ci: 收口生产 main 分支部署流程

Jenkinsfile

@@ -170,8 +170,8 @@ pipeline {
         choice(name: 'ENVIRONMENT', choices: environmentChoicesForJob(env.JOB_BASE_NAME), description: '部署环境')
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '各服务构建成功后是否独立部署')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选')
-        string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库地址')
+        string(name: 'IMAGE_REPOSITORY', defaultValue: 'git.buggoglobal.com/java-project/baiyue-firstleg', description: '共享镜像仓库地址')
-        string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像')
+        string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
         choice(name: 'DOWNSTREAM_JOB_PREFIX', choices: downstreamJobPrefixChoicesForJob(env.JOB_BASE_NAME), description: '由当前总控 Job 固定的单服务 Job 前缀')
     }
 
@@ -192,6 +192,17 @@ pipeline {
                     env.RESOLVED_ENVIRONMENT = resolvedEnvironment
                     echo "Job ${env.JOB_BASE_NAME} 使用部署环境: ${env.RESOLVED_ENVIRONMENT}"
 
+                    if (env.RESOLVED_ENVIRONMENT == 'production') {
+                        sh '''
+                            set -eu
+                            git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+                            test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" || {
+                              echo "生产构建只允许 origin/main 当前提交；请先通过 Pull Request 合并到 main 后再部署" >&2
+                              exit 1
+                            }
+                        '''
+                    }
+
                     String requestedRepository = params.IMAGE_REPOSITORY?.trim()
                     if (!requestedRepository || requestedRepository == 'registry.example.com/your-group/baiyue-firstleg') {
                         error('必须填写真实镜像仓库地址')

Jenkinsfile.service

@@ -56,8 +56,8 @@ pipeline {
         booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务')
         booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试')
         choice(name: 'EVENT_BRIDGE_REGION', choices: ['BOTH', 'CN', 'OVERSEAS', 'SELECT'], description: '仅 event-bridge-service 使用；BOTH 在开发/测试环境同时部署国内和海外实例；SELECT 为总控兼容值')
-        string(name: 'IMAGE_REPOSITORY', defaultValue: '172.31.198.7:10082/java-project/baiyue-firstleg', description: '内网共享镜像仓库基础路径，不包含服务名和标签')
+        string(name: 'IMAGE_REPOSITORY', defaultValue: 'git.buggoglobal.com/java-project/baiyue-firstleg', description: '共享镜像仓库基础路径，不包含服务名和标签')
-        string(name: 'DOCKER_BASE_IMAGE', defaultValue: '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine', description: '内网 Java 17 基础镜像')
+        string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
     }
 
     environment {
@@ -146,6 +146,16 @@ pipeline {
                             test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")"
                         '''
 
+                        sh '''
+                            if [ "${RESOLVED_ENVIRONMENT}" = "production" ]; then
+                              git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+                              git merge-base --is-ancestor "${RESOLVED_SOURCE_COMMIT}" origin/main || {
+                                echo "生产构建只允许已经合并到 main 的提交" >&2
+                                exit 1
+                              }
+                            fi
+                        '''
+
                         script {
                             currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${env.RESOLVED_ENVIRONMENT} | ${env.NODE_NAME}"
                             echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}，节点: ${env.NODE_NAME}"
@@ -263,36 +273,33 @@ pipeline {
             }
         }
 
