatic rollback.
+- `prepare-v2-source.py` selects the local Server/Hub `dev` refs by default,
+  resolves the SHAs once, and records the exact reviewed overlay in its receipt.
+  The CE14 native anchor and allowlisted native file seams do not float.
+- The combined source receipt is validated before any Docker build and retained
+  in the final image, **not** fed into the C/Go compiler layer. A Hub-only SHA
+  change should reuse that existing layer; this is a cache-key guarantee,
+  **not** a measured cache-hit claim. BuildKit, ccache, Go, npm and pip caches
+  may still be absent on a particular builder.
+- Legacy `release.yaml`/CE14 packaging is restricted to deliberately selected
+  maintenance refs and fixed Server/Hub SHA inputs, never the default V2 path.
+  Missing runtime launchers or invalid input hashes must fail explicitly rather
+  than copying or silently falling back to historical application files.
+
+**Approval boundary:** a manual integration or release check is not authorization
+to compile all targets, publish an image, change DEV/PROD containers, or roll
+back a deployment. Each operation requires its own approved scope.
+
+Prepare the CE14 source plus reviewed current CloudFile `dev` overlays with
+`python3 tools/prepare-v2-source.py --workspace . --output /path/to/prepared-source`
+from a three-repository workspace. To reproduce a historical source snapshot,
+supply `--source-set build/v2/source-set.json` explicitly instead.
+
+Then use the existing dependency images and cache directory:
 
 ```sh
 CF_BASE_IMAGE=cloudfile-build-base:ce14-v2 \
@@ -206,7 +243,10 @@ reproduces RawPostDataException on the prior image; no schema, tag migration or
 native binary rebuild is involved.
 
 
-## 内部文件读取：复用 Seafile 原生票据（2026-10-19）
+## 内部文件读取：复用 Seafile 原生票据（2026-10-19，历史构建快照）
+
+> 以下源码 SHA 与当时的构建限制用于复现 10 月 19 日的特定候选；
+> **不是当前 `dev` 的源码选择规则**。当前构建规则以上方说明为准。
 
 本候选版本固定 Server `89ae96652389024730ac9d3927ed3be908534ce9`
 与 Hub `bfc7651f188b8a537a466e7ee0bc143bc6acb85e`。