fix build dev

2026-04-04 11:18:17 +08:00 · 2026-04-04 11:18:17 +08:00 · 36ff1b5aca
commit 36ff1b5aca
parent 43228d255e
5 changed files with 100 additions and 96 deletions
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@ -3,102 +3,130 @@ name: Build and Deploy
 on:
  push:
    branches:
-      - main
      - master
+      - dev

 jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        run: |
+          git clone --depth=1 --branch=${{ github.ref_name }} https://gitea.airlabs.art/${{ github.repository }}.git .

-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-        with:
-          config-inline: |
-            [registry."docker.io"]
-              mirrors = ["https://docker.m.daocloud.io", "https://docker.1panel.live", "https://hub.rat.dev"]
+      - name: Set environment by branch
+        run: |
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          BUILD_DATE=$(date +%Y%m%d)

-      - name: Login to Huawei Cloud SWR
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ secrets.SWR_SERVER }}
-          username: ${{ secrets.SWR_USERNAME }}
-          password: ${{ secrets.SWR_PASSWORD }}
+          if [[ "${{ github.ref_name }}" == "master" ]]; then
+            echo "IMAGE_TAG=prod-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
+            echo "CR_ORG=prod" >> $GITHUB_ENV
+            echo "DEPLOY_ENV=production" >> $GITHUB_ENV
+            echo "DOMAIN_API=airflow-studio-api.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_WEB=airflow-studio.airlabs.art" >> $GITHUB_ENV
+            echo "REDIS_URL=redis://zyc:Zyc188208@redis-shzlf5t46gjvow7ua.redis.ivolces.com:6379/0" >> $GITHUB_ENV
+          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
+            echo "IMAGE_TAG=dev-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
+            echo "CR_ORG=dev" >> $GITHUB_ENV
+            echo "DEPLOY_ENV=development" >> $GITHUB_ENV
+            echo "DOMAIN_API=airflow-studio-api.test.airlabs.art" >> $GITHUB_ENV
+            echo "DOMAIN_WEB=airflow-studio.test.airlabs.art" >> $GITHUB_ENV
+            echo "REDIS_URL=redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0" >> $GITHUB_ENV
+          fi
+
+      - name: Login to Volcano Engine CR
+        run: |
+          echo "${{ secrets.CR_PASSWORD }}" | docker login --username "${{ secrets.CR_USERNAME }}" --password-stdin ${{ secrets.CR_SERVER }}

      - name: Build and Push Backend
        id: build_backend
        run: |
          set -o pipefail
-          docker buildx build \
-            --push \
-            --no-cache \
-            --provenance=false \
-            --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/video-backend:latest \
+          DOCKER_BUILDKIT=0 docker build \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:${{ env.IMAGE_TAG }} \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:latest \
            ./backend 2>&1 | tee /tmp/build.log
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:${{ env.IMAGE_TAG }}
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-backend:latest

      - name: Build and Push Web
        id: build_web
        run: |
          set -o pipefail
-          docker buildx build \
-            --push \
-            --provenance=false \
-            --tag ${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}/video-web:latest \
+          DOCKER_BUILDKIT=0 docker build \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:${{ env.IMAGE_TAG }} \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:latest \
            ./web 2>&1 | tee -a /tmp/build.log
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:${{ env.IMAGE_TAG }}
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/video-web:latest

-      - name: Setup SSH
+      - name: Setup Kubectl
+        run: kubectl version --client
+
+      - name: Set kubeconfig
        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.K3S_SSH_KEY }}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -H ${{ secrets.K3S_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          mkdir -p $HOME/.kube
+          if [[ "${{ github.ref_name }}" == "master" ]]; then
+            echo "${{ secrets.VOLCANO_PROD_KUBE_CONFIG }}" > $HOME/.kube/config
+          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
+            echo "${{ secrets.VOLCANO_TEST_KUBE_CONFIG }}" > $HOME/.kube/config
+          fi
+          chmod 600 $HOME/.kube/config

-      - name: Deploy to K3s via SSH
+      - name: Deploy to K3s
        id: deploy
        run: |
-          SWR_IMAGE="${{ secrets.SWR_SERVER }}/${{ secrets.SWR_ORG }}"
+          echo "Environment: ${{ env.DEPLOY_ENV }}"
+          CR_IMAGE="${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}"

