feat: update CI/CD pipeline for multi-env deploy and use mirror registry

- Add dev branch trigger and environment-based config (prod/dev)
- Switch to Volcano container registry with retry logic
- Use mirror images for Docker base images (daocloud.io)
- Add dynamic domain/DB/Redis config per environment

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -5,78 +5,154 @@ on:
     branches:
       - main
       - master
+      - dev
 
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        run: |
+          git clone --depth=1 --branch=${{ github.ref_name }} https://gitea.airlabs.art/${{ github.repository }}.git .
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-        with:
-          config-inline: |
-            [registry."docker.io"]
-              mirrors = ["https://docker.m.daocloud.io", "https://docker.1panel.live", "https://hub.rat.dev"]
+      - name: Set environment by branch
+        run: |
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          BUILD_DATE=$(date +%Y%m%d)
 
-      - name: Login to Huawei Cloud SWR
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ secrets.SWR_SERVER }}
-          username: ${{ secrets.SWR_USERNAME }}
-          password: ${{ secrets.SWR_PASSWORD }}
+          if [[ "${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "master" ]]; then
+            echo "IMAGE_TAG=prod-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
+            echo "CR_SERVER_ACTIVE=gitea-prod-cn-shanghai.cr.volces.com" >> $GITHUB_ENV
+            echo "CR_USERNAME_ACTIVE=seaislee@76339115" >> $GITHUB_ENV
+            echo "CR_PASSWORD_ACTIVE=${{ secrets.CR_PROD_PASSWORD }}" >> $GITHUB_ENV
+            echo "CR_ORG=prod" >> $GITHUB_ENV
+            echo "DEPLOY_ENV=production" >> $GITHUB_ENV
+            echo "DOMAIN_API=qy-lty.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_ADMIN=qy-lty-admin.airlabs.art" >> $GITHUB_ENV
+            echo "DB_HOST=pgm-7xv4811oj11j86htzo.pg.rds.aliyuncs.com" >> $GITHUB_ENV
+            echo "REDIS_LOCATION=redis://r-7xvat0vez5clwbzk5vpd.redis.rds.aliyuncs.com:6379/0" >> $GITHUB_ENV
+          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
+            echo "IMAGE_TAG=dev-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
+            echo "CR_SERVER_ACTIVE=${{ secrets.CR_SERVER }}" >> $GITHUB_ENV
+            echo "CR_USERNAME_ACTIVE=${{ secrets.CR_USERNAME }}" >> $GITHUB_ENV
+            echo "CR_PASSWORD_ACTIVE=${{ secrets.CR_PASSWORD }}" >> $GITHUB_ENV
+            echo "CR_ORG=dev" >> $GITHUB_ENV
+            echo "DEPLOY_ENV=development" >> $GITHUB_ENV
+            echo "DOMAIN_API=qy-lty.test.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_ADMIN=qy-lty-admin.test.airlabs.art" >> $GITHUB_ENV
+            echo "DB_HOST=pgm-7xv4811oj11j86htzo.pg.rds.aliyuncs.com" >> $GITHUB_ENV
+            echo "REDIS_LOCATION=redis://r-7xvat0vez5clwbzk5vpd.redis.rds.aliyuncs.com:6379/0" >> $GITHUB_ENV
+          fi
+
+      - name: Login to Container Registry
+        run: |
+          echo "${{ env.CR_PASSWORD_ACTIVE }}" | docker login --username "${{ env.CR_USERNAME_ACTIVE }}" --password-stdin ${{ env.CR_SERVER_ACTIVE }}
 
       - name: Build and Push Backend
-        id: build-backend
+        id: build_backend
         run: |
           set -o pipefail
-          docker buildx build \
-            --push \
-            --provenance=false \
-            --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-backend:latest \
-            ./qy_lty 2>&1 | tee /tmp/build.log
+          for attempt in 1 2 3; do
+            echo "Build backend attempt $attempt/3..."
+            DOCKER_BUILDKIT=0 docker build \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:${{ env.IMAGE_TAG }} \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:latest \
+              ./qy_lty 2>&1 | tee /tmp/build.log && break
+            echo "Attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
+          for attempt in 1 2 3; do
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:${{ env.IMAGE_TAG }} && \
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-backend:latest && break
+            echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
 
