[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-strapi-article:zh:proxy-dns-resolution-path-testing":3,"blog-article:\u002Fblog\u002Fproxy-dns-resolution-path-testing":610,"blog-related:\u002Fblog\u002Fproxy-dns-resolution-path-testing":611,"blog-translations:\u002Fblog\u002Fproxy-dns-resolution-path-testing":612},{"available":4,"article":5,"relatedArticles":148,"translations":522},true,{"source":6,"id":7,"documentId":8,"translationKey":8,"locale":9,"slug":10,"path":11,"_path":11,"title":12,"description":13,"excerpt":13,"image":14,"publishedAt":15,"updatedAt":16,"author":17,"tags":18,"featured":19,"sortOrder":20,"readingTime":21,"bodyType":22,"bodyBlocks":23,"bodyHtml":147},"strapi",3980,"uuh7klkjl5x2lbcyglc3enah","zh","proxy-dns-resolution-path-testing","\u002Fblog\u002Fproxy-dns-resolution-path-testing","应用接入代理后，如何检查 DNS 请求走了哪条解析路径","用抓包、代理日志和权威 DNS 三证据判断解析发生在客户端本地还是代理端；目标服务收到的是已解析后的连接目标，socks5 与 socks5h 的域名传递方式是最容易漏掉的泄漏点。","https:\u002F\u002Fcms.quanqiudaili.com\u002Fuploads\u002Flarge_DNS_cover_87e222b179.webp","2026-11-06T07:38:31.202Z","2026-11-06T07:38:31.179Z","Global Proxies Team",[],false,0,2,"blocks",[24,30,35,39,43,47,51,55,67,71,75,79,83,87,98,107,126,130,135,139,143],{"type":25,"children":26},"paragraph",[27],{"text":28,"type":29},"DNS 测试的重点是确认查询由客户端还是代理端发起。本地解析使用设备上的 DNS 解析器；代理端解析则由代理侧查询目标域名。目标服务通常收到的是已经解析后的连接请求，不是这次 DNS 查询的发起方。","text",{"type":31,"level":21,"children":32},"heading",[33],{"text":34,"type":29},"区分客户端本地 DNS 解析和代理端 DNS 解析",{"type":25,"children":36},[37],{"text":38,"type":29},"客户端本地解析由设备上的 DNS 解析器发起，查询经过本地网络；代理端解析则由代理侧解析器查询域名。目标侧内部服务发现属于另一类测试，不应与客户端或代理端解析混为一谈。先确认解析由谁发起，再判断出口地区是否符合预期。",{"type":31,"level":21,"children":40},[41],{"text":42,"type":29},"结合抓包、代理日志和权威 DNS 判断解析路径",{"type":25,"children":44},[45],{"text":46,"type":29},"抓到本机发出的 53 端口 DNS 查询，可以证明该查询走了本地路径；没有抓到时，还需检查 DoH、DoT、系统缓存和容器网络。代理日志中出现目标域名，只能说明“域名被交给代理端”，属于线索而不是证据——要确认代理端真的做了查询，得看代理解析器的实际查询记录或缓存命中。常用做法是给每次测试分配唯一的自有测试子域，附上用例 ID 和时间窗，把本地解析记录、代理解析记录和权威 DNS 日志按同一查询名串起来；日志里还要标注递归查询与转发关系，映射关系拿不到时把结论标为待确认。另外要分清两件事：解析“代理接入地址”和解析“目标域名”不是同一条路径，前者发生在建立隧道之前，不能拿来证明后者。",{"type":31,"level":21,"children":48},[49],{"text":50,"type":29},"检查 HTTP CONNECT 和 SOCKS5 如何传递目标地址",{"type":25,"children":52},[53],{"text":54,"type":29},"HTTP CONNECT 通常将目标域名交给代理处理。使用 SOCKS5 时，解析位置取决于客户端和它的实现：以 curl 为例，`socks5:\u002F\u002F` 会在本地解析后向代理发 IP，`socks5h:\u002F\u002F` 则把域名交给代理解析；确认时看实际发往代理的请求里是域名还是 IP，并结合权威日志核对。