-          # Replace image placeholders in yaml files
-          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${SWR_IMAGE}/video-backend:latest|g" k8s/backend-deployment.yaml
-          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${SWR_IMAGE}/video-backend:latest|g" k8s/celery-deployment.yaml
-          sed -i "s|\${CI_REGISTRY_IMAGE}/video-web:latest|${SWR_IMAGE}/video-web:latest|g" k8s/web-deployment.yaml
+          # Replace image placeholders
+          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${CR_IMAGE}/video-backend:${{ env.IMAGE_TAG }}|g" k8s/backend-deployment.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/video-backend:latest|${CR_IMAGE}/video-backend:${{ env.IMAGE_TAG }}|g" k8s/celery-deployment.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/video-web:latest|${CR_IMAGE}/video-web:${{ env.IMAGE_TAG }}|g" k8s/web-deployment.yaml

-          # Copy k8s manifests to server
-          scp -o StrictHostKeyChecking=no k8s/backend-deployment.yaml k8s/web-deployment.yaml k8s/ingress.yaml k8s/celery-deployment.yaml root@${{ secrets.K3S_HOST }}:/tmp/
+          # Replace domain placeholders in ingress
+          sed -i "s|airflow-studio-api.airlabs.art|${{ env.DOMAIN_API }}|g" k8s/ingress.yaml
+          sed -i "s|airflow-studio.airlabs.art|${{ env.DOMAIN_WEB }}|g" k8s/ingress.yaml

-          # Create/update secrets and apply manifests on server
+          # Replace DB config for production
+          if [[ "${{ env.DEPLOY_ENV }}" == "production" ]]; then
+            sed -i "s|mysql-8351f937d637.rds.ivolces.com|mysqld9bb4e81696d.rds.ivolces.com|g" k8s/backend-deployment.yaml
+            sed -i "s|mysql-8351f937d637.rds.ivolces.com|mysqld9bb4e81696d.rds.ivolces.com|g" k8s/celery-deployment.yaml
+          fi
+
+          # Replace CORS origin
+          sed -i "s|https://airflow-studio.airlabs.art|https://${{ env.DOMAIN_WEB }}|g" k8s/backend-deployment.yaml
+
+          # Replace Redis URL by environment
+          sed -i "s|redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0|${{ env.REDIS_URL }}|g" k8s/backend-deployment.yaml
+          sed -i "s|redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0|${{ env.REDIS_URL }}|g" k8s/celery-deployment.yaml
+
+          # Create/update secrets (业务密钥，DB 已写在 yaml 里)
+          kubectl create secret generic video-backend-secrets \
+            --from-literal=ARK_API_KEY='${{ secrets.ARK_API_KEY }}' \
+            --from-literal=TOS_ACCESS_KEY='${{ secrets.TOS_ACCESS_KEY }}' \
+            --from-literal=TOS_SECRET_KEY='${{ secrets.TOS_SECRET_KEY }}' \
+            --from-literal=DJANGO_SECRET_KEY='${{ secrets.DJANGO_SECRET_KEY }}' \
+            --from-literal=ALIYUN_SMS_ACCESS_KEY='${{ secrets.ALIYUN_SMS_ACCESS_KEY }}' \
+            --from-literal=ALIYUN_SMS_ACCESS_SECRET='${{ secrets.ALIYUN_SMS_ACCESS_SECRET }}' \
+            --dry-run=client -o yaml | kubectl apply -f -
+
+          # Apply manifests
          set -o pipefail
-          ssh -o StrictHostKeyChecking=no root@${{ secrets.K3S_HOST }} << ENDSSH
-            export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+          {
+            kubectl apply -f k8s/backend-deployment.yaml
+            kubectl apply -f k8s/celery-deployment.yaml
+            kubectl apply -f k8s/web-deployment.yaml
+            kubectl apply -f k8s/ingress.yaml

-            kubectl create secret generic video-backend-secrets \
-              --from-literal=ARK_API_KEY='${{ secrets.ARK_API_KEY }}' \
-              --from-literal=TOS_ACCESS_KEY='${{ secrets.TOS_ACCESS_KEY }}' \
-              --from-literal=TOS_SECRET_KEY='${{ secrets.TOS_SECRET_KEY }}' \
-              --from-literal=DJANGO_SECRET_KEY='${{ secrets.DJANGO_SECRET_KEY }}' \
-              --from-literal=DB_HOST='${{ secrets.DB_HOST }}' \
-              --from-literal=DB_USER='${{ secrets.DB_USER }}' \
-              --from-literal=DB_PASSWORD='${{ secrets.DB_PASSWORD }}' \
-              --from-literal=ALIYUN_SMS_ACCESS_KEY='${{ secrets.ALIYUN_SMS_ACCESS_KEY }}' \
-              --from-literal=ALIYUN_SMS_ACCESS_SECRET='${{ secrets.ALIYUN_SMS_ACCESS_SECRET }}' \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-            kubectl apply -f /tmp/backend-deployment.yaml
-            kubectl apply -f /tmp/celery-deployment.yaml
-            kubectl apply -f /tmp/web-deployment.yaml
-            kubectl apply -f /tmp/ingress.yaml
-
-            # Preserve real client IP: disable SNAT on Traefik
+            # Preserve real client IP
            kubectl patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true