       - name: Build and Push Admin Frontend
-        id: build-admin
+        id: build_admin
         run: |
           set -o pipefail
-          docker buildx build \
-            --push \
-            --provenance=false \
-            --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-admin:latest \
-            ./qy-lty-admin 2>&1 | tee -a /tmp/build.log
+          for attempt in 1 2 3; do
+            echo "Build admin attempt $attempt/3..."
+            DOCKER_BUILDKIT=0 docker build \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:${{ env.IMAGE_TAG }} \
+              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:latest \
+              ./qy-lty-admin 2>&1 | tee -a /tmp/build.log && break
+            echo "Attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
+          for attempt in 1 2 3; do
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:${{ env.IMAGE_TAG }} && \
+            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/lty-admin:latest && break
+            echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10
+          done
 
       - name: Setup Kubectl
         run: |
-          curl -LO "https://dl.k8s.io/release/v1.28.2/bin/linux/amd64/kubectl" || \
-          curl -LO "https://cdn.dl.k8s.io/release/v1.28.2/bin/linux/amd64/kubectl"
-          chmod +x kubectl
-          mv kubectl /usr/local/bin/
+          if ! command -v kubectl &>/dev/null; then
+            for attempt in 1 2 3; do
+              curl -LO "https://files.m.daocloud.io/dl.k8s.io/release/v1.28.0/bin/linux/amd64/kubectl" && break
+              echo "Download attempt $attempt failed, retrying in 5s..." && sleep 5
+            done
+            chmod +x kubectl && mv kubectl /usr/local/bin/
+          fi
+          kubectl version --client
+
+      - name: Set kubeconfig
+        run: |
+          mkdir -p $HOME/.kube
+          if [[ "${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "master" ]]; then
+            echo "${{ secrets.KUBE_CONFIG }}" > $HOME/.kube/config
+          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
+            echo "${{ secrets.VOLCANO_TEST_KUBE_CONFIG }}" > $HOME/.kube/config
+          fi
+          chmod 600 $HOME/.kube/config
 
       - name: Deploy to K3s
-        uses: Azure/k8s-set-context@v3
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBE_CONFIG }}
-
-      - name: Update K8s Manifests
         id: deploy
         run: |
-          # Replace image placeholders
-          sed -i "s|\${CI_REGISTRY_IMAGE}/lty-backend:latest|${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-backend:latest|g" k8s/backend-deployment-prod.yaml
-          sed -i "s|\${CI_REGISTRY_IMAGE}/lty-admin:latest|${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/lty-admin:latest|g" k8s/admin-deployment-prod.yaml
+          echo "Environment: ${{ env.DEPLOY_ENV }}"
+          CR_IMAGE="${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}"
 
-          # Apply manifests and restart
-          set -o pipefail
+          # Replace image placeholders
+          sed -i "s|\${CI_REGISTRY_IMAGE}/lty-backend:latest|${CR_IMAGE}/lty-backend:${{ env.IMAGE_TAG }}|g" k8s/backend-deployment-prod.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/lty-admin:latest|${CR_IMAGE}/lty-admin:${{ env.IMAGE_TAG }}|g" k8s/admin-deployment-prod.yaml
+
+          # Replace domain placeholders by environment
+          sed -i "s|qy-lty.airlabs.art|${{ env.DOMAIN_API }}|g" k8s/ingress.yaml
+          sed -i "s|qy-lty-admin.airlabs.art|${{ env.DOMAIN_ADMIN }}|g" k8s/ingress.yaml
+          sed -i "s|https://qy-lty.airlabs.art|https://${{ env.DOMAIN_API }}|g" k8s/admin-deployment-prod.yaml
+
+          # Replace DB host by environment
+          sed -i "s|pgm-7xv4811oj11j86htzo.pg.rds.aliyuncs.com|${{ env.DB_HOST }}|g" k8s/backend-deployment-prod.yaml
+
+          # Replace Redis by environment
+          sed -i "s|redis://r-7xvat0vez5clwbzk5vpd.redis.rds.aliyuncs.com:6379/0|${{ env.REDIS_LOCATION }}|g" k8s/backend-deployment-prod.yaml
+
+          # All kubectl operations with retry
+          for attempt in 1 2 3; do
+            echo "Deploy attempt $attempt/3..."
             {
+              # Create/update image pull secret
+              kubectl create secret docker-registry cr-pull-secret \
+                --docker-server="${{ env.CR_SERVER_ACTIVE }}" \
+                --docker-username="${{ env.CR_USERNAME_ACTIVE }}" \
+                --docker-password="${{ env.CR_PASSWORD_ACTIVE }}" \
+                --dry-run=client -o yaml | kubectl apply -f -
+
+              # Apply manifests
               kubectl apply -f k8s/backend-deployment-prod.yaml
               kubectl apply -f k8s/admin-deployment-prod.yaml
               kubectl apply -f k8s/ingress.yaml
+
+              # Preserve real client IP
+              kubectl patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true
+
               kubectl rollout restart deployment/lty-backend
               kubectl rollout restart deployment/lty-admin
-          } 2>&1 | tee /tmp/deploy.log
+            } 2>&1 | tee /tmp/deploy.log && break
+            echo "Attempt $attempt failed, retrying in 10s..."
+            sleep 10
+          done
 