其他库的等价开关和默认值并不统一，按各自 API 和版本文档确认，不要把字符串约定当成 SOCKS5 的通用行为。",{"type":25,"children":56},[57,59,65],{"text":58,"type":29},"配置代理协议时，可对照",{"text":60,"type":29,"marks":61},"代理设置帮助",[62],{"href":63,"type":64},"https:\u002F\u002Fhelp.quanqiudaili.com\u002Fdocs\u002Fproxy-Settings","link",{"text":66,"type":29},"核查客户端设置。",{"type":31,"level":21,"children":68},[69],{"text":70,"type":29},"识别本地 DNS、DoH、DoT 和缓存导致的解析泄漏",{"type":25,"children":72},[73],{"text":74,"type":29},"本地 DNS 查询、DoH\u002FDoT 请求、系统缓存和应用自带解析库，都可能让实际结果与预期不同。排查时先确认查询由哪个组件发起，再核对解析结果和权威 DNS 日志；不要在定位解析路径前就更换 DNS 服务器。",{"type":31,"level":21,"children":76},[77],{"text":78,"type":29},"用自有测试域名验证 DNS 请求来源并记录结果",{"type":25,"children":80},[81],{"text":82,"type":29},"用自有域名较可靠的做法是权威 DNS 日志能看到查询名和来源 IP，这是重要证据。",{"type":25,"children":84},[85],{"text":86,"type":29},"记录查询发起方、查询名称、解析结果、出口归属和证据来源，并结合抓包、代理日志与权威 DNS 日志判断解析路径。\n抓包、代理日志和权威 DNS 日志应能共同支持同一判断；证据不一致时，将结论标记为待确认。若解析结果指向非预期内网或地区，应停止测试并检查配置。",{"type":25,"children":88},[89,91,96],{"text":90,"type":29},"发现 DNS 与预期不符时，可从",{"text":92,"type":29,"marks":93},"全球代理帮助中心",[94],{"href":95,"type":64},"https:\u002F\u002Fhelp.quanqiudaili.com\u002F",{"text":97,"type":29},"查找客户端接入文档。",{"type":25,"children":99},[100,102,105],{"text":101,"type":29},"如果需要核对主机、端口或协议参数，可参考",{"text":60,"type":29,"marks":103},[104],{"href":63,"type":64},{"text":106,"type":29},"。",{"type":108,"format":109,"children":110},"list","unordered",[111,119],{"type":112,"children":113},"list-item",[114],{"text":115,"type":29,"marks":116},"curl 手册中的 `--socks5` 与 `--socks5-hostname` 参数说明",[117],{"href":118,"type":64},"https:\u002F\u002Fcurl.se\u002Fdocs\u002Fmanpage.html",{"type":112,"children":120},[121],{"text":122,"type":29,"marks":123},"RFC 9499《DNS Terminology》（递归查询与转发术语）",[124],{"href":125,"type":64},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9499.html",{"type":31,"level":21,"children":127},[128],{"text":129,"type":29},"常见问题",{"type":31,"level":131,"children":132},3,[133],{"text":134,"type":29},"怎么判断 DNS 请求有没有走代理？",{"type":25,"children":136},[137],{"text":138,"type":29},"看解析发起方和权威日志来源。抓到本机发出的明文 DNS 查询，说明这次解析在本地；没抓到还要同时查 DoH\u002FDoT、缓存和容器网络。",{"type":31,"level":131,"children":140},[141],{"text":142,"type":29},"socks5 和 socks5h 有什么区别？",{"type":25,"children":144},[145],{"text":146,"type":29},"`socks5h` 由代理解析域名，`socks5` 可能本地解析后传 IP；以 curl 为例就是 `socks5h:\u002F\u002F` 与 `socks5:\u002F\u002F` 