diff --git a/Jenkinsfile b/Jenkinsfile index 078ce6bab..28574f7ef 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -170,8 +170,8 @@ pipeline { choice(name: 'ENVIRONMENT', choices: environmentChoicesForJob(env.JOB_BASE_NAME), description: '部署环境') booleanParam(name: 'DEPLOY', defaultValue: false, description: '各服务构建成功后是否独立部署') booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选') - string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库地址') - string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像') + string(name: 'IMAGE_REPOSITORY', defaultValue: 'git.buggoglobal.com/java-project/baiyue-firstleg', description: '共享镜像仓库地址') + string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像') choice(name: 'DOWNSTREAM_JOB_PREFIX', choices: downstreamJobPrefixChoicesForJob(env.JOB_BASE_NAME), description: '由当前总控 Job 固定的单服务 Job 前缀') } @@ -192,6 +192,17 @@ pipeline { env.RESOLVED_ENVIRONMENT = resolvedEnvironment echo "Job ${env.JOB_BASE_NAME} 使用部署环境: ${env.RESOLVED_ENVIRONMENT}" + if (env.RESOLVED_ENVIRONMENT == 'production') { + sh ''' + set -eu + git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main + test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" || { + echo "生产构建只允许 origin/main 当前提交；请先通过 Pull Request 合并到 main 后再部署" >&2 + exit 1 + } + ''' + } + String requestedRepository = params.IMAGE_REPOSITORY?.trim() if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') { error('必须填写真实镜像仓库地址') diff --git a/Jenkinsfile.service b/Jenkinsfile.service index 2cd097345..1d44cdf46 100644 --- a/Jenkinsfile.service +++ b/Jenkinsfile.service @@ -56,8 +56,8 @@ pipeline { booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务') booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试') choice(name: 'EVENT_BRIDGE_REGION', choices: ['BOTH', 'CN', 'OVERSEAS', 'SELECT'], description: '仅 event-bridge-service 使用；BOTH 在开发/测试环境同时部署国内和海外实例；SELECT 为总控兼容值') - string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库基础路径，不包含服务名和标签') - string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像') + string(name: 'IMAGE_REPOSITORY', defaultValue: 'git.buggoglobal.com/java-project/baiyue-firstleg', description: '共享镜像仓库基础路径，不包含服务名和标签') + string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像') } environment { @@ -146,6 +146,16 @@ pipeline { test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")" ''' + sh ''' + if [ "${RESOLVED_ENVIRONMENT}" = "production" ]; then + git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main + git merge-base --is-ancestor "${RESOLVED_SOURCE_COMMIT}" origin/main || { + echo "生产构建只允许已经合并到 main 的提交" >&2 + exit 1 + } + fi + ''' + script { currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${env.RESOLVED_ENVIRONMENT} | ${env.NODE_NAME}" echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}，节点: ${env.NODE_NAME}" @@ -263,36 +273,33 @@ pipeline { } } - stage('部署单个服务') { + stage('部署生产环境单个服务') { when { beforeAgent true - expression { params.DEPLOY && !['development', 'test'].contains(env.RESOLVED_ENVIRONMENT) } - } - agent { - label "${env.RESOLVED_ENVIRONMENT == 'development' ? 'java-dev' : 'master'}" + expression { params.DEPLOY && env.RESOLVED_ENVIRONMENT == 'production' } } + agent { label 'java-builder' } steps { deleteDir() unstash 'deployment-files' script { String credentialId = "firstleg-${env.RESOLVED_ENVIRONMENT}-env" - String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0] - boolean localDevelopmentDeploy = env.RESOLVED_ENVIRONMENT == 'development' && - env.NODE_LABELS?.tokenize()?.contains('java-dev') - - withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) { - try { - sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"' + String serviceDeployResource = "firstleg-production-${env.RESOLVED_SERVICE}-deploy" + lock(resource: serviceDeployResource, inversePrecedence: true) { + withCredentials([ + file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE'), + usernamePassword(credentialsId: 'gitea-production-pull-token', usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD'), + sshUserPrivateKey(credentialsId: 'firstleg-production-ssh', keyFileVariable: 'TARGET_SSH_KEY', usernameVariable: 'TARGET_SSH_USER'), + string(credentialsId: 'firstleg-production-host', variable: 'TARGET_SSH_HOST'), + file(credentialsId: 'firstleg-production-known-hosts', variable: 'TARGET_SSH_KNOWN_HOSTS') + ]) { withEnv([ - "DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}", + 'TARGET_DEPLOY_DIR=/data/firstleg/deploy/services', + 'TARGET_SSH_TARGET=' + env.TARGET_SSH_USER + '@' + env.TARGET_SSH_HOST, "EVENT_BRIDGE_REGION_OVERRIDE=${params.EVENT_BRIDGE_REGION}" ]) { - withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) { - sh "sh deploy/scripts/deploy-services.sh '${env.RESOLVED_ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\"" - } + sh "sh deploy/scripts/deploy-built-service.sh '${env.RESOLVED_ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\"" } - } finally { - sh "docker logout ${registryHost} || true" } } } diff --git a/deploy/docker-compose.overseas.yml b/deploy/docker-compose.overseas.yml index fbde2d580..5d969d59c 100644 --- a/deploy/docker-compose.overseas.yml +++ b/deploy/docker-compose.overseas.yml @@ -8,8 +8,8 @@ x-overseas-common: &overseas-common environment: &overseas-environment SPRING_PROFILES_ACTIVE: overseas NACOS_SERVER_ADDR: ${NACOS_SERVER_ADDR} - NACOS_USERNAME: ${NACOS_USERNAME} - NACOS_PASSWORD: ${NACOS_PASSWORD} + NACOS_USERNAME: ${OVERSEAS_NACOS_USERNAME} + NACOS_PASSWORD: ${OVERSEAS_NACOS_PASSWORD} NACOS_GROUP: ${NACOS_GROUP:-BAIYUE} NACOS_NAMESPACE: ${OVERSEAS_NACOS_NAMESPACE:-prod-overseas} REDIS_HOST: ${OVERSEAS_REDIS_HOST:-host.docker.internal} diff --git a/deploy/scripts/deploy-built-service.sh b/deploy/scripts/deploy-built-service.sh index b01bb374b..2320435d8 100644 --- a/deploy/scripts/deploy-built-service.sh +++ b/deploy/scripts/deploy-built-service.sh @@ -29,9 +29,9 @@ for value_name in HEALTH_TIMEOUT_SECONDS HEALTH_POLL_SECONDS; do done case "$DEPLOY_ENV" in - development|test) ;; + development|test|production) ;; *) - echo "直接镜像传输仅支持 development/test，当前: $DEPLOY_ENV" >&2 + echo "仅支持 development/test/production，当前: $DEPLOY_ENV" >&2 exit 2 ;; esac @@ -115,7 +115,7 @@ if [ "$SERVICE" = "finance" ]; then fi if [ "$PROJECT_NAME" = "firstleg-$DEPLOY_ENV-overseas" ]; then - for key in NACOS_SERVER_ADDR NACOS_USERNAME NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do + for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_USERNAME OVERSEAS_NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then echo "部署海外服务时，环境文件必须包含非空 $key" >&2 exit 2 @@ -188,6 +188,10 @@ if [ "$SERVICE" = "file" ]; then echo "开发环境部署 file 服务时 MQ_TOPIC_PREFIX 必须非空且不能使用 test-" >&2 exit 2 fi + if [ "$DEPLOY_ENV" = "production" ] && [ -n "$MQ_PREFIX" ]; then + echo "生产环境部署 file 服务时 MQ_TOPIC_PREFIX 必须为空，使用正式 Topic" >&2 + exit 2 + fi fi : "${REGISTRY_USER:?REGISTRY_USER 未设置}" @@ -505,7 +509,7 @@ if [ "$new_started" = "true" ] && wait_for_health; then fi echo "新镜像健康检查失败: $new_image" >&2 -failed_container_id="$(remote_container_id || true)" +failed_container_id="$(container_id || true)" if [ -n "$failed_container_id" ]; then echo "新镜像容器最近日志（最多 200 行）:" >&2 docker logs --tail 200 "$failed_container_id" 2>&1 || true diff --git a/deploy/scripts/deploy-services.sh b/deploy/scripts/deploy-services.sh index 423e5a7e5..c18282116 100644 --- a/deploy/scripts/deploy-services.sh +++ b/deploy/scripts/deploy-services.sh @@ -72,7 +72,7 @@ else fi if [ "$DEPLOY_REGION" = "OVERSEAS" ]; then - for key in NACOS_SERVER_ADDR NACOS_USERNAME NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do + for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_USERNAME OVERSEAS_NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then echo "部署海外服务时，环境文件必须包含非空 $key" >&2 exit 2 diff --git a/scripts/overseas-deployment-contract.test.mjs b/scripts/overseas-deployment-contract.test.mjs index 1e861c5ab..8b8bbb62d 100644 --- a/scripts/overseas-deployment-contract.test.mjs +++ b/scripts/overseas-deployment-contract.test.mjs @@ -66,9 +66,8 @@ test('service map freezes unique internal ports and moves event bridge away from test('overseas compose is isolated from CN defaults and disables implicit schema execution', async () => { const compose = await read('deploy/docker-compose.overseas.yml') assert.match(compose, /^name: firstleg-\$\{DEPLOY_ENV:-test\}-overseas$/m) - assert.match(compose, /NACOS_USERNAME: \$\{NACOS_USERNAME\}/) - assert.match(compose, /NACOS_PASSWORD: \$\{NACOS_PASSWORD\}/) - assert.doesNotMatch(compose, /OVERSEAS_NACOS_(?:USERNAME|PASSWORD)/) + assert.match(compose, /NACOS_USERNAME: \$\{OVERSEAS_NACOS_USERNAME\}/) + assert.match(compose, /NACOS_PASSWORD: \$\{OVERSEAS_NACOS_PASSWORD\}/) assert.match(compose, /NACOS_NAMESPACE: \$\{OVERSEAS_NACOS_NAMESPACE:-prod-overseas\}/) assert.match(compose, /REGION_CODE: OVERSEAS/) assert.match(compose, /SPRING_SQL_INIT_MODE: never/) diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs index 584e27f08..229e936e9 100644 --- a/scripts/test-environment-pipeline-contract.test.mjs +++ b/scripts/test-environment-pipeline-contract.test.mjs @@ -76,6 +76,9 @@ test('production deployments cannot skip tests', () => { assert.match(coordinatorPipeline, /env\.RESOLVED_ENVIRONMENT == 'production' && params\.SKIP_TESTS/) assert.match(coordinatorPipeline, /error\('生产环境禁止跳过测试'\)/) assert.match(pipeline, /生产环境手工构建禁止跳过测试/) + assert.match(coordinatorPipeline, /refs\/heads\/main:refs\/remotes\/origin\/main/) + assert.match(coordinatorPipeline, /test "\$\(git rev-parse HEAD\)" = "\$\(git rev-parse origin\/main\)"/) + assert.match(pipeline, /git merge-base --is-ancestor "\$\{RESOLVED_SOURCE_COMMIT\}" origin\/main/) }) test('Java builds use the shared builder pool and serialize incremental target deployments', () => { @@ -86,7 +89,9 @@ test('Java builds use the shared builder pool and serialize incremental target d assert.match(pipeline, /String deploySlotLabel = "firstleg-\$\{env\.RESOLVED_ENVIRONMENT\}-deploy-slot"/) assert.match(pipeline, /lock\(label: deploySlotLabel, quantity: 1, inversePrecedence: true\)/) assert.match(pipeline, /deploy-built-service\.sh/) - assert.doesNotMatch(pipeline, /dev_deploy|test_deploy|TARGET_SSH_KEY/) + assert.doesNotMatch(pipeline, /dev_deploy|test_deploy/) + assert.match(pipeline, /firstleg-production-ssh/) + assert.match(pipeline, /TARGET_SSH_KEY/) assert.match(directDeployScript, /docker pull "\$IMAGE"/) assert.match(directDeployScript, /run_ssh docker pull "\$IMAGE"/) assert.doesNotMatch(directDeployScript, /docker save "\$IMAGE"/) @@ -195,12 +200,12 @@ test('shared builders use a reachable public Maven mirror instead of the retired assert.doesNotMatch(ciMavenSettings, /:18081/) }) -test('Java service images use the internal registry base image by default', () => { - const internalBaseImage = '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine' +test('Java service images use the canonical Gitea registry base image by default', () => { + const internalBaseImage = 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine' assert.match(coordinatorPipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.'))) assert.match(pipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.'))) - assert.match(serviceDockerfile, new RegExp(internalBaseImage.replaceAll('.', '\\.'))) + assert.match(serviceDockerfile, /ARG BASE_IMAGE/) assert.doesNotMatch(coordinatorPipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/) assert.doesNotMatch(pipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/) assert.doesNotMatch(serviceDockerfile, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)