-        stage('部署单个服务') {
+        stage('部署生产环境单个服务') {
             when {
                 beforeAgent true
-                expression { params.DEPLOY && !['development', 'test'].contains(env.RESOLVED_ENVIRONMENT) }
+                expression { params.DEPLOY && env.RESOLVED_ENVIRONMENT == 'production' }
-            }
-            agent {
-                label "${env.RESOLVED_ENVIRONMENT == 'development' ? 'java-dev' : 'master'}"
             }
+            agent { label 'java-builder' }
             steps {
                 deleteDir()
                 unstash 'deployment-files'
                 script {
                     String credentialId = "firstleg-${env.RESOLVED_ENVIRONMENT}-env"
-                    String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
+                    String serviceDeployResource = "firstleg-production-${env.RESOLVED_SERVICE}-deploy"
-                    boolean localDevelopmentDeploy = env.RESOLVED_ENVIRONMENT == 'development' &&
+                    lock(resource: serviceDeployResource, inversePrecedence: true) {
-                        env.NODE_LABELS?.tokenize()?.contains('java-dev')
+                        withCredentials([
-
+                            file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE'),
-                    withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
+                            usernamePassword(credentialsId: 'gitea-production-pull-token', usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD'),
-                        try {
+                            sshUserPrivateKey(credentialsId: 'firstleg-production-ssh', keyFileVariable: 'TARGET_SSH_KEY', usernameVariable: 'TARGET_SSH_USER'),
-                            sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
+                            string(credentialsId: 'firstleg-production-host', variable: 'TARGET_SSH_HOST'),
+                            file(credentialsId: 'firstleg-production-known-hosts', variable: 'TARGET_SSH_KNOWN_HOSTS')
+                        ]) {
                             withEnv([
-                                "DEVELOPMENT_DEPLOY_LOCAL=${localDevelopmentDeploy}",
+                                'TARGET_DEPLOY_DIR=/data/firstleg/deploy/services',
+                                'TARGET_SSH_TARGET=' + env.TARGET_SSH_USER + '@' + env.TARGET_SSH_HOST,
                                 "EVENT_BRIDGE_REGION_OVERRIDE=${params.EVENT_BRIDGE_REGION}"
                             ]) {
-                                withCredentials([file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE')]) {
+                                sh "sh deploy/scripts/deploy-built-service.sh '${env.RESOLVED_ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
-                                    sh "sh deploy/scripts/deploy-services.sh '${env.RESOLVED_ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
-                                }
                             }
-                        } finally {
-                            sh "docker logout ${registryHost} || true"
                         }
                     }
                 }

deploy/docker-compose.overseas.yml

@@ -8,8 +8,8 @@ x-overseas-common: &overseas-common
   environment: &overseas-environment
     SPRING_PROFILES_ACTIVE: overseas
     NACOS_SERVER_ADDR: ${NACOS_SERVER_ADDR}
-    NACOS_USERNAME: ${NACOS_USERNAME}
+    NACOS_USERNAME: ${OVERSEAS_NACOS_USERNAME}
-    NACOS_PASSWORD: ${NACOS_PASSWORD}
+    NACOS_PASSWORD: ${OVERSEAS_NACOS_PASSWORD}
     NACOS_GROUP: ${NACOS_GROUP:-BAIYUE}
     NACOS_NAMESPACE: ${OVERSEAS_NACOS_NAMESPACE:-prod-overseas}
     REDIS_HOST: ${OVERSEAS_REDIS_HOST:-host.docker.internal}

deploy/scripts/deploy-built-service.sh

@@ -29,9 +29,9 @@ for value_name in HEALTH_TIMEOUT_SECONDS HEALTH_POLL_SECONDS; do
 done
 
 case "$DEPLOY_ENV" in
-  development|test) ;;
+  development|test|production) ;;
   *)
-    echo "直接镜像传输仅支持 development/test，当前: $DEPLOY_ENV" >&2
+    echo "仅支持 development/test/production，当前: $DEPLOY_ENV" >&2
     exit 2
     ;;
 esac
@@ -115,7 +115,7 @@ if [ "$SERVICE" = "finance" ]; then
 fi
 
 if [ "$PROJECT_NAME" = "firstleg-$DEPLOY_ENV-overseas" ]; then
-    for key in NACOS_SERVER_ADDR NACOS_USERNAME NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
+    for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_USERNAME OVERSEAS_NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
       if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
         echo "部署海外服务时，环境文件必须包含非空 $key" >&2
         exit 2
@@ -188,6 +188,10 @@ if [ "$SERVICE" = "file" ]; then
     echo "开发环境部署 file 服务时 MQ_TOPIC_PREFIX 必须非空且不能使用 test-" >&2
     exit 2
   fi
+  if [ "$DEPLOY_ENV" = "production" ] && [ -n "$MQ_PREFIX" ]; then
+    echo "生产环境部署 file 服务时 MQ_TOPIC_PREFIX 必须为空，使用正式 Topic" >&2
+    exit 2
+  fi
 fi
 
 : "${REGISTRY_USER:?REGISTRY_USER 未设置}"
@@ -505,7 +509,7 @@ if [ "$new_started" = "true" ] && wait_for_health; then
 fi
 
 echo "新镜像健康检查失败: $new_image" >&2
-failed_container_id="$(remote_container_id || true)"
+failed_container_id="$(container_id || true)"
 if [ -n "$failed_container_id" ]; then
   echo "新镜像容器最近日志（最多 200 行）:" >&2
   docker logs --tail 200 "$failed_container_id" 2>&1 || true

deploy/scripts/deploy-services.sh

@@ -72,7 +72,7 @@ else
 fi
 
 if [ "$DEPLOY_REGION" = "OVERSEAS" ]; then
-  for key in NACOS_SERVER_ADDR NACOS_USERNAME NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
+  for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_USERNAME OVERSEAS_NACOS_PASSWORD OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
     if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
       echo "部署海外服务时，环境文件必须包含非空 $key" >&2
       exit 2