的区别，其他客户端按各自文档确认。","",[149,281,405],{"source":6,"id":150,"documentId":151,"translationKey":151,"locale":9,"slug":152,"path":153,"_path":153,"title":154,"description":155,"excerpt":155,"image":156,"publishedAt":157,"updatedAt":158,"author":17,"tags":159,"featured":19,"sortOrder":20,"readingTime":21,"bodyType":22,"bodyBlocks":160,"bodyHtml":147},3987,"ehyrf4ygtsshhwkd0o87xat6","tls-certificate-compatibility-proxy-testing","\u002Fblog\u002Ftls-certificate-compatibility-proxy-testing","应用发布前，如何检查代理环境下的 TLS 证书兼容性","先分清直连、隧道转发和代理中间人三类链路，再逐级核对证书链、信任库位置与 SAN；本机正常而容器失败的，多为 CA 没进镜像。","https:\u002F\u002Fcms.quanqiudaili.com\u002Fuploads\u002Flarge_TLS_cover_ad09ec52a5.webp","2026-11-06T07:43:24.293Z","2026-11-06T07:43:24.278Z",[],[161,172,176,180,188,192,196,200,204,208,212,216,220,224,228,232,236,240,249,253,262,265,269,273,277],{"type":25,"children":162},[163,165,170],{"text":164,"type":29},"代理环境下的 TLS 问题，先要分清证书由谁签发：直连看目标证书，隧道转发看目标证书，代理中间人看代理自签 CA。",{"text":166,"type":29,"marks":167},"代理IP",[168],{"type":169},"bold",{"text":171,"type":29}," 本身不改变 TLS 握手，但企业代理或抓包工具会替换证书链，发布前必须把这条链路完整验一遍。",{"type":31,"level":21,"children":173},[174],{"text":175,"type":29},"先确认代理是否会替换目标站的 TLS 证书",{"type":25,"children":177},[178],{"text":179,"type":29},"直连或 HTTP CONNECT 隧道通常保留目标站点的证书，应检查证书链、有效期和 SAN（证书允许使用的域名）。如果企业代理会解密并重新签发 TLS 流量，客户端看到的是企业代理签发的站点证书；此时要确认该证书能连到受信任的企业 CA。先判断代理是否替换了证书，再确定检查对象。",{"type":25,"children":181},[182,184,187],{"text":183,"type":29},"核对代理协议与客户端接入方式时，可参考",{"text":60,"type":29,"marks":185},[186],{"href":63,"type":64},{"text":106,"type":29},{"type":31,"level":21,"children":189},[190],{"text":191,"type":29},"使用 OpenSSL 查看代理连接返回的证书链",{"type":25,"children":193},[194],{"text":195,"type":29},"```bash\nopenssl s_client -proxy proxy.example.com:8080 \\\n-connect target.example.com:443 \\\n-servername target.example.com -showcerts \\\n-verify_hostname target.example.com -verify_return_error \\\n-CAfile \u002Fpath\u002Fto\u002Fca-bundle.pem\n```",{"type":25,"children":197},[198],{"text":199,"type":29},"查看输出中的 `issuer`、有效期和 SAN，并重点看两件事：证书链能否构建到受信锚、主机名是否匹配。服务端通常只提供叶证书和中间证书，不要求它回传根证书；根证书应该来自你信任的本地信任库（`-CAfile` 或 `-CApath`），而不是从连接里“捡”到一个就信。验收看退出码和验证输出（`Verify return code`），不要只看“连接成功”；最后仍在真实应用运行时或容器里做一次正负对照。",{"type":25,"children":201},[202],{"text":203,"type":29},"`-proxy` 参数需要 OpenSSL 1.1.0 或更高版本，且默认只支持 HTTP CONNECT；SOCKS5 场景改用支持该协议的工具（如 curl 的 `--proxy socks5h:\u002F\u002F`）或对应的客户端验证。