feat(ci): 试点规范 2（test → LAN → 手动 ubuntu2）

.gitea/workflows-disabled/deploy-cloud.yml

@@ -1,22 +1,34 @@
 name: 发布-云端
-# 审核 = 人工决定打不打 tag：push v* 标签即发布公网
+# 审核 = 人工在 Gitea Actions 点 Run workflow，填入已推送的 tag 版本 → 部署公网
 # 发布历史 = git tag 列表（git tag -l 'v*'），发布版本号 = tag 名
 on:
-  push:
+  workflow_dispatch:
-    tags: ['v*']
+    inputs:
+      version:
+        description: '发布版本（已推送的 tag，如 v1.0.4）'
+        required: true
 
 jobs:
   deploy:
     runs-on: build-runner
+    env:
+      VERSION: ${{ inputs.version }}
     steps:
+      - name: 校验版本号
+        run: |
+          if ! printf '%s' "$VERSION" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "❌ 版本号格式应为 vX.Y.Z，例如 v1.0.4"
+            exit 1
+          fi
+
       - name: 拉取代码（tag 版本）
         run: |
-          git clone --depth 1 --branch "${GITHUB_REF_NAME}" "http://dafe:${{ secrets.GITHUB_TOKEN }}@192.168.51.66:3000/dafe/homepage.git" site
+          git clone --depth 1 --branch "$VERSION" "http://dafe:${{ secrets.GITHUB_TOKEN }}@192.168.51.66:3000/dafe/homepage.git" site
 
       - name: 注入发布版本号（缓存击穿，版本=tag 名）
         run: |
           cd site
-          sed -i "s/?v=[0-9]*/?v=${GITHUB_REF_NAME}/g" index.html
+          sed -i "s/?v=[0-9]*/?v=${VERSION}/g" index.html
 
       - name: 发布到 ubuntu2（阿里云正式机，公网 www.shashann.com）
         env:
@@ -32,5 +44,5 @@ jobs:
 
       - name: 上线验证
         run: |
-          curl -s -f -o /dev/null --resolve www.shashann.com:443:101.133.145.181 https://www.shashann.com/ || { echo "❌ 公网验证失败"; exit 1; }
+          curl -s -f -o /dev/null --noproxy '*' --resolve www.shashann.com:443:101.133.145.181 https://www.shashann.com/ || { echo "❌ 公网验证失败"; exit 1; }
-          echo "✅ 云端已发布 ${GITHUB_REF_NAME} $(date '+%H:%M:%S')"
+          echo "✅ 云端已发布 ${VERSION} $(date '+%H:%M:%S')"

