优化

Jenkinsfile

@@ -56,7 +56,7 @@ pipeline {
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '各服务构建成功后是否独立部署')
         booleanParam(name: 'INITIALIZE_TEST_DATABASE', defaultValue: false, description: '仅 test：调度服务前幂等初始化测试数据库')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选')
-        string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '预发布/生产镜像仓库地址；test 环境自动使用本机镜像')
+        string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '所有环境共用的镜像仓库地址')
         string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
         string(name: 'DOWNSTREAM_JOB_PREFIX', defaultValue: 'baiyue-firstleg-', description: '单服务 Jenkins Job 名称前缀，例如 baiyue-firstleg-auth')
     }
@@ -73,19 +73,14 @@ pipeline {
                     env.RESOLVED_ENVIRONMENT = resolvedEnvironment
                     echo "Job ${env.JOB_BASE_NAME} 使用部署环境: ${env.RESOLVED_ENVIRONMENT}"
 
-                    String requestedRepository
+                    String requestedRepository = params.IMAGE_REPOSITORY?.trim()
-                    if (['development', 'test'].contains(env.RESOLVED_ENVIRONMENT)) {
+                    if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') {
-                        requestedRepository = "baiyue-firstleg-${env.RESOLVED_ENVIRONMENT}"
+                        error('必须填写真实镜像仓库地址')
-                        echo "${env.RESOLVED_ENVIRONMENT} 环境使用本地构建镜像，不登录、不推送远程 Registry"
-                    } else {
-                        requestedRepository = params.IMAGE_REPOSITORY?.trim()
-                        if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') {
-                            error('预发布/生产环境必须填写真实镜像仓库地址')
-                        }
-                        if (requestedRepository.contains('://') || !requestedRepository.contains('/')) {
-                            error('IMAGE_REPOSITORY 格式错误：请填写 host[:port]/owner/image，不要包含 http:// 或 https://')
-                        }
                     }
+                    if (requestedRepository.contains('://') || !requestedRepository.contains('/')) {
+                        error('IMAGE_REPOSITORY 格式错误：请填写 host[:port]/owner/image，不要包含 http:// 或 https://')
+                    }
+                    echo "${env.RESOLVED_ENVIRONMENT} 环境使用共享镜像仓库: ${requestedRepository}"
                     env.RESOLVED_IMAGE_REPOSITORY = requestedRepository
 
                     String jobPrefix = params.DOWNSTREAM_JOB_PREFIX?.trim()

Jenkinsfile.service

@@ -19,15 +19,8 @@ def serviceJars = [
 ]
 
 pipeline {
-    // 每个 Jenkins 子 Job 使用自己的 workspace，因此不同服务可以并行执行 mvn clean。
+    // 构建在任意 java-builder 节点执行，部署再回到目标环境节点。
-    // 开发环境利用开发服务器的计算资源；测试及其他环境继续留在原 master 节点。
+    agent none
-    agent {
-        label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'master'}"
-    }
-
-    tools {
-        maven 'maven-3.8.8'
-    }
 
     options {
         skipDefaultCheckout(true)
@@ -42,7 +35,7 @@ pipeline {
         choice(name: 'ENVIRONMENT', choices: ['test', 'development', 'staging', 'production'], description: '部署环境')
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试')
-        string(name: 'IMAGE_REPOSITORY', defaultValue: 'baiyue-firstleg-test', description: '镜像仓库基础路径，不包含服务名和标签')
+        string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '共享镜像仓库基础路径，不包含服务名和标签')
         string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
     }
 
@@ -56,124 +49,152 @@ pipeline {
     }
 
     stages {
-        stage('校验参数并检出指定提交') {
+        stage('构建并发布单服务') {
-            steps {
+            agent { label 'java-builder' }
-                checkout scm
+            tools { maven 'maven-3.8.8' }
+            stages {
+                stage('校验参数并检出指定提交') {
+                    steps {
+                        checkout scm
 
