From 4de4595ec035365aea3805fae5df5a22b9749128 Mon Sep 17 00:00:00 2001 From: zyc <1439655764@qq.com> Date: Sat, 4 Apr 2026 15:33:32 +0800 Subject: [PATCH] feat: update CI/CD pipeline for multi-env deploy and use mirror registry - Add dev branch trigger and environment-based config (prod/dev) - Switch to Volcano container registry with retry logic - Use mirror images for Docker base images (daocloud.io) - Add dynamic domain/DB/Redis config per environment Co-Authored-By: Claude Opus 4.6 (1M context) --- .gitea/workflows/deploy.yaml | 208 ++++++++++++++++++++++++----------- qy-lty-admin/Dockerfile | 4 +- qy_lty/Dockerfile | 2 +- 3 files changed, 149 insertions(+), 65 deletions(-) diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml index d758eb2..c1d8011 100644 --- a/.gitea/workflows/deploy.yaml +++ b/.gitea/workflows/deploy.yaml @@ -5,78 +5,154 @@ on: branches: - main - master + - dev jobs: build-and-deploy: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + run: | + git clone --depth=1 --branch=${{ github.ref_name }} https://gitea.airlabs.art/${{ github.repository }}.git . - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - with: - config-inline: | - [registry."docker.io"] - mirrors = ["https://docker.m.daocloud.io", "https://docker.1panel.live", "https://hub.rat.dev"] + - name: Set environment by branch + run: | + SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7) + BUILD_DATE=$(date +%Y%m%d) - - name: Login to Huawei Cloud SWR - uses: docker/login-action@v2 - with: - registry: ${{ secrets.SWR_SERVER }} - username: ${{ secrets.SWR_USERNAME }} - password: ${{ secrets.SWR_PASSWORD }} + if [[ "${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "master" ]]; then + echo "IMAGE_TAG=prod-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV + echo "CR_SERVER_ACTIVE=gitea-prod-cn-shanghai.cr.volces.com" >> $GITHUB_ENV + echo "CR_USERNAME_ACTIVE=seaislee@76339115" >> $GITHUB_ENV + echo "CR_PASSWORD_ACTIVE=${{ secrets.CR_PROD_PASSWORD }}" >> $GITHUB_ENV + echo "CR_ORG=prod" >> $GITHUB_ENV + echo "DEPLOY_ENV=production" >> $GITHUB_ENV + echo "DOMAIN_API=qy-lty.airlabs.art" >> $GITHUB_ENV + echo "DOMAIN_ADMIN=qy-lty-admin.airlabs.art" >> $GITHUB_ENV + echo "DB_HOST=pgm-7xv4811oj11j86htzo.pg.rds.aliyuncs.com" >> $GITHUB_ENV + echo "REDIS_LOCATION=redis://r-7xvat0vez5clwbzk5vpd.redis.rds.aliyuncs.com:6379/0" >> $GITHUB_ENV + elif [[ "${{ github.ref_name }}" == "dev" ]]; then + echo "IMAGE_TAG=dev-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV + echo "CR_SERVER_ACTIVE=${{ secrets.CR_SERVER }}" >> $GITHUB_ENV + echo "CR_USERNAME_ACTIVE=${{ secrets.CR_USERNAME }}" >> $GITHUB_ENV + echo "CR_PASSWORD_ACTIVE=${{ secrets.CR_PASSWORD }}" >> $GITHUB_ENV + echo "CR_ORG=dev" >> $GITHUB_ENV + echo "DEPLOY_ENV=development" >> $GITHUB_ENV + echo "DOMAIN_API=qy-lty.test.airlabs.art" >> $GITHUB_ENV + echo "DOMAIN_ADMIN=qy-lty-admin.test.airlabs.art" >> $GITHUB_ENV + echo "DB_HOST=pgm-7xv4811oj11j86htzo.pg.rds.aliyuncs.com" >> $GITHUB_ENV + echo "REDIS_LOCATION=redis://r-7xvat0vez5clwbzk5vpd.redis.rds.aliyuncs.com:6379/0" >> $GITHUB_ENV + fi + + - name: Login to Container Registry + run: | + echo "${{ env.CR_PASSWORD_ACTIVE }}" | docker login --username "${{ env.CR_USERNAME_ACTIVE }}" --password-stdin ${{ env.CR_SERVER_ACTIVE }} - name: Build and Push Backend - id: build-backend + id: build_backend run: | set -o pipefail - docker buildx build \ - --push \ - --provenance=false \ - --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-backend:latest \ - ./qy_lty 2>&1 | tee /tmp/build.log + for attempt in 1 2 3; do + echo "Build backend attempt $attempt/3..." + DOCKER_BUILDKIT=0 docker build \ + --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:${{ env.IMAGE_TAG }} \ + --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:latest \ + ./qy_lty 2>&1 | tee /tmp/build.log && break + echo "Attempt $attempt failed, retrying in 10s..." && sleep 10 + done + for attempt in 1 2 3; do + docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:${{ env.IMAGE_TAG }} && \ + docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:latest && break + echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10 + done - name: Build and Push Admin Frontend - id: build-admin + id: build_admin run: | set -o pipefail - docker buildx build \ - --push \ - --provenance=false \ - --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-admin:latest \ - ./qy-lty-admin 2>&1 | tee -a /tmp/build.log + for attempt in 1 2 3; do + echo "Build admin attempt $attempt/3..." + DOCKER_BUILDKIT=0 docker build \ + --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:${{ env.IMAGE_TAG }} \ + --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:latest \ + ./qy-lty-admin 2>&1 | tee -a /tmp/build.log && break + echo "Attempt $attempt failed, retrying in 10s..." && sleep 10 + done + for attempt in 1 2 3; do + docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:${{ env.IMAGE_TAG }} && \ + docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:latest && break + echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10 + done - name: Setup Kubectl run: | - curl -LO "https://dl.k8s.io/release/v1.28.2/bin/linux/amd64/kubectl" || \ - curl -LO "https://cdn.dl.k8s.io/release/v1.28.2/bin/linux/amd64/kubectl" - chmod +x kubectl - mv kubectl /usr/local/bin/ + if ! command -v kubectl &>/dev/null; then + for attempt in 1 2 3; do + curl -LO "https://files.m.daocloud.io/dl.k8s.io/release/v1.28.0/bin/linux/amd64/kubectl" && break + echo "Download attempt $attempt failed, retrying in 5s..." && sleep 5 + done + chmod +x kubectl && mv kubectl /usr/local/bin/ + fi + kubectl version --client + + - name: Set kubeconfig + run: | + mkdir -p $HOME/.kube + if [[ "${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "master" ]]; then + echo "${{ secrets.KUBE_CONFIG }}" > $HOME/.kube/config + elif [[ "${{ github.ref_name }}" == "dev" ]]; then + echo "${{ secrets.VOLCANO_TEST_KUBE_CONFIG }}" > $HOME/.kube/config + fi + chmod 600 $HOME/.kube/config - name: Deploy to K3s - uses: Azure/k8s-set-context@v3 - with: - method: kubeconfig - kubeconfig: ${{ secrets.KUBE_CONFIG }} - - - name: Update K8s Manifests id: deploy run: | + echo "Environment: ${{ env.DEPLOY_ENV }}" + CR_IMAGE="${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}" + # Replace image placeholders - sed -i "s|\${CI_REGISTRY_IMAGE}/lty-backend:latest|${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-backend:latest|g" k8s/backend-deployment-prod.yaml - sed -i "s|\${CI_REGISTRY_IMAGE}/lty-admin:latest|${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-admin:latest|g" k8s/admin-deployment-prod.yaml + sed -i "s|\${CI_REGISTRY_IMAGE}/lty-backend:latest|${CR_IMAGE}/lty-backend:${{ env.IMAGE_TAG }}|g" k8s/backend-deployment-prod.yaml + sed -i "s|\${CI_REGISTRY_IMAGE}/lty-admin:latest|${CR_IMAGE}/lty-admin:${{ env.IMAGE_TAG }}|g" k8s/admin-deployment-prod.yaml - # Apply manifests and restart - set -o pipefail - { - kubectl apply -f k8s/backend-deployment-prod.yaml - kubectl apply -f k8s/admin-deployment-prod.yaml - kubectl apply -f k8s/ingress.yaml - kubectl rollout restart deployment/lty-backend - kubectl rollout restart deployment/lty-admin - } 2>&1 | tee /tmp/deploy.log + # Replace domain placeholders by environment + sed -i "s|qy-lty.airlabs.art|${{ env.DOMAIN_API }}|g" k8s/ingress.yaml + sed -i "s|qy-lty-admin.airlabs.art|${{ env.DOMAIN_ADMIN }}|g" k8s/ingress.yaml + sed -i "s|https://qy-lty.airlabs.art|https://${{ env.DOMAIN_API }}|g" k8s/admin-deployment-prod.yaml + # Replace DB host by environment + sed -i "s|pgm-7xv4811oj11j86htzo.pg.rds.aliyuncs.com|${{ env.DB_HOST }}|g" k8s/backend-deployment-prod.yaml + + # Replace Redis by environment + sed -i "s|redis://r-7xvat0vez5clwbzk5vpd.redis.rds.aliyuncs.com:6379/0|${{ env.REDIS_LOCATION }}|g" k8s/backend-deployment-prod.yaml + + # All kubectl operations with retry + for attempt in 1 2 3; do + echo "Deploy attempt $attempt/3..." + { + # Create/update image pull secret + kubectl