java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: 收口生产 main 分支部署流程

Browse Source
This commit is contained in:
ouyangxq
2026-09-17 11:49:00 +08:00
parent bf8256a817
commit cd16687d25
7 changed files with 62 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Jenkinsfile
Vendored
+13 -2
View File
@@ -170,8 +170,8 @@ pipeline {
choice(name: 'ENVIRONMENT', choices: environmentChoicesForJob(env.JOB_BASE_NAME), description: '部署环境')
booleanParam(name: 'DEPLOY', defaultValue: false, description: '各服务构建成功后是否独立部署')
booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选')
string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库地址')
string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像')
string(name: 'IMAGE_REPOSITORY', defaultValue: 'git.buggoglobal.com/java-project/baiyue-firstleg', description: '共享镜像仓库地址')
string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
choice(name: 'DOWNSTREAM_JOB_PREFIX', choices: downstreamJobPrefixChoicesForJob(env.JOB_BASE_NAME), description: '由当前总控 Job 固定的单服务 Job 前缀')
}
@@ -192,6 +192,17 @@ pipeline {
env.RESOLVED_ENVIRONMENT = resolvedEnvironment
echo "Job ${env.JOB_BASE_NAME} 使用部署环境: ${env.RESOLVED_ENVIRONMENT}"
if (env.RESOLVED_ENVIRONMENT == 'production') {
sh '''
set -eu
git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" || {
echo "生产构建只允许 origin/main 当前提交；请先通过 Pull Request 合并到 main 后再部署" >&2
exit 1
}
'''
}
String requestedRepository = params.IMAGE_REPOSITORY?.trim()
if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') {
error('必须填写真实镜像仓库地址')
Jenkinsfile.service
+27 -20
View File
@@ -56,8 +56,8 @@ pipeline {
booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务')
booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试')
choice(name: 'EVENT_BRIDGE_REGION', choices: ['BOTH', 'CN', 'OVERSEAS', 'SELECT'], description: '仅 event-bridge-service 使用；BOTH 在开发/测试环境同时部署国内和海外实例；SELECT 为总控兼容值')
string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库基础路径，不包含服务名和标签')
string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像')
string(name: 'IMAGE_REPOSITORY', defaultValue: 'git.buggoglobal.com/java-project/baiyue-firstleg', description: '共享镜像仓库基础路径，不包含服务名和标签')
string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
}
environment {
@@ -146,6 +146,16 @@ pipeline {
test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")"
'''
sh '''
if [ "${RESOLVED_ENVIRONMENT}" = "production" ]; then
git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
git merge-base --is-ancestor "${RESOLVED_SOURCE_COMMIT}" origin/main || {
echo "生产构建只允许已经合并到 main 的提交" >&2
exit 1
}
fi
'''
script {
currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${env.RESOLVED_ENVIRONMENT} | ${env.NODE_NAME}"
echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}，节点: ${env.NODE_NAME}"
@@ -263,36 +273,33 @@ pipeline {
}
}
stage('部署单个服务') {
stage('部署生产环境单个服务') {
when {
beforeAgent true
expression { params.DEPLOY && !['development', 'test'].contains(env.RESOLVED_ENVIRONMENT) }
}
agent {
label "${env.RESOLVED_ENVIRONMENT == 'development' ? 'java-dev' : 'master'}"
expression { params.DEPLOY && env.RESOLVED_ENVIRONMENT == 'production' }
}
agent { label 'java-builder' }
steps {
deleteDir()
unstash 'deployment-files'
script {
String credentialId = "firstleg-${env.RESOLVED_ENVIRONMENT}-env"
String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
boolean localDevelopmentDeploy = env.RESOLVED_ENVIRONMENT == 'development' &&
env.NODE_LABELS?.tokenize()?.contains('java-dev')
withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
