chore: remove redundant .github/workflows (using Gitea Actions)
This commit is contained in:
CI Bot
@@ -1,96 +0,0 @@
|
||||
name: CI/CD Pipeline
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
- develop
|
||||
- 'feature/**'
|
||||
- 'bugfix/**'
|
||||
- 'hotfix/**'
|
||||
- 'release/**'
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
- develop
|
||||
|
||||
jobs:
|
||||
validate:
|
||||
name: Validate Code Quality And Tests
|
||||
runs-on: ubuntu-latest
|
||||
container: xiaoxia-ci-python:3.12
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
run: |
|
||||
python - <<'PY'
|
||||
import os
|
||||
import tarfile
|
||||
import urllib.request
|
||||
|
||||
api_url = os.environ['GITHUB_API_URL']
|
||||
repository = os.environ['GITHUB_REPOSITORY']
|
||||
sha = os.environ['GITHUB_SHA']
|
||||
token = os.environ.get('GITHUB_TOKEN', '')
|
||||
archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
|
||||
request = urllib.request.Request(archive_url)
|
||||
if token:
|
||||
request.add_header('Authorization', f'token {token}')
|
||||
with urllib.request.urlopen(request, timeout=120) as response:
|
||||
with open('/tmp/repo.tar.gz', 'wb') as archive:
|
||||
archive.write(response.read())
|
||||
with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
|
||||
members = archive.getmembers()
|
||||
top_level = members[0].name.split('/')[0] + '/'
|
||||
for member in members:
|
||||
member.name = member.name.removeprefix(top_level)
|
||||
if member.name:
|
||||
archive.extract(member, '.')
|
||||
PY
|
||||
|
||||
- name: Verify CI environment
|
||||
run: |
|
||||
python --version
|
||||
python -m pip --version
|
||||
python -m black --version
|
||||
python -m isort --version-number
|
||||
python -m flake8 --version
|
||||
bandit --version
|
||||
pytest --version
|
||||
echo "✅ Prebuilt CI environment is ready"
|
||||
|
||||
- name: Run code quality checks
|
||||
run: |
|
||||
python -m compileall -q alembic apps packages tests scripts
|
||||
python -m black --check alembic apps packages tests scripts
|
||||
python -m isort --check-only alembic apps packages tests scripts
|
||||
python -m flake8 apps packages tests --count --statistics
|
||||
|
||||
- name: Run security scan
|
||||
run: |
|
||||
bandit -r apps packages -q
|
||||
|
||||
- name: Validate release scripts syntax
|
||||
run: |
|
||||
bash -n scripts/backup_postgres.sh
|
||||
bash -n scripts/restore_postgres_plan.sh
|
||||
bash -n scripts/init_production_env.sh
|
||||
|
||||
- name: Validate Alembic migrations
|
||||
run: |
|
||||
DATABASE_URL=postgresql+psycopg://postgres:postgres@localhost:5432/xiaoxia_saas \
|
||||
python -m alembic upgrade head --sql > /tmp/alembic-upgrade.sql
|
||||
test -s /tmp/alembic-upgrade.sql
|
||||
grep -q "Running upgrade" /tmp/alembic-upgrade.sql
|
||||
python scripts/check_schema_metadata.py
|
||||
|
||||
- name: Run tests
|
||||
run: |
|
||||
python -m pytest tests -q
|
||||
|
||||
- name: Build summary
|
||||
if: github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
|
||||
run: |
|
||||
echo "✅ Build completed successfully!"