运行 `openssl version` 可先检查本机版本。",{"type":31,"level":21,"children":205},[206],{"text":207,"type":29},"检查系统、运行时和容器使用的证书信任库",{"type":25,"children":209},[210],{"text":211,"type":29},"信任库位置取决于应用使用的运行时：Linux 系统证书通常位于 `\u002Fetc\u002Fssl\u002Fcerts`，Java 使用自己的 `cacerts`，Node 可通过 `NODE_EXTRA_CA_CERTS` 指定额外 CA，Python 的 `requests` 常使用 `certifi`。容器还要单独检查镜像内的证书。本机正常而容器失败时，先比较两边实际加载的 CA。",{"type":31,"level":21,"children":213},[214],{"text":215,"type":29},"根据 TLS 错误定位证书链和主机名问题",{"type":25,"children":217},[218],{"text":219,"type":29},"出现 `unable to get local issuer certificate` 时，先检查证书链是否缺少中间 CA；出现 `self signed certificate` 时，确认它是否为预期的企业 CA 或测试证书。`hostname mismatch` 通常表示证书 SAN 不包含目标域名；`protocol version` 或 `cipher mismatch` 则需要核对客户端与服务端支持的 TLS 版本和加密套件。",{"type":31,"level":21,"children":221},[222],{"text":223,"type":29},"发布前检查证书有效期、信任链和轮换结果",{"type":31,"level":131,"children":225},[226],{"text":227,"type":29},"在预发布环境验证证书更新和轮换",{"type":25,"children":229},[230],{"text":231,"type":29},"发布前记录证书到期时间，证书轮换后复测一次；灰度环境的信任库要和生产一致，否则灰度通过、生产失败。",{"type":31,"level":131,"children":233},[234],{"text":235,"type":29},"记录证书签发者、有效期和信任库位置",{"type":25,"children":237},[238],{"text":239,"type":29},"发布前记录目标域名和端口、证书签发者与到期时间、信任库位置，以及代理是否会重新签发证书。\n检查清单四项：链能构建到受信锚、CA 在信任库、主机名匹配 SAN、证书未过期。任一项不满足就不能发布；发现证书替换影响生产流量时，立即回滚配置。",{"type":25,"children":241},[242,244,247],{"text":243,"type":29},"证书链异常仍无法归因时，可从",{"text":92,"type":29,"marks":245},[246],{"href":95,"type":64},{"text":248,"type":29},"查找对应接入文档。",{"type":25,"children":250},[251],{"text":252,"type":29},"OpenSSL 参数以手册为准：",{"type":108,"format":109,"children":254},[255],{"type":112,"children":256},[257],{"text":258,"type":29,"marks":259},"`openssl s_client` 手册（`-proxy`、`-verify_hostname`、`-verify_return_error`）",[260],{"href":261,"type":64},"https:\u002F\u002Fdocs.openssl.org\u002F3.5\u002Fman1\u002Fopenssl-s_client\u002F",{"type":31,"level":21,"children":263},[264],{"text":129,"type":29},{"type":31,"level":131,"children":266},[267],{"text":268,"type":29},"代理环境下证书报错一定是代理问题吗？",{"type":25,"children":270},[271],{"text":272,"type":29},"不一定。先看证书链和信任库，主机名不符或 CA 缺失更常见。",{"type":31,"level":131,"children":274},[275],{"text":276,"type":29},"为什么本机正常、容器里失败？",{"type":25,"children":278},[279],{"text":280,"type":29},"容器镜像没有导入同一个 