            kubectl rollout restart deployment/video-backend
            kubectl rollout restart deployment/celery-worker
            kubectl rollout restart deployment/video-web
-
-            rm -f /tmp/backend-deployment.yaml /tmp/web-deployment.yaml /tmp/ingress.yaml /tmp/celery-deployment.yaml
-          ENDSSH
+          } 2>&1 | tee /tmp/deploy.log

      # ===== Log Center: failure reporting =====
      - name: Report failure to Log Center
@ -137,7 +165,7 @@ jobs:
            -H "Content-Type: application/json" \
            -d "{
              \"project_id\": \"video_backend\",
-              \"environment\": \"${{ github.ref_name }}\",
+              \"environment\": \"${{ env.DEPLOY_ENV }}\",
              \"level\": \"ERROR\",
              \"source\": \"${SOURCE}\",
              \"commit_hash\": \"${{ github.sha }}\",
--- a/k8s/backend-deployment.yaml
+++ b/k8s/backend-deployment.yaml
@ -14,8 +14,6 @@ spec:
      labels:
        app: video-backend
    spec:
-      imagePullSecrets:
-      - name: swr-secret
      containers:
      - name: video-backend
        image: ${CI_REGISTRY_IMAGE}/video-backend:latest
@ -34,29 +32,20 @@ spec:
            secretKeyRef:
              name: video-backend-secrets
              key: DJANGO_SECRET_KEY
-        # Database (Aliyun RDS)
+        # Database (Volcano Engine RDS - 默认测试环境，生产环境通过 CI 替换)
        - name: DB_HOST
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_HOST
+          value: "mysql-8351f937d637.rds.ivolces.com"
        - name: DB_NAME
          value: "video_auto"
        - name: DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_USER
+          value: "zyc"
        - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_PASSWORD
+          value: "Zyc188208"
        - name: DB_PORT
          value: "3306"
        # Redis (Celery broker)
        - name: REDIS_URL
-          value: "redis://:vAhRnAA6VMco@redis-cngzyc2r77ka16g7a.redis.ivolces.com:6379/0"
+          value: "redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0"
        # CORS
        - name: CORS_ALLOWED_ORIGINS
          value: "https://airflow-studio.airlabs.art"
--- a/k8s/celery-deployment.yaml
+++ b/k8s/celery-deployment.yaml
@ -14,8 +14,6 @@ spec:
      labels:
        app: celery-worker
    spec:
-      imagePullSecrets:
-      - name: swr-secret
      containers:
      - name: celery-worker
        image: ${CI_REGISTRY_IMAGE}/video-backend:latest
@ -35,25 +33,16 @@ spec:
              key: DJANGO_SECRET_KEY
        # Redis
        - name: REDIS_URL
-          value: "redis://:vAhRnAA6VMco@redis-cngzyc2r77ka16g7a.redis.ivolces.com:6379/0"
-        # Database (Aliyun RDS)
+          value: "redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0"
+        # Database (Volcano Engine RDS - 默认测试环境，生产环境通过 CI 替换)
        - name: DB_HOST
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_HOST
+          value: "mysql-8351f937d637.rds.ivolces.com"
        - name: DB_NAME
          value: "video_auto"
        - name: DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_USER
+          value: "zyc"
        - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: video-backend-secrets
-              key: DB_PASSWORD
+          value: "Zyc188208"
        - name: DB_PORT
          value: "3306"
        # TOS (from Secret)
--- a/k8s/cert-manager-issuer.yaml
+++ b/k8s/cert-manager-issuer.yaml
@ -12,4 +12,4 @@ spec:
    solvers:
    - http01:
        ingress:
-          class: alb
+          class: traefik
--- a/k8s/web-deployment.yaml
+++ b/k8s/web-deployment.yaml
@ -14,8 +14,6 @@ spec:
      labels:
        app: video-web
    spec:
-      imagePullSecrets:
-      - name: swr-secret
      containers:
      - name: video-web
        image: ${CI_REGISTRY_IMAGE}/video-web:latest