try {
sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
String serviceDeployResource = "firstleg-production-${env.RESOLVED_SERVICE}-deploy"
lock(resource: serviceDeployResource, inversePrecedence: true) {
withCredentials([
file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE'),
usernamePassword(credentialsId: 'gitea-production-pull-token', usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD'),
sshUserPrivateKey(credentialsId: 'firstleg-production-ssh', keyFileVariable: 'TARGET_SSH_KEY', usernameVariable: 'TARGET_SSH_USER'),
string(credentialsId: 'firstleg-production-host', variable: 'TARGET_SSH_HOST'),
file(credentialsId: 'firstleg-production-known-hosts', variable: 'TARGET_SSH_KNOWN_HOSTS')
]) {
withEnv([
"DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}",
'TARGET_DEPLOY_DIR=/data/firstleg/deploy/services',
'TARGET_SSH_TARGET=' + env.TARGET_SSH_USER + '@' + env.TARGET_SSH_HOST,
"EVENT_BRIDGE_REGION_OVERRIDE=${params.EVENT_BRIDGE_REGION}"
]) {
withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) {
sh "sh deploy/scripts/deploy-services.sh '${env.RESOLVED_ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
}
sh "sh deploy/scripts/deploy-built-service.sh '${env.RESOLVED_ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
}
} finally {
sh "docker logout ${registryHost} || true"
}
}
}
deploy/docker-compose.overseas.yml
+2 -2
View File
@@ -8,8 +8,8 @@ x-overseas-common: &overseas-common
environment: &overseas-environment
SPRING_PROFILES_ACTIVE: overseas
NACOS_SERVER_ADDR: ${NACOS_SERVER_ADDR}
NACOS_USERNAME: ${NACOS_USERNAME}
NACOS_PASSWORD: ${NACOS_PASSWORD}
NACOS_USERNAME: ${OVERSEAS_NACOS_USERNAME}
NACOS_PASSWORD: ${OVERSEAS_NACOS_PASSWORD}
NACOS_GROUP: ${NACOS_GROUP:-BAIYUE}
NACOS_NAMESPACE: ${OVERSEAS_NACOS_NAMESPACE:-prod-overseas}
REDIS_HOST: ${OVERSEAS_REDIS_HOST:-host.docker.internal}
deploy/scripts/deploy-built-service.sh
+8 -4
View File
@@ -29,9 +29,9 @@ for value_name in HEALTH_TIMEOUT_SECONDS HEALTH_POLL_SECONDS; do
done
case "$DEPLOY_ENV" in
development|test) ;;
development|test|production) ;;
*)
echo "直接镜像传输仅支持 development/test，当前: $DEPLOY_ENV" >&2
echo "仅支持 development/test/production，当前: $DEPLOY_ENV" >&2
exit 2
;;
esac
@@ -115,7 +115,7 @@ if [ "$SERVICE" = "finance" ]; then
fi
if [ "$PROJECT_NAME" = "firstleg-$DEPLOY_ENV-overseas" ]; then
for key in NACOS_SERVER_ADDR NACOS_USERNAME NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_USERNAME OVERSEAS_NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
echo "部署海外服务时，环境文件必须包含非空 $key" >&2
exit 2
@@ -188,6 +188,10 @@ if [ "$SERVICE" = "file" ]; then
echo "开发环境部署 file 服务时 MQ_TOPIC_PREFIX 必须非空且不能使用 test-" >&2
exit 2
fi
if [ "$DEPLOY_ENV" = "production" ] && [ -n "$MQ_PREFIX" ]; then
echo "生产环境部署 file 服务时 MQ_TOPIC_PREFIX 必须为空，使用正式 Topic" >&2
exit 2
fi
fi
: "${REGISTRY_USER:?REGISTRY_USER 未设置}"
@@ -505,7 +509,7 @@ if [ "$new_started" = "true" ] && wait_for_health; then
fi
echo "新镜像健康检查失败: $new_image" >&2
failed_container_id="$(remote_container_id || true)"
failed_container_id="$(container_id || true)"
if [ -n "$failed_container_id" ]; then
echo "新镜像容器最近日志（最多 200 行）:" >&2
docker logs --tail 200 "$failed_container_id" 2>&1 || true
deploy/scripts/deploy-services.sh
+1 -1
View File
@@ -72,7 +72,7 @@ else
fi
if [ "$DEPLOY_REGION" = "OVERSEAS" ]; then
for key in NACOS_SERVER_ADDR NACOS_USERNAME NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_USERNAME OVERSEAS_NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