|
||||
echo "Branch: ${GITHUB_REF_NAME}"
|
||||
echo "Commit: ${GITHUB_SHA}"
|
||||
@@ -1,414 +0,0 @@
|
||||
# ===========================================
|
||||
# 小虾剪辑 SaaS 发布工作流
|
||||
# ===========================================
|
||||
#
|
||||
# 触发条件:
|
||||
# - 推送 v* 格式的 tag (如 v0.1.5)
|
||||
#
|
||||
# 完整流程:
|
||||
# 1. 构建 API + Worker 镜像
|
||||
# 2. 构建 Web 镜像
|
||||
# 3. 创建 Release
|
||||
# 4. 上传到生产服务器
|
||||
# 5. 执行部署
|
||||
# 6. 运行 E2E 测试
|
||||
#
|
||||
# 环境变量:
|
||||
# PRODUCTION_SSH_HOST - 生产服务器地址
|
||||
# PRODUCTION_SSH_USER - 生产服务器用户名
|
||||
# PRODUCTION_SSH_KEY - SSH 私钥
|
||||
#
|
||||
|
||||
name: Release Pipeline
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'v*'
|
||||
|
||||
env:
|
||||
VERSION: ${ { github.ref_name } }
|
||||
|
||||
jobs:
|
||||
# =========================================
|
||||
# Job 1: 构建所有镜像
|
||||
# =========================================
|
||||
build-images:
|
||||
name: Build All Images
|
||||
runs-on: runtime-builder:host
|
||||
container: localhost:5000/xiaoxia-ci-python:3.12
|
||||
|
||||
outputs:
|
||||
version: ${{ env.VERSION }}
|
||||
|
||||
steps:
|
||||
# 检出代码
|
||||
- name: Checkout code
|
||||
run: |
|
||||
python - <<'PY'
|
||||
import os
|
||||
import tarfile
|
||||
import urllib.request
|
||||
|
||||
api_url = os.environ['GITHUB_API_URL']
|
||||
repository = os.environ['GITHUB_REPOSITORY']
|
||||
sha = os.environ['GITHUB_SHA']
|
||||
token = os.environ.get('GITHUB_TOKEN', '')
|
||||
archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
|
||||
request = urllib.request.Request(archive_url)
|
||||
if token:
|
||||
request.add_header('Authorization', f'token {token}')
|
||||
with urllib.request.urlopen(request, timeout=120) as response:
|
||||
with open('/tmp/repo.tar.gz', 'wb') as archive:
|
||||
archive.write(response.read())
|
||||
with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
|
||||
members = archive.getmembers()
|
||||
top_level = members[0].name.split('/')[0] + '/'
|
||||
for member in members:
|
||||
member.name = member.name.removeprefix(top_level)
|
||||
if member.name:
|
||||
archive.extract(member, '.')
|
||||
PY
|
||||
|
||||
# 构建 API 镜像
|
||||
- name: Build API Image
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
API_IMAGE="xiaoxia-saas-api:$VERSION"
|
||||
docker build --pull=false \
|
||||
-f infra/docker/api.Dockerfile \
|
||||
-t "$API_IMAGE" \
|
||||
-t "xiaoxia-saas-api:latest" \
|
||||
.
|
||||
|
||||
# 构建 Worker 镜像
|
||||
- name: Build Worker Image
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
|
||||
docker build --pull=false \
|
||||
-f infra/docker/worker.Dockerfile \
|
||||
-t "$WORKER_IMAGE" \
|
||||
-t "xiaoxia-saas-worker:latest" \
|
||||
.
|
||||
|
||||
# 构建 Web 镜像
|
||||
- name: Build Web Image
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
# 先构建前端
|
||||
docker run --rm \
|
||||
--pull=never \
|
||||
-v "$PWD:/workspace" \
|
||||
-w /workspace/apps/web \
|
||||
docker.m.daocloud.io/library/node:20 \
|
||||
sh -lc 'npm ci && npm run build'
|
||||
# 构建 Nginx 镜像
|
||||
docker build --pull=false \
|
||||
-f infra/docker/web-artifact.Dockerfile \
|
||||
-t "xiaoxia-saas-web:$VERSION" \
|
||||
.
