113 lines
6.2 KiB
YAML
113 lines
6.2 KiB
YAML
name: build
|
||
|
||
# 前端应用 CI（照 notice/front build.yml 模板）：构建 → 打包 zip → 推 Nexus raw → webhook 通知 projman 建档
|
||
# 触发：push 到 main / 手动 Run workflow
|
||
# userhome 应用 deployMode=auto：webhook 建档后 projman 自动发布前端版本（下载 zip → persist → Caddy 切链）
|
||
# 凭据不走仓库 Secrets：runner 与 projman 同机，Nexus 凭据与部署令牌均从宿主 prod.env / projman DB 直读
|
||
# （NEXUS_USER 缺省 admin；DEPLOY_TOKEN = app_identity code=proj11-deploy 的明文，与 webhook 校验同源）
|
||
|
||
on:
|
||
push:
|
||
branches: [ main ]
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
build:
|
||
runs-on: ubuntu-latest
|
||
container:
|
||
image: docker:24
|
||
options: --network infra-infra-net
|
||
steps:
|
||
- name: 安装 git / curl / zip（alpine）
|
||
run: |
|
||
# 统一走 aliyun 源：dl-cdn 时段性被拦会卡满 60s×2（2026-10-20 事故）
|
||
sed -i 's#dl-cdn.alpinelinux.org#mirrors.aliyun.com#g' /etc/apk/repositories
|
||
apk add --no-cache git curl zip
|
||
|
||
# 内网 Gitea 无法访问 GitHub 拉 actions/checkout，手动 clone 本仓库
|
||
- name: 拉取源码（内网无 GitHub，手动 clone 本仓库）
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
run: |
|
||
git clone --depth 1 --branch main "http://x-access-token:${GITHUB_TOKEN}@gitea.yunhaixingtong.com/${{ github.repository }}.git" /tmp/src
|
||
cp -a /tmp/src/. .
|
||
rm -rf /tmp/src
|
||
COMMIT_MSG=$(git log -1 --pretty=%s | tr '\n' ' ' | sed 's/["\\]/ /g' | cut -c1-200)
|
||
echo "COMMIT_MSG=${COMMIT_MSG}" >> "$GITHUB_ENV"
|
||
|
||
# 凭据：宿主 prod.env（Nexus）+ projman DB（部署令牌）；经 docker.sock 起一次性容器读取，不回显
|
||
- name: 读取凭据（prod.env + projman DB）
|
||
run: |
|
||
set -e
|
||
PWD_DB=$(docker run --rm -v /opt/docker/projman-deploy:/pe:ro alpine sh -c "grep '^PROJMAN_DB_PASSWORD=' /pe/prod.env | head -1 | cut -d= -f2-")
|
||
NXUSER=$(docker run --rm -v /opt/docker/projman-deploy:/pe:ro alpine sh -c "grep '^PROJMAN_NEXUS_USER=' /pe/prod.env | head -1 | cut -d= -f2-")
|
||
NXPASS=$(docker run --rm -v /opt/docker/projman-deploy:/pe:ro alpine sh -c "grep '^PROJMAN_NEXUS_PASSWORD=' /pe/prod.env | head -1 | cut -d= -f2-")
|
||
TOKEN=$(docker exec -e MYSQL_PWD="$PWD_DB" mysql8 mysql -uroot -N -e \
|
||
"select secret_text from app_identity where code='proj11-deploy' and purpose='deploy_token' limit 1" bsch_projman \
|
||
| tr -d '[:space:]')
|
||
[ -n "$NXUSER" ] || NXUSER=admin
|
||
[ -n "$NXPASS" ] || { echo 'Nexus 凭据缺失'; exit 1; }
|
||
[ -n "$TOKEN" ] || { echo 'userhome 部署令牌缺失'; exit 1; }
|
||
echo "NEXUS_USER=${NXUSER}" >> "$GITHUB_ENV"
|
||
echo "NEXUS_PASSWORD=${NXPASS}" >> "$GITHUB_ENV"
|
||
echo "DEPLOY_TOKEN=${TOKEN}" >> "$GITHUB_ENV"
|
||
|
||
# 前端构建：独立 node 容器（容器名全局唯一，防并发互踩——2026-09-10 三仓同推事故）
|
