Merge branch 'test' into dev

Jenkinsfile

@@ -56,7 +56,7 @@ pipeline {
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '各服务构建成功后是否独立部署')
         booleanParam(name: 'INITIALIZE_TEST_DATABASE', defaultValue: false, description: '仅 test：调度服务前幂等初始化测试数据库')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选')
-        string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '预发布/生产镜像仓库地址；test 环境自动使用本机镜像')
+        string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '所有环境共用的镜像仓库地址')
         string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
         string(name: 'DOWNSTREAM_JOB_PREFIX', defaultValue: 'baiyue-firstleg-', description: '单服务 Jenkins Job 名称前缀，例如 baiyue-firstleg-auth')
     }
@@ -73,19 +73,14 @@ pipeline {
                     env.RESOLVED_ENVIRONMENT = resolvedEnvironment
                     echo "Job ${env.JOB_BASE_NAME} 使用部署环境: ${env.RESOLVED_ENVIRONMENT}"
 
-                    String requestedRepository
+                    String requestedRepository = params.IMAGE_REPOSITORY?.trim()
-                    if (['development', 'test'].contains(env.RESOLVED_ENVIRONMENT)) {
-                        requestedRepository = "baiyue-firstleg-${env.RESOLVED_ENVIRONMENT}"
-                        echo "${env.RESOLVED_ENVIRONMENT} 环境使用本地构建镜像，不登录、不推送远程 Registry"
-                    } else {
-                        requestedRepository = params.IMAGE_REPOSITORY?.trim()
                     if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') {
-                            error('预发布/生产环境必须填写真实镜像仓库地址')
+                        error('必须填写真实镜像仓库地址')
                     }
                     if (requestedRepository.contains('://') || !requestedRepository.contains('/')) {
                         error('IMAGE_REPOSITORY 格式错误：请填写 host[:port]/owner/image，不要包含 http:// 或 https://')
                     }
-                    }
+                    echo "${env.RESOLVED_ENVIRONMENT} 环境使用共享镜像仓库: ${requestedRepository}"
                     env.RESOLVED_IMAGE_REPOSITORY = requestedRepository
 
                     String jobPrefix = params.DOWNSTREAM_JOB_PREFIX?.trim()

Jenkinsfile.service

@@ -19,12 +19,8 @@ def serviceJars = [
 ]
 
 pipeline {
-    // 每个 Jenkins 子 Job 使用自己的 workspace，因此不同服务可以并行执行 mvn clean。
+    // 构建在任意 java-builder 节点执行，部署再回到目标环境节点。
-    agent any
+    agent none
-
-    tools {
-        maven 'maven-3.8.8'
-    }
 
     options {
         skipDefaultCheckout(true)
@@ -39,7 +35,7 @@ pipeline {
         choice(name: 'ENVIRONMENT', choices: ['test', 'development', 'staging', 'production'], description: '部署环境')
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试')
-        string(name: 'IMAGE_REPOSITORY', defaultValue: 'baiyue-firstleg-test', description: '镜像仓库基础路径，不包含服务名和标签')
+        string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '共享镜像仓库基础路径，不包含服务名和标签')
         string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
     }
 
@@ -52,6 +48,10 @@ pipeline {
         DEVELOPMENT_DEPLOY_DIR = '/opt/firstleg/application'
     }
 
+    stages {
+        stage('构建并发布单服务') {
+            agent { label 'java-builder' }
+            tools { maven 'maven-3.8.8' }
             stages {
                 stage('校验参数并检出指定提交') {
                     steps {
@@ -81,11 +81,8 @@ pipeline {
                             if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) {
                                 error('IMAGE_TAG 不是合法的 Docker 镜像标签')
                             }
-                    if (!imageRepository || imageRepository.contains('://')) {
+                            if (!imageRepository || imageRepository.contains('://') || !imageRepository.contains('/')) {
-                        error('IMAGE_REPOSITORY 不能为空且不能包含 http:// 或 https://')
+                                error('IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式，且不能包含协议前缀')
-                    }
-                    if (!['development', 'test'].contains(params.ENVIRONMENT) && !imageRepository.contains('/')) {
-                        error('预发布/生产环境 IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式')
                             }
 
                             env.RESOLVED_SERVICE = service
@@ -104,8 +101,8 @@ pipeline {
                         '''
 
                         script {
-                    currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${params.ENVIRONMENT}"
+                            currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${params.ENVIRONMENT} | ${env.NODE_NAME}"
-                    echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}"
+                            echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}，节点: ${env.NODE_NAME}"
                         }
                     }
                 }
@@ -137,13 +134,11 @@ pipeline {
                             String image = "${env.RESOLVED_IMAGE_REPOSITORY}/${env.RESOLVED_SERVICE}:${env.RESOLVED_IMAGE_TAG}"
                             String contextDir = ".docker-context/${env.RESOLVED_SERVICE}"
                             String jar = serviceJars[env.RESOLVED_SERVICE]
+                            String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
                             sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'"
                             sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'"
 