|
||||
|
||||
# 保存镜像
|
||||
- name: Save Images
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
mkdir -p dist/release-images dist/release-artifacts
|
||||
|
||||
# 保存 API + Worker 镜像
|
||||
docker save \
|
||||
"xiaoxia-saas-api:$VERSION" \
|
||||
"xiaoxia-saas-api:latest" \
|
||||
"xiaoxia-saas-worker:$VERSION" \
|
||||
"xiaoxia-saas-worker:latest" \
|
||||
-o dist/release-images/xiaoxia-runtime-images-$VERSION.tar
|
||||
|
||||
# 保存 Web 镜像
|
||||
docker save "xiaoxia-saas-web:$VERSION" \
|
||||
-o dist/release-images/xiaoxia-web-$VERSION.tar
|
||||
|
||||
# 上传镜像到构建服务器存储
|
||||
- name: Upload Images Artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: release-images-${{ env.VERSION }}
|
||||
path: dist/release-images/
|
||||
retention-days: 7
|
||||
|
||||
# =========================================
|
||||
# Job 2: 打包源码
|
||||
# =========================================
|
||||
package-source:
|
||||
name: Package Source
|
||||
runs-on: runtime-builder:host
|
||||
|
||||
needs: build-images
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
run: |
|
||||
python - <<'PY'
|
||||
import os
|
||||
import tarfile
|
||||
import urllib.request
|
||||
|
||||
api_url = os.environ['GITHUB_API_URL']
|
||||
repository = os.environ['GITHUB_REPOSITORY']
|
||||
sha = os.environ['GITHUB_SHA']
|
||||
token = os.environ.get('GITHUB_TOKEN', '')
|
||||
archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
|
||||
request = urllib.request.Request(archive_url)
|
||||
if token:
|
||||
request.add_header('Authorization', f'token {token}')
|
||||
with urllib.request.urlopen(request, timeout=120) as response:
|
||||
with open('/tmp/repo.tar.gz', 'wb') as archive:
|
||||
archive.write(response.read())
|
||||
with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
|
||||
members = archive.getmembers()
|
||||
top_level = members[0].name.split('/')[0] + '/'
|
||||
for member in members:
|
||||
member.name = member.name.removeprefix(top_level)
|
||||
if member.name:
|
||||
archive.extract(member, '.')
|
||||
PY
|
||||
|
||||
- name: Package Source
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
mkdir -p dist/release-artifacts
|
||||
|
||||
# 排除不需要的文件
|
||||
tar --exclude=.git \
|
||||
--exclude=apps/web/node_modules \
|
||||
--exclude=apps/web/dist \
|
||||
--exclude=dist \
|
||||
--exclude=*.pyc \
|
||||
--exclude=__pycache__ \
|
||||
-czf "dist/release-artifacts/xiaoxia-release-$VERSION.tar.gz" .
|
||||
|
||||
- name: Upload Source Artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: release-source-${{ env.VERSION }}
|
||||
path: dist/release-artifacts/
|
||||
retention-days: 7
|
||||
|
||||
# =========================================
|
||||
# Job 3: 部署到生产环境
|
||||
# =========================================
|
||||
deploy-production:
|
||||
name: Deploy to Production
|
||||
runs-on: runtime-builder:host
|
||||
needs: [build-images, package-source]
|
||||
|
||||
steps:
|
||||
- name: Download Images
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: release-images-${{ env.VERSION }}
|
||||
path: dist/release-images/
|
||||
|
||||
- name: Download Source
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: release-source-${{ env.VERSION }}
|
||||
path: dist/release-artifacts/
|
||||
|
||||
- name: Upload to Production Server
|
||||
env:
|
||||
PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
