From b029f4ce28dc645f856bc59c1afc5c18abca893f Mon Sep 17 00:00:00 2001 From: ouyangxq <775153912@qq.com> Date: Thu, 20 Aug 2026 12:49:54 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Jenkinsfile | 4 +- Jenkinsfile.service | 70 +++++-- deploy/scripts/deploy-built-service.sh | 173 ++++++++++++++++++ ...est-environment-pipeline-contract.test.mjs | 9 +- 4 files changed, 237 insertions(+), 19 deletions(-) create mode 100644 deploy/scripts/deploy-built-service.sh diff --git a/Jenkinsfile b/Jenkinsfile index c1b6cd5dc..830b43831 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -75,7 +75,8 @@ pipeline { String requestedRepository if (['development', 'test'].contains(env.RESOLVED_ENVIRONMENT)) { - requestedRepository = '172.31.198.7:10082/java-project/baiyue-firstleg' + requestedRepository = "baiyue-firstleg-${env.RESOLVED_ENVIRONMENT}" + echo "${env.RESOLVED_ENVIRONMENT} 环境使用本地镜像，由构建节点直接传输到部署目标" } else { requestedRepository = params.IMAGE_REPOSITORY?.trim() if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') { @@ -85,7 +86,6 @@ pipeline { error('IMAGE_REPOSITORY 格式错误：请填写 host[:port]/owner/image，不要包含 http:// 或 https://') } } - echo "${env.RESOLVED_ENVIRONMENT} 环境使用共享镜像仓库: ${requestedRepository}" env.RESOLVED_IMAGE_REPOSITORY = requestedRepository String jobPrefix = params.DOWNSTREAM_JOB_PREFIX?.trim() diff --git a/Jenkinsfile.service b/Jenkinsfile.service index b603678f1..283449f4d 100644 --- a/Jenkinsfile.service +++ b/Jenkinsfile.service @@ -64,7 +64,7 @@ pipeline { String sourceCommit = params.SOURCE_COMMIT?.trim() String imageTag = params.IMAGE_TAG?.trim() String imageRepository = ['development', 'test'].contains(params.ENVIRONMENT) - ? '172.31.198.7:10082/java-project/baiyue-firstleg' + ? "baiyue-firstleg-${params.ENVIRONMENT}" : params.IMAGE_REPOSITORY?.trim() if (!sourceCommit) { @@ -83,8 +83,11 @@ pipeline { if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) { error('IMAGE_TAG 不是合法的 Docker 镜像标签') } - if (!imageRepository || imageRepository.contains('://') || !imageRepository.contains('/')) { - error('IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式，且不能包含协议前缀') + if (!imageRepository || imageRepository.contains('://')) { + error('IMAGE_REPOSITORY 不能为空且不能包含协议前缀') + } + if (!['development', 'test'].contains(params.ENVIRONMENT) && !imageRepository.contains('/')) { + error('预发布/生产环境 IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式') } env.RESOLVED_SERVICE = service @@ -140,16 +143,59 @@ pipeline { sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'" sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'" - echo "推送共享镜像: ${image}" - withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) { - try { - sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"' - sh "docker push ${image}" - } finally { - sh "docker logout ${registryHost} || true" + if (['development', 'test'].contains(params.ENVIRONMENT)) { + echo "${params.ENVIRONMENT} 镜像已保存在构建节点 ${env.NODE_NAME}: ${image}" + } else { + echo "推送共享镜像: ${image}" + withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) { + try { + sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"' + sh "docker push ${image}" + } finally { + sh "docker logout ${registryHost} || true" + } + } + if (params.DEPLOY) { + stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true + } + } + } + } + } + + stage('直接部署开发或测试环境') { + when { + expression { params.DEPLOY && ['development', 'test'].contains(params.ENVIRONMENT) } + } + steps { + script { + boolean development = params.ENVIRONMENT == 'development' + boolean targetIsLocal = development + ? env.NODE_LABELS?.tokenize()?.contains('java-dev') + : env.NODE_NAME == 'master' + String credentialId = "firstleg-${params.ENVIRONMENT}-env" + String remoteTarget = development ? 