fix(ci): serialize deployments per service

Jenkinsfile.service

@@ -194,8 +194,12 @@ pipeline {
             steps {
                 script {
                     String deploySlotLabel = "firstleg-${params.ENVIRONMENT}-deploy-slot"
+                    String serviceDeployResource = "firstleg-${params.ENVIRONMENT}-${env.RESOLVED_SERVICE}-deploy"
                     String credentialId = "firstleg-${params.ENVIRONMENT}-env"
                     String targetLabel = params.ENVIRONMENT == 'development' ? 'java-dev' : 'java-test'
+                    // 不同服务可以并行，但同一环境的同一服务只能有一个任务更新容器。
+                    // resource 未预配置时 Lockable Resources 会创建仅在构建期间存在的临时资源。
+                    lock(resource: serviceDeployResource, inversePrecedence: true) {
                         lock(label: deploySlotLabel, quantity: 1, inversePrecedence: true) {
                             node(targetLabel) {
                                 deleteDir()
@@ -232,6 +236,7 @@ pipeline {
                     }
                 }
             }
+        }
 
         stage('部署单个服务') {
             when {

scripts/test-environment-pipeline-contract.test.mjs

@@ -71,13 +71,17 @@ test('development and test deployment locks are acquired before target executors
     pipeline.indexOf("stage('部署开发或测试环境')"),
     pipeline.indexOf("stage('部署单个服务')")
   )
+  const serviceLockIndex = directDeployStage.indexOf('lock(resource: serviceDeployResource')
   const lockIndex = directDeployStage.indexOf('lock(label: deploySlotLabel')
   const nodeIndex = directDeployStage.indexOf('node(targetLabel)')
 
   assert.match(directDeployStage, /agent none/)
   assert.match(directDeployStage, /String targetLabel = params\.ENVIRONMENT == 'development' \? 'java-dev' : 'java-test'/)
+  assert.match(directDeployStage, /String serviceDeployResource = "firstleg-\$\{params\.ENVIRONMENT\}-\$\{env\.RESOLVED_SERVICE\}-deploy"/)
+  assert.ok(serviceLockIndex >= 0, 'per-service deployment lock must exist')
   assert.ok(lockIndex >= 0, 'deployment slot lock must exist')
   assert.ok(nodeIndex >= 0, 'target node allocation must exist')
+  assert.ok(serviceLockIndex < lockIndex, 'per-service lock must be acquired before the shared deployment slot')
   assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
 })