.gitea/workflows/deploy.yml

@@ -0,0 +1,146 @@
+# standard: 2 @ v1
+# =============================================================================
+# CI/CD 规范 2：push → 局域网自动发布；云端（ubuntu2）手动确认后发布
+#
+# 必需 hook：ci/test.sh、deploy/lan.sh、deploy/cloud.sh
+# 可选 hook：deploy/health-lan.sh、deploy/health-cloud.sh
+#
+# 本文件是完整可执行版本。项目侧复制到 .gitea/workflows/deploy.yml，
+# 只改这一行版本号，不要改正文。
+#
+# 边界：云端只写 ubuntu2（101.133.145.181），不切 DNS、不碰 ShannonProd。
+# 验证必须用 --resolve 指向 ubuntu2，不能依赖公网 DNS 当前指向。
+#
+# Gitea 1.24 忽略 concurrency / timeout-minutes / environment，
+# 因此串行依赖 deploy-runner capacity=1，超时由 shell timeout 控制。
+# =============================================================================
+name: CI-CD-2
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "要发布的 commit/tag（留空 = 当前 main HEAD）"
+        required: false
+        default: ""
+
+env:
+  GITEA_URL: ${{ github.server_url }}
+  GITEA_REPO: ${{ github.repository }}
+  GITEA_SHA: ${{ github.sha }}
+  GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  CLOUD_TARGET: ubuntu2
+
+jobs:
+  test:
+    name: test
+    runs-on: build-runner
+    steps:
+      - name: 拉取源码
+        env:
+          INPUT_REF: ${{ inputs.ref }}
+        run: |
+          set -euo pipefail
+          # 手动发布/回滚时测的是目标 ref，不是当前 main HEAD；门禁不能被绕过
+          TEST_REF="${INPUT_REF:-$GITEA_SHA}"
+          echo "TEST_REF=${TEST_REF}"
+          curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TEST_REF}.tar.gz" \
+            -o /tmp/src.tar.gz
+          rm -rf /src && mkdir -p /src
+          tar xzf /tmp/src.tar.gz -C /src --strip-components=1
+
+      - name: 质量门禁（强制）
+        working-directory: /src
+        run: |
+          set -euo pipefail
+          [ -f ci/test.sh ] || { echo "缺少 ci/test.sh（规范 2 强制）"; exit 1; }
+          timeout 1800 bash ci/test.sh
+
+  deploy-lan:
+    name: deploy-lan
+    needs: test
+    # 手动 dispatch 也必须有 test 成功，不允许绕过门禁。
+    if: >-
+      always() && needs.test.result == 'success' && (
+        (github.event_name == 'push' && github.ref == 'refs/heads/main')
+        || github.event_name == 'workflow_dispatch'
+      )
+    runs-on: deploy-runner
+    env:
+      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+      CLOUD_SSH_KEY: ${{ secrets.CLOUD_SSH_KEY }}
+    steps:
+      - name: 拉取待发布版本
+        env:
+          INPUT_REF: ${{ inputs.ref }}
+        run: |
+          set -euo pipefail
+          TARGET_REF="${INPUT_REF:-$GITEA_SHA}"
+          echo "TARGET_REF=${TARGET_REF}" >> "$GITHUB_ENV"
+          curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TARGET_REF}.tar.gz" \
+            -o /tmp/src.tar.gz
+          rm -rf /src && mkdir -p /src
+          tar xzf /tmp/src.tar.gz -C /src --strip-components=1
+
+      - name: 局域网部署
+        working-directory: /src
+        run: |
+          set -euo pipefail
+          [ -f deploy/lan.sh ] || { echo "缺少 deploy/lan.sh（规范 2 强制）"; exit 1; }
+          timeout 1800 bash deploy/lan.sh
+
+      - name: 局域网健康检查
+        working-directory: /src
+        run: |
+          set -euo pipefail
+          if [ -f deploy/health-lan.sh ]; then
+            timeout 300 bash deploy/health-lan.sh
+          else
+            echo "INFO: 无 deploy/health-lan.sh，跳过"
+          fi
+
+  deploy-cloud:
+    name: deploy-cloud
+    needs: deploy-lan
+    # 只有人工点 Run workflow 才会进入；push 永远不自动上云
+    if: >-
+      always() && github.event_name == 'workflow_dispatch'
+      && needs.deploy-lan.result == 'success'
+    runs-on: deploy-runner
+    env:
+      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+      CLOUD_SSH_KEY: ${{ secrets.CLOUD_SSH_KEY }}
+    steps:
+      - name: 拉取待发布版本
+        env:
+          INPUT_REF: ${{ inputs.ref }}
+        run: |
+          set -euo pipefail
+          TARGET_REF="${INPUT_REF:-$GITEA_SHA}"
+          echo "TARGET_REF=${TARGET_REF}" >> "$GITHUB_ENV"
+          curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TARGET_REF}.tar.gz" \
+            -o /tmp/src.tar.gz
+          rm -rf /src && mkdir -p /src
+          tar xzf /tmp/src.tar.gz -C /src --strip-components=1
+
+      - name: 云端部署（人工确认后）
+        working-directory: /src
+        run: |
+          set -euo pipefail
+          [ -f deploy/cloud.sh ] || { echo "缺少 deploy/cloud.sh（规范 2 强制）"; exit 1; }
+          timeout 1800 bash deploy/cloud.sh ubuntu2
+
+      - name: 云端健康检查
+        working-directory: /src
+        run: |
+          set -euo pipefail
+          if [ -f deploy/health-cloud.sh ]; then
+            timeout 300 bash deploy/health-cloud.sh
+          else
+            echo "INFO: 无 deploy/health-cloud.sh，跳过"
+          fi

ci/test.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# 静态站门禁：关键文件存在 + HTML 引用的本地资源都存在
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+for file in index.html robots.txt sitemap.xml llms.txt assets/css/style.css assets/js/main.js; do
+  [ -f "$file" ] || { echo "缺少 $file"; exit 1; }
+done
+
+grep -q 'assets/css/style.css?v=' index.html || { echo "index.html 缺少 CSS 版本参数"; exit 1; }
+grep -q 'assets/js/main.js?v=' index.html || { echo "index.html 缺少 JS 版本参数"; exit 1; }
+
+python3 - <<'PY'
+import os
+import re
+import sys
+
+html = open("index.html", encoding="utf-8").read()
+refs = set(re.findall(r'(?:src|href)="(assets/[^"]+)"', html))
+missing = sorted(ref for ref in refs if not os.path.exists(ref.split("?")[0]))
+if missing:
+    print("index.html 引用了不存在的资源:")
+    print("\n".join(missing))
+    sys.exit(1)
+print(f"资源引用检查通过（{len(refs)} 个）")
+PY