CA，信任库不一致。",{"source":6,"id":282,"documentId":283,"translationKey":283,"locale":9,"slug":284,"path":285,"_path":285,"title":286,"description":287,"excerpt":287,"image":288,"publishedAt":289,"updatedAt":290,"author":17,"tags":291,"featured":19,"sortOrder":20,"readingTime":21,"bodyType":22,"bodyBlocks":292,"bodyHtml":147},3986,"g5ee4zs0pa8hyuc307nk5nwf","proxy-error-handling-mock-testing","\u002Fblog\u002Fproxy-error-handling-mock-testing","如何在不依赖真实代理服务时测试应用的代理错误处理","用可注入的代理桩和故障矩阵覆盖超时、拒绝、认证失败，在受控环境验证重试、退避与降级；不接真实代理，也不记录任何真实凭据。","https:\u002F\u002Fcms.quanqiudaili.com\u002Fuploads\u002Flarge_cover_5ce09c130c.webp","2026-11-06T07:42:03.722Z","2026-11-06T07:42:03.708Z",[],[293,302,306,310,314,318,322,326,330,334,338,349,353,357,366,370,386,389,393,397,401],{"type":25,"children":294},[295,297,300],{"text":296,"type":29},"代理错误处理最适合用本地 mock 验证。407、超时、连接重置、TLS 失败、慢响应、半关闭六类故障都能稳定复现，测试不再依赖服务商侧的偶发故障。",{"text":166,"type":29,"marks":298},[299],{"type":169},{"text":301,"type":29}," 的真实链路不可控，mock 的价值就是把“偶发”变成“可重复”，但结论只对应用逻辑成立。",{"type":31,"level":21,"children":303},[304],{"text":305,"type":29},"代理错误测试需要覆盖的六种故障",{"type":25,"children":307},[308],{"text":309,"type":29},"可先覆盖六种常见故障：让 mock 返回带 `Proxy-Authenticate` 的 407，检查客户端是否重试或报告认证错误；延迟超过客户端超时时，检查超时处理；连接重置时，检查中断后的动作；TLS 负例一次只改一个变量（未受信 CA、可信 CA 但 SAN 不对、证书过期），并保持校验开启，看客户端实际报什么错；分段延迟发送时，记录首字节和完整响应耗时；测“响应不完整”时，用声明了 `Content-Length` 却提前 EOF、或缺少 chunked 终止块的响应做负例，完整的 close-delimited 响应只作正常对照——单纯关闭写方向并不等于响应不完整。之后再按应用实际支持的错误分支补充测试。\n矩阵按应用实际支持的错误分支建立，上表是起步集合，可以补代理 DNS 失败、认证挑战格式异常和重试上限三类用例。矩阵未覆盖的分支，不会被这一组测试验证。",{"type":31,"level":21,"children":311},[312],{"text":313,"type":29},"如何搭建可重复触发故障的 mock 代理",{"type":25,"children":315},[316],{"text":317,"type":29},"mitmproxy、toxiproxy 或自建 TCP 服务都可以用于 mock，但注入点要和故障所在层对应。407 需要能处理 CONNECT 并返回 `Proxy-Authenticate` 的受控代理；TCP 延迟和连接重置可在传输层注入；SOCKS 认证错误则要按 SOCKS 协议构造，不能用 HTTP 的 407 代替。记录工具、客户端版本、触发步骤和清理方法，其他人才能复现。",{"type":31,"level":21,"children":319},[320],{"text":321,"type":29},"除了错误码，还要验证应用如何处理故障",{"type":25,"children":323},[324],{"text":325,"type":29},"收到 407 只说明应用识别到了代理认证错误。还要检查重试次数和间隔、熔断或降级是否符合预期，以及日志是否隐藏凭据。407 和 401 要分开判断：前者由代理要求认证，后者由目标服务要求认证。",{"type":25,"children":327},[328],{"text":329,"type":29},"407 和 401 必须分开断言：`Proxy-Authenticate` 是代理要求认证，`WWW-Authenticate` 是目标服务要求认证。混在一起，会把代理认证失败记成应用登录失败。",{"type":31,"level":21,"children":331},[332],{"text":333,"type":29},"避免 mock 测试漏掉真实故障分支",{"type":25,"children":335},[336],{"text":337,"type":29},"要触发客户端超时，mock 延迟必须超过客户端配置的超时值；要测试请求中断后的处理，应在连接建立后再重置。mock 结果只说明应用对模拟故障的处理方式，不能直接推断真实代理链路表现。",{"type":25,"children":339},[340,342,347],{"text":341,"type":29},"mock 通过后若要转入真实环境验证，可按",{"text":343,"type":29,"marks":344},"全球代理使用流程",[345],{"href":346,"type":64},"https:\u002F\u002Fhelp.quanqiudaili.com\u002Fdocs\u002FProcess",{"text":348,"type":29},"依次核对产品、参数和接入步骤。",{"type":31,"level":21,"children":350},[351],{"text":352,"type":29},"记录 mock 故障参数和应用处理结果",{"type":25,"children":354},[355],{"text":356,"type":29},"每个用例记录故障类型、注入参数、期望动作、实际结果，以及日志是否隐藏凭据。