From 7a5719b5a1fae775b8ca9fc6df5aeec1279f7c6c Mon Sep 17 00:00:00 2001 From: ouyangxq <775153912@qq.com> Date: Thu, 20 Aug 2026 10:22:51 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Jenkinsfile | 21 +- Jenkinsfile.service | 226 ++++++++++-------- deploy/scripts/deploy-development-service.sh | 6 + deploy/scripts/deploy-services.sh | 17 +- ...est-environment-pipeline-contract.test.mjs | 9 + 5 files changed, 151 insertions(+), 128 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 998a3bbe1..3ef4adbdf 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -56,7 +56,7 @@ pipeline { booleanParam(name: 'DEPLOY', defaultValue: false, description: '各服务构建成功后是否独立部署') booleanParam(name: 'INITIALIZE_TEST_DATABASE', defaultValue: false, description: '仅 test：调度服务前幂等初始化测试数据库') booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选') - string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '预发布/生产镜像仓库地址；test 环境自动使用本机镜像') + string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '所有环境共用的镜像仓库地址') string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像') string(name: 'DOWNSTREAM_JOB_PREFIX', defaultValue: 'baiyue-firstleg-', description: '单服务 Jenkins Job 名称前缀，例如 baiyue-firstleg-auth') } @@ -73,19 +73,14 @@ pipeline { env.RESOLVED_ENVIRONMENT = resolvedEnvironment echo "Job ${env.JOB_BASE_NAME} 使用部署环境: ${env.RESOLVED_ENVIRONMENT}" - String requestedRepository - if (['development', 'test'].contains(env.RESOLVED_ENVIRONMENT)) { - requestedRepository = "baiyue-firstleg-${env.RESOLVED_ENVIRONMENT}" - echo "${env.RESOLVED_ENVIRONMENT} 环境使用本地构建镜像，不登录、不推送远程 Registry" - } else { - requestedRepository = params.IMAGE_REPOSITORY?.trim() - if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') { - error('预发布/生产环境必须填写真实镜像仓库地址') - } - if (requestedRepository.contains('://') || !requestedRepository.contains('/')) { - error('IMAGE_REPOSITORY 格式错误：请填写 host[:port]/owner/image，不要包含 http:// 或 https://') - } + String requestedRepository = params.IMAGE_REPOSITORY?.trim() + if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') { + error('必须填写真实镜像仓库地址') } + if (requestedRepository.contains('://') || !requestedRepository.contains('/')) { + error('IMAGE_REPOSITORY 格式错误：请填写 host[:port]/owner/image，不要包含 http:// 或 https://') + } + echo "${env.RESOLVED_ENVIRONMENT} 环境使用共享镜像仓库: ${requestedRepository}" env.RESOLVED_IMAGE_REPOSITORY = requestedRepository String jobPrefix = params.DOWNSTREAM_JOB_PREFIX?.trim() diff --git a/Jenkinsfile.service b/Jenkinsfile.service index db2c1e1f9..8dae16c76 100644 --- a/Jenkinsfile.service +++ b/Jenkinsfile.service @@ -19,15 +19,8 @@ def serviceJars = [ ] pipeline { - // 每个 Jenkins 子 Job 使用自己的 workspace，因此不同服务可以并行执行 mvn clean。 - // 开发环境利用开发服务器的计算资源；测试及其他环境继续留在原 master 节点。 - agent { - label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'master'}" - } - - tools { - maven 'maven-3.8.8' - } + // 构建在任意 java-builder 节点执行，部署再回到目标环境节点。 + agent none options { skipDefaultCheckout(true) @@ -42,7 +35,7 @@ pipeline { choice(name: 'ENVIRONMENT', choices: ['test', 'development', 'staging', 'production'], description: '部署环境') booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务') booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试') - string(name: 'IMAGE_REPOSITORY', defaultValue: 'baiyue-firstleg-test', description: '镜像仓库基础路径，不包含服务名和标签') + string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '共享镜像仓库基础路径，不包含服务名和标签') string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像') } @@ -56,124 +49,152 @@ pipeline { } stages { - stage('校验参数并检出指定提交') { - steps { - checkout scm + stage('构建并发布单服务') { + agent { label 'java-builder' } + tools { maven 'maven-3.8.8' } + stages { + stage('校验参数并检出指定提交') { + steps { + checkout scm - script { - String service = serviceModules.find { candidate -> - env.JOB_BASE_NAME?.endsWith("-${candidate}") - } - String sourceCommit = params.SOURCE_COMMIT?.trim() - String imageTag = params.IMAGE_TAG?.trim() - String imageRepository = params.IMAGE_REPOSITORY?.trim() + script { + String service = serviceModules.find { candidate -> + env.JOB_BASE_NAME?.endsWith("-${candidate}") + } + String sourceCommit = params.SOURCE_COMMIT?.trim() + String imageTag = params.IMAGE_TAG?.trim() + String imageRepository = params.IMAGE_REPOSITORY?.trim() - if (!sourceCommit) { - sourceCommit = sh(script: 'git rev-parse HEAD', returnStdout: true).trim() - } - if (!imageTag) { - imageTag = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim() - } + if (!sourceCommit) { + sourceCommit = sh(script: 'git rev-parse HEAD', returnStdout: true).trim() + } + if (!imageTag) { + imageTag = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim() + } - if (!serviceModules.contains(service)) { - error("无法从 Job 名称 ${env.JOB_BASE_NAME} 识别服务；名称必须以以下服务之一结尾: ${serviceModules.join(', ')}") - } - if (!sourceCommit || !(sourceCommit ==~ /(?i)[0-9a-f]{7,40}/)) { - error('SOURCE_COMMIT 必须是 7 到 40 位十六进制 Git commit') - } - if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) { - error('IMAGE_TAG 不是合法的 Docker 镜像标签') - } - if (!imageRepository || imageRepository.contains('://')) { - error('IMAGE_REPOSITORY 不能为空且不能包含 http:// 或 https://') - } - if (!['development', 'test'].contains(params.ENVIRONMENT) && !imageRepository.contains('/')) { - error('预发布/生产环境 IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式') - } + if (!serviceModules.contains(service)) { + error("无法从 Job 名称 ${env.JOB_BASE_NAME} 识别服务；名称必须以以下服务之一结尾: ${serviceModules.join(', ')}") + } + if (!sourceCommit || !(sourceCommit ==~ /(?i)[0-9a-f]{7,40}/)) { + error('SOURCE_COMMIT 必须是 7 到 40 位十六进制 Git commit') + } + if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) { + error('IMAGE_TAG 不是合法的 Docker 镜像标签') + } + if (!imageRepository || imageRepository.contains('://') || !imageRepository.contains('/')) { + error('IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式，且不能包含协议前缀') + } - env.RESOLVED_SERVICE = service - env.RESOLVED_SOURCE_COMMIT = sourceCommit - env.RESOLVED_IMAGE_TAG = imageTag - env.RESOLVED_IMAGE_REPOSITORY = imageRepository + env.RESOLVED_SERVICE = service + env.RESOLVED_SOURCE_COMMIT = sourceCommit + env.RESOLVED_IMAGE_TAG = imageTag + env.RESOLVED_IMAGE_REPOSITORY = imageRepository + } + + sh ''' + if ! git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}" 2>/dev/null; then + git fetch --no-tags origin + fi + git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}" + git checkout --detach "${RESOLVED_SOURCE_COMMIT}" + test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")" + ''' + + script { + currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${params.ENVIRONMENT} | ${env.NODE_NAME}" + echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}，节点: ${env.NODE_NAME}" + } + } } - sh ''' - if ! git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}" 2>/dev/null; then - git fetch --no-tags origin - fi - git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}" - git checkout --detach "${RESOLVED_SOURCE_COMMIT}" - test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")" - ''' - - script { - currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${params.ENVIRONMENT}" - echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}" + stage('Maven 