优化

Jenkinsfile

@@ -75,7 +75,8 @@ pipeline {
 
                     String requestedRepository
                     if (['development', 'test'].contains(env.RESOLVED_ENVIRONMENT)) {
-                        requestedRepository = '172.31.198.7:10082/java-project/baiyue-firstleg'
+                        requestedRepository = "baiyue-firstleg-${env.RESOLVED_ENVIRONMENT}"
+                        echo "${env.RESOLVED_ENVIRONMENT} 环境使用本地镜像，由构建节点直接传输到部署目标"
                     } else {
                         requestedRepository = params.IMAGE_REPOSITORY?.trim()
                         if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') {
@@ -85,7 +86,6 @@ pipeline {
                             error('IMAGE_REPOSITORY 格式错误：请填写 host[:port]/owner/image，不要包含 http:// 或 https://')
                         }
                     }
-                    echo "${env.RESOLVED_ENVIRONMENT} 环境使用共享镜像仓库: ${requestedRepository}"
                     env.RESOLVED_IMAGE_REPOSITORY = requestedRepository
 
                     String jobPrefix = params.DOWNSTREAM_JOB_PREFIX?.trim()

Jenkinsfile.service

@@ -64,7 +64,7 @@ pipeline {
                             String sourceCommit = params.SOURCE_COMMIT?.trim()
                             String imageTag = params.IMAGE_TAG?.trim()
                             String imageRepository = ['development', 'test'].contains(params.ENVIRONMENT)
-                                ? '172.31.198.7:10082/java-project/baiyue-firstleg'
+                                ? "baiyue-firstleg-${params.ENVIRONMENT}"
                                 : params.IMAGE_REPOSITORY?.trim()
 
                             if (!sourceCommit) {
@@ -83,8 +83,11 @@ pipeline {
                             if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) {
                                 error('IMAGE_TAG 不是合法的 Docker 镜像标签')
                             }
-                            if (!imageRepository || imageRepository.contains('://') || !imageRepository.contains('/')) {
+                            if (!imageRepository || imageRepository.contains('://')) {
-                                error('IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式，且不能包含协议前缀')
+                                error('IMAGE_REPOSITORY 不能为空且不能包含协议前缀')
+                            }
+                            if (!['development', 'test'].contains(params.ENVIRONMENT) && !imageRepository.contains('/')) {
+                                error('预发布/生产环境 IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式')
                             }
 
                             env.RESOLVED_SERVICE = service
@@ -140,16 +143,59 @@ pipeline {
                             sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'"
                             sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'"
 
-                            echo "推送共享镜像: ${image}"
+                            if (['development', 'test'].contains(params.ENVIRONMENT)) {
-                            withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
+                                echo "${params.ENVIRONMENT} 镜像已保存在构建节点 ${env.NODE_NAME}: ${image}"
-                                try {
+                            } else {
-                                    sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
+                                echo "推送共享镜像: ${image}"
-                                    sh "docker push ${image}"
+                                withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
-                                } finally {
+                                    try {
-                                    sh "docker logout ${registryHost} || true"
+                                        sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
+                                        sh "docker push ${image}"
+                                    } finally {
+                                        sh "docker logout ${registryHost} || true"
+                                    }
+                                }
+                                if (params.DEPLOY) {
+                                    stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true
+                                }
+                            }
+                        }
+                    }
+                }
+
+                stage('直接部署开发或测试环境') {
+                    when {
+                        expression { params.DEPLOY && ['development', 'test'].contains(params.ENVIRONMENT) }
+                    }
+                    steps {
+                        script {
+                            boolean development = params.ENVIRONMENT == 'development'
+                            boolean targetIsLocal = development
+                                ? env.NODE_LABELS?.tokenize()?.contains('java-dev')
+                                : env.NODE_NAME == 'master'
+                            String credentialId = "firstleg-${params.ENVIRONMENT}-env"
+                            String remoteTarget = development ? 'deploy@172.31.198.8' : 'deploy@172.31.198.7'
+                            String remoteKey = development
+                                ? '/var/jenkins_home/.ssh/dev_deploy'
+                                : '/home/deploy/.ssh/test_deploy'
+                            String remoteKnownHosts = development
+                                ? '/var/jenkins_home/.ssh/known_hosts'
+                                : '/home/deploy/.ssh/known_hosts'
+                            String remoteDir = development
+                                ? '/opt/firstleg/application'
+                                : '/opt/firstleg/test-application'
+
+                            withEnv([
+                                "TARGET_IS_LOCAL=${targetIsLocal}",
+                                "TARGET_SSH_TARGET=${remoteTarget}",
+                                "TARGET_SSH_KEY=${remoteKey}",
+                                "TARGET_SSH_KNOWN_HOSTS=${remoteKnownHosts}",
+                                "TARGET_DEPLOY_DIR=${remoteDir}"
+                            ]) {
+                                withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) {
+                                    sh "sh deploy/scripts/deploy-built-service.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
                                 }
                             }
-                            stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true
                         }
                     }
                 }
@@ -164,7 +210,7 @@ pipeline {
         stage('部署单个服务') {
             when {
                 beforeAgent true
-                expression { params.DEPLOY }
+                expression { params.DEPLOY && !['development', 'test'].contains(params.ENVIRONMENT) }
             }
             agent {
                 label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'master'}"