'deploy@172.31.198.8' : 'deploy@172.31.198.7' + String remoteKey = development + ? '/var/jenkins_home/.ssh/dev_deploy' + : '/home/deploy/.ssh/test_deploy' + String remoteKnownHosts = development + ? '/var/jenkins_home/.ssh/known_hosts' + : '/home/deploy/.ssh/known_hosts' + String remoteDir = development + ? '/opt/firstleg/application' + : '/opt/firstleg/test-application' + + withEnv([ + "TARGET_IS_LOCAL=${targetIsLocal}", + "TARGET_SSH_TARGET=${remoteTarget}", + "TARGET_SSH_KEY=${remoteKey}", + "TARGET_SSH_KNOWN_HOSTS=${remoteKnownHosts}", + "TARGET_DEPLOY_DIR=${remoteDir}" + ]) { + withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) { + sh "sh deploy/scripts/deploy-built-service.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\"" } } - stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true } } } @@ -164,7 +210,7 @@ pipeline { stage('部署单个服务') { when { beforeAgent true - expression { params.DEPLOY } + expression { params.DEPLOY && !['development', 'test'].contains(params.ENVIRONMENT) } } agent { label "${params.ENVIRONMENT == 'development' ? 'java-dev' : 'master'}" diff --git a/deploy/scripts/deploy-built-service.sh b/deploy/scripts/deploy-built-service.sh new file mode 100644 index 000000000..e6eb3fa1e --- /dev/null +++ b/deploy/scripts/deploy-built-service.sh @@ -0,0 +1,173 @@ +#!/usr/bin/env sh +set -eu + +if [ "$#" -ne 5 ]; then + echo "用法: $0 <环境> <镜像仓库> <镜像标签> <服务> <环境文件>" >&2 + exit 2 +fi + +DEPLOY_ENV="$1" +IMAGE_REPOSITORY="$2" +IMAGE_TAG="$3" +SERVICE="$4" +ENV_FILE="$5" +COMPOSE_FILE="deploy/docker-compose.yml" +IMAGE="$IMAGE_REPOSITORY/$SERVICE:$IMAGE_TAG" +PROJECT_NAME="firstleg-$DEPLOY_ENV" + +case "$DEPLOY_ENV" in + development|test) ;; + *) + echo "直接镜像传输仅支持 development/test，当前: $DEPLOY_ENV" >&2 + exit 2 + ;; +esac + +case "$SERVICE" in + *[!A-Za-z0-9_-]*|'') + echo "非法服务名: $SERVICE" >&2 + exit 2 + ;; +esac + +for file in "$ENV_FILE" "$COMPOSE_FILE"; do + if [ ! -f "$file" ]; then + echo "必需文件不存在: $file" >&2 + exit 2 + fi +done + +env_file_has_key() { + grep -q "^$1=" "$ENV_FILE" +} + +env_file_value() { + sed -n "s/^$1=//p" "$ENV_FILE" | tail -n 1 | tr -d '\r' +} + +if [ "$SERVICE" = "finance" ]; then + for key in FINANCE_DB_URL FINANCE_DB_USERNAME FINANCE_DB_PASSWORD; do + if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then + echo "部署 finance 服务时，环境文件必须包含非空 $key" >&2 + exit 2 + fi + done +fi + +if [ "$SERVICE" = "file" ]; then + if ! env_file_has_key ROCKETMQ_NAME_SERVER || [ -z "$(env_file_value ROCKETMQ_NAME_SERVER)" ]; then + echo "部署 file 服务时，环境文件必须包含非空 ROCKETMQ_NAME_SERVER" >&2 + exit 2 + fi + if ! env_file_has_key MQ_TOPIC_PREFIX; then + echo "部署 file 服务时，环境文件必须显式包含 MQ_TOPIC_PREFIX" >&2 + exit 2 + fi + MQ_PREFIX=$(env_file_value MQ_TOPIC_PREFIX) + if [ "$DEPLOY_ENV" = "test" ] && [ "$MQ_PREFIX" != "test-" ]; then + echo "测试环境部署 file 服务时 MQ_TOPIC_PREFIX 必须为 test-" >&2 + exit 2 + fi + if [ "$DEPLOY_ENV" = "development" ] && { [ -z "$MQ_PREFIX" ] || [ "$MQ_PREFIX" = "test-" ]; }; then + echo "开发环境部署 file 服务时 MQ_TOPIC_PREFIX 必须非空且不能使用 test-" >&2 + exit 2 + fi +fi + +docker image inspect "$IMAGE" >/dev/null + +deploy_local() { + export DEPLOY_ENV IMAGE_REPOSITORY IMAGE_TAG + docker compose \ + --project-name "$PROJECT_NAME" \ + --env-file "$ENV_FILE" \ + -f "$COMPOSE_FILE" \ + up -d --remove-orphans --pull never "$SERVICE" + docker compose \ + --project-name "$PROJECT_NAME" \ + --env-file "$ENV_FILE" \ + -f "$COMPOSE_FILE" \ + ps "$SERVICE" +} + +if [ "${TARGET_IS_LOCAL:-false}" = "true" ]; then + echo "镜像已在目标服务器本机，直接部署: $IMAGE" + deploy_local + exit 0 +fi + +SSH_TARGET="${TARGET_SSH_TARGET:?TARGET_SSH_TARGET 未设置}" +SSH_KEY="${TARGET_SSH_KEY:?TARGET_SSH_KEY 