echo "部署海外服务时，环境文件必须包含非空 $key" >&2
exit 2
scripts/overseas-deployment-contract.test.mjs
+2 -3
View File
@@ -66,9 +66,8 @@ test('service map freezes unique internal ports and moves event bridge away from
test('overseas compose is isolated from CN defaults and disables implicit schema execution', async () => {
const compose = await read('deploy/docker-compose.overseas.yml')
assert.match(compose, /^name: firstleg-\$\{DEPLOY_ENV:-test\}-overseas$/m)
assert.match(compose, /NACOS_USERNAME: \$\{NACOS_USERNAME\}/)
assert.match(compose, /NACOS_PASSWORD: \$\{NACOS_PASSWORD\}/)
assert.doesNotMatch(compose, /OVERSEAS_NACOS_(?:USERNAME|PASSWORD)/)
assert.match(compose, /NACOS_USERNAME: \$\{OVERSEAS_NACOS_USERNAME\}/)
assert.match(compose, /NACOS_PASSWORD: \$\{OVERSEAS_NACOS_PASSWORD\}/)
assert.match(compose, /NACOS_NAMESPACE: \$\{OVERSEAS_NACOS_NAMESPACE:-prod-overseas\}/)
assert.match(compose, /REGION_CODE: OVERSEAS/)
assert.match(compose, /SPRING_SQL_INIT_MODE: never/)
scripts/test-environment-pipeline-contract.test.mjs
+9 -4
View File
@@ -76,6 +76,9 @@ test('production deployments cannot skip tests', () => {
assert.match(coordinatorPipeline, /env\.RESOLVED_ENVIRONMENT == 'production' && params\.SKIP_TESTS/)
assert.match(coordinatorPipeline, /error\('生产环境禁止跳过测试'\)/)
assert.match(pipeline, /生产环境手工构建禁止跳过测试/)
assert.match(coordinatorPipeline, /refs\/heads\/main:refs\/remotes\/origin\/main/)
assert.match(coordinatorPipeline, /test "\$\(git rev-parse HEAD\)" = "\$\(git rev-parse origin\/main\)"/)
assert.match(pipeline, /git merge-base --is-ancestor "\$\{RESOLVED_SOURCE_COMMIT\}" origin\/main/)
})
test('Java builds use the shared builder pool and serialize incremental target deployments', () => {
@@ -86,7 +89,9 @@ test('Java builds use the shared builder pool and serialize incremental target d
assert.match(pipeline, /String deploySlotLabel = "firstleg-\$\{env\.RESOLVED_ENVIRONMENT\}-deploy-slot"/)
assert.match(pipeline, /lock\(label: deploySlotLabel, quantity: 1, inversePrecedence: true\)/)
assert.match(pipeline, /deploy-built-service\.sh/)
assert.doesNotMatch(pipeline, /dev_deploy|test_deploy|TARGET_SSH_KEY/)
assert.doesNotMatch(pipeline, /dev_deploy|test_deploy/)
assert.match(pipeline, /firstleg-production-ssh/)
assert.match(pipeline, /TARGET_SSH_KEY/)
assert.match(directDeployScript, /docker pull "\$IMAGE"/)
assert.match(directDeployScript, /run_ssh docker pull "\$IMAGE"/)
assert.doesNotMatch(directDeployScript, /docker save "\$IMAGE"/)
@@ -195,12 +200,12 @@ test('shared builders use a reachable public Maven mirror instead of the retired
assert.doesNotMatch(ciMavenSettings, /:18081/)
})
test('Java service images use the internal registry base image by default', () => {
const internalBaseImage = '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine'
test('Java service images use the canonical Gitea registry base image by default', () => {
const internalBaseImage = 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine'
assert.match(coordinatorPipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
assert.match(pipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
assert.match(serviceDockerfile, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
assert.match(serviceDockerfile, /ARG BASE_IMAGE/)
assert.doesNotMatch(coordinatorPipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)
assert.doesNotMatch(pipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)
assert.doesNotMatch(serviceDockerfile, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)