fix(ci): isolate Docker registry credentials

scripts/test-environment-pipeline-contract.test.mjs

@@ -64,6 +64,26 @@ test('development and test deployment locks are acquired before target executors
   assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
 })
 
+test('parallel image publications isolate registry credentials per Jenkins job', () => {
+  const imageStage = pipeline.slice(
+    pipeline.indexOf("stage('构建并发布单服务镜像')"),
+    pipeline.indexOf("stage('部署开发或测试环境')")
+  )
+  const loginIndex = imageStage.indexOf('docker login')
+  const buildIndex = imageStage.indexOf('docker build')
+  const pushIndex = imageStage.indexOf('docker push')
+  const logoutIndex = imageStage.indexOf('docker logout')
+  const cleanupIndex = imageStage.indexOf('rm -rf "$DOCKER_CONFIG"')
+
+  assert.match(imageStage, /String dockerConfigDir = "\$\{pwd\(tmp: true\)\}\/docker-auth"/)
+  assert.match(imageStage, /withEnv\(\["DOCKER_CONFIG=\$\{dockerConfigDir\}"\]\)/)
+  assert.ok(loginIndex >= 0 && loginIndex < buildIndex, 'registry login must happen before image build')
+  assert.ok(buildIndex < pushIndex, 'image build must happen before image push')
+  assert.ok(pushIndex < logoutIndex, 'registry logout must happen after image push')
+  assert.ok(logoutIndex < cleanupIndex, 'temporary Docker credentials must be removed last')
+  assert.doesNotMatch(imageStage, /\/home\/deploy\/\.docker\/config\.json/)
+})
+
 test('parallel remote deployments keep env and compose assets isolated by project', () => {
   assert.match(directDeployScript, /REMOTE_ENV_NAME="\.env\.\$PROJECT_NAME"/)
   assert.match(directDeployScript, /REMOTE_COMPOSE_NAME="docker-compose\.\$PROJECT_NAME\.yml"/)