xiaoxia-saas/scripts/build_release_images.sh

#!/bin/sh
set -eu

VERSION="${1:-${RELEASE_VERSION:-}}"
if [ -z "$VERSION" ]; then
  echo "Usage: $0 <version> [staging|production]"
  echo "Example: $0 v0.1.5 production"
  echo "         $0 abc1234 staging"
  exit 1
fi

# 环境参数：staging 或 production（默认 production）
BUILD_ENV="${2:-production}"
case "$BUILD_ENV" in
  staging)   NGINX_CONF_FILE="infra/docker/nginx-staging.conf" ;;
  *)         NGINX_CONF_FILE="infra/docker/nginx-production.conf" ;;
esac
echo "Build environment: $BUILD_ENV → nginx config: $NGINX_CONF_FILE"

ROOT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
cd "$ROOT_DIR"

if docker ps --format "{{.Names}}" | grep -Eq "^(xiaoxia-(api|web|worker|postgres|redis)-production|gitea)$"; then
  if [ "${ALLOW_SHARED_PRODUCTION_BUILD_HOST:-false}" != "true" ]; then
    echo "Refusing to build runtime images on a host that is running production services."
    exit 1
  fi
fi

# ---- Registry 配置 ----
REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
CACHE_REGISTRY="${CACHE_REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
# 主缓存 tag：develop 分支构建时写入，所有分支读取
CACHE_TAG_PRIMARY="${CACHE_TAG:-develop}"

API_IMAGE="xiaoxia-saas-api:$VERSION"
WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
WEB_IMAGE="xiaoxia-saas-web:$VERSION"
API_DEV="xiaoxia-saas-api:dev"
WORKER_DEV="xiaoxia-saas-worker:dev"
WEB_DEV="xiaoxia-saas-web:dev"

# Registry 上的完整镜像名（SHA/版本 tag）
REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:$VERSION"
REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:$VERSION"
REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:$VERSION"

# Registry 上的 dev floating tag（仅 staging/develop 构建时推送，供 Watchtower 监听自动更新）
REGISTRY_API_DEV="${REGISTRY}/xiaoxia-saas-api:dev"
REGISTRY_WORKER_DEV="${REGISTRY}/xiaoxia-saas-worker:dev"
REGISTRY_WEB_DEV="${REGISTRY}/xiaoxia-saas-web:dev"

USE_CACHE=0
USE_PUSH=0
CACHE_WRITE=0

# 检查 buildx 和 Registry 认证
if docker buildx version >/dev/null 2>&1; then
  if [ -n "${REGISTRY_TOKEN:-}" ]; then
    printf "%s" "${REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u xiaoxia --password-stdin 2>/dev/null && USE_CACHE=1 && USE_PUSH=1
  fi
  docker buildx use default 2>/dev/null || true
fi

# ---- 是否需要推送 dev tag ----
# staging 构建 或 develop 分支构建时才推送 :dev tag，供 Watchtower 自动更新；
# production / release tag 构建不推送 dev tag，避免污染生产 tag 指向。
PUSH_DEV_TAG=0
BRANCH_NAME="${GITHUB_REF_NAME:-${CI_COMMIT_BRANCH:-unknown}}"
if [ "$BUILD_ENV" = "staging" ] || [ "$BRANCH_NAME" = "develop" ]; then
  PUSH_DEV_TAG=1
  echo "Dev tag push: ENABLED (BUILD_ENV=$BUILD_ENV, BRANCH=$BRANCH_NAME) — Watchtower will pick up new :dev"
else
  echo "Dev tag push: disabled (BUILD_ENV=$BUILD_ENV, BRANCH=$BRANCH_NAME)"
fi

# ---- 缓存读写策略（按分支隔离）----
# 默认只读不写，防止 feature 分支污染主缓存
# 只有 develop/main 分支才写回缓存
# 清理本地旧镜像
docker rmi -f "$API_IMAGE" "$API_DEV" 2>/dev/null || true

if [ "$USE_CACHE" -eq 1 ]; then
  docker buildx build \
    --build-arg APP_VERSION="$VERSION" \
    --cache-from "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
    -f infra/docker/api.Dockerfile \
    -t "$API_IMAGE" -t "$API_DEV" \
    --load \
    .
else
  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_DEV" .
fi

build_with_cache() {
  # usage: build_with_cache <image_name> <dockerfile> <extra_args...>
  IMG_NAME="$1"
  DOCKERFILE="$2"
  shift 2
  EXTRA_ARGS="$*"

  CACHE_FROM="type=registry,ref=${CACHE_REGISTRY}/${IMG_NAME}-cache:${CACHE_TAG_PRIMARY},ignore-error=true"

  if [ "$CACHE_WRITE" -eq 1 ]; then
    CACHE_TO="type=registry,ref=${CACHE_REGISTRY}/${IMG_NAME}-cache:${CACHE_TAG_PRIMARY},mode=max"
    echo "  cache: read+write from ${CACHE_REGISTRY}/${IMG_NAME}-cache:${CACHE_TAG_PRIMARY}"
  else
    CACHE_TO=""
    echo "  cache: read-only from ${CACHE_REGISTRY}/${IMG_NAME}-cache:${CACHE_TAG_PRIMARY}"
  fi