\n用例边界是应用逻辑，不覆盖真实服务商的 SLA 和地区行为。出现真实凭据进入 mock 日志、或测试影响到共享环境时，立即停止并清理。",{"type":25,"children":358},[359,361,364],{"text":360,"type":29},"开始真实环境验证前，可用",{"text":60,"type":29,"marks":362},[363],{"href":63,"type":64},{"text":365,"type":29},"核对协议、地址和认证参数。",{"type":25,"children":367},[368],{"text":369,"type":29},"故障注入工具与协议定义：",{"type":108,"format":109,"children":371},[372,379],{"type":112,"children":373},[374],{"text":375,"type":29,"marks":376},"toxiproxy（TCP 延迟、重置、带宽限制）",[377],{"href":378,"type":64},"https:\u002F\u002Fgithub.com\u002FShopify\u002Ftoxiproxy",{"type":112,"children":380},[381],{"text":382,"type":29,"marks":383},"RFC 9110《HTTP Semantics》（407 与 `Proxy-Authenticate`）",[384],{"href":385,"type":64},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9110.html",{"type":31,"level":21,"children":387},[388],{"text":129,"type":29},{"type":31,"level":131,"children":390},[391],{"text":392,"type":29},"mock 代理能替代真实代理测试吗？",{"type":25,"children":394},[395],{"text":396,"type":29},"不能。它验证应用逻辑，不验证真实链路的稳定性和地区行为。",{"type":31,"level":131,"children":398},[399],{"text":400,"type":29},"407 和 401 有什么区别？",{"type":25,"children":402},[403],{"text":404,"type":29},"407 是代理要求认证，401 是目标服务要求认证。",{"source":6,"id":406,"documentId":407,"translationKey":407,"locale":9,"slug":408,"path":409,"_path":409,"title":410,"description":411,"excerpt":411,"image":412,"publishedAt":413,"updatedAt":414,"author":17,"tags":415,"featured":19,"sortOrder":20,"readingTime":21,"bodyType":22,"bodyBlocks":416,"bodyHtml":147},3985,"bpamp8c4gnpz3p9kslssa97y","ci-runner-proxy-build-impact-testing","\u002Fblog\u002Fci-runner-proxy-build-impact-testing","如何在 CI Runner 中验证代理不会影响构建步骤","在 Runner 内固定镜像、构建输入与测试时段，用出口 IP、DNS、TLS 和依赖清单作为证据，区分代理影响与构建环境波动；产物哈希只在构建可复现时才作对照。","https:\u002F\u002Fcms.quanqiudaili.com\u002Fuploads\u002Flarge_CI_Runner_cover_023a325e36.webp","2026-11-06T07:41:47.066Z","2026-11-06T07:41:47.049Z",[],[417,421,425,429,433,437,446,450,454,458,462,466,470,474,483,487,503,506,510,514,518],{"type":25,"children":418},[419],{"text":420,"type":29},"判断代理是否影响 CI，不能只看最终构建是否成功。应按实际流程检查代码拉取、依赖安装、单元测试、构建和产物上传。代理配置可能来自环境变量、包管理器或容器后台服务；配置不一致时，本地命令与流水线可能表现不同。",{"type":31,"level":21,"children":422},[423],{"text":424,"type":29},"如何判断代理没有影响 CI 构建",{"type":25,"children":426},[427],{"text":428,"type":29},"按顺序检查代码是否拉取到相同 commit、依赖校验是否通过、单元测试结果是否与基线一致。