-                script {
+                        script {
-                    String service = serviceModules.find { candidate ->
+                            String service = serviceModules.find { candidate ->
-                        env.JOB_BASE_NAME?.endsWith("-${candidate}")
+                                env.JOB_BASE_NAME?.endsWith("-${candidate}")
-                    }
+                            }
-                    String sourceCommit = params.SOURCE_COMMIT?.trim()
+                            String sourceCommit = params.SOURCE_COMMIT?.trim()
-                    String imageTag = params.IMAGE_TAG?.trim()
+                            String imageTag = params.IMAGE_TAG?.trim()
-                    String imageRepository = params.IMAGE_REPOSITORY?.trim()
+                            String imageRepository = params.IMAGE_REPOSITORY?.trim()
 
-                    if (!sourceCommit) {
+                            if (!sourceCommit) {
-                        sourceCommit = sh(script: 'git rev-parse HEAD', returnStdout: true).trim()
+                                sourceCommit = sh(script: 'git rev-parse HEAD', returnStdout: true).trim()
-                    }
+                            }
-                    if (!imageTag) {
+                            if (!imageTag) {
-                        imageTag = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim()
+                                imageTag = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim()
-                    }
+                            }
 
-                    if (!serviceModules.contains(service)) {
+                            if (!serviceModules.contains(service)) {
-                        error("无法从 Job 名称 ${env.JOB_BASE_NAME} 识别服务；名称必须以以下服务之一结尾: ${serviceModules.join(', ')}")
+                                error("无法从 Job 名称 ${env.JOB_BASE_NAME} 识别服务；名称必须以以下服务之一结尾: ${serviceModules.join(', ')}")
-                    }
+                            }
-                    if (!sourceCommit || !(sourceCommit ==~ /(?i)[0-9a-f]{7,40}/)) {
+                            if (!sourceCommit || !(sourceCommit ==~ /(?i)[0-9a-f]{7,40}/)) {
-                        error('SOURCE_COMMIT 必须是 7 到 40 位十六进制 Git commit')
+                                error('SOURCE_COMMIT 必须是 7 到 40 位十六进制 Git commit')
-                    }
+                            }
-                    if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) {
+                            if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) {
-                        error('IMAGE_TAG 不是合法的 Docker 镜像标签')
+                                error('IMAGE_TAG 不是合法的 Docker 镜像标签')
-                    }
+                            }
-                    if (!imageRepository || imageRepository.contains('://')) {
+                            if (!imageRepository || imageRepository.contains('://') || !imageRepository.contains('/')) {
-                        error('IMAGE_REPOSITORY 不能为空且不能包含 http:// 或 https://')
+                                error('IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式，且不能包含协议前缀')
-                    }
+                            }
-                    if (!['development', 'test'].contains(params.ENVIRONMENT) && !imageRepository.contains('/')) {
-                        error('预发布/生产环境 IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式')
-                    }
 
-                    env.RESOLVED_SERVICE = service
+                            env.RESOLVED_SERVICE = service
-                    env.RESOLVED_SOURCE_COMMIT = sourceCommit
+                            env.RESOLVED_SOURCE_COMMIT = sourceCommit
-                    env.RESOLVED_IMAGE_TAG = imageTag
+                            env.RESOLVED_IMAGE_TAG = imageTag
-                    env.RESOLVED_IMAGE_REPOSITORY = imageRepository
+                            env.RESOLVED_IMAGE_REPOSITORY = imageRepository
+                        }
+
+                        sh '''
+                            if ! git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}" 2>/dev/null; then
+                              git fetch --no-tags origin
+                            fi
+                            git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}"
+                            git checkout --detach "${RESOLVED_SOURCE_COMMIT}"
+                            test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")"
+                        '''
+
+                        script {
+                            currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${params.ENVIRONMENT} | ${env.NODE_NAME}"
+                            echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}，节点: ${env.NODE_NAME}"
+                        }
+                    }
                 }
 