create secret docker-registry cr-pull-secret \ + --docker-server="${{ env.CR_SERVER_ACTIVE }}" \ + --docker-username="${{ env.CR_USERNAME_ACTIVE }}" \ + --docker-password="${{ env.CR_PASSWORD_ACTIVE }}" \ + --dry-run=client -o yaml | kubectl apply -f - + + # Apply manifests + kubectl apply -f k8s/backend-deployment-prod.yaml + kubectl apply -f k8s/admin-deployment-prod.yaml + kubectl apply -f k8s/ingress.yaml + + # Preserve real client IP + kubectl patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true + + kubectl rollout restart deployment/lty-backend + kubectl rollout restart deployment/lty-admin + } 2>&1 | tee /tmp/deploy.log && break + echo "Attempt $attempt failed, retrying in 10s..." + sleep 10 + done + + # ===== Log Center: failure reporting ===== - name: Report failure to Log Center if: failure() run: | @@ -84,35 +160,42 @@ jobs: DEPLOY_LOG="" FAILED_STEP="unknown" - if [ -f /tmp/build.log ]; then - BUILD_LOG=$(tail -50 /tmp/build.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g') + if [[ "${{ steps.build_backend.outcome }}" == "failure" || "${{ steps.build_admin.outcome }}" == "failure" ]]; then FAILED_STEP="build" - fi - if [ -f /tmp/deploy.log ]; then - DEPLOY_LOG=$(tail -50 /tmp/deploy.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g') - if [ -n "$DEPLOY_LOG" ]; then - FAILED_STEP="deploy" + if [ -f /tmp/build.log ]; then + BUILD_LOG=$(tail -50 /tmp/build.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g') + fi + elif [[ "${{ steps.deploy.outcome }}" == "failure" ]]; then + FAILED_STEP="deploy" + if [ -f /tmp/deploy.log ]; then + DEPLOY_LOG=$(tail -50 /tmp/deploy.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g') fi fi - if [ -z "$BUILD_LOG" ] && [ -z "$DEPLOY_LOG" ]; then - BUILD_LOG="No captured output. Check Gitea Actions UI for details." - FAILED_STEP="pre-build" + ERROR_LOG="${BUILD_LOG}${DEPLOY_LOG}" + if [ -z "$ERROR_LOG" ]; then + ERROR_LOG="No captured output. Check Gitea Actions UI for details." fi - ERROR_LOG="${BUILD_LOG}${DEPLOY_LOG}" + if [[ "$FAILED_STEP" == "deploy" ]]; then + SOURCE="deployment" + ERROR_TYPE="DeployError" + else + SOURCE="cicd" + ERROR_TYPE="DockerBuildError" + fi curl -s -X POST "https://qiyuan-log-center-api.airlabs.art/api/v1/logs/report" \ -H "Content-Type: application/json" \ -d "{ \"project_id\": \"lty\", - \"environment\": \"${{ github.ref_name }}\", + \"environment\": \"${{ env.DEPLOY_ENV }}\", \"level\": \"ERROR\", - \"source\": \"cicd\", + \"source\": \"${SOURCE}\", \"commit_hash\": \"${{ github.sha }}\", \"repo_url\": \"https://gitea.airlabs.art/zyc/lty.git\", \"error\": { - \"type\": \"CICDFailure\", + \"type\": \"${ERROR_TYPE}\", \"message\": \"[${FAILED_STEP}] Build and Deploy failed on branch ${{ github.ref_name }}\", \"stack_trace\": [\"${ERROR_LOG}\"] }, @@ -120,9 +203,10 @@ jobs: \"job_name\": \"build-and-deploy\", \"step_name\": \"${FAILED_STEP}\", \"workflow\": \"${{ github.workflow }}\", - \"run_id\": \"${{ github.run_id }}\", + \"run_id\": \"${{ github.run_number }}\", \"branch\": \"${{ github.ref_name }}\", \"actor\": \"${{ github.actor }}\", - \"commit\": \"${{ github.sha }}\" + \"commit\": \"${{ github.sha }}\", + \"run_url\": \"https://gitea.airlabs.art/${{ github.repository }}/actions/runs/${{ github.run_number }}\" } }" || true diff --git a/qy-lty-admin/Dockerfile b/qy-lty-admin/Dockerfile index 2931ce5..433bedf 100644 --- a/qy-lty-admin/Dockerfile +++ b/qy-lty-admin/Dockerfile @@ -1,5 +1,5 @@ # 构建阶段 -FROM node:22.10.0-alpine AS builder +FROM docker.m.daocloud.io/node:22.10.0-alpine AS builder # 设置工作目录 WORKDIR /app @@ -21,7 +21,7 @@ COPY . . RUN yarn build # 运行阶段 -FROM node:22.10.0-alpine AS runner +FROM docker.m.daocloud.io/node:22.10.0-alpine AS runner # 设置工作目录 WORKDIR /app diff --git a/qy_lty/Dockerfile b/qy_lty/Dockerfile index f8bf0f8..475a8ef 100644 --- a/qy_lty/Dockerfile +++ b/qy_lty/Dockerfile @@ -1,5 +1,5 @@ # 使用国内的 Python 3.8 镜像作为基础镜像 -FROM python:3.8 +FROM docker.m.daocloud.io/python:3.8 # 设置工作目录为 /app WORKDIR /app