构建可复现时比较产物哈希；否则比较关键文件和依赖清单。上传环节要确认远端文件实际存在，并在支持时核对摘要或完整性校验。各阶段记录退出码和耗时；确需记录出口 IP 时，应使用受控日志并隐藏代理凭据。",{"type":31,"level":21,"children":430},[431],{"text":432,"type":29},"检查 CI 环境变量、包管理器和容器的代理配置",{"type":25,"children":434},[435],{"text":436,"type":29},"先检查构建进程是否读取 `HTTP_PROXY` 和 `HTTPS_PROXY`，再确认 `NO_PROXY` 中哪些地址会绕过代理。npm、pip 和 Maven 也可能分别读取 `.npmrc`、`pip.conf` 或 `settings.xml`；容器拉取镜像则由容器后台服务的配置决定。不要只凭宿主机环境变量判断代理已经生效。",{"type":25,"children":438},[439,441,444],{"text":440,"type":29},"配置入口和协议参数可对照",{"text":60,"type":29,"marks":442},[443],{"href":63,"type":64},{"text":445,"type":29},"逐项核实。",{"type":31,"level":21,"children":447},[448],{"text":449,"type":29},"对比启用代理和不启用代理时的构建结果",{"type":25,"children":451},[452],{"text":453,"type":29},"在相同 commit、Runner 镜像、依赖来源和资源规格下，分别运行启用代理与不启用代理的任务。冷缓存和暖缓存应分开比较，并使用隔离的缓存目录；每组可重复运行并保留原始结果。除代理开关外，其他条件尽量保持一致，便于判断差异来源。",{"type":31,"level":21,"children":455},[456],{"text":457,"type":29},"区分正常的耗时变化与构建产物差异",{"type":25,"children":459},[460],{"text":461,"type":29},"代理会让下载耗时发生变化，但不能预设“代理一定更慢”。判断是否影响构建，用各阶段耗时分布和事前设定的预算，不用单次耗时下结论；产物对照的前提是构建可复现、非确定性元数据已规范化；做不到时改比依赖清单、测试结果、关键文件和构建日志，不能仅凭整体哈希变化判定代理造成回归。",{"type":25,"children":463},[464],{"text":465,"type":29},"两类误判最常见：`NO_PROXY` 漏配，内部制品库被送进代理，出现 407 或超时；缓存掩盖失败，上一次的缓存让本次跳过了真实下载，清缓存复跑才暴露问题。",{"type":31,"level":21,"children":467},[468],{"text":469,"type":29},"记录 CI 代理测试结果并设定验收条件",{"type":25,"children":471},[472],{"text":473,"type":29},"记录 Runner 镜像、commit、实际生效的代理配置和各阶段结果，并注明缓存命中情况。被缓存跳过的步骤应标为未覆盖，必要时单独补跑。所有相关阶段通过后，再依据构建是否可复现判断产物差异。若影响其他流水线、日志出现凭据或耗时超过预算，应停止并回滚配置。",{"type":25,"children":475},[476,478,481],{"text":477,"type":29},"CI 中出现连接失败时，可从",{"text":92,"type":29,"marks":479},[480],{"href":95,"type":64},{"text":482,"type":29},"查找官方接入说明。",{"type":25,"children":484},[485],{"text":486,"type":29},"相关机制说明：",{"type":108,"format":109,"children":488},[489,496],{"type":112,"children":490},[491],{"text":492,"type":29,"marks":493},"`npm ci` 的安装与校验行为",[494],{"href":495,"type":64},"https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv10\u002Fcommands\u002Fnpm-ci",{"type":112,"children":497},[498],{"text":499,"type":29,"marks":500},"GitHub Actions 依赖缓存",[501],{"href":502,"type":64},"https:\u002F\u002Fdocs.github.com\u002Factions\u002Fusing-workflows\u002Fcaching-dependencies-to-speed-up-workflows",{"type":31,"level":21,"children":504},[505],{"text":129,"type":29},{"type":31,"level":131,"children":507},[508],{"text":509,"type":29},"CI 里设了 HTTP_PROXY 为什么还是不走代理？",{"type":25,"children":511},[512],{"text":513,"type":29},"可能被 NO_PROXY 覆盖，或包管理器有独立配置，以实际生效的配置为准。",{"type":31,"level":131,"children":515},[516],{"text":517,"type":29},"构建成功就说明代理没影响吗？",{"type":25,"children":519},[520],{"text":521,"type":29},"不一定。