|
||||
PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
|
||||
PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
|
||||
production_user="${PRODUCTION_SSH_USER:-root}"
|
||||
|
||||
mkdir -p ~/.ssh
|
||||
if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
|
||||
key_path="$HOME/.ssh/id_ed25519"
|
||||
printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
|
||||
chmod 600 "$key_path"
|
||||
else
|
||||
key_path="/root/.ssh/xiaoxia_runtime_builder"
|
||||
fi
|
||||
|
||||
ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
|
||||
# 创建目录
|
||||
ssh -i "$key_path" "$production_user@$production_host" \
|
||||
"mkdir -p /var/lib/xiaoxia-saas-production"
|
||||
|
||||
- name: Transfer and Deploy
|
||||
env:
|
||||
PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
|
||||
PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
|
||||
PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
|
||||
production_user="${PRODUCTION_SSH_USER:-root}"
|
||||
|
||||
if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
|
||||
key_path="$HOME/.ssh/id_ed25519"
|
||||
else
|
||||
key_path="/root/.ssh/xiaoxia_runtime_builder"
|
||||
fi
|
||||
|
||||
# 上传镜像
|
||||
scp -i "$key_path" \
|
||||
"dist/release-images/xiaoxia-runtime-images-$VERSION.tar" \
|
||||
"$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
|
||||
|
||||
scp -i "$key_path" \
|
||||
"dist/release-images/xiaoxia-web-$VERSION.tar" \
|
||||
"$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
|
||||
|
||||
# 上传源码
|
||||
scp -i "$key_path" \
|
||||
"dist/release-artifacts/xiaoxia-release-$VERSION.tar.gz" \
|
||||
"$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
|
||||
|
||||
- name: Execute Deployment
|
||||
env:
|
||||
PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
|
||||
PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
|
||||
PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
|
||||
run: |
|
||||
VERSION="${{ env.VERSION }}"
|
||||
production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
|
||||
production_user="${PRODUCTION_SSH_USER:-root}"
|
||||
|
||||
if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
|
||||
key_path="$HOME/.ssh/id_ed25519"
|
||||
else
|
||||
key_path="/root/.ssh/xiaoxia_runtime_builder"
|
||||
fi
|
||||
|
||||
ssh -i "$key_path" "$production_user@$production_host" <<'REMOTE_DEPLOY'
|
||||
set -eu
|
||||
|
||||
VERSION="${{ env.VERSION }}"
|
||||
cd /var/lib/xiaoxia-saas-production
|
||||
|
||||
# 加载镜像
|
||||
docker load -i "runtime-images-$VERSION.tar"
|
||||
docker load -i "web-$VERSION.tar"
|
||||
|
||||
# 解压源码
|
||||
rm -rf repo
|
||||
mkdir -p repo
|
||||
tar -xzf "release-$VERSION.tar.gz" -C repo
|
||||
|
||||
# 复制环境文件
|
||||
cp .env repo/.env
|
||||
|
||||
# 部署
|
||||
cd repo
|
||||
export API_IMAGE="xiaoxia-saas-api:$VERSION"
|
||||
export WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
|
||||
export WEB_IMAGE="xiaoxia-saas-web:$VERSION"
|
||||
export APP_VERSION="$VERSION"
|
||||
export RELEASE_VERSION="$VERSION"
|
||||
|
||||
bash infra/docker/deploy-production.sh
|
||||
|
||||
# 健康检查
|
||||
i=0
|
||||
while [ "$i" -lt 30 ]; do
|
||||
if wget -qO- http://127.0.0.1:8001/health; then
|
||||
echo "Deployment successful!"
|
||||
exit 0
|
||||
fi
|
||||
i=$((i + 1))
|
||||
sleep 2
|
||||
done
|
||||
|
||||
echo "Health check failed!"