  # 清理本地旧镜像，避免 buildx --load 报 already exists 错误
  docker rmi -f "$IMG_NAME:$VERSION" 2>/dev/null || true

  if [ "$USE_CACHE" -eq 1 ]; then
    if [ -n "$CACHE_TO" ]; then
      docker buildx build \
        $EXTRA_ARGS \
        --cache-from "$CACHE_FROM" \
        --cache-to "$CACHE_TO" \
        -f "$DOCKERFILE" \
        -t "$IMG_NAME:$VERSION" \
        --load \
        .
    else
      docker buildx build \
        $EXTRA_ARGS \
        --cache-from "$CACHE_FROM" \
        -f "$DOCKERFILE" \
        -t "$IMG_NAME:$VERSION" \
        --load \
        .
    fi
  else
    docker build --pull=false $EXTRA_ARGS -f "$DOCKERFILE" -t "$IMG_NAME:$VERSION" .
  fi
}

echo "=== Building API image ==="
build_with_cache "api" "infra/docker/api.Dockerfile" \
  "--build-arg APP_VERSION=$VERSION"
docker tag "$API_IMAGE" "$API_DEV"

echo "=== Building Worker image ==="
# 清理本地旧镜像
docker rmi -f "$WORKER_IMAGE" "$WORKER_DEV" 2>/dev/null || true

if [ "$USE_CACHE" -eq 1 ]; then
  docker buildx build \
    --build-arg APP_VERSION="$VERSION" \
    --cache-from "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
    -f infra/docker/worker.Dockerfile \
    -t "$WORKER_IMAGE" -t "$WORKER_DEV" \
    --load \
    .
else
  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_DEV" .
fi

echo "=== Building Web image (with buildx cache) ==="
# 先构建前端产物（使用持久化 npm 缓存卷）
NPM_CACHE_VOLUME="xiaoxia-npm-cache"
if ! docker volume inspect "$NPM_CACHE_VOLUME" >/dev/null 2>&1; then
  docker volume create "$NPM_CACHE_VOLUME" >/dev/null
  echo "  Created npm cache volume: $NPM_CACHE_VOLUME"
fi

docker run --rm \
  -v "$PWD:/workspace" \
  -v "$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules" \
  -w /workspace/apps/web \
  docker.m.daocloud.io/library/node:20 \
  sh -lc "npm ci && npm run build"

test -f apps/web/dist/index.html

# 清理本地旧镜像
docker rmi -f "$WEB_IMAGE" "$WEB_DEV" 2>/dev/null || true

if [ "$USE_CACHE" -eq 1 ]; then
  docker buildx build \
    --cache-from "type=registry,ref=${CACHE_REGISTRY}/web-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
    -f infra/docker/web-artifact.Dockerfile \
    --build-arg "NGINX_CONF=$NGINX_CONF_FILE" \
    -t "$WEB_IMAGE" -t "$WEB_DEV" \
    --load \
    .
else
  docker build --pull=false \
    -f infra/docker/web-artifact.Dockerfile \
    --build-arg "NGINX_CONF=$NGINX_CONF_FILE" \
    -t "$WEB_IMAGE" -t "$WEB_DEV" \
    .
fi

# Push 到 Registry
if [ "$USE_PUSH" -eq 1 ]; then
  echo "=== Pushing SHA/version-tagged images to Registry ==="
  docker tag "$API_IMAGE" "$REGISTRY_API"
  docker tag "$WORKER_IMAGE" "$REGISTRY_WORKER"
  docker tag "$WEB_IMAGE" "$REGISTRY_WEB"
  docker push "$REGISTRY_API"
  docker push "$REGISTRY_WORKER"
  docker push "$REGISTRY_WEB"
  echo "SHA-tagged images pushed to $REGISTRY"

  # ---- 额外推送 :dev floating tag（仅 staging/develop）----
  # :dev tag 指向最新一次 develop/staging 构建，供 Watchtower 通过 WATCHTOWER_ROLLING_RESTART 等方式
  # 监听镜像更新并自动 pull + restart；部署脚本 (ci_staging_deploy.sh) 仍使用 SHA tag 做确定性部署，
  # dev tag 仅作为"最新 develop 成功构建"的可滚动标识，避免并发构建互相覆盖导致的不可重现问题。
  if [ "$PUSH_DEV_TAG" -eq 1 ]; then
    echo "=== Pushing :dev floating tags to Registry (for Watchtower auto-update) ==="
    docker tag "$API_IMAGE" "$REGISTRY_API_DEV"
    docker tag "$WORKER_IMAGE" "$REGISTRY_WORKER_DEV"
    docker tag "$WEB_IMAGE" "$REGISTRY_WEB_DEV"
    docker push "$REGISTRY_API_DEV"
    docker push "$REGISTRY_WORKER_DEV"
    docker push "$REGISTRY_WEB_DEV"
    echo ":dev tags pushed to $REGISTRY"
  fi
else
  echo "Registry push skipped (no auth token available)"
fi

echo "=== Build complete ==="
docker images | grep "xiaoxia-saas" | grep -E "($VERSION|dev)" || true