+      # ===== Log Center: failure reporting =====
       - name: Report failure to Log Center
         if: failure()
         run: |
@@ -84,35 +160,42 @@ jobs:
           DEPLOY_LOG=""
           FAILED_STEP="unknown"
 
+          if [[ "${{ steps.build_backend.outcome }}" == "failure" || "${{ steps.build_admin.outcome }}" == "failure" ]]; then
+            FAILED_STEP="build"
             if [ -f /tmp/build.log ]; then
               BUILD_LOG=$(tail -50 /tmp/build.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
-            FAILED_STEP="build"
             fi
+          elif [[ "${{ steps.deploy.outcome }}" == "failure" ]]; then
+            FAILED_STEP="deploy"
             if [ -f /tmp/deploy.log ]; then
               DEPLOY_LOG=$(tail -50 /tmp/deploy.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
-            if [ -n "$DEPLOY_LOG" ]; then
-              FAILED_STEP="deploy"
             fi
           fi
 
-          if [ -z "$BUILD_LOG" ] && [ -z "$DEPLOY_LOG" ]; then
-            BUILD_LOG="No captured output. Check Gitea Actions UI for details."
-            FAILED_STEP="pre-build"
-          fi
-
           ERROR_LOG="${BUILD_LOG}${DEPLOY_LOG}"
+          if [ -z "$ERROR_LOG" ]; then
+            ERROR_LOG="No captured output. Check Gitea Actions UI for details."
+          fi
+
+          if [[ "$FAILED_STEP" == "deploy" ]]; then
+            SOURCE="deployment"
+            ERROR_TYPE="DeployError"
+          else
+            SOURCE="cicd"
+            ERROR_TYPE="DockerBuildError"
+          fi
 
           curl -s -X POST "https://qiyuan-log-center-api.airlabs.art/api/v1/logs/report" \
             -H "Content-Type: application/json" \
             -d "{
               \"project_id\": \"lty\",
-              \"environment\": \"${{ github.ref_name }}\",
+              \"environment\": \"${{ env.DEPLOY_ENV }}\",
               \"level\": \"ERROR\",
-              \"source\": \"cicd\",
+              \"source\": \"${SOURCE}\",
               \"commit_hash\": \"${{ github.sha }}\",
               \"repo_url\": \"https://gitea.airlabs.art/zyc/lty.git\",
               \"error\": {
-                \"type\": \"CICDFailure\",
+                \"type\": \"${ERROR_TYPE}\",
                 \"message\": \"[${FAILED_STEP}] Build and Deploy failed on branch ${{ github.ref_name }}\",
                 \"stack_trace\": [\"${ERROR_LOG}\"]
               },
@@ -120,9 +203,10 @@ jobs:
                 \"job_name\": \"build-and-deploy\",
                 \"step_name\": \"${FAILED_STEP}\",
                 \"workflow\": \"${{ github.workflow }}\",
-                \"run_id\": \"${{ github.run_id }}\",
+                \"run_id\": \"${{ github.run_number }}\",
                 \"branch\": \"${{ github.ref_name }}\",
                 \"actor\": \"${{ github.actor }}\",
-                \"commit\": \"${{ github.sha }}\"
+                \"commit\": \"${{ github.sha }}\",
+                \"run_url\": \"https://gitea.airlabs.art/${{ github.repository }}/actions/runs/${{ github.run_number }}\"
               }
             }" || true

qy-lty-admin/Dockerfile

@@ -1,5 +1,5 @@
 # 构建阶段
-FROM node:22.10.0-alpine AS builder
+FROM docker.m.daocloud.io/node:22.10.0-alpine AS builder
 
 # 设置工作目录
 WORKDIR /app
@@ -21,7 +21,7 @@ COPY . .
 RUN yarn build
 
 # 运行阶段
-FROM node:22.10.0-alpine AS runner
+FROM docker.m.daocloud.io/node:22.10.0-alpine AS runner
 
 # 设置工作目录
 WORKDIR /app

qy_lty/Dockerfile

@@ -1,5 +1,5 @@
 # 使用国内的 Python 3.8 镜像作为基础镜像
-FROM python:3.8
+FROM docker.m.daocloud.io/python:3.8
 # 设置工作目录为 /app
 WORKDIR /app