测试与打包') { + steps { + script { + if (params.ENVIRONMENT == 'production' && params.SKIP_TESTS) { + error('生产环境禁止跳过测试') + } + boolean skipTestExecution = params.ENVIRONMENT == 'test' || params.SKIP_TESTS + String testOption = skipTestExecution ? '-DskipTests' : '' + if (params.ENVIRONMENT == 'test') { + echo '测试环境快速部署：编译主代码和测试代码，但不重复执行单元测试；完整测试由提交门禁和预发布执行' + } + sh "mvn --settings ${env.MAVEN_SETTINGS} --batch-mode --errors -pl ${env.RESOLVED_SERVICE} -am clean package ${testOption}" + } + } + post { + always { + junit allowEmptyResults: true, testResults: '**/target/surefire-reports/TEST-*.xml' + } + } } - } - } - stage('Maven 测试与打包') { - steps { - script { - if (params.ENVIRONMENT == 'production' && params.SKIP_TESTS) { - error('生产环境禁止跳过测试') + stage('构建并发布单服务镜像') { + steps { + script { + String image = "${env.RESOLVED_IMAGE_REPOSITORY}/${env.RESOLVED_SERVICE}:${env.RESOLVED_IMAGE_TAG}" + String contextDir = ".docker-context/${env.RESOLVED_SERVICE}" + String jar = serviceJars[env.RESOLVED_SERVICE] + String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0] + sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'" + sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'" + + echo "推送共享镜像: ${image}" + withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) { + try { + sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"' + sh "docker push ${image}" + } finally { + sh "docker logout ${registryHost} || true" + } + } + stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true + } } - boolean skipTestExecution = params.ENVIRONMENT == 'test' || params.SKIP_TESTS - String testOption = skipTestExecution ? '-DskipTests' : '' - if (params.ENVIRONMENT == 'test') { - echo '测试环境快速部署：编译主代码和测试代码，但不重复执行单元测试；完整测试由提交门禁和预发布执行' - } - sh "mvn --settings ${env.MAVEN_SETTINGS} --batch-mode --errors -pl ${env.RESOLVED_SERVICE} -am clean package ${testOption}" } } post { always { - junit allowEmptyResults: true, testResults: '**/target/surefire-reports/TEST-*.xml' - } - } - } - - stage('构建并发布单服务镜像') { - steps { - script { - String image = "${env.RESOLVED_IMAGE_REPOSITORY}/${env.RESOLVED_SERVICE}:${env.RESOLVED_IMAGE_TAG}" - String contextDir = ".docker-context/${env.RESOLVED_SERVICE}" - String jar = serviceJars[env.RESOLVED_SERVICE] - sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'" - sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'" - - if (['development', 'test'].contains(params.ENVIRONMENT)) { - echo "${params.ENVIRONMENT} 镜像已保存在当前 Docker 节点：${image}" - } else { - String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0] - withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) { - try { - sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"' - sh "docker push ${image}" - } finally { - sh "docker logout ${registryHost} || true" - } - } - } + cleanWs(deleteDirs: true, notFailBuild: true) } } } stage('部署单个服务') { - when { expression { params.DEPLOY } } + when { + beforeAgent true + expression { params.DEPLOY } + } + agent { + label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'master'}" + } steps { + deleteDir() + unstash 'deployment-files' script { String credentialId = "firstleg-${params.ENVIRONMENT}-env" + String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0] boolean localDevelopmentDeploy = params.ENVIRONMENT == 'development' && env.NODE_LABELS?.tokenize()?.contains('java-dev') - withEnv(["DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}"]) { - withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) { - sh "sh deploy/scripts/deploy-services.