Deploy Agent
d6f28e8f37
- 添加 docs/deployment.md 完整部署文档，包含： - 环境要求 - 首次部署流程 - 版本更新流程 - 回滚流程 - 常见问题排查 - 环境变量说明 - 添加标准化部署脚本： - scripts/deploy_production.sh: 生产环境部署脚本 - scripts/deploy_staging.sh: 预发布环境部署脚本 - scripts/rollback.sh: 回滚脚本（支持交互式和命令行模式） - 完善 infra/docker/compose.yml： - 添加详细注释说明 - 添加资源限制建议（注释） - 记录 web volume 挂载的注意事项（避免 403 问题） - 添加 .github/workflows/release.yml： - 完整的发布流程 - 构建所有三个镜像（api、worker、web） - 自动部署到生产环境 - E2E 测试和 GitHub Release 创建
415 lines
14 KiB
YAML
Executable File
415 lines
14 KiB
YAML
Executable File
# ===========================================
|
|
# 小虾剪辑 SaaS 发布工作流
|
|
# ===========================================
|
|
#
|
|
# 触发条件:
|
|
# - 推送 v* 格式的 tag (如 v0.1.5)
|
|
#
|
|
# 完整流程:
|
|
# 1. 构建 API + Worker 镜像
|
|
# 2. 构建 Web 镜像
|
|
# 3. 创建 Release
|
|
# 4. 上传到生产服务器
|
|
# 5. 执行部署
|
|
# 6. 运行 E2E 测试
|
|
#
|
|
# 环境变量:
|
|
# PRODUCTION_SSH_HOST - 生产服务器地址
|
|
# PRODUCTION_SSH_USER - 生产服务器用户名
|
|
# PRODUCTION_SSH_KEY - SSH 私钥
|
|
#
|
|
|
|
name: Release Pipeline
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
env:
|
|
VERSION: ${ { github.ref_name } }
|
|
|
|
jobs:
|
|
# =========================================
|
|
# Job 1: 构建所有镜像
|
|
# =========================================
|
|
build-images:
|
|
name: Build All Images
|
|
runs-on: runtime-builder:host
|
|
container: localhost:5000/xiaoxia-ci-python:3.12
|
|
|
|
outputs:
|
|
version: ${{ env.VERSION }}
|
|
|
|
steps:
|
|
# 检出代码
|
|
- name: Checkout code
|
|
run: |
|
|
python - <<'PY'
|
|
import os
|
|
import tarfile
|
|
import urllib.request
|
|
|
|
api_url = os.environ['GITHUB_API_URL']
|
|
repository = os.environ['GITHUB_REPOSITORY']
|
|
sha = os.environ['GITHUB_SHA']
|
|
token = os.environ.get('GITHUB_TOKEN', '')
|
|
archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
|
|
request = urllib.request.Request(archive_url)
|
|
if token:
|
|
request.add_header('Authorization', f'token {token}')
|
|
with urllib.request.urlopen(request, timeout=120) as response:
|
|
with open('/tmp/repo.tar.gz', 'wb') as archive:
|
|
archive.write(response.read())
|
|
with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
|
|
members = archive.getmembers()
|
|
top_level = members[0].name.split('/')[0] + '/'
|
|
for member in members:
|
|
member.name = member.name.removeprefix(top_level)
|
|
if member.name:
|
|
archive.extract(member, '.')
|
|
PY
|
|
|
|
# 构建 API 镜像
|
|
- name: Build API Image
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
API_IMAGE="xiaoxia-saas-api:$VERSION"
|
|
docker build --pull=false \
|
|
-f infra/docker/api.Dockerfile \
|
|
-t "$API_IMAGE" \
|
|
-t "xiaoxia-saas-api:latest" \
|
|
.
|
|
|
|
# 构建 Worker 镜像
|
|
- name: Build Worker Image
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
|
|
docker build --pull=false \
|
|
-f infra/docker/worker.Dockerfile \
|
|
-t "$WORKER_IMAGE" \
|
|
-t "xiaoxia-saas-worker:latest" \
|
|
.
|
|
|
|
# 构建 Web 镜像
|
|
- name: Build Web Image
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
# 先构建前端
|
|
docker run --rm \
|
|
--pull=never \
|
|
-v "$PWD:/workspace" \
|
|
-w /workspace/apps/web \
|
|
docker.m.daocloud.io/library/node:20 \
|
|
sh -lc 'npm ci && npm run build'
|
|
# 构建 Nginx 镜像
|
|
docker build --pull=false \
|
|
-f infra/docker/web-artifact.Dockerfile \
|
|
-t "xiaoxia-saas-web:$VERSION" \
|
|
.