deploy/scripts/deploy-built-service.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ "$#" -ne 5 ]; then
+  echo "用法: $0 <环境> <镜像仓库> <镜像标签> <服务> <环境文件>" >&2
+  exit 2
+fi
+
+DEPLOY_ENV="$1"
+IMAGE_REPOSITORY="$2"
+IMAGE_TAG="$3"
+SERVICE="$4"
+ENV_FILE="$5"
+COMPOSE_FILE="deploy/docker-compose.yml"
+IMAGE="$IMAGE_REPOSITORY/$SERVICE:$IMAGE_TAG"
+PROJECT_NAME="firstleg-$DEPLOY_ENV"
+
+case "$DEPLOY_ENV" in
+  development|test) ;;
+  *)
+    echo "直接镜像传输仅支持 development/test，当前: $DEPLOY_ENV" >&2
+    exit 2
+    ;;
+esac
+
+case "$SERVICE" in
+  *[!A-Za-z0-9_-]*|'')
+    echo "非法服务名: $SERVICE" >&2
+    exit 2
+    ;;
+esac
+
+for file in "$ENV_FILE" "$COMPOSE_FILE"; do
+  if [ ! -f "$file" ]; then
+    echo "必需文件不存在: $file" >&2
+    exit 2
+  fi
+done
+
+env_file_has_key() {
+  grep -q "^$1=" "$ENV_FILE"
+}
+
+env_file_value() {
+  sed -n "s/^$1=//p" "$ENV_FILE" | tail -n 1 | tr -d '\r'
+}
+
+if [ "$SERVICE" = "finance" ]; then
+  for key in FINANCE_DB_URL FINANCE_DB_USERNAME FINANCE_DB_PASSWORD; do
+    if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
+      echo "部署 finance 服务时，环境文件必须包含非空 $key" >&2
+      exit 2
+    fi
+  done
+fi
+
+if [ "$SERVICE" = "file" ]; then
+  if ! env_file_has_key ROCKETMQ_NAME_SERVER || [ -z "$(env_file_value ROCKETMQ_NAME_SERVER)" ]; then
+    echo "部署 file 服务时，环境文件必须包含非空 ROCKETMQ_NAME_SERVER" >&2
+    exit 2
+  fi
+  if ! env_file_has_key MQ_TOPIC_PREFIX; then
+    echo "部署 file 服务时，环境文件必须显式包含 MQ_TOPIC_PREFIX" >&2
+    exit 2
+  fi
+  MQ_PREFIX=$(env_file_value MQ_TOPIC_PREFIX)
+  if [ "$DEPLOY_ENV" = "test" ] && [ "$MQ_PREFIX" != "test-" ]; then
+    echo "测试环境部署 file 服务时 MQ_TOPIC_PREFIX 必须为 test-" >&2
+    exit 2
+  fi
+  if [ "$DEPLOY_ENV" = "development" ] && { [ -z "$MQ_PREFIX" ] || [ "$MQ_PREFIX" = "test-" ]; }; then
+    echo "开发环境部署 file 服务时 MQ_TOPIC_PREFIX 必须非空且不能使用 test-" >&2
+    exit 2
+  fi
+fi
+
+docker image inspect "$IMAGE" >/dev/null
+
+deploy_local() {
+  export DEPLOY_ENV IMAGE_REPOSITORY IMAGE_TAG
+  docker compose \
+    --project-name "$PROJECT_NAME" \
+    --env-file "$ENV_FILE" \
+    -f "$COMPOSE_FILE" \
+    up -d --remove-orphans --pull never "$SERVICE"
+  docker compose \
+    --project-name "$PROJECT_NAME" \
+    --env-file "$ENV_FILE" \
+    -f "$COMPOSE_FILE" \
+    ps "$SERVICE"
+}
+
+if [ "${TARGET_IS_LOCAL:-false}" = "true" ]; then
+  echo "镜像已在目标服务器本机，直接部署: $IMAGE"
+  deploy_local
+  exit 0
+fi
+
+SSH_TARGET="${TARGET_SSH_TARGET:?TARGET_SSH_TARGET 未设置}"
+SSH_KEY="${TARGET_SSH_KEY:?TARGET_SSH_KEY 未设置}"
+SSH_KNOWN_HOSTS="${TARGET_SSH_KNOWN_HOSTS:?TARGET_SSH_KNOWN_HOSTS 未设置}"
+REMOTE_DIR="${TARGET_DEPLOY_DIR:?TARGET_DEPLOY_DIR 未设置}"
+
+for file in "$SSH_KEY" "$SSH_KNOWN_HOSTS"; do
+  if [ ! -f "$file" ]; then
+    echo "SSH 文件不存在: $file" >&2
+    exit 2
+  fi
+done
+
+run_ssh() {
+  ssh -i "$SSH_KEY" \
+    -o BatchMode=yes \
+    -o Compression=no \
+    -o StrictHostKeyChecking=yes \
+    -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" \
+    -o ConnectTimeout=10 \
+    "$SSH_TARGET" "$@"
+}
+
+run_scp() {
+  scp -i "$SSH_KEY" \
+    -o BatchMode=yes \
+    -o Compression=no \
+    -o StrictHostKeyChecking=yes \
+    -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" \
+    -o ConnectTimeout=10 \
+    "$@"
+}
+
+run_ssh install -d -m 750 "$REMOTE_DIR"
+
+SUFFIX="${IMAGE_TAG}.$$.${SERVICE}"
+REMOTE_ENV_TMP="$REMOTE_DIR/.env.$SUFFIX.tmp"
+REMOTE_COMPOSE_TMP="$REMOTE_DIR/docker-compose.yml.$SUFFIX.tmp"
+run_scp "$ENV_FILE" "$SSH_TARGET:$REMOTE_ENV_TMP"
+run_scp "$COMPOSE_FILE" "$SSH_TARGET:$REMOTE_COMPOSE_TMP"
+run_ssh sh -s -- "$REMOTE_DIR" "$REMOTE_ENV_TMP" "$REMOTE_COMPOSE_TMP" <<'REMOTE_PREPARE'
+set -eu
+remote_dir="$1"
+env_tmp="$2"
+compose_tmp="$3"
+chmod 600 "$env_tmp"
+chmod 644 "$compose_tmp"
+mv -f "$env_tmp" "$remote_dir/.env"
+mv -f "$compose_tmp" "$remote_dir/docker-compose.yml"
+REMOTE_PREPARE
+
+echo "传输镜像到 $SSH_TARGET: $IMAGE"
+docker save "$IMAGE" | gzip -1 | run_ssh 'gzip -dc | docker load'
+
+run_ssh sh -s -- "$REMOTE_DIR" "$DEPLOY_ENV" "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE" <<'REMOTE_DEPLOY'
+set -eu
+remote_dir="$1"
+deploy_env="$2"
+image_repository="$3"
+image_tag="$4"
+service="$5"
+cd "$remote_dir"
+export DEPLOY_ENV="$deploy_env"
+export IMAGE_REPOSITORY="$image_repository"
+export IMAGE_TAG="$image_tag"
+docker compose \
+  --project-name "firstleg-$deploy_env" \
+  --env-file .env \
+  -f docker-compose.yml \
+  up -d --remove-orphans --pull never "$service"
+docker compose \
+  --project-name "firstleg-$deploy_env" \
+  --env-file .env \
+  -f docker-compose.yml \
+  ps "$service"
+REMOTE_DEPLOY