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\"" + + withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) { + try { + sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"' + withEnv(["DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}"]) { + withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) { + sh "sh deploy/scripts/deploy-services.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\"" + } + } + } finally { + sh "docker logout ${registryHost} || true" } } } } + post { + always { + cleanWs(deleteDirs: true, notFailBuild: true) + } + } } } @@ -181,8 +202,5 @@ pipeline { success { echo "${env.RESOLVED_SERVICE} 已独立完成构建${params.DEPLOY ? '和部署' : ''}" } - always { - cleanWs(deleteDirs: true, notFailBuild: true) - } } } diff --git a/deploy/scripts/deploy-development-service.sh b/deploy/scripts/deploy-development-service.sh index 10c33440a..459337f8a 100644 --- a/deploy/scripts/deploy-development-service.sh +++ b/deploy/scripts/deploy-development-service.sh @@ -64,6 +64,12 @@ if [ "${DEVELOPMENT_DEPLOY_LOCAL:-false}" = "true" ]; then export DEPLOY_ENV=development export IMAGE_REPOSITORY IMAGE_TAG + docker compose \ + --project-name firstleg-development \ + --env-file .env \ + -f docker-compose.yml \ + pull $SERVICES + docker compose \ --project-name firstleg-development \ --env-file .env \ diff --git a/deploy/scripts/deploy-services.sh b/deploy/scripts/deploy-services.sh index 40bdad59d..41a2c0b9b 100644 --- a/deploy/scripts/deploy-services.sh +++ b/deploy/scripts/deploy-services.sh @@ -79,22 +79,17 @@ if [ "$DEPLOY_ENV" = "development" ]; then "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE_CSV" "$ENV_FILE" fi -PULL_POLICY_ARGS="" -if [ "$DEPLOY_ENV" = "test" ]; then - PULL_POLICY_ARGS="--pull never" -else - docker compose \ - --project-name "firstleg-${DEPLOY_ENV}" \ - --env-file "$ENV_FILE" \ - -f deploy/docker-compose.yml \ - pull $SERVICES -fi +docker compose \ + --project-name "firstleg-${DEPLOY_ENV}" \ + --env-file "$ENV_FILE" \ + -f deploy/docker-compose.yml \ + pull $SERVICES docker compose \ --project-name "firstleg-${DEPLOY_ENV}" \ --env-file "$ENV_FILE" \ -f deploy/docker-compose.yml \ - up -d --remove-orphans $PULL_POLICY_ARGS $SERVICES + up -d --remove-orphans --pull never $SERVICES docker compose \ --project-name "firstleg-${DEPLOY_ENV}" \ diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs index b681d6092..f995dd738 100644 --- a/scripts/test-environment-pipeline-contract.test.mjs +++ b/scripts/test-environment-pipeline-contract.test.mjs @@ -4,6 +4,8 @@ import test from 'node:test' const pipeline = (await readFile(new URL('../Jenkinsfile.service', import.meta.url), 'utf8')) .replaceAll('\r\n', '\n') +const deployScript = (await readFile(new URL('../deploy/scripts/deploy-services.sh', import.meta.url), 'utf8')) + .replaceAll('\r\n', '\n') test('test deployments compile packages without rerunning the full unit test suite', () => { assert.match(pipeline, /params\.ENVIRONMENT == 'test' \|\| params\.SKIP_TESTS/) @@ -16,3 +18,10 @@ test('production deployments cannot skip tests', () => { assert.match(pipeline, /params\.ENVIRONMENT == 'production' && params\.SKIP_TESTS/) assert.match(pipeline, /error\('生产环境禁止跳过测试'\)/) }) + +test('Java builds use the shared builder pool and deploy on the target environment node', () => { + assert.match(pipeline, /agent \{ label 'java-builder' \}/) + assert.match(pipeline, /params\.ENVIRONMENT == 'development' \? 'java-dev' : 'master'/) + assert.match(pipeline, /docker push \$\{image\}/) + assert.match(deployScript, /pull \$SERVICES/) +})