homepage/.gitea/workflows/deploy.yml

# standard: 2 @ v1
# =============================================================================
# CI/CD 规范 2：push → 局域网自动发布；云端（ubuntu2）手动确认后发布
#
# 必需 hook：ci/test.sh、deploy/lan.sh、deploy/cloud.sh
# 可选 hook：deploy/health-lan.sh、deploy/health-cloud.sh
#
# 本文件是完整可执行版本。项目侧复制到 .gitea/workflows/deploy.yml，
# 只改这一行版本号，不要改正文。
#
# 边界：云端只写 ubuntu2（101.133.145.181），不切 DNS、不碰 ShannonProd。
# 验证必须用 --resolve 指向 ubuntu2，不能依赖公网 DNS 当前指向。
#
# Gitea 1.24 忽略 concurrency / timeout-minutes / environment，
# 因此串行依赖 deploy-runner capacity=1，超时由 shell timeout 控制。
# =============================================================================
name: CI-CD-2

on:
  push:
  pull_request:
  workflow_dispatch:
    inputs:
      ref:
        description: "要发布的 commit/tag（留空 = 当前 main HEAD）"
        required: false
        default: ""

env:
  GITEA_URL: ${{ github.server_url }}
  GITEA_REPO: ${{ github.repository }}
  GITEA_SHA: ${{ github.sha }}
  GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  CLOUD_TARGET: ubuntu2

jobs:
  test:
    name: test
    runs-on: build-runner
    steps:
      - name: 拉取源码
        env:
          INPUT_REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          # 手动发布/回滚时测的是目标 ref，不是当前 main HEAD；门禁不能被绕过
          TEST_REF="${INPUT_REF:-$GITEA_SHA}"
          echo "TEST_REF=${TEST_REF}"
          curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
            "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TEST_REF}.tar.gz" \
            -o /tmp/src.tar.gz
          rm -rf /src && mkdir -p /src
          tar xzf /tmp/src.tar.gz -C /src --strip-components=1

      - name: 质量门禁（强制）
        working-directory: /src
        run: |
          set -euo pipefail
          [ -f ci/test.sh ] || { echo "缺少 ci/test.sh（规范 2 强制）"; exit 1; }
          timeout 1800 bash ci/test.sh

  deploy-lan:
    name: deploy-lan
    needs: test
    # 手动 dispatch 也必须有 test 成功，不允许绕过门禁。
    if: >-
      always() && needs.test.result == 'success' && (
        (github.event_name == 'push' && github.ref == 'refs/heads/main')
        || github.event_name == 'workflow_dispatch'
      )
    runs-on: deploy-runner
    env:
      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
      CLOUD_SSH_KEY: ${{ secrets.CLOUD_SSH_KEY }}
    steps:
      - name: 拉取待发布版本
        env:
          INPUT_REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          TARGET_REF="${INPUT_REF:-$GITEA_SHA}"
          echo "TARGET_REF=${TARGET_REF}" >> "$GITHUB_ENV"
          curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
            "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TARGET_REF}.tar.gz" \
            -o /tmp/src.tar.gz
          rm -rf /src && mkdir -p /src
          tar xzf /tmp/src.tar.gz -C /src --strip-components=1

      - name: 局域网部署
        working-directory: /src
        run: |
          set -euo pipefail
          [ -f deploy/lan.sh ] || { echo "缺少 deploy/lan.sh（规范 2 强制）"; exit 1; }
          timeout 1800 bash deploy/lan.sh

      - name: 局域网健康检查
        working-directory: /src
        run: |
          set -euo pipefail
          if [ -f deploy/health-lan.sh ]; then
            timeout 300 bash deploy/health-lan.sh
          else
            echo "INFO: 无 deploy/health-lan.sh，跳过"
          fi

  deploy-cloud:
    name: deploy-cloud
    needs: deploy-lan
    # 只有人工点 Run workflow 才会进入；push 永远不自动上云
    if: >-
      always() && github.event_name == 'workflow_dispatch'
      && needs.deploy-lan.result == 'success'
    runs-on: deploy-runner
    env:
      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
      CLOUD_SSH_KEY: ${{ secrets.CLOUD_SSH_KEY }}
    steps:
      - name: 拉取待发布版本
        env:
          INPUT_REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          TARGET_REF="${INPUT_REF:-$GITEA_SHA}"
          echo "TARGET_REF=${TARGET_REF}" >> "$GITHUB_ENV"
          curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
            "${GITEA_URL}/api/v1/repos/${GITEA_REPO}/archive/${TARGET_REF}.tar.gz" \
            -o /tmp/src.tar.gz
          rm -rf /src && mkdir -p /src
          tar xzf /tmp/src.tar.gz -C /src --strip-components=1

      - name: 云端部署（人工确认后）
        working-directory: /src
        run: |
          set -euo pipefail
          [ -f deploy/cloud.sh ] || { echo "缺少 deploy/cloud.sh（规范 2 强制）"; exit 1; }
          timeout 1800 bash deploy/cloud.sh ubuntu2

      - name: 云端健康检查
        working-directory: /src
        run: |
          set -euo pipefail
          if [ -f deploy/health-cloud.sh ]; then
            timeout 300 bash deploy/health-cloud.sh
          else
            echo "INFO: 无 deploy/health-cloud.sh，跳过"
          fi