-                    if (['development', 'test'].contains(params.ENVIRONMENT)) {
+                            echo "推送共享镜像: ${image}"
-                        echo "${params.ENVIRONMENT} 镜像已保存在当前 Docker 节点：${image}"
-                    } else {
-                        String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
                             withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
                                 try {
                                     sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
@@ -152,20 +147,53 @@ pipeline {
                                     sh "docker logout ${registryHost} || true"
                                 }
                             }
+                            stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true
                         }
                     }
                 }
             }
+            post {
+                always {
+                    cleanWs(deleteDirs: true, notFailBuild: true)
+                }
+            }
+        }
 
         stage('部署单个服务') {
-            when { expression { params.DEPLOY } }
+            when {
+                beforeAgent true
+                expression { params.DEPLOY }
+            }
+            agent {
+                label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'master'}"
+            }
             steps {
+                deleteDir()
+                unstash 'deployment-files'
                 script {
                     String credentialId = "firstleg-${params.ENVIRONMENT}-env"
+                    String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
+                    boolean localDevelopmentDeploy = params.ENVIRONMENT == 'development' &&
+                        env.NODE_LABELS?.tokenize()?.contains('java-dev')
+
+                    withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
+                        try {
+                            sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
+                            withEnv(["DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}"]) {
                                 withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) {
                                     sh "sh deploy/scripts/deploy-services.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
                                 }
                             }
+                        } finally {
+                            sh "docker logout ${registryHost} || true"
+                        }
+                    }
+                }
+            }
+            post {
+                always {
+                    cleanWs(deleteDirs: true, notFailBuild: true)
+                }
             }
         }
     }
@@ -174,8 +202,5 @@ pipeline {
         success {
             echo "${env.RESOLVED_SERVICE} 已独立完成构建${params.DEPLOY ? '和部署' : ''}"
         }
-        always {
-            cleanWs(deleteDirs: true, notFailBuild: true)
-        }
     }
 }

deploy/scripts/deploy-development-service.sh

@@ -44,6 +44,46 @@ for service in $SERVICES; do
   esac
 done
 
+if [ "${DEVELOPMENT_DEPLOY_LOCAL:-false}" = "true" ]; then
+  echo "开发镜像已在开发节点本机构建，直接部署: $SERVICE_CSV"
+  install -d -m 750 "$REMOTE_DIR"
+
+  SUFFIX="${IMAGE_TAG}.$$.${SERVICE_CSV}"
+  LOCAL_ENV_TMP="$REMOTE_DIR/.env.$SUFFIX.tmp"
+  LOCAL_COMPOSE_TMP="$REMOTE_DIR/docker-compose.yml.$SUFFIX.tmp"
+  install -m 600 "$ENV_FILE" "$LOCAL_ENV_TMP"
+  install -m 644 "$COMPOSE_FILE" "$LOCAL_COMPOSE_TMP"
+  mv -f "$LOCAL_ENV_TMP" "$REMOTE_DIR/.env"
+  mv -f "$LOCAL_COMPOSE_TMP" "$REMOTE_DIR/docker-compose.yml"
+
+  for service in $SERVICES; do
+    docker image inspect "$IMAGE_REPOSITORY/$service:$IMAGE_TAG" >/dev/null
+  done
+
+  cd "$REMOTE_DIR"
+  export DEPLOY_ENV=development
+  export IMAGE_REPOSITORY IMAGE_TAG
+
+  docker compose \
+    --project-name firstleg-development \
+    --env-file .env \
+    -f docker-compose.yml \
+    pull $SERVICES
+
+  docker compose \
+    --project-name firstleg-development \
+    --env-file .env \
+    -f docker-compose.yml \
+    up -d --remove-orphans --pull never $SERVICES
+
+  docker compose \
+    --project-name firstleg-development \
+    --env-file .env \
+    -f docker-compose.yml \
+    ps $SERVICES
+  exit 0
+fi
+
 run_ssh() {
   ssh -i "$SSH_KEY" \
     -o BatchMode=yes \

deploy/scripts/deploy-services.sh

@@ -79,22 +79,17 @@ if [ "$DEPLOY_ENV" = "development" ]; then
     "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE_CSV" "$ENV_FILE"
 fi
 
-PULL_POLICY_ARGS=""
+docker compose \
-if [ "$DEPLOY_ENV" = "test" ]; then
-  PULL_POLICY_ARGS="--pull never"
-else
-  docker compose \
   --project-name "firstleg-${DEPLOY_ENV}" \
   --env-file "$ENV_FILE" \
   -f deploy/docker-compose.yml \
   pull $SERVICES
-fi
 
 docker compose \
   --project-name "firstleg-${DEPLOY_ENV}" \
   --env-file "$ENV_FILE" \
   -f deploy/docker-compose.yml \
-  up -d --remove-orphans $PULL_POLICY_ARGS $SERVICES
+  up -d --remove-orphans --pull never $SERVICES
 
 docker compose \
   --project-name "firstleg-${DEPLOY_ENV}" \

scripts/test-environment-pipeline-contract.test.mjs

@@ -4,6 +4,8 @@ import test from 'node:test'
 
 const pipeline = (await readFile(new URL('../Jenkinsfile.service', import.meta.url), 'utf8'))
   .replaceAll('\r\n', '\n')
+const deployScript = (await readFile(new URL('../deploy/scripts/deploy-services.sh', import.meta.url), 'utf8'))
+  .replaceAll('\r\n', '\n')
 
 test('test deployments compile packages without rerunning the full unit test suite', () => {
   assert.match(pipeline, /params\.ENVIRONMENT == 'test' \|\| params\.SKIP_TESTS/)
@@ -16,3 +18,10 @@ test('production deployments cannot skip tests', () => {
   assert.match(pipeline, /params\.ENVIRONMENT == 'production' && params\.SKIP_TESTS/)
   assert.match(pipeline, /error\('生产环境禁止跳过测试'\)/)
 })
+
+test('Java builds use the shared builder pool and deploy on the target environment node', () => {
+  assert.match(pipeline, /agent \{ label 'java-builder' \}/)
+  assert.match(pipeline, /params\.ENVIRONMENT == 'development' \? 'java-dev' : 'master'/)
+  assert.match(pipeline, /docker push \$\{image\}/)
+  assert.match(deployScript, /pull \$SERVICES/)
+})