ci(vps-gate): commit必打[vps]/[nas]标签+vps-deployed tag+待推issue [nas]

- ci-cd: enforce-label(本次push无标签→fail,merge豁免) + check-vps-needed(nas-verify绿后对比vps-deployed tag,有[vps]未部署→开issue)
- vps-deploy: 成功打vps-deployed tag + 关issue(gap清空)
- scripts/ci/vps_pending_check.py: issue开/关/更新(CI复用)
- docs: vps-impact-map触及面表 + vps-deploy-pending判定记录
- CLAUDE.md: 部署流程段补标签约定

.gitea/workflows/ci-cd.yml

@@ -25,6 +25,31 @@ jobs:
           git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
           git fetch --depth 1 origin "${GITHUB_SHA}"
           git checkout FETCH_HEAD
+      - name: enforce commit label ([vps]/[nas] 必打, merge 豁免)
+        if: github.event_name == 'push'
+        run: |
+          set -e
+          BEFORE=${{ github.event.before }}
+          AFTER=${{ github.event.after }}
+          if [[ "$BEFORE" =~ ^0+$ ]]; then
+            git fetch origin "$AFTER" --depth 20
+            RANGE="HEAD~20..HEAD"
+          else
+            git fetch origin "$BEFORE" "$AFTER" --depth 50
+            RANGE="${BEFORE}..${AFTER}"
+          fi
+          # 缺标签 = 既无 [vps]/[nas] 且非 Merge 开头
+          MISSING=$(git log --format=%s "$RANGE" | grep -vE '\[(vps|nas)\]|^Merge' || true)
+          if [ -n "$MISSING" ]; then
+            echo "❌ 以下 commit 缺 [vps]/[nas] 环境标签:"
+            echo "$MISSING"
+            echo ""
+            echo "规范: <type>(<scope>): <desc> [vps]   # VPS 也中招, 要推 prod"
+            echo "      <type>(<scope>): <desc> [nas]   # NAS/docker 专属, VPS 不中招"
+            echo "详见 docs/vps-impact-map.md"
+            exit 1
+          fi
+          echo "✅ 本次 push commit 标签齐全"
       - name: pytest 冒烟 (venv310 数据层核心)
         run: |
           PY=/Users/chufeng/.openclaw/sanguo_projects/sanguo_vnpy_v2/venv310/bin/python
@@ -96,10 +121,21 @@ jobs:
           n=c.execute(\"SELECT COUNT(*) FROM dbbardata WHERE symbol=?\",(\"600519\",)).fetchone()[0]
           print(\"dbbardata 600519 rows:\", n)
           exit(0 if n>0 else 1)'"
-      - name: 提示 VPS 部署方式(验证通过后才推 prod)
+      - name: check-vps-needed (vps-deployed tag 对比 + 待推 issue 信号)
+        env:
+          GTOKEN: ${{ github.token }}
         run: |
-          echo "::notice::NAS 验证通过 ✅ 。部署 VPS 触发 vps-deploy.yml, 传 sha=${GITHUB_SHA::7}"
-          echo "  人工: Gitea → Actions → vps-deploy.yml → Run workflow, sha=${GITHUB_SHA}"
-          echo "  agent: dispatch_workflow workflow_id=vps-deploy.yml inputs={sha:${GITHUB_SHA}}"
+          set -e
+          git fetch origin "$GITHUB_SHA" --depth 100 2>/dev/null || true
+          git fetch origin refs/tags/vps-deployed:refs/tags/vps-deployed 2>/dev/null || true
+          if git rev-parse --verify vps-deployed >/dev/null 2>&1; then
+            RANGE="$(git rev-parse vps-deployed)..HEAD"
+          else
+            RANGE="HEAD~50..HEAD"
+            echo "⚠️ vps-deployed tag 不存在(首次/未推过 VPS), 查最近 50 commit"
+          fi
+          export VPS_LOG="$(git log --format='%h %s' "$RANGE" --grep='\[vps\]' || true)"
+          echo "::notice::NAS 验证通过 ✅ 。含 [vps] 则开 [待推VPS] issue(人工/agent 推 vps-deploy.yml)"
+          python3 scripts/ci/vps_pending_check.py
 
   # 注: VPS 部署已拆到 .gitea/workflows/vps-deploy.yml (workflow_dispatch 人工/agent 触发)

.gitea/workflows/vps-deploy.yml

@@ -40,3 +40,18 @@ jobs:
         run: bash scripts/nas_sync/promote.sh --target vps
       - name: VPS 冒烟 (LocalUnifiedProvider 真数据)
         run: ssh 49.232.102.198 'cd C:\sanguo_vnpy_v2 && C:\Python310\python.exe -X utf8 scripts/data_platform/verify_unified_e2e.py'
+      - name: mark vps-deployed tag (VPS 版本真相, session 用 git log vps-deployed..HEAD 查未部署)
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          set -e
+          SHA="${{ inputs.sha }}"
+          git tag -f vps-deployed "$SHA"
+          git push -f "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git" refs/tags/vps-deployed
+          echo "✅ vps-deployed → ${SHA::7}"
+      - name: 关闭 [待推VPS] issue (tag=HEAD → gap 清空 = 绿)
+        env:
+          GTOKEN: ${{ github.token }}
+        run: |
+          export VPS_LOG=""
+          python3 scripts/ci/vps_pending_check.py