|
||||
exit 1
|
||||
REMOTE_DEPLOY
|
||||
|
||||
# =========================================
|
||||
# Job 4: 运行 E2E 测试
|
||||
# =========================================
|
||||
e2e-test:
|
||||
name: Run E2E Tests
|
||||
runs-on: runtime-builder:host
|
||||
needs: deploy-production
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
run: |
|
||||
python - <<'PY'
|
||||
import os
|
||||
import tarfile
|
||||
import urllib.request
|
||||
|
||||
api_url = os.environ['GITHUB_API_URL']
|
||||
repository = os.environ['GITHUB_REPOSITORY']
|
||||
sha = os.environ['GITHUB_SHA']
|
||||
token = os.environ.get('GITHUB_TOKEN', '')
|
||||
archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
|
||||
request = urllib.request.Request(archive_url)
|
||||
if token:
|
||||
request.add_header('Authorization', f'token {token}')
|
||||
with urllib.request.urlopen(request, timeout=120) as response:
|
||||
with open('/tmp/repo.tar.gz', 'wb') as archive:
|
||||
archive.write(response.read())
|
||||
with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
|
||||
members = archive.getmembers()
|
||||
top_level = members[0].name.split('/')[0] + '/'
|
||||
for member in members:
|
||||
member.name = member.name.removeprefix(top_level)
|
||||
if member.name:
|
||||
archive.extract(member, '.')
|
||||
PY
|
||||
|
||||
- name: Run Playwright E2E
|
||||
run: |
|
||||
docker run --rm \
|
||||
-e E2E_BASE_URL=https://saas.xiaoxiajianji.com \
|
||||
-e E2E_API_BASE=https://api.xiaoxiajianji.com/api/v1 \
|
||||
-e E2E_BROWSER_CHANNEL=chromium \
|
||||
-v "$PWD:/workspace" \
|
||||
-w /workspace/apps/web \
|
||||
mcr.microsoft.com/playwright:v1.45.0-jammy \
|
||||
sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/'
|
||||
|
||||
# =========================================
|
||||
# Job 5: 创建 GitHub Release
|
||||
# =========================================
|
||||
create-release:
|
||||
name: Create Release
|
||||
runs-on: ubuntu-latest
|
||||
needs: [deploy-production, e2e-test]
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Generate Changelog
|
||||
id: changelog
|
||||
run: |
|
||||
VERSION=${GITHUB_REF#refs/tags/}
|
||||
# 简单获取 CHANGELOG 中该版本的内容
|
||||
CHANGELOG=$(awk "/^## \[$VERSION\]/,/^## \[/" CHANGELOG.md | head -n -1)
|
||||
echo "body<<EOF" >> $GITHUB_OUTPUT
|
||||
echo "## What's Changed" >> $GITHUB_OUTPUT
|
||||
echo "" >> $GITHUB_OUTPUT
|
||||
echo "$CHANGELOG" >> $GITHUB_OUTPUT
|
||||
echo "" >> $GITHUB_OUTPUT
|
||||
echo "**Full Changelog**: https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md" >> $GITHUB_OUTPUT
|
||||
echo "EOF" >> $GITHUB_OUTPUT
|
||||
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Create Release
|
||||
uses: softprops/action-gh-release@v1
|
||||
with:
|
||||
body: ${{ steps.changelog.outputs.body }}
|
||||
draft: false
|
||||
prerelease: false
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
@@ -1,59 +0,0 @@
|
||||
name: Security Scan
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main, develop ]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
schedule:
|
||||
# Run every Monday at 00:00 UTC
|
||||
- cron: '0 0 * * 1'
|
||||
|
||||
jobs:
|
||||
security-scan:
|
||||
name: Security Scan
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.12'
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
pip install safety bandit
|
||||
|
||||
- name: Check for known security vulnerabilities
|
||||
run: |
|
||||
pip install -r requirements.txt
|
||||
safety check --json
|
||||
|
||||
- name: Run Bandit security linter
|
||||
run: |
|
||||
bandit -r packages/ apps/ -f json -o bandit-report.json || true
|
||||
cat bandit-report.json
|
||||
|
||||
- name: Upload security reports
|
||||
uses: actions/upload-artifact@v3
|
||||
if: always()
|
||||
with:
|
||||
name: security-reports
|
||||
path: |
|
||||
bandit-report.json
|
||||
|
||||
dependency-review:
|
||||
name: Dependency Review
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event_name == 'pull_request'
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Dependency Review
|
||||
uses: actions/dependency-review-action@v3
|
||||
Reference in New Issue
Block a user