|
|
|
|
# 保存镜像
|
|
- name: Save Images
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
mkdir -p dist/release-images dist/release-artifacts
|
|
|
|
# 保存 API + Worker 镜像
|
|
docker save \
|
|
"xiaoxia-saas-api:$VERSION" \
|
|
"xiaoxia-saas-api:latest" \
|
|
"xiaoxia-saas-worker:$VERSION" \
|
|
"xiaoxia-saas-worker:latest" \
|
|
-o dist/release-images/xiaoxia-runtime-images-$VERSION.tar
|
|
|
|
# 保存 Web 镜像
|
|
docker save "xiaoxia-saas-web:$VERSION" \
|
|
-o dist/release-images/xiaoxia-web-$VERSION.tar
|
|
|
|
# 上传镜像到构建服务器存储
|
|
- name: Upload Images Artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: release-images-${{ env.VERSION }}
|
|
path: dist/release-images/
|
|
retention-days: 7
|
|
|
|
# =========================================
|
|
# Job 2: 打包源码
|
|
# =========================================
|
|
package-source:
|
|
name: Package Source
|
|
runs-on: runtime-builder:host
|
|
|
|
needs: build-images
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
run: |
|
|
python - <<'PY'
|
|
import os
|
|
import tarfile
|
|
import urllib.request
|
|
|
|
api_url = os.environ['GITHUB_API_URL']
|
|
repository = os.environ['GITHUB_REPOSITORY']
|
|
sha = os.environ['GITHUB_SHA']
|
|
token = os.environ.get('GITHUB_TOKEN', '')
|
|
archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
|
|
request = urllib.request.Request(archive_url)
|
|
if token:
|
|
request.add_header('Authorization', f'token {token}')
|
|
with urllib.request.urlopen(request, timeout=120) as response:
|
|
with open('/tmp/repo.tar.gz', 'wb') as archive:
|
|
archive.write(response.read())
|
|
with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
|
|
members = archive.getmembers()
|
|
top_level = members[0].name.split('/')[0] + '/'
|
|
for member in members:
|
|
member.name = member.name.removeprefix(top_level)
|
|
if member.name:
|
|
archive.extract(member, '.')
|
|
PY
|
|
|
|
- name: Package Source
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
mkdir -p dist/release-artifacts
|
|
|
|
# 排除不需要的文件
|
|
tar --exclude=.git \
|
|
--exclude=apps/web/node_modules \
|
|
--exclude=apps/web/dist \
|
|
--exclude=dist \
|
|
--exclude=*.pyc \
|
|
--exclude=__pycache__ \
|
|
-czf "dist/release-artifacts/xiaoxia-release-$VERSION.tar.gz" .
|
|
|
|
- name: Upload Source Artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: release-source-${{ env.VERSION }}
|
|
path: dist/release-artifacts/
|
|
retention-days: 7
|
|
|
|
# =========================================
|
|
# Job 3: 部署到生产环境
|
|
# =========================================
|
|
deploy-production:
|
|
name: Deploy to Production
|
|
runs-on: runtime-builder:host
|
|
needs: [build-images, package-source]
|
|
|
|
steps:
|
|
- name: Download Images
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: release-images-${{ env.VERSION }}
|
|
path: dist/release-images/
|
|
|
|
- name: Download Source
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: release-source-${{ env.VERSION }}
|
|
path: dist/release-artifacts/
|
|
|
|
- name: Upload to Production Server
|
|
env:
|
|
PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
|
|
PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
|
|
PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
|
|
production_user="${PRODUCTION_SSH_USER:-root}"
|
|
|
|
mkdir -p ~/.ssh
|
|
if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
|
|
key_path="$HOME/.ssh/id_ed25519"
|
|
printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
|
|
chmod 600 "$key_path"
|
|
else
|
|
key_path="/root/.ssh/xiaoxia_runtime_builder"
|
|
fi
|
|
|
|
ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
|
|
# 创建目录
|
|
ssh -i "$key_path" "$production_user@$production_host" \
|
|
"mkdir -p /var/lib/xiaoxia-saas-production"
|
|
|
|
- name: Transfer and Deploy
|
|
env:
|
|
PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
|
|
PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
|
|
PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
|
|
production_user="${PRODUCTION_SSH_USER:-root}"
|
|
|
|
if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
|
|
key_path="$HOME/.ssh/id_ed25519"
|
|
else
|
|
key_path="/root/.ssh/xiaoxia_runtime_builder"
|
|
fi
|
|
|
|
# 上传镜像
|
|
scp -i "$key_path" \
|
|
"dist/release-images/xiaoxia-runtime-images-$VERSION.tar" \
|
|
"$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
|
|
|
|
scp -i "$key_path" \
|
|