-                sh '''
+                stage('Maven 测试与打包') {
-                    if ! git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}" 2>/dev/null; then
+                    steps {
-                      git fetch --no-tags origin
+                        script {
-                    fi
+                            if (params.ENVIRONMENT == 'production' && params.SKIP_TESTS) {
-                    git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}"
+                                error('生产环境禁止跳过测试')
-                    git checkout --detach "${RESOLVED_SOURCE_COMMIT}"
+                            }
-                    test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")"
+                            boolean skipTestExecution = params.ENVIRONMENT == 'test' || params.SKIP_TESTS
-                '''
+                            String testOption = skipTestExecution ? '-DskipTests' : ''
-
+                            if (params.ENVIRONMENT == 'test') {
-                script {
+                                echo '测试环境快速部署：编译主代码和测试代码，但不重复执行单元测试；完整测试由提交门禁和预发布执行'
-                    currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${params.ENVIRONMENT}"
+                            }
-                    echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}"
+                            sh "mvn --settings ${env.MAVEN_SETTINGS} --batch-mode --errors -pl ${env.RESOLVED_SERVICE} -am clean package ${testOption}"
+                        }
+                    }
+                    post {
+                        always {
+                            junit allowEmptyResults: true, testResults: '**/target/surefire-reports/TEST-*.xml'
+                        }
+                    }
                 }
-            }
-        }
 
-        stage('Maven 测试与打包') {
+                stage('构建并发布单服务镜像') {
-            steps {
+                    steps {
-                script {
+                        script {
-                    if (params.ENVIRONMENT == 'production' && params.SKIP_TESTS) {
+                            String image = "${env.RESOLVED_IMAGE_REPOSITORY}/${env.RESOLVED_SERVICE}:${env.RESOLVED_IMAGE_TAG}"
-                        error('生产环境禁止跳过测试')
+                            String contextDir = ".docker-context/${env.RESOLVED_SERVICE}"
+                            String jar = serviceJars[env.RESOLVED_SERVICE]
+                            String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
+                            sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'"
+                            sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'"
+
+                            echo "推送共享镜像: ${image}"
+                            withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
+                                try {
+                                    sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
+                                    sh "docker push ${image}"
+                                } finally {
+                                    sh "docker logout ${registryHost} || true"
+                                }
+                            }
+                            stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true
+                        }
                     }
-                    boolean skipTestExecution = params.ENVIRONMENT == 'test' || params.SKIP_TESTS
-                    String testOption = skipTestExecution ? '-DskipTests' : ''
-                    if (params.ENVIRONMENT == 'test') {
-                        echo '测试环境快速部署：编译主代码和测试代码，但不重复执行单元测试；完整测试由提交门禁和预发布执行'
-                    }
-                    sh "mvn --settings ${env.MAVEN_SETTINGS} --batch-mode --errors -pl ${env.RESOLVED_SERVICE} -am clean package ${testOption}"
                 }
             }
             post {
                 always {
-                    junit allowEmptyResults: true, testResults: '**/target/surefire-reports/TEST-*.xml'
+                    cleanWs(deleteDirs: true, notFailBuild: true)
-                }
-            }
-        }
-
-        stage('构建并发布单服务镜像') {
-            steps {
-                script {
-                    String image = "${env.RESOLVED_IMAGE_REPOSITORY}/${env.RESOLVED_SERVICE}:${env.RESOLVED_IMAGE_TAG}"
-                    String contextDir = ".docker-context/${env.RESOLVED_SERVICE}"
-                    String jar = serviceJars[env.RESOLVED_SERVICE]
-                    sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'"
-                    sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'"
-
-                    if (['development', 'test'].contains(params.ENVIRONMENT)) {
-                        echo "${params.ENVIRONMENT} 镜像已保存在当前 Docker 节点：${image}"
-                    } else {
-                        String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
-                        withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
-                            try {
-                                sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
-                                sh "docker push ${image}"
-                            } finally {
-                                sh "docker logout ${registryHost} || true"
-                            }
-                        }
-                    }
                 }
             }
         }
 
