ci(deploy): 仅允许 master 自动部署

tests/deploy_master_only.test.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+WORKFLOW="$ROOT_DIR/.github/workflows/deploy.yml"
+
+if ! grep -q '^      - master$' "$WORKFLOW"; then
+  echo "部署工作流尚未监听 master"
+  exit 1
+fi
+if grep -q '^      - dev$' "$WORKFLOW"; then
+  echo "部署工作流仍监听 dev"
+  exit 1
+fi
+if ! grep -q '^      group: deploy-master$' "$WORKFLOW"; then
+  echo "部署并发组尚未切换到 master"
+  exit 1
+fi
+if ! grep -q '^          DEPLOY_BRANCH: master$' "$WORKFLOW"; then
+  echo "手动部署分支尚未固定为 master"
+  exit 1
+fi
+
+TEST_DIR="$(mktemp -d)"
+trap 'rm -rf "$TEST_DIR"' EXIT
+mkdir -p "$TEST_DIR/project" "$TEST_DIR/bin"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$TEST_DIR/bin/python3"
+chmod +x "$TEST_DIR/bin/python3"
+
+set +e
+OUTPUT="$(
+  PATH="$TEST_DIR/bin" \
+  PROJECT_DIR="$TEST_DIR/project" \
+  VENV_DIR="$TEST_DIR/project/.venv" \
+  DEPLOY_BRANCH=dev \
+  SKIP_GIT_PULL=1 \
+  /bin/bash "$ROOT_DIR/deploy.sh" 2>&1
+)"
+STATUS=$?
+set -e
+
+if [ "$STATUS" -eq 0 ] || [[ "$OUTPUT" != *"只允许部署 master"* ]]; then
+  echo "deploy.sh 没有拒绝 dev 分支"
+  exit 1
+fi
+
+echo "master-only 部署约束验证通过"