init: UserBaseService (backend + deploy + scripts)
This commit is contained in:
chenxing
@@ -0,0 +1,116 @@
|
||||
name: ci-userbase-service
|
||||
|
||||
# 后端标准化 CI：maven 构建 jar -> docker build -> 推 Nexus docker-hosted -> 部署 160
|
||||
# 触发：push 到 main（service 仓库根即后端代码）/ 手动 Run workflow
|
||||
# 依赖仓库 Actions Secrets：NEXUS_USER / NEXUS_PASSWORD（ci-docker 账号，仅 docker-hosted 推送权）
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: 'image tag (default = short sha)'
|
||||
required: false
|
||||
default: 'auto'
|
||||
deploy:
|
||||
description: 'deploy to 160 after build (auto / skip)'
|
||||
required: false
|
||||
default: 'auto'
|
||||
|
||||
jobs:
|
||||
build-and-push:
|
||||
runs-on: ubuntu-latest
|
||||
# docker:24 自带 docker CLI，复用宿主 docker daemon（act_runner v0.6.1 已挂载 docker.sock）。
|
||||
# 切勿再声明 volumes: docker.sock（会报 Duplicate mount point）。
|
||||
container:
|
||||
image: docker:24
|
||||
steps:
|
||||
- name: Install git (alpine)
|
||||
run: apk add --no-cache git
|
||||
|
||||
# 内网 Gitea 无法访问 github.com 拉取 actions/checkout，改为直接 clone 本仓库
|
||||
- name: Checkout (manual, internal Gitea)
|
||||
run: |
|
||||
git clone --depth 1 --branch main http://192.168.10.160:3000/${GITHUB_REPOSITORY}.git /tmp/src
|
||||
cp -a /tmp/src/. .
|
||||
rm -rf /tmp/src
|
||||
|
||||
- name: Compute image tag
|
||||
id: meta
|
||||
run: |
|
||||
if [ "${{ inputs.tag }}" = "auto" ] || [ -z "${{ inputs.tag }}" ]; then
|
||||
echo "tag=$(echo ${GITHUB_SHA} | cut -c1-7)" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Build jar with Maven
|
||||
run: |
|
||||
# job 容器经 docker.sock 调宿主 docker daemon，故 docker run -v 路径按宿主解析；
|
||||
# act 工作区是宿主 docker volume，容器内 $PWD 对宿主不可见，直接 -v $PWD:/build 会绑空目录。
|
||||
# 故改为：起 maven 容器 -> docker cp 源码入容器 -> exec 构建 -> cp 产物回工作区。
|
||||
# mavenbuild 加入 infra-infra-net，用容器名 nexus 直连 Nexus(8081 maven-public)。
|
||||
# 先清理上次失败残留的同名容器
|
||||
docker rm -f mavenbuild 2>/dev/null || true
|
||||
docker run -d --name mavenbuild \
|
||||
--network infra-infra-net \
|
||||
-v /opt/docker/ubs-m2:/root/.m2 \
|
||||
-w /build maven:3.6.3-jdk-8 sleep 3600
|
||||
docker cp "${PWD}/." mavenbuild:/build/
|
||||
# settings.xml：新增 profile 把 nexus:8081 maven-public 作为额外仓库（infra-infra-net 内容器名直连）。
|
||||
# 不用 mirror(external:http:*)：对 BOM import 解析未生效；profile 方式更可靠。
|
||||
docker exec mavenbuild sh -c "printf '%s' '<settings><profiles><profile><id>nexus-repo</id><repositories><repository><id>nexus-internal</id><url>http://nexus:8081/repository/maven-public/</url><releases><enabled>true</enabled></releases><snapshots><enabled>true</enabled><updatePolicy>always</updatePolicy></snapshots></repository></repositories></profile></profiles><activeProfiles><activeProfile>nexus-repo</activeProfile></activeProfiles></settings>' > /root/.m2/settings.xml"
|
||||
# 仅清旧 yh-auth 缓存（含 08-05 local install 的 maven-metadata-local.xml）；BOM 等其它模块保留缓存。
|
||||
docker exec mavenbuild rm -rf /root/.m2/repository/com/yunhai/platform/yh-auth-spring-boot-starter
|
||||
docker exec mavenbuild sh -c 'cd /build && mvn -U -B -DskipTests clean package'
|
||||
mkdir -p "${PWD}/target"
|
||||
docker cp mavenbuild:/build/target/userbase.jar "${PWD}/target/userbase.jar"
|
||||
docker rm -f mavenbuild
|
||||
|
||||
- name: Login to Nexus docker registry
|
||||
run: echo "${{ secrets.NEXUS_PASSWORD }}" | docker login nexus:8083 -u ${{ secrets.NEXUS_USER }} --password-stdin
|
||||
|
||||
- name: Build image
|
||||
run: docker build -t nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }} -f docker/Dockerfile .
|
||||
|
||||
- name: Push image
|
||||
run: docker push nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}
|
||||
|
||||
- name: Report build
|
||||
run: echo "pushed nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}"
|
||||
|
||||
# 部署阶段（仅在 push 或手动 dispatch deploy=auto 时执行），运行在 160 的 act_runner 上。
|
||||
- name: Deploy (pull + rollout with rollback)
|
||||
if: github.event_name == 'push' || inputs.deploy == 'auto'
|
||||
run: |
|
||||
set +e
|
||||
IMG=nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}
|
||||
echo "deploying $IMG"
|
||||
echo "${{ secrets.NEXUS_PASSWORD }}" | docker login nexus:8083 -u ${{ secrets.NEXUS_USER }} --password-stdin
|
||||
docker pull "$IMG"
|
||||
RB=userbase-service:rb-$(date +%s)
|
||||
docker tag userbase-service:latest "$RB" 2>/dev/null || true
|
||||
docker stop userbase-service 2>/dev/null; docker rm -f userbase-service 2>/dev/null
|
||||
# SCA 2.2.4 坑: 命名空间必须用 SPRING_CLOUD_NACOS_CONFIG_NAMESPACE；
|
||||
# 凭据必须放顶层 SPRING_CLOUD_NACOS_USERNAME/PASSWORD。
|
||||
docker run -d --name userbase-service --restart unless-stopped --network infra-infra-net -p 8060:8060 \
|
||||
-e NACOS_ADDR=nacos:8848 \
|
||||
-e SPRING_CLOUD_NACOS_CONFIG_NAMESPACE=6196f0de-a28d-4894-8f10-e2982b57c6bc \
|
||||
-e SPRING_CLOUD_NACOS_USERNAME=yh-reader \
|
||||
-e SPRING_CLOUD_NACOS_PASSWORD=123456 \
|
||||
"$IMG"
|
||||
OK=0
|
||||
for i in $(seq 1 30); do
|
||||
sleep 5
|
||||
CODE=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8060/userbase/ 2>/dev/null || true)
|
||||
if [ "$CODE" != "000" ]; then OK=1; break; fi
|
||||
done
|
||||
if [ "$OK" = "0" ]; then
|
||||
echo "!! UNHEALTHY -> rollback to userbase-service:latest"
|
||||
docker stop userbase-service 2>/dev/null; docker rm -f userbase-service 2>/dev/null
|
||||
docker run -d --name userbase-service --restart unless-stopped --network infra-infra-net -p 8060:8060 userbase-service:latest
|
||||
echo "rolled back"; exit 7
|
||||
fi
|
||||
echo "DEPLOY OK: $IMG"
|
||||
docker tag "$IMG" userbase-service:latest
|
||||
docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' | grep userbase || true
|
||||
Reference in New Issue
Block a user