发版流程实战：从代码提交到生产上线的完整链路

# .github/workflows/ci.yml
# 完整的 CI 流水线：构建 → 测试 → 代码扫描 → 镜像构建与推送
name: CI Pipeline

on:
  push:
    branches: [develop, main]
  pull_request:
    branches: [develop, main]

# 同一分支的新 push 自动取消之前的运行，避免资源浪费
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # ──────────────────────────────────────────────
  # Job 1: 代码编译与单元测试
  # ──────────────────────────────────────────────
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: 'maven'  # 内置缓存支持，无需手动配置 actions/cache

      - name: Build & Unit Test
        run: mvn clean verify -B -DskipITs  # 跳过集成测试，单独跑

      - name: Generate JaCoCo Report
        if: success()
        run: mvn jacoco:report

      # 上传测试报告和覆盖率报告，方便在 PR 中查看
      - name: Upload Test Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: |
            target/surefire-reports/
            target/site/jacoco/
          retention-days: 7

  # ──────────────────────────────────────────────
  # Job 2: 代码质量与安全扫描
  # ──────────────────────────────────────────────
  code-scan:
    runs-on: ubuntu-latest
    needs: build-and-test  # 构建通过后再扫描
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # SonarQube 需要完整 git 历史来做 blame 分析

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: 'maven'

      # SonarQube 静态代码分析
      - name: SonarQube Scan
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        run: mvn sonar:sonar -Dsonar.projectKey=myapp

      # Trivy 文件系统漏洞扫描（扫描依赖包）
      - name: Trivy FS Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # 发现高危漏洞时阻断流水线

  # ──────────────────────────────────────────────
  # Job 3: 构建并推送 Docker 镜像
  # ──────────────────────────────────────────────
  build-image:
    runs-on: ubuntu-latest
    needs: [build-and-test, code-scan]  # 测试和扫描都通过后才构建镜像
    # 仅在 push 到主分支时推送镜像，PR 只做验证
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write  # 推送到 GitHub Container Registry
    outputs:
      image-tag: ${{ steps.meta.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # 使用 Docker Buildx 获得更好的构建缓存
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # 登录 GitHub Container Registry
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # 自动生成镜像 tag：分支名-sha、语义化版本（如果是 tag）
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      # 构建并推送，使用 GitHub Actions 缓存加速二次构建
      - name: Build & Push Docker Image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # 镜像构建后立即扫描镜像漏洞
      - name: Trivy Image Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

# .github/workflows/deploy.yml
# CD 流水线：staging 部署 → 审批 → canary 灰度 → 生产全量
name: CD Pipeline

on:
  # 通过 workflow_call 被 CI 流水线调用，或手动触发
  workflow_call:
    inputs:
      image-tag:
        required: true
        type: string
        description: '要部署的镜像 tag'
  workflow_dispatch:
    inputs:
      image-tag:
        required: true
        type: string
        description: '要部署的镜像 tag（Git SHA）'
      skip-canary:
        required: false
        type: boolean
        default: false
        description: '是否跳过 canary 灰度阶段'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # ──────────────────────────────────────────────
  # Job 1: 部署到 Staging 环境
  # ──────────────────────────────────────────────
  deploy-staging:
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # 配置 kubectl 连接 staging 集群
      - name: Set up kubeconfig
        uses: azure/k8s-set-context@v4
        with:
          kubeconfig: ${{ secrets.STAGING_KUBECONFIG }}

      # 更新 Deployment 镜像
      - name: Deploy to Staging
        run: |
          kubectl set image deployment/myapp \
            myapp=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.image-tag }} \
            -n staging
          echo "等待 rollout 完成..."
          kubectl rollout status deployment/myapp -n staging --timeout=300s

      # 冒烟测试：验证核心接口
      - name: Smoke Test
        run: |
          for i in $(seq 1 5); do
            if curl -sf https://staging.example.com/health; then
              echo "\n✅ Staging 健康检查通过"
              exit 0
            fi
            echo "等待服务就绪... ($i/5)"
            sleep 10
          done
          echo "❌ Staging 健康检查失败"
          exit 1

      # E2E 测试（可选）
      - name: E2E Tests
        run: |
          # 在 staging 环境运行端到端测试
          # mvn verify -Pstaging -Dbase.url=https://staging.example.com
          echo "E2E 测试通过"

  # ──────────────────────────────────────────────
  # Job 2: Canary 灰度部署（10% 流量）
  # ──────────────────────────────────────────────
  # 通过 GitHub Environment 的审批门禁
  deploy-canary:
    needs: deploy-staging
    if: ${{ !inputs.skip-canary }}
    runs-on: ubuntu-latest
    environment:
      name: production-canary
      url: https://example.com
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up kubeconfig
        uses: azure/k8s-set-context@v4
        with:
          kubeconfig: ${{ secrets.PROD_KUBECONFIG }}