"dist/release-images/xiaoxia-web-$VERSION.tar" \
|
|
"$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
|
|
|
|
# 上传源码
|
|
scp -i "$key_path" \
|
|
"dist/release-artifacts/xiaoxia-release-$VERSION.tar.gz" \
|
|
"$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
|
|
|
|
- name: Execute Deployment
|
|
env:
|
|
PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
|
|
PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
|
|
PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
|
|
run: |
|
|
VERSION="${{ env.VERSION }}"
|
|
production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
|
|
production_user="${PRODUCTION_SSH_USER:-root}"
|
|
|
|
if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
|
|
key_path="$HOME/.ssh/id_ed25519"
|
|
else
|
|
key_path="/root/.ssh/xiaoxia_runtime_builder"
|
|
fi
|
|
|
|
ssh -i "$key_path" "$production_user@$production_host" <<'REMOTE_DEPLOY'
|
|
set -eu
|
|
|
|
VERSION="${{ env.VERSION }}"
|
|
cd /var/lib/xiaoxia-saas-production
|
|
|
|
# 加载镜像
|
|
docker load -i "runtime-images-$VERSION.tar"
|
|
docker load -i "web-$VERSION.tar"
|
|
|
|
# 解压源码
|
|
rm -rf repo
|
|
mkdir -p repo
|
|
tar -xzf "release-$VERSION.tar.gz" -C repo
|
|
|
|
# 复制环境文件
|
|
cp .env repo/.env
|
|
|
|
# 部署
|
|
cd repo
|
|
export API_IMAGE="xiaoxia-saas-api:$VERSION"
|
|
export WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
|
|
export WEB_IMAGE="xiaoxia-saas-web:$VERSION"
|
|
export APP_VERSION="$VERSION"
|
|
export RELEASE_VERSION="$VERSION"
|
|
|
|
bash infra/docker/deploy-production.sh
|
|
|
|
# 健康检查
|
|
i=0
|
|
while [ "$i" -lt 30 ]; do
|
|
if wget -qO- http://127.0.0.1:8001/health; then
|
|
echo "Deployment successful!"
|
|
exit 0
|
|
fi
|
|
i=$((i + 1))
|
|
sleep 2
|
|
done
|
|
|
|
echo "Health check failed!"
|
|
exit 1
|
|
REMOTE_DEPLOY
|
|
|
|
# =========================================
|
|
# Job 4: 运行 E2E 测试
|
|
# =========================================
|
|
e2e-test:
|
|
name: Run E2E Tests
|
|
runs-on: runtime-builder:host
|
|
needs: deploy-production
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
run: |
|
|
python - <<'PY'
|
|
import os
|
|
import tarfile
|
|
import urllib.request
|
|
|
|
api_url = os.environ['GITHUB_API_URL']
|
|
repository = os.environ['GITHUB_REPOSITORY']
|
|
sha = os.environ['GITHUB_SHA']
|
|
token = os.environ.get('GITHUB_TOKEN', '')
|
|
archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
|
|
request = urllib.request.Request(archive_url)
|
|
if token:
|
|
request.add_header('Authorization', f'token {token}')
|
|
with urllib.request.urlopen(request, timeout=120) as response:
|
|
with open('/tmp/repo.tar.gz', 'wb') as archive:
|
|
archive.write(response.read())
|
|
with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
|
|
members = archive.getmembers()
|
|
top_level = members[0].name.split('/')[0] + '/'
|
|
for member in members:
|
|
member.name = member.name.removeprefix(top_level)
|
|
if member.name:
|
|
archive.extract(member, '.')
|
|
PY
|
|
|
|
- name: Run Playwright E2E
|
|
run: |
|
|
docker run --rm \
|
|
-e E2E_BASE_URL=https://saas.xiaoxiajianji.com \
|
|
-e E2E_API_BASE=https://api.xiaoxiajianji.com/api/v1 \
|
|
-e E2E_BROWSER_CHANNEL=chromium \
|
|
-v "$PWD:/workspace" \
|
|
-w /workspace/apps/web \
|
|
mcr.microsoft.com/playwright:v1.45.0-jammy \
|
|
sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/'
|
|
|
|
# =========================================
|
|
# Job 5: 创建 GitHub Release
|
|
# =========================================
|
|
create-release:
|
|
name: Create Release
|
|
runs-on: ubuntu-latest
|
|
needs: [deploy-production, e2e-test]
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Generate Changelog
|
|
id: changelog
|
|
run: |
|
|
VERSION=${GITHUB_REF#refs/tags/}
|
|
# 简单获取 CHANGELOG 中该版本的内容
|
|
CHANGELOG=$(awk "/^## \[$VERSION\]/,/^## \[/" CHANGELOG.md | head -n -1)
|
|
echo "body<<EOF" >> $GITHUB_OUTPUT
|
|
echo "## What's Changed" >> $GITHUB_OUTPUT
|
|
echo "" >> $GITHUB_OUTPUT
|
|
echo "$CHANGELOG" >> $GITHUB_OUTPUT
|
|
echo "" >> $GITHUB_OUTPUT
|
|
echo "**Full Changelog**: https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md" >> $GITHUB_OUTPUT
|
|
echo "EOF" >> $GITHUB_OUTPUT
|
|
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@v1
|
|
with:
|
|
body: ${{ steps.changelog.outputs.body }}
|
|
draft: false
|
|
prerelease: false
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|