From adb1328b75e1a2bceac8b4bc7d9c7d598117a24e Mon Sep 17 00:00:00 2001 From: dafe Date: Tue, 10 Nov 2026 14:46:47 +0800 Subject: [PATCH] =?UTF-8?q?feat(ci):=20=E8=AF=95=E7=82=B9=E8=A7=84?= =?UTF-8?q?=E8=8C=83=202=EF=BC=88test=20=E2=86=92=20LAN=20=E2=86=92=20?= =?UTF-8?q?=E6=89=8B=E5=8A=A8=20ubuntu2=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../deploy-cloud.yml | 0 .../deploy-lan.yml | 0 .gitea/workflows/deploy.yml | 146 ++++++++++++++++++ ci/test.sh | 26 ++++ deploy/cloud.sh | 48 ++++++ deploy/health-cloud.sh | 8 + deploy/health-lan.sh | 13 ++ deploy/lan.sh | 30 ++++ 8 files changed, 271 insertions(+) rename .gitea/{workflows => workflows-disabled}/deploy-cloud.yml (100%) rename .gitea/{workflows => workflows-disabled}/deploy-lan.yml (100%) create mode 100644 .gitea/workflows/deploy.yml create mode 100755 ci/test.sh create mode 100755 deploy/cloud.sh create mode 100755 deploy/health-cloud.sh create mode 100755 deploy/health-lan.sh create mode 100755 deploy/lan.sh diff --git a/.gitea/workflows/deploy-cloud.yml b/.gitea/workflows-disabled/deploy-cloud.yml similarity index 100% rename from .gitea/workflows/deploy-cloud.yml rename to .gitea/workflows-disabled/deploy-cloud.yml diff --git a/.gitea/workflows/deploy-lan.yml b/.gitea/workflows-disabled/deploy-lan.yml similarity index 100% rename from .gitea/workflows/deploy-lan.yml rename to .gitea/workflows-disabled/deploy-lan.yml diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml new file mode 100644 index 0000000..7797795 --- /dev/null +++ b/.gitea/workflows/deploy.yml @@ -0,0 +1,146 @@ +# standard: 2 @ v1 +# ============================================================================= +# CI/CD 规范 2：push → 局域网自动发布；云端（ubuntu2）手动确认后发布 +# +# 必需 hook：ci/test.sh、deploy/lan.sh、deploy/cloud.sh +# 可选 hook：deploy/health-lan.sh、deploy/health-cloud.sh +# +# 本文件是完整可执行版本。项目侧复制到 .gitea/workflows/deploy.yml， +# 只改这一行版本号，不要改正文。 +# +# 边界：云端只写 ubuntu2（101.133.145.181），不切 DNS、不碰 ShannonProd。 +# 验证必须用 --resolve 指向 ubuntu2，不能依赖公网 DNS 当前指向。 +# +# Gitea 1.24 忽略 concurrency / timeout-minutes / environment， +# 因此串行依赖 deploy-runner capacity=1，超时由 shell timeout 控制。 +# ============================================================================= +name: CI-CD-2 + +on: + push: + pull_request: + workflow_dispatch: + inputs: + ref: + description: "要发布的 commit/tag（留空 = 当前 main HEAD）" + required: false + default: "" + +env: + GITEA_URL: ${{ github.server_url }} + GITEA_REPO: ${{ github.repository }} + GITEA_SHA: ${{ github.sha }} + GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }} + CLOUD_TARGET: ubuntu2 + +jobs: + test: + name: test + runs-on: build-runner + steps: + - name: 拉取源码 + env: + INPUT_REF: ${{ inputs.ref }} + run: | + set -euo pipefail + # 手动发布/回滚时测的是目标 ref，不是当前 main HEAD；门禁不能被绕过 + TEST_REF="${INPUT_REF:-$GITEA_SHA}" + echo "TEST_REF=${TEST_REF}" + curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \ + "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TEST_REF}.tar.gz" \ + -o /tmp/src.tar.gz + rm -rf /src && mkdir -p /src + tar xzf /tmp/src.tar.gz -C /src --strip-components=1 + + - name: 质量门禁（强制） + working-directory: /src + run: | + set -euo pipefail + [ -f ci/test.sh ] || { echo "缺少 ci/test.sh（规范 2 强制）"; exit 1; } + timeout 1800 bash ci/test.sh + + deploy-lan: + name: deploy-lan + needs: test + # 手动 dispatch 也必须有 test 成功，不允许绕过门禁。 + if: >- + always() && needs.test.result == 'success' && ( + (github.event_name == 'push' && github.ref == 'refs/heads/main') + || github.event_name == 'workflow_dispatch' + ) + runs-on: deploy-runner + env: + DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} + CLOUD_SSH_KEY: ${{ secrets.CLOUD_SSH_KEY }} + steps: + - name: 拉取待发布版本 + env: + INPUT_REF: ${{ inputs.ref }} + run: | + set -euo pipefail + TARGET_REF="${INPUT_REF:-$GITEA_SHA}" + echo "TARGET_REF=${TARGET_REF}" >> "$GITHUB_ENV" + curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \ + "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TARGET_REF}.tar.gz" \ + -o /tmp/src.tar.gz + rm -rf /src && mkdir -p /src + tar xzf /tmp/src.tar.gz -C /src --strip-components=1 + + - name: 局域网部署 + working-directory: /src + run: | + set -euo pipefail + [ -f deploy/lan.sh ] || { echo "缺少 deploy/lan.sh（规范 2 强制）"; exit 1; } + timeout 1800 bash deploy/lan.sh + + - name: 局域网健康检查 + working-directory: /src + run: | + set -euo pipefail + if [ -f deploy/health-lan.sh ]; then + timeout 300 bash deploy/health-lan.sh + else + echo "INFO: 无 deploy/health-lan.sh，跳过" + fi + + deploy-cloud: + name: deploy-cloud + needs: deploy-lan + # 只有人工点 Run workflow 才会进入；push 永远不自动上云 + if: >- + always() && github.event_name == 'workflow_dispatch' + && needs.deploy-lan.result == 'success' + runs-on: deploy-runner + env: + DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} + CLOUD_SSH_KEY: ${{ secrets.CLOUD_SSH_KEY }} + steps: + - name: 拉取待发布版本 + env: + INPUT_REF: ${{ inputs.ref }} + run: | + set -euo pipefail + TARGET_REF="${INPUT_REF:-$GITEA_SHA}" + echo "TARGET_REF=${TARGET_REF}" >> "$GITHUB_ENV" + curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \ + "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TARGET_REF}.tar.gz" \ + -o /tmp/src.tar.gz + rm -rf /src && mkdir -p /src + tar xzf /tmp/src.tar.gz -C /src --strip-components=1 + + - name: 云端部署（人工确认后） + working-directory: /src + run: | + set -euo pipefail + [ -f deploy/cloud.sh ] || { echo "缺少 deploy/cloud.sh（规范 2 强制）"; exit 1; } + timeout 1800 bash deploy/cloud.sh ubuntu2 + + - name: 云端健康检查 + working-directory: /src + run: | + set -euo pipefail + if [ -f deploy/health-cloud.sh ]; then + timeout 300 bash deploy/health-cloud.sh + else + echo "INFO: 无 deploy/health-cloud.sh，跳过" + fi diff --git a/ci/test.sh b/ci/test.sh new file mode 100755 index 0000000..42789cc --- /dev/null +++ b/ci/test.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash +# 静态站门禁：关键文件存在 + HTML 引用的本地资源都存在 +set -euo pipefail +cd "$(dirname "$0")/.." + +for file in index.html robots.txt sitemap.xml llms.txt assets/css/style.css assets/js/main.js; do + [ -f "$file" ] || { echo "缺少 $file"; exit 1; } +done + +grep -q 'assets/css/style.css?v=' index.html || { echo "index.html 缺少 CSS 版本参数"; exit 1; } +grep -q 'assets/js/main.js?v=' index.html || { echo "index.html 缺少 JS 版本参数"; exit 1; } + +python3 - <<'PY' +import os +import re +import sys + +html = open("index.html", encoding="utf-8").read() +refs = set(re.findall(r'(?:src|href)="(assets/[^"]+)"', html)) +missing = sorted(ref for ref in refs if not os.path.exists(ref.split("?")[0])) +if missing: + print("index.html 引用了不存在的资源:") + print("\n".join(missing)) + sys.exit(1) +print(f"资源引用检查通过（{len(refs)} 个）") +PY diff --git a/deploy/cloud.sh b/deploy/cloud.sh new file mode 100755 index 0000000..341cd14 --- /dev/null +++ b/deploy/cloud.sh @@ -0,0 +1,48 @@ +#!/usr/bin/env bash +# 发布到 ubuntu2（101.133.145.181:/var/www/shashann-homepage） +# 注意：不切 DNS、不碰 ShannonProd；公网验证用 health-cloud.sh 的 --resolve。 +set -euo pipefail +cd "$(dirname "$0")/.." + +TARGET="${1:-}" +case "$TARGET" in + ubuntu2) + SSH_HOST="root@101.133.145.181" + DEPLOY_DIR="/var/www/shashann-homepage" + ;; + *) + echo "不支持的目标: $TARGET" + exit 1 + ;; +esac + +# 手动发布按 tag 注入版本；普通提交按短 SHA +VERSION="${TARGET_REF:-$GITEA_SHA}" +if printf '%s' "$VERSION" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then + VERSION="${VERSION#v}" +else + VERSION="${GITEA_SHA:0:8}" +fi + +python3 - "$VERSION" <<'PY' +import re +import sys + +version = sys.argv[1] +path = "index.html" +html = open(path, encoding="utf-8").read() +html = re.sub(r'(assets/css/style\.css)\?v=[^"\']*', r"\1?v=" + version, html) +html = re.sub(r'(assets/js/main\.js)\?v=[^"\']*', r"\1?v=" + version, html) +open(path, "w", encoding="utf-8").write(html) +PY + +mkdir -p ~/.ssh && chmod 700 ~/.ssh +printf '%s\n' "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY 未配置}" > ~/.ssh/id_ed25519 +chmod 600 ~/.ssh/id_ed25519 +ssh-keyscan -H 101.133.145.181 >> ~/.ssh/known_hosts 2>/dev/null || true + +ssh "$SSH_HOST" "mkdir -p ${DEPLOY_DIR} && find ${DEPLOY_DIR} -mindepth 1 -maxdepth 1 -exec rm -rf {} +" +tar czf - index.html assets robots.txt sitemap.xml llms.txt \ + | ssh "$SSH_HOST" "tar xzf - -C ${DEPLOY_DIR}" + +echo "ubuntu2 已发布 ${VERSION}" diff --git a/deploy/health-cloud.sh b/deploy/health-cloud.sh new file mode 100755 index 0000000..390f4eb --- /dev/null +++ b/deploy/health-cloud.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash +# 只验证 ubuntu2 上的副本；DNS 当前仍指向 ShannonProd，不能按公网 DNS 判断。 +set -euo pipefail + +curl -skf -m 10 --noproxy '*' \ + --resolve www.shashann.com:443:101.133.145.181 \ + https://www.shashann.com/ > /dev/null +echo "OK ubuntu2 https://www.shashann.com/ (101.133.145.181)" diff --git a/deploy/health-lan.sh b/deploy/health-lan.sh new file mode 100755 index 0000000..bd50b4f --- /dev/null +++ b/deploy/health-lan.sh @@ -0,0 +1,13 @@ +#!/usr/bin/env bash +set -euo pipefail + +for _ in $(seq 1 10); do + if curl -skf -m 5 --noproxy '*' https://192.168.51.66/homepage/ > /dev/null; then + echo "OK https://192.168.51.66/homepage/" + exit 0 + fi + sleep 3 +done + +echo "FAIL https://192.168.51.66/homepage/" +exit 1 diff --git a/deploy/lan.sh b/deploy/lan.sh new file mode 100755 index 0000000..ea061f6 --- /dev/null +++ b/deploy/lan.sh @@ -0,0 +1,30 @@ +#!/usr/bin/env bash +# 发布到局域网 192.168.51.66:/home/ubuntu/homepage-site +set -euo pipefail +cd "$(dirname "$0")/.." + +STAMP="${GITEA_SHA:0:8}" +[ -n "$STAMP" ] || { echo "GITEA_SHA 为空"; exit 1; } + +python3 - "$STAMP" <<'PY' +import re +import sys + +stamp = sys.argv[1] +path = "index.html" +html = open(path, encoding="utf-8").read() +html = re.sub(r'(assets/css/style\.css)\?v=[^"\']*', r"\1?v=" + stamp, html) +html = re.sub(r'(assets/js/main\.js)\?v=[^"\']*', r"\1?v=" + stamp, html) +open(path, "w", encoding="utf-8").write(html) +PY + +mkdir -p ~/.ssh && chmod 700 ~/.ssh +printf '%s\n' "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY 未配置}" > ~/.ssh/id_ed25519 +chmod 600 ~/.ssh/id_ed25519 +ssh-keyscan -H 192.168.51.66 >> ~/.ssh/known_hosts 2>/dev/null || true + +ssh ubuntu@192.168.51.66 'mkdir -p /home/ubuntu/homepage-site && find /home/ubuntu/homepage-site -mindepth 1 -maxdepth 1 -exec rm -rf {} +' +tar czf - index.html assets robots.txt sitemap.xml llms.txt \ + | ssh ubuntu@192.168.51.66 'tar xzf - -C /home/ubuntu/homepage-site' + +echo "局域网已发布 ${STAMP}"