8542632cff
CD 修復: - 修復 buildx HTTP vs HTTPS 問題 (insecure registry 設定) - 移除 UAT 環境 (違反 Memory 鐵律) - 新增 Production 部署 Telegram 通知 - 修復 deploy-prod.yml 硬編碼 Token (改用 secrets) docs: - 新增 guidelines/ 結構化指引目錄 - ARCHITECTURE.md, FRONTEND.md, OPERATIONS.md Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
120 lines
4.0 KiB
YAML
120 lines
4.0 KiB
YAML
name: CD
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths-ignore:
|
||
- 'docs/**'
|
||
- '*.md'
|
||
|
||
env:
|
||
REGISTRY: 192.168.0.110:5000
|
||
IMAGE_PREFIX: library/awoooi
|
||
|
||
jobs:
|
||
# ==================== Build & Push Images ====================
|
||
build-images:
|
||
name: Build & Push Images
|
||
runs-on: self-hosted
|
||
strategy:
|
||
matrix:
|
||
app: [web, api]
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@v3
|
||
with:
|
||
# 修復: Harbor 是 HTTP，需要設定 insecure registry
|
||
driver-opts: |
|
||
network=host
|
||
buildkitd-config-inline: |
|
||
[registry."192.168.0.110:5000"]
|
||
http = true
|
||
insecure = true
|
||
|
||
- name: Login to WOOO Harbor
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: ${{ env.REGISTRY }}
|
||
username: ${{ secrets.HARBOR_USER }}
|
||
password: ${{ secrets.HARBOR_PASSWORD }}
|
||
|
||
- name: Generate image tag
|
||
id: tag
|
||
run: |
|
||
SHA=$(git rev-parse --short HEAD)
|
||
RUN_ID=${{ github.run_id }}
|
||
echo "tag=${SHA}-${RUN_ID}" >> $GITHUB_OUTPUT
|
||
|
||
- name: Build & Push to Harbor
|
||
uses: docker/build-push-action@v5
|
||
with:
|
||
context: .
|
||
file: apps/${{ matrix.app }}/Dockerfile
|
||
push: true
|
||
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-${{ matrix.app }}:${{ steps.tag.outputs.tag }}
|
||
cache-from: type=gha
|
||
cache-to: type=gha,mode=max
|
||
|
||
- name: Output image tag
|
||
run: |
|
||
echo "::notice::Image pushed: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-${{ matrix.app }}:${{ steps.tag.outputs.tag }}"
|
||
|
||
# ==================== Deploy to Production ====================
|
||
# Memory 鐵律: 禁止 UAT，只有 Dev + Prod
|
||
deploy-prod:
|
||
name: Deploy to Production
|
||
runs-on: self-hosted
|
||
needs: build-images
|
||
environment: production
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Setup Kubeconfig
|
||
run: |
|
||
mkdir -p ~/.kube
|
||
echo "${{ secrets.KUBE_CONFIG_PROD }}" | base64 -d > ~/.kube/config
|
||
chmod 600 ~/.kube/config
|
||
|
||
- name: Generate image tag
|
||
id: tag
|
||
run: |
|
||
SHA=$(git rev-parse --short HEAD)
|
||
RUN_ID=${{ github.run_id }}
|
||
echo "tag=${SHA}-${RUN_ID}" >> $GITHUB_OUTPUT
|
||
|
||
- name: Deploy with Kustomize
|
||
run: |
|
||
cd k8s/overlays/prod
|
||
kustomize edit set image \
|
||
awoooi-web=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-web:${{ steps.tag.outputs.tag }} \
|
||
awoooi-api=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-api:${{ steps.tag.outputs.tag }}
|
||
kubectl apply -k .
|
||
|
||
- name: Wait for rollout
|
||
run: |
|
||
kubectl rollout status deployment/awoooi-web -n awoooi --timeout=300s
|
||
kubectl rollout status deployment/awoooi-api -n awoooi --timeout=300s
|
||
|
||
- name: Health check
|
||
run: |
|
||
sleep 10
|
||
curl -f https://api.awoooi.wooo.work/api/v1/health || exit 1
|
||
|
||
- name: Notify Telegram on Success
|
||
if: success()
|
||
run: |
|
||
curl -s -X POST "https://api.telegram.org/bot${{ secrets.TELEGRAM_BOT_TOKEN }}/sendMessage" \
|
||
-d chat_id="${{ secrets.TELEGRAM_CHAT_ID }}" \
|
||
-d text="✅ *AWOOOI 部署成功*%0A%0ACommit: \`${{ github.sha }}\`%0ABranch: \`${{ github.ref_name }}\`%0AWorkflow: [查看](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" \
|
||
-d parse_mode="Markdown"
|
||
|
||
- name: Notify Telegram on Failure
|
||
if: failure()
|
||
run: |
|
||
curl -s -X POST "https://api.telegram.org/bot${{ secrets.TELEGRAM_BOT_TOKEN }}/sendMessage" \
|
||
-d chat_id="${{ secrets.TELEGRAM_CHAT_ID }}" \
|
||
-d text="❌ *AWOOOI 部署失敗*%0A%0ACommit: \`${{ github.sha }}\`%0ABranch: \`${{ github.ref_name }}\`%0AWorkflow: [查看](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" \
|
||
-d parse_mode="Markdown"
|