未设置}" +SSH_KNOWN_HOSTS="${TARGET_SSH_KNOWN_HOSTS:?TARGET_SSH_KNOWN_HOSTS 未设置}" +REMOTE_DIR="${TARGET_DEPLOY_DIR:?TARGET_DEPLOY_DIR 未设置}" + +for file in "$SSH_KEY" "$SSH_KNOWN_HOSTS"; do + if [ ! -f "$file" ]; then + echo "SSH 文件不存在: $file" >&2 + exit 2 + fi +done + +run_ssh() { + ssh -i "$SSH_KEY" \ + -o BatchMode=yes \ + -o Compression=no \ + -o StrictHostKeyChecking=yes \ + -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" \ + -o ConnectTimeout=10 \ + "$SSH_TARGET" "$@" +} + +run_scp() { + scp -i "$SSH_KEY" \ + -o BatchMode=yes \ + -o Compression=no \ + -o StrictHostKeyChecking=yes \ + -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" \ + -o ConnectTimeout=10 \ + "$@" +} + +run_ssh install -d -m 750 "$REMOTE_DIR" + +SUFFIX="${IMAGE_TAG}.$$.${SERVICE}" +REMOTE_ENV_TMP="$REMOTE_DIR/.env.$SUFFIX.tmp" +REMOTE_COMPOSE_TMP="$REMOTE_DIR/docker-compose.yml.$SUFFIX.tmp" +run_scp "$ENV_FILE" "$SSH_TARGET:$REMOTE_ENV_TMP" +run_scp "$COMPOSE_FILE" "$SSH_TARGET:$REMOTE_COMPOSE_TMP" +run_ssh sh -s -- "$REMOTE_DIR" "$REMOTE_ENV_TMP" "$REMOTE_COMPOSE_TMP" <<'REMOTE_PREPARE' +set -eu +remote_dir="$1" +env_tmp="$2" +compose_tmp="$3" +chmod 600 "$env_tmp" +chmod 644 "$compose_tmp" +mv -f "$env_tmp" "$remote_dir/.env" +mv -f "$compose_tmp" "$remote_dir/docker-compose.yml" +REMOTE_PREPARE + +echo "传输镜像到 $SSH_TARGET: $IMAGE" +docker save "$IMAGE" | gzip -1 | run_ssh 'gzip -dc | docker load' + +run_ssh sh -s -- "$REMOTE_DIR" "$DEPLOY_ENV" "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE" <<'REMOTE_DEPLOY' +set -eu +remote_dir="$1" +deploy_env="$2" +image_repository="$3" +image_tag="$4" +service="$5" +cd "$remote_dir" +export DEPLOY_ENV="$deploy_env" +export IMAGE_REPOSITORY="$image_repository" +export IMAGE_TAG="$image_tag" +docker compose \ + --project-name "firstleg-$deploy_env" \ + --env-file .env \ + -f docker-compose.yml \ + up -d --remove-orphans --pull never "$service" +docker compose \ + --project-name "firstleg-$deploy_env" \ + --env-file .env \ + -f docker-compose.yml \ + ps "$service" +REMOTE_DEPLOY diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs index d1c573b40..9e533ae23 100644 --- a/scripts/test-environment-pipeline-contract.test.mjs +++ b/scripts/test-environment-pipeline-contract.test.mjs @@ -4,7 +4,7 @@ import test from 'node:test' const pipeline = (await readFile(new URL('../Jenkinsfile.service', import.meta.url), 'utf8')) .replaceAll('\r\n', '\n') -const deployScript = (await readFile(new URL('../deploy/scripts/deploy-services.sh', import.meta.url), 'utf8')) +const directDeployScript = (await readFile(new URL('../deploy/scripts/deploy-built-service.sh', import.meta.url), 'utf8')) .replaceAll('\r\n', '\n') const ciMavenSettings = (await readFile(new URL('../deploy/maven/settings-ci.xml', import.meta.url), 'utf8')) .replaceAll('\r\n', '\n') @@ -23,11 +23,10 @@ test('production deployments cannot skip tests', () => { test('Java builds use the shared builder pool and deploy on the target environment node', () => { assert.match(pipeline, /agent \{ label 'java-builder' \}/) - assert.match(pipeline, /params\.ENVIRONMENT == 'development' \? 'java-dev' : 'master'/) assert.match(pipeline, /\['development', 'test'\]\.contains\(params\.ENVIRONMENT\)/) - assert.match(pipeline, /172\.31\.198\.7:10082\/java-project\/baiyue-firstleg/) - assert.match(pipeline, /docker push \$\{image\}/) - assert.match(deployScript, /pull \$SERVICES/) + assert.match(pipeline, /deploy-built-service\.sh/) + assert.match(directDeployScript, /docker save "\$IMAGE" \| gzip -1 \| run_ssh/) + assert.match(directDeployScript, /--pull never/) }) test('shared builders use a reachable public Maven mirror instead of the retired private proxy', () => {