||
- name: 构建前端（node 容器）
|
||
run: |
|
||
set -e
|
||
BUILD_CONTAINER="frontbuild-${GITHUB_RUN_ID:-0}-$(date +%s)"
|
||
echo "BUILD_CONTAINER=${BUILD_CONTAINER}"
|
||
docker rm -f "$BUILD_CONTAINER" 2>/dev/null || true
|
||
# npm 缓存落宿主持久目录，跨构建复用（照 notice/service 的 m2 缓存做法）；无此卷则每次从零下载 754 个包
|
||
mkdir -p /opt/docker/projman-npm-cache
|
||
docker run -d --name "$BUILD_CONTAINER" \
|
||
-v /opt/docker/projman-npm-cache:/root/.npm \
|
||
-w /build node:20 sleep 3600
|
||
docker cp "${PWD}/." "$BUILD_CONTAINER":/build/
|
||
docker exec "$BUILD_CONTAINER" sh -c '
|
||
set -e
|
||
cd /build
|
||
# 内网到 registry.npmjs.org 跨境极慢（实测 npm install 12分46秒/754 包），切国内镜像
|
||
npm config set registry https://registry.npmmirror.com
|
||
if [ -f .npmrc ]; then sed -i "/SASS_BINARY_PATH/d" .npmrc; fi
|
||
# 本仓不提交 lock（.gitignore 忽略 yarn.lock/package-lock 均无），npm ci 无 lock 必 EUSAGE——用 install。
|
||
# --ignore-scripts：依赖里的 node-sass@6 是 webpack 遗留（vite 5 实际走 dart-sass），
|
||
# 其 node-gyp 编译在 node:20 无预编译包必炸；esbuild 二进制走 optionalDependencies 不受影响。
|
||
# --prefer-offline：优先用 /root/.npm 缓存，避免重复下载
|
||
npm install --ignore-scripts --no-audit --no-fund --loglevel=error --prefer-offline
|
||
npm run build
|
||
'
|
||
echo "=== dist 产物 ==="
|
||
docker exec "$BUILD_CONTAINER" sh -c 'ls -la /build/dist/ | head -20'
|
||
docker cp "$BUILD_CONTAINER":/build/dist ./dist
|
||
docker rm -f "$BUILD_CONTAINER"
|
||
echo "BUILD CHECK OK"
|
||
|
||
# 打包 dist → zip（vite outDir 直出 dist/，zip 根目录直接是 index.html/css/js）
|
||
- name: 打包产物
|
||
run: |
|
||
TAG=$(echo "$GITHUB_SHA" | cut -c1-8)
|
||
ZIP_FILE="userhome-front-${TAG}.zip"
|
||
cd dist && zip -r "../${ZIP_FILE}" . && cd ..
|
||
echo "ZIP_FILE=${ZIP_FILE}" >> "$GITHUB_ENV"
|
||
echo "TAG=${TAG}" >> "$GITHUB_ENV"
|
||
ls -la "${ZIP_FILE}"
|
||
|
||
- name: 上传产物到 Nexus
|
||
run: |
|
||
set -e
|
||
NEXUS_URL="http://nexus.yunhaixingtong.com:8081/repository/front-hosted/${ZIP_FILE}"
|
||
curl -sSf -X PUT -u "${NEXUS_USER}:${NEXUS_PASSWORD}" --upload-file "${ZIP_FILE}" "${NEXUS_URL}"
|
||
echo "NEXUS_URL=${NEXUS_URL}" >> "$GITHUB_ENV"
|
||
echo "uploaded to ${NEXUS_URL}"
|
||
|
||
# 通知 projman：webhook 建档（type=front）；userhome deployMode=auto → 建档后自动发布
|
||
- name: 通知 projman 建档（auto 发布）
|
||
run: |
|
||
curl -sSf -X POST "http://192.168.10.160:8090/projman/api/deploy/webhook" \
|
||
-H "Content-Type: application/json" \
|
||
-H "X-Deploy-Token: ${DEPLOY_TOKEN}" \
|
||
-d "{\"app\":\"userhome\",\"front\":\"front\",\"tag\":\"${TAG}\",\"sha\":\"${GITHUB_SHA}\",\"message\":\"${COMMIT_MSG}\",\"nexusUrl\":\"${NEXUS_URL}\"}"
|
||
echo "webhook 建档完成，auto 模式将自动发布"
|