      # 部署 canary 版本（副本数 1，承载约 10% 流量）
      - name: Deploy Canary
        run: |
          kubectl set image deployment/myapp-canary \
            myapp=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.image-tag }} \
            -n production
          kubectl rollout status deployment/myapp-canary -n production --timeout=300s

      # 灰度观察期：监控核心指标
      - name: Monitor Canary (5 min)
        run: |
          echo "🔍 开始灰度观察，持续 5 分钟..."
          for i in $(seq 1 10); do
            # 检查错误率（从 Prometheus 拉取）
            ERROR_RATE=$(curl -s "http://prometheus:9090/api/v1/query?query=rate(http_server_requests_seconds_count{status=~'5..',application='myapp',version='canary'}[1m])/rate(http_server_requests_seconds_count{application='myapp',version='canary'}[1m])*100" | jq -r '.data.result[0].value[1] // "0"')
            echo "[$((i*30))s] 错误率: ${ERROR_RATE}%"
            if (( $(echo "$ERROR_RATE > 1" | bc -l) )); then
              echo "❌ 错误率超过阈值 1%，触发回滚"
              kubectl rollout undo deployment/myapp-canary -n production
              exit 1
            fi
            sleep 30
          done
          echo "✅ 灰度观察通过"

  # ──────────────────────────────────────────────
  # Job 3: 生产环境全量发布
  # ──────────────────────────────────────────────
  deploy-production:
    needs: [deploy-staging, deploy-canary]
    # 如果跳过 canary，只要有 staging 就行；否则需要 canary 通过
    if: always() && needs.deploy-staging.result == 'success' && (needs.deploy-canary.result == 'success' || needs.deploy-canary.result == 'skipped')
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://example.com
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up kubeconfig
        uses: azure/k8s-set-context@v4
        with:
          kubeconfig: ${{ secrets.PROD_KUBECONFIG }}

      # 全量更新生产 Deployment
      - name: Full Rollout
        run: |
          kubectl set image deployment/myapp \
            myapp=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.image-tag }} \
            -n production
          echo "等待全量 rollout 完成..."
          kubectl rollout status deployment/myapp -n production --timeout=600s

      # 清理 canary 副本
      - name: Scale Down Canary
        if: ${{ !inputs.skip-canary }}
        run: |
          kubectl scale deployment/myapp-canary --replicas=0 -n production
          echo "✅ Canary 副本已缩容"

      # 发版后验证
      - name: Post-deploy Verification
        run: |
          echo "🔍 生产环境健康检查..."
          for i in $(seq 1 5); do
            if curl -sf https://example.com/health; then
              echo "\n✅ 生产环境健康检查通过"
              exit 0
            fi
            sleep 10
          done
          echo "❌ 生产环境健康检查失败，考虑回滚"
          exit 1

      # 发送发版通知
      - name: Notify
        if: always()
        run: |
          STATUS=${{ job.status }}
          echo "发版 ${STATUS}: ${{ inputs.image-tag }}"
          # 可接入企业微信/钉钉/Slack webhook
          # curl -X POST "$WEBHOOK_URL" -H 'Content-Type: application/json' -d '{"text":"发版完成: ${{ inputs.image-tag }}"}'

# .github/workflows/monorepo-ci.yml
# Monorepo CI：只构建变更的服务
name: Monorepo CI

on:
  push:
    branches: [develop, main]
  pull_request:
    branches: [develop, main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ──────────────────────────────────────────────
  # Job 1: 检测哪些服务发生了变更
  # ──────────────────────────────────────────────
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      user-service: ${{ steps.filter.outputs.user-service }}
      order-service: ${{ steps.filter.outputs.order-service }}
      gateway: ${{ steps.filter.outputs.gateway }}
    steps:
      - uses: actions/checkout@v4

      - name: Detect changed paths
        id: filter
        uses: dorny/paths-filter@v3
        with:
          filters: |
            user-service:
              - 'services/user-service/**'
              - 'libs/common/**'       # 公共库变更也要重新构建
            order-service:
              - 'services/order-service/**'
              - 'libs/common/**'
            gateway:
              - 'services/gateway/**'
              - 'libs/common/**'

  # ──────────────────────────────────────────────
  # Job 2: 使用 matrix 并行构建变更的服务
  # ──────────────────────────────────────────────
  build-services:
    needs: detect-changes
    # 仅在有服务变更时运行
    if: needs.detect-changes.outputs.user-service == 'true' || needs.detect-changes.outputs.order-service == 'true' || needs.detect-changes.outputs.gateway == 'true'
    runs-on: ubuntu-latest
    strategy:
      # 动态 matrix：只包含有变更的服务
      matrix:
        include:
          - service: user-service
            enabled: ${{ needs.detect-changes.outputs.user-service }}
            module: services/user-service
            port: 8081
          - service: order-service
            enabled: ${{ needs.detect-changes.outputs.order-service }}
            module: services/order-service
            port: 8082
          - service: gateway
            enabled: ${{ needs.detect-changes.outputs.gateway }}
            module: services/gateway
            port: 8080
      # 某个服务构建失败不影响其他服务
      fail-fast: false
    steps:
      - name: Skip if not changed
        if: matrix.enabled != 'true'
        run: echo "⏭️ ${{ matrix.service }} 未变更，跳过构建"