scripts/overseas-deployment-contract.test.mjs

@@ -66,9 +66,8 @@ test('service map freezes unique internal ports and moves event bridge away from
 test('overseas compose is isolated from CN defaults and disables implicit schema execution', async () => {
   const compose = await read('deploy/docker-compose.overseas.yml')
   assert.match(compose, /^name: firstleg-\$\{DEPLOY_ENV:-test\}-overseas$/m)
-  assert.match(compose, /NACOS_USERNAME: \$\{NACOS_USERNAME\}/)
+  assert.match(compose, /NACOS_USERNAME: \$\{OVERSEAS_NACOS_USERNAME\}/)
-  assert.match(compose, /NACOS_PASSWORD: \$\{NACOS_PASSWORD\}/)
+  assert.match(compose, /NACOS_PASSWORD: \$\{OVERSEAS_NACOS_PASSWORD\}/)
-  assert.doesNotMatch(compose, /OVERSEAS_NACOS_(?:USERNAME|PASSWORD)/)
   assert.match(compose, /NACOS_NAMESPACE: \$\{OVERSEAS_NACOS_NAMESPACE:-prod-overseas\}/)
   assert.match(compose, /REGION_CODE: OVERSEAS/)
   assert.match(compose, /SPRING_SQL_INIT_MODE: never/)

scripts/test-environment-pipeline-contract.test.mjs

@@ -76,6 +76,9 @@ test('production deployments cannot skip tests', () => {
   assert.match(coordinatorPipeline, /env\.RESOLVED_ENVIRONMENT == 'production' && params\.SKIP_TESTS/)
   assert.match(coordinatorPipeline, /error\('生产环境禁止跳过测试'\)/)
   assert.match(pipeline, /生产环境手工构建禁止跳过测试/)
+  assert.match(coordinatorPipeline, /refs\/heads\/main:refs\/remotes\/origin\/main/)
+  assert.match(coordinatorPipeline, /test "\$\(git rev-parse HEAD\)" = "\$\(git rev-parse origin\/main\)"/)
+  assert.match(pipeline, /git merge-base --is-ancestor "\$\{RESOLVED_SOURCE_COMMIT\}" origin\/main/)
 })
 
 test('Java builds use the shared builder pool and serialize incremental target deployments', () => {
@@ -86,7 +89,9 @@ test('Java builds use the shared builder pool and serialize incremental target d
   assert.match(pipeline, /String deploySlotLabel = "firstleg-\$\{env\.RESOLVED_ENVIRONMENT\}-deploy-slot"/)
   assert.match(pipeline, /lock\(label: deploySlotLabel, quantity: 1, inversePrecedence: true\)/)
   assert.match(pipeline, /deploy-built-service\.sh/)
-  assert.doesNotMatch(pipeline, /dev_deploy|test_deploy|TARGET_SSH_KEY/)
+  assert.doesNotMatch(pipeline, /dev_deploy|test_deploy/)
+  assert.match(pipeline, /firstleg-production-ssh/)
+  assert.match(pipeline, /TARGET_SSH_KEY/)
   assert.match(directDeployScript, /docker pull "\$IMAGE"/)
   assert.match(directDeployScript, /run_ssh docker pull "\$IMAGE"/)
   assert.doesNotMatch(directDeployScript, /docker save "\$IMAGE"/)
@@ -195,12 +200,12 @@ test('shared builders use a reachable public Maven mirror instead of the retired
   assert.doesNotMatch(ciMavenSettings, /:18081/)
 })
 
-test('Java service images use the internal registry base image by default', () => {
+test('Java service images use the canonical Gitea registry base image by default', () => {
-  const internalBaseImage = '172.31.198.7:10082/java-project/eclipse-temurin:17-jre-alpine'
+  const internalBaseImage = 'git.buggoglobal.com/java-project/eclipse-temurin:17-jre-alpine'
 
   assert.match(coordinatorPipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
   assert.match(pipeline, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
-  assert.match(serviceDockerfile, new RegExp(internalBaseImage.replaceAll('.', '\\.')))
+  assert.match(serviceDockerfile, /ARG BASE_IMAGE/)
   assert.doesNotMatch(coordinatorPipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)
   assert.doesNotMatch(pipeline, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)
   assert.doesNotMatch(serviceDockerfile, /docker\.m\.daocloud\.io\/library\/eclipse-temurin/)