From fa92936406bac5b1f55442a6f71a415806592f3b Mon Sep 17 00:00:00 2001
From: ouyangxq <775153912@qq.com>
Date: Tue, 25 Aug 2026 15:16:41 +0800
Subject: [PATCH] fix(deploy): bind development gateways to loopback

---
 deploy/scripts/deploy-built-service.sh              | 10 ++--------
 scripts/test-environment-pipeline-contract.test.mjs |  9 ++++-----
 2 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/deploy/scripts/deploy-built-service.sh b/deploy/scripts/deploy-built-service.sh
index b8d703d8c..29707e71e 100644
--- a/deploy/scripts/deploy-built-service.sh
+++ b/deploy/scripts/deploy-built-service.sh
@@ -37,10 +37,7 @@ case "$DEPLOY_ENV" in
 esac
 
 if [ "$DEPLOY_ENV" = "development" ]; then
-  case "$SERVICE" in
-    gateway|gateway-overseas) PUBLISHED_BIND_ADDRESS=0.0.0.0 ;;
-    *) PUBLISHED_BIND_ADDRESS=127.0.0.1 ;;
-  esac
+  PUBLISHED_BIND_ADDRESS=127.0.0.1
 else
   PUBLISHED_BIND_ADDRESS="${PUBLISHED_BIND_ADDRESS:-0.0.0.0}"
 fi
@@ -433,10 +430,7 @@ export DEPLOY_ENV="$deploy_env"
 export IMAGE_REPOSITORY="$image_repository"
 export IMAGE_TAG="$image_tag"
 if [ "$deploy_env" = "development" ]; then
-  case "$service" in
-    gateway|gateway-overseas) export PUBLISHED_BIND_ADDRESS=0.0.0.0 ;;
-    *) export PUBLISHED_BIND_ADDRESS=127.0.0.1 ;;
-  esac
+  export PUBLISHED_BIND_ADDRESS=127.0.0.1
 else
   export PUBLISHED_BIND_ADDRESS="${PUBLISHED_BIND_ADDRESS:-0.0.0.0}"
 fi
diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs
index 22eaf133c..4d324af00 100644
--- a/scripts/test-environment-pipeline-contract.test.mjs
+++ b/scripts/test-environment-pipeline-contract.test.mjs
@@ -85,13 +85,12 @@ test('development and test deployment locks are acquired before target executors
   assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
 })
 
-test('development exposes gateways for remote acceptance and keeps internal services on loopback', () => {
+test('development publishes every service on loopback without changing test defaults', () => {
   assert.match(serviceCompose, /\$\{PUBLISHED_BIND_ADDRESS:-0\.0\.0\.0\}:\$\{GATEWAY_PORT:-9000\}:9000/)
   assert.match(overseasCompose, /\$\{PUBLISHED_BIND_ADDRESS:-0\.0\.0\.0\}:\$\{GATEWAY_OVERSEAS_PORT:-9300\}:9300/)
-  assert.match(directDeployScript, /gateway\|gateway-overseas\) PUBLISHED_BIND_ADDRESS=0\.0\.0\.0/)
-  assert.match(directDeployScript, /\*\) PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
-  assert.match(directDeployScript, /gateway\|gateway-overseas\) export PUBLISHED_BIND_ADDRESS=0\.0\.0\.0/)
-  assert.match(directDeployScript, /\*\) export PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
+  assert.match(directDeployScript, /if \[ "\$DEPLOY_ENV" = "development" \]; then\s+PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
+  assert.match(directDeployScript, /if \[ "\$deploy_env" = "development" \]; then\s+export PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
+  assert.doesNotMatch(directDeployScript, /gateway\|gateway-overseas\) (?:export )?PUBLISHED_BIND_ADDRESS=0\.0\.0\.0/)
 })
 
 test('parallel image publications isolate registry credentials per Jenkins job', () => {