scripts/test-environment-pipeline-contract.test.mjs

@@ -4,7 +4,7 @@ import test from 'node:test'
 
 const pipeline = (await readFile(new URL('../Jenkinsfile.service', import.meta.url), 'utf8'))
   .replaceAll('\r\n', '\n')
-const deployScript = (await readFile(new URL('../deploy/scripts/deploy-services.sh', import.meta.url), 'utf8'))
+const directDeployScript = (await readFile(new URL('../deploy/scripts/deploy-built-service.sh', import.meta.url), 'utf8'))
   .replaceAll('\r\n', '\n')
 const ciMavenSettings = (await readFile(new URL('../deploy/maven/settings-ci.xml', import.meta.url), 'utf8'))
   .replaceAll('\r\n', '\n')
@@ -23,11 +23,10 @@ test('production deployments cannot skip tests', () => {
 
 test('Java builds use the shared builder pool and deploy on the target environment node', () => {
   assert.match(pipeline, /agent \{ label 'java-builder' \}/)
-  assert.match(pipeline, /params\.ENVIRONMENT == 'development' \? 'java-dev' : 'master'/)
   assert.match(pipeline, /\['development', 'test'\]\.contains\(params\.ENVIRONMENT\)/)
-  assert.match(pipeline, /172\.31\.198\.7:10082\/java-project\/baiyue-firstleg/)
+  assert.match(pipeline, /deploy-built-service\.sh/)
-  assert.match(pipeline, /docker push \$\{image\}/)
+  assert.match(directDeployScript, /docker save "\$IMAGE" \| gzip -1 \| run_ssh/)
-  assert.match(deployScript, /pull \$SERVICES/)
+  assert.match(directDeployScript, /--pull never/)
 })
 
 test('shared builders use a reachable public Maven mirror instead of the retired private proxy', () => {