         stage('部署单个服务') {
-            when { expression { params.DEPLOY } }
+            when {
+                beforeAgent true
+                expression { params.DEPLOY }
+            }
+            agent {
+                label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'master'}"
+            }
             steps {
+                deleteDir()
+                unstash 'deployment-files'
                 script {
                     String credentialId = "firstleg-${params.ENVIRONMENT}-env"
+                    String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
                     boolean localDevelopmentDeploy = params.ENVIRONMENT == 'development' &&
                         env.NODE_LABELS?.tokenize()?.contains('java-dev')
-                    withEnv(["DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}"]) {
+
-                        withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) {
+                    withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
-                            sh "sh deploy/scripts/deploy-services.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
+                        try {
+                            sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
+                            withEnv(["DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}"]) {
+                                withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) {
+                                    sh "sh deploy/scripts/deploy-services.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
+                                }
+                            }
+                        } finally {
+                            sh "docker logout ${registryHost} || true"
                         }
                     }
                 }
             }
+            post {
+                always {
+                    cleanWs(deleteDirs: true, notFailBuild: true)
+                }
+            }
         }
     }
 
@@ -181,8 +202,5 @@ pipeline {
         success {
             echo "${env.RESOLVED_SERVICE} 已独立完成构建${params.DEPLOY ? '和部署' : ''}"
         }
-        always {
-            cleanWs(deleteDirs: true, notFailBuild: true)
-        }
     }
 }

deploy/scripts/deploy-development-service.sh

@@ -64,6 +64,12 @@ if [ "${DEVELOPMENT_DEPLOY_LOCAL:-false}" = "true" ]; then
   export DEPLOY_ENV=development
   export IMAGE_REPOSITORY IMAGE_TAG
 
+  docker compose \
+    --project-name firstleg-development \
+    --env-file .env \
+    -f docker-compose.yml \
+    pull $SERVICES
+
   docker compose \
     --project-name firstleg-development \
     --env-file .env \

deploy/scripts/deploy-services.sh

@@ -79,22 +79,17 @@ if [ "$DEPLOY_ENV" = "development" ]; then
     "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE_CSV" "$ENV_FILE"
 fi
 
-PULL_POLICY_ARGS=""
+docker compose \
-if [ "$DEPLOY_ENV" = "test" ]; then
+  --project-name "firstleg-${DEPLOY_ENV}" \
-  PULL_POLICY_ARGS="--pull never"
+  --env-file "$ENV_FILE" \
-else
+  -f deploy/docker-compose.yml \
-  docker compose \
+  pull $SERVICES
-    --project-name "firstleg-${DEPLOY_ENV}" \
-    --env-file "$ENV_FILE" \
-    -f deploy/docker-compose.yml \
-    pull $SERVICES
-fi
 
 docker compose \
   --project-name "firstleg-${DEPLOY_ENV}" \
   --env-file "$ENV_FILE" \
   -f deploy/docker-compose.yml \
-  up -d --remove-orphans $PULL_POLICY_ARGS $SERVICES
+  up -d --remove-orphans --pull never $SERVICES
 
 docker compose \
   --project-name "firstleg-${DEPLOY_ENV}" \

scripts/test-environment-pipeline-contract.test.mjs

@@ -4,6 +4,8 @@ import test from 'node:test'
 
 const pipeline = (await readFile(new URL('../Jenkinsfile.service', import.meta.url), 'utf8'))
   .replaceAll('\r\n', '\n')
+const deployScript = (await readFile(new URL('../deploy/scripts/deploy-services.sh', import.meta.url), 'utf8'))
+  .replaceAll('\r\n', '\n')
 
 test('test deployments compile packages without rerunning the full unit test suite', () => {
   assert.match(pipeline, /params\.ENVIRONMENT == 'test' \|\| params\.SKIP_TESTS/)
@@ -16,3 +18,10 @@ test('production deployments cannot skip tests', () => {
   assert.match(pipeline, /params\.ENVIRONMENT == 'production' && params\.SKIP_TESTS/)
   assert.match(pipeline, /error\('生产环境禁止跳过测试'\)/)
 })
+
+test('Java builds use the shared builder pool and deploy on the target environment node', () => {
+  assert.match(pipeline, /agent \{ label 'java-builder' \}/)
+  assert.match(pipeline, /params\.ENVIRONMENT == 'development' \? 'java-dev' : 'master'/)
+  assert.match(pipeline, /docker push \$\{image\}/)
+  assert.match(deployScript, /pull \$SERVICES/)
+})