ci: 增加 Client 生产部署流程

Jenkinsfile

@@ -1,6 +1,6 @@
 pipeline {
   agent {
-    label "${env.JOB_BASE_NAME?.endsWith('-dev') ? 'java-dev' : 'java-test'}"
+    label "${env.JOB_BASE_NAME?.endsWith('-prod') ? 'java-builder' : (env.JOB_BASE_NAME?.endsWith('-dev') ? 'java-dev' : 'java-test')}"
   }
 
   environment {
@@ -10,6 +10,7 @@ pipeline {
     REGISTRY_CREDENTIALS = 'gitea-registry-token'
     NODE_BASE_IMAGE = '172.31.198.7:10082/java-project/node:22-alpine'
     NGINX_BASE_IMAGE = '172.31.198.7:10082/java-project/nginx:1.27-alpine'
+    PRODUCTION_IMAGE_REPOSITORY = 'git.buggoglobal.com/html/client-web'
   }
 
   options {
@@ -22,6 +23,17 @@ pipeline {
       steps {
         script {
           env.IS_DEVELOPMENT = env.JOB_BASE_NAME?.endsWith('-dev') ? 'true' : 'false'
+          env.IS_PRODUCTION = env.JOB_BASE_NAME?.endsWith('-prod') ? 'true' : 'false'
+          if (env.IS_PRODUCTION == 'true') {
+            sh '''
+              set -eu
+              git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+              test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" || {
+                echo "生产部署只允许 origin/main 当前提交；请先合并代码到 main" >&2
+                exit 1
+              }
+            '''
+          }
           env.SOURCE_TAG = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim()
         }
         sh 'git log -1 --oneline'
@@ -29,7 +41,7 @@ pipeline {
     }
 
     stage('构建并部署测试前端') {
-      when { expression { env.IS_DEVELOPMENT != 'true' } }
+      when { expression { env.IS_DEVELOPMENT != 'true' && env.IS_PRODUCTION != 'true' } }
       steps {
         withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
           sh '''
@@ -50,6 +62,61 @@ pipeline {
       }
     }
 
+    stage('构建并发布生产镜像') {
+      when { expression { env.IS_PRODUCTION == 'true' } }
+      steps {
+        withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
+          sh '''
+            set -eu
+            export DOCKER_CONFIG="${WORKSPACE}@tmp/docker-auth"
+            rm -rf "$DOCKER_CONFIG"
+            mkdir -p "$DOCKER_CONFIG"
+            cleanup_registry() {
+              docker logout git.buggoglobal.com >/dev/null 2>&1 || true
+              rm -rf "$DOCKER_CONFIG"
+            }
+            trap cleanup_registry EXIT HUP INT TERM
+            printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin git.buggoglobal.com
+            image="$PRODUCTION_IMAGE_REPOSITORY:$SOURCE_TAG"
+            docker build \
+              --build-arg NODE_IMAGE="$NODE_BASE_IMAGE" \
+              --build-arg NGINX_IMAGE="$NGINX_BASE_IMAGE" \
+              --build-arg VITE_ADMIN_WEB_ORIGIN=https://admin.buggoglobal.com \
+              -t "$image" .
+            docker push "$image"
+          '''
+        }
+      }
+    }
+
+    stage('确认部署生产前端') {
+      when { expression { env.IS_PRODUCTION == 'true' } }
+      steps {
+        input message: "确认将 main 提交 ${env.SOURCE_TAG} 部署到 app.buggoglobal.com？", ok: '确认部署'
+      }
+    }
+
+    stage('部署生产前端') {
+      when { expression { env.IS_PRODUCTION == 'true' } }
+      steps {
+        lock(resource: 'firstleg-production-client-web-deploy', inversePrecedence: true) {
+          withCredentials([
+            usernamePassword(credentialsId: 'gitea-production-pull-token', usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD'),
+            sshUserPrivateKey(credentialsId: 'firstleg-production-ssh', keyFileVariable: 'TARGET_SSH_KEY', usernameVariable: 'TARGET_SSH_USER'),
+            string(credentialsId: 'firstleg-production-host', variable: 'TARGET_SSH_HOST'),
+            file(credentialsId: 'firstleg-production-known-hosts', variable: 'TARGET_SSH_KNOWN_HOSTS')
+          ]) {
+            withEnv([
+              'TARGET_DEPLOY_DIR=/data/firstleg/deploy/frontend',
+              'TARGET_SSH_TARGET=' + env.TARGET_SSH_USER + '@' + env.TARGET_SSH_HOST
+            ]) {
+              sh "sh scripts/deploy-production.sh client-web '${env.PRODUCTION_IMAGE_REPOSITORY}' '${env.SOURCE_TAG}' docker-compose.production.yml"
+            }
+          }
+        }
+      }
+    }
+
     stage('构建并部署开发前端') {
       when { expression { env.IS_DEVELOPMENT == 'true' } }
       steps {
@@ -82,7 +149,7 @@ pipeline {
     }
 
     stage('部署检查') {
-      when { expression { env.IS_DEVELOPMENT != 'true' } }
+      when { expression { env.IS_DEVELOPMENT != 'true' && env.IS_PRODUCTION != 'true' } }
       steps {
         sh '''
           set -eu
@@ -96,7 +163,9 @@ pipeline {
   post {
     failure {
       sh '''
-        if [ "${IS_DEVELOPMENT:-false}" = "true" ]; then
+        if [ "${IS_PRODUCTION:-false}" = "true" ]; then
+          echo "生产部署失败，请查看上方远程部署日志"
+        elif [ "${IS_DEVELOPMENT:-false}" = "true" ]; then
           docker logs --tail=100 client-web-development || true
         else
           docker compose -f docker-compose.test.yml logs --tail=100 || true