deploy/cloud.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# 发布到 ubuntu2（101.133.145.181:/var/www/shashann-homepage）
+# 注意：不切 DNS、不碰 ShannonProd；公网验证用 health-cloud.sh 的 --resolve。
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+TARGET="${1:-}"
+case "$TARGET" in
+  ubuntu2)
+    SSH_HOST="root@101.133.145.181"
+    DEPLOY_DIR="/var/www/shashann-homepage"
+    ;;
+  *)
+    echo "不支持的目标: $TARGET"
+    exit 1
+    ;;
+esac
+
+# 手动发布按 tag 注入版本；普通提交按短 SHA
+VERSION="${TARGET_REF:-$GITEA_SHA}"
+if printf '%s' "$VERSION" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+  VERSION="${VERSION#v}"
+else
+  VERSION="${GITEA_SHA:0:8}"
+fi
+
+python3 - "$VERSION" <<'PY'
+import re
+import sys
+
+version = sys.argv[1]
+path = "index.html"
+html = open(path, encoding="utf-8").read()
+html = re.sub(r'(assets/css/style\.css)\?v=[^"\']*', r"\1?v=" + version, html)
+html = re.sub(r'(assets/js/main\.js)\?v=[^"\']*', r"\1?v=" + version, html)
+open(path, "w", encoding="utf-8").write(html)
+PY
+
+mkdir -p ~/.ssh && chmod 700 ~/.ssh
+printf '%s\n' "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY 未配置}" > ~/.ssh/id_ed25519
+chmod 600 ~/.ssh/id_ed25519
+ssh-keyscan -H 101.133.145.181 >> ~/.ssh/known_hosts 2>/dev/null || true
+
+ssh "$SSH_HOST" "mkdir -p ${DEPLOY_DIR} && find ${DEPLOY_DIR} -mindepth 1 -maxdepth 1 -exec rm -rf {} +"
+tar czf - index.html assets robots.txt sitemap.xml llms.txt \
+  | ssh "$SSH_HOST" "tar xzf - -C ${DEPLOY_DIR}"
+
+echo "ubuntu2 已发布 ${VERSION}"

deploy/health-cloud.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# 只验证 ubuntu2 上的副本；DNS 当前仍指向 ShannonProd，不能按公网 DNS 判断。
+set -euo pipefail
+
+curl -skf -m 10 --noproxy '*' \
+  --resolve www.shashann.com:443:101.133.145.181 \
+  https://www.shashann.com/ > /dev/null
+echo "OK ubuntu2 https://www.shashann.com/ (101.133.145.181)"

deploy/health-lan.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for _ in $(seq 1 10); do
+  if curl -skf -m 5 --noproxy '*' https://192.168.51.66/homepage/ > /dev/null; then
+    echo "OK https://192.168.51.66/homepage/"
+    exit 0
+  fi
+  sleep 3
+done
+
+echo "FAIL https://192.168.51.66/homepage/"
+exit 1

deploy/lan.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# 发布到局域网 192.168.51.66:/home/ubuntu/homepage-site
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+STAMP="${GITEA_SHA:0:8}"
+[ -n "$STAMP" ] || { echo "GITEA_SHA 为空"; exit 1; }
+
+python3 - "$STAMP" <<'PY'
+import re
+import sys
+
+stamp = sys.argv[1]
+path = "index.html"
+html = open(path, encoding="utf-8").read()
+html = re.sub(r'(assets/css/style\.css)\?v=[^"\']*', r"\1?v=" + stamp, html)
+html = re.sub(r'(assets/js/main\.js)\?v=[^"\']*', r"\1?v=" + stamp, html)
+open(path, "w", encoding="utf-8").write(html)
+PY
+
+mkdir -p ~/.ssh && chmod 700 ~/.ssh
+printf '%s\n' "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY 未配置}" > ~/.ssh/id_ed25519
+chmod 600 ~/.ssh/id_ed25519
+ssh-keyscan -H 192.168.51.66 >> ~/.ssh/known_hosts 2>/dev/null || true
+
+ssh ubuntu@192.168.51.66 'mkdir -p /home/ubuntu/homepage-site && find /home/ubuntu/homepage-site -mindepth 1 -maxdepth 1 -exec rm -rf {} +'
+tar czf - index.html assets robots.txt sitemap.xml llms.txt \
+  | ssh ubuntu@192.168.51.66 'tar xzf - -C /home/ubuntu/homepage-site'
+
+echo "局域网已发布 ${STAMP}"

tools/finish-feature.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# 在 feature 分支上执行：合并到 main、推送、删除本地和远端分支
+# 用法：bash tools/finish-feature.sh
+set -euo pipefail
+
+BRANCH=$(git branch --show-current)
+if [[ ! "$BRANCH" =~ ^feature/ ]]; then
+  echo "❌ 当前分支不是 feature/*：${BRANCH}"
+  exit 1
+fi
+
+if ! git diff --quiet || ! git diff --cached --quiet; then
+  echo "❌ 工作区有未提交改动，先提交或暂存"
+  exit 1
+fi
+
+echo "== 合并 ${BRANCH} → main"
+git checkout main
+git pull --ff-only origin main
+git merge --no-ff "$BRANCH" -m "Merge branch '${BRANCH}'"
+git push origin main
+
+echo "== 清理分支 ${BRANCH}"
+git branch -d "$BRANCH"
+if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
+  git push origin --delete "$BRANCH"
+fi
+
+echo "✅ 已合并并清理 ${BRANCH}"