From 4c9a9276db031bce003f4ce56cf9e24eb443041b Mon Sep 17 00:00:00 2001
From: HyxiaoGe <18889592303@163.com>
Date: Tue, 18 Aug 2026 16:53:04 +0800
Subject: [PATCH 1/2] Fix deployment migration network conflict

---
 .github/workflows/container.yml | 1 +
 .github/workflows/deploy.yml    | 2 +-
 docker-compose.migrate.yml      | 7 +++++++
 3 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 docker-compose.migrate.yml

diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
index 769f44a..ea2f09a 100644
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@@ -50,6 +50,7 @@ jobs:
           DATABASE_URL_SYNC=postgresql://external:secret@db.example:5432/auth \
           REDIS_URL=redis://cache.example:6379/0 \
           docker compose config --quiet
+          docker compose -f docker-compose.yml -f docker-compose.migrate.yml config --quiet
 
   pr-image:
     name: Container build
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3798e20..c1aef4e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -126,7 +126,7 @@ jobs:
             # 旧实例不理解 auth_generation；迁移前先停流量，关闭双写协议窗口。
             docker compose -f docker-compose.yml stop auth
           fi
-          if ! docker compose -f docker-compose.yml run --rm --no-deps auth alembic upgrade head; then
+          if ! docker compose -f docker-compose.yml -f docker-compose.migrate.yml run --rm --no-deps auth alembic upgrade head; then
             migration_failed=1
             if [ "$auth_generation_cutover" -eq 1 ]; then
               echo "::error::数据库迁移失败，恢复已停止的旧容器"
diff --git a/docker-compose.migrate.yml b/docker-compose.migrate.yml
new file mode 100644
index 0000000..781abc7
--- /dev/null
+++ b/docker-compose.migrate.yml
@@ -0,0 +1,7 @@
+services:
+  auth:
+    # One-off migration containers run alongside the live auth service, so they
+    # must not inherit its dedicated ingress address.
+    networks:
+      auth_edge:
+        ipv4_address: !reset null

From 967ccac9211780b270d00bf6df21b20dbf37401a Mon Sep 17 00:00:00 2001
From: HyxiaoGe <18889592303@163.com>
Date: Tue, 18 Aug 2026 17:03:58 +0800
Subject: [PATCH 2/2] Update deployment workflow tests

---
 tests/test_deploy_workflow.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tests/test_deploy_workflow.py b/tests/test_deploy_workflow.py
index 7913fa9..996c44f 100644
--- a/tests/test_deploy_workflow.py
+++ b/tests/test_deploy_workflow.py
@@ -8,6 +8,10 @@ def _workflow() -> str:
 
 
 GENERATION_MIGRATION = "alembic/versions/c8d9e0f1a2b3_add_auth_generation.py"
+MIGRATION_COMMAND = (
+    "docker compose -f docker-compose.yml -f docker-compose.migrate.yml "
+    "run --rm --no-deps auth alembic upgrade head"
+)
 
 
 def test_deploy_detects_auth_generation_cutover_from_previous_sha():
@@ -21,7 +25,7 @@ def test_deploy_builds_stops_migrates_then_switches_for_generation_cutover():
     deploy_sequence = workflow.split("# 先构建新镜像，再按迁移类型安全切换。", 1)[1]
     build = "docker compose -f docker-compose.yml build auth"
     stop = "docker compose -f docker-compose.yml stop auth"
-    migrate = "docker compose -f docker-compose.yml run --rm --no-deps auth alembic upgrade head"
+    migrate = MIGRATION_COMMAND
     switch = "docker compose -f docker-compose.yml up -d --no-build auth"
 
     assert build in deploy_sequence
@@ -40,13 +44,16 @@ def test_generation_migration_failure_restores_source_and_restarts_stopped_old_c
     assert "docker compose -f docker-compose.yml start auth" in recovery
     assert "http://127.0.0.1:8100/health" in recovery
     assert "docker compose -f docker-compose.yml build auth" not in recovery
-    assert (
-        'if ! docker compose -f docker-compose.yml run --rm --no-deps auth alembic upgrade head; then'
-        in workflow
-    )
+    assert f"if ! {MIGRATION_COMMAND}; then" in workflow
     assert "数据库迁移失败，恢复已停止的旧容器" in workflow
 
 
+def test_migration_container_does_not_reuse_live_static_ip():
+    override = (Path(__file__).parents[1] / "docker-compose.migrate.yml").read_text()
+
+    assert "ipv4_address: !reset null" in override
+
+
 def test_generation_migration_success_disables_legacy_sha_rollback_on_new_container_failure():
     workflow = _workflow()
     assert 'if [ "$auth_generation_cutover" -eq 1 ] && [ "$migration_succeeded" -eq 1 ]; then' in workflow