缓存可能掩盖下载失败，需要清缓存复跑并比对产物。",[523],{"source":6,"id":7,"documentId":8,"translationKey":8,"locale":9,"slug":10,"path":11,"_path":11,"title":12,"description":13,"excerpt":13,"image":14,"publishedAt":15,"updatedAt":16,"author":17,"tags":524,"featured":19,"sortOrder":20,"readingTime":21,"bodyType":22,"bodyBlocks":525,"bodyHtml":147},[],[526,529,532,535,538,541,544,547,554,557,560,563,566,569,576,583,595,598,601,604,607],{"type":25,"children":527},[528],{"text":28,"type":29},{"type":31,"level":21,"children":530},[531],{"text":34,"type":29},{"type":25,"children":533},[534],{"text":38,"type":29},{"type":31,"level":21,"children":536},[537],{"text":42,"type":29},{"type":25,"children":539},[540],{"text":46,"type":29},{"type":31,"level":21,"children":542},[543],{"text":50,"type":29},{"type":25,"children":545},[546],{"text":54,"type":29},{"type":25,"children":548},[549,550,553],{"text":58,"type":29},{"text":60,"type":29,"marks":551},[552],{"href":63,"type":64},{"text":66,"type":29},{"type":31,"level":21,"children":555},[556],{"text":70,"type":29},{"type":25,"children":558},[559],{"text":74,"type":29},{"type":31,"level":21,"children":561},[562],{"text":78,"type":29},{"type":25,"children":564},[565],{"text":82,"type":29},{"type":25,"children":567},[568],{"text":86,"type":29},{"type":25,"children":570},[571,572,575],{"text":90,"type":29},{"text":92,"type":29,"marks":573},[574],{"href":95,"type":64},{"text":97,"type":29},{"type":25,"children":577},[578,579,582],{"text":101,"type":29},{"text":60,"type":29,"marks":580},[581],{"href":63,"type":64},{"text":106,"type":29},{"type":108,"format":109,"children":584},[585,590],{"type":112,"children":586},[587],{"text":115,"type":29,"marks":588},[589],{"href":118,"type":64},{"type":112,"children":591},[592],{"text":122,"type":29,"marks":593},[594],{"href":125,"type":64},{"type":31,"level":21,"children":596},[597],{"text":129,"type":29},{"type":31,"level":131,"children":599},[600],{"text":134,"type":29},{"type":25,"children":602},[603],{"text":138,"type":29},{"type":31,"level":131,"children":605},[606],{"text":142,"type":29},{"type":25,"children":608},[609],{"text":146,"type":29},null,[],[]]