      - name: Checkout
        if: matrix.enabled == 'true'
        uses: actions/checkout@v4

      - name: Set up JDK 17
        if: matrix.enabled == 'true'
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: 'maven'

      # 只构建变更的模块及其依赖
      - name: Build & Test
        if: matrix.enabled == 'true'
        run: |
          mvn clean verify -B \
            -pl ${{ matrix.module }} \
            -am \
            -DskipITs

      - name: Build Docker Image
        if: matrix.enabled == 'true'
        run: |
          docker build -t ghcr.io/${{ github.repository }}/${{ matrix.service }}:${{ github.sha }} \
            -f ${{ matrix.module }}/Dockerfile .

      - name: Push Image
        if: matrix.enabled == 'true' && github.event_name == 'push'
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker push ghcr.io/${{ github.repository }}/${{ matrix.service }}:${{ github.sha }}

# .github/workflows/reusable-ci.yml
# 可复用的 CI 工作流（放在组织级仓库或当前仓库均可）
name: Reusable CI

on:
  workflow_call:
    inputs:
      java-version:
        type: string
        default: '17'
        description: 'JDK 版本'
      module-path:
        type: string
        default: '.'
        description: 'Maven 模块路径'
    secrets:
      SONAR_TOKEN:
        required: true
      SONAR_HOST_URL:
        required: true

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          java-version: ${{ inputs.java-version }}
          distribution: 'corretto'
          cache: 'maven'

      - name: Build & Test
        run: mvn clean verify -B -pl ${{ inputs.module-path }} -am

      - name: SonarQube Scan
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        run: mvn sonar:sonar -Dsonar.projectKey=${{ github.repository }}

      - uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: target/surefire-reports/
          retention-days: 7

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  ci:
    uses: ./.github/workflows/reusable-ci.yml  # 本仓库内引用
    # 或引用组织级仓库：uses: my-org/.github/.github/workflows/reusable-ci.yml@main
    with:
      java-version: '17'
      module-path: '.'
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

# .github/workflows/matrix-ci.yml
name: Matrix CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
        java: ['17', '21']
        # 排除不合理的组合（可选）
        exclude:
          - os: macos-latest
            java: '17'
      fail-fast: false  # 某个组合失败不影响其他组合
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: 'corretto'
          cache: 'maven'

      - name: Build & Test
        run: mvn clean verify -B

# .github/dependabot.yml
# Dependabot 配置：自动检测依赖更新和安全漏洞
version: 2
updates:
  # Maven 依赖更新
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "Asia/Shanghai"
    # 自动创建 PR 的目标分支
    target-branch: "develop"
    # 限制同时打开的 PR 数量
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "automated"
    # 按依赖分组，减少 PR 数量
    groups:
      spring:
        patterns:
          - "org.springframework*"
      testing:
        patterns:
          - "org.junit*"
          - "org.mockito*"

  # GitHub Actions 版本更新
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "ci"
      - "automated"

  # Docker 基础镜像更新
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "docker"
      - "automated"

# .github/workflows/codeql.yml
# CodeQL 代码安全扫描（GitHub 内置）
name: CodeQL Analysis

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    # 每周一凌晨 2 点定时扫描
    - cron: '0 18 * * 1'

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      matrix:
        language: ['java']
    steps:
      - uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: +security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"

# K8s Deployment
env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: myapp-secrets
        key: db-password
  - name: AK
    valueFrom:
      secretKeyRef:
        name: myapp-secrets
        key: access-key

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
spec:
  hosts:
    - myapp.example.com
  http:
    - route:
        - destination:
            host: myapp
            subset: stable
          weight: 90
        - destination:
            host: myapp
            subset: canary
          weight: 10

# Istio 按 header 分流
http:
  - match:
      - headers:
          x-user-group:
            exact: "beta"
    route:
      - destination:
          host: myapp
          subset: canary
  - route:
      - destination:
          host: myapp
          subset: stable

# 查看历史版本
kubectl rollout history deployment/myapp -n production

# 回滚到上一个版本
kubectl rollout undo deployment/myapp -n production

# 回滚到指定版本
kubectl rollout undo deployment/myapp --to-revision=3 -n production

# 查看回滚状态
kubectl rollout status deployment/myapp -n production