ljwx-shiti/.gitea/workflows/ci.yml

name: Local CI/CD Pipeline

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master, develop]

env:
  # 本地 Harbor 配置
  HARBOR_HOST: ${{ secrets.HARBOR_CN_HOST || 'harbor.omniverseai.net' }}
  HARBOR_PROJECT: ${{ secrets.HARBOR_PROJECT || 'ljwx' }}
  IMAGE_NAME: ${{ secrets.IMAGE_NAME || 'ljwx-shiti' }}

jobs:
  # ── Job 1: Lint and Test ──────────────────────────────────────────────────
  test:
    name: Test Backend
    runs-on: ubuntu-latest
    timeout-minutes: 20

    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: wrongbook
          POSTGRES_PASSWORD: wrongbook
          POSTGRES_DB: wrongbook_test
        ports:
          - 5433:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

      redis:
        image: redis:7-alpine
        ports:
          - 6380:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"

      - name: Install dependencies
        run: |
          cd backend
          pip install --upgrade pip
          pip install -e ".[dev]"

      - name: Run linter
        run: |
          cd backend
          ruff check .

      - name: Run migrations
        env:
          DATABASE_URL: postgresql+asyncpg://wrongbook:wrongbook@localhost:5433/wrongbook_test
        run: |
          cd backend
          alembic upgrade head

      - name: Run tests with coverage
        env:
          TEST_DATABASE_URL: postgresql+asyncpg://wrongbook:wrongbook@localhost:5433/wrongbook_test
          REDIS_URL: redis://localhost:6380/0
          ANTHROPIC_AUTH_TOKEN: sk-ant-test-placeholder
          ANTHROPIC_BASE_URL: https://api.anthropic.com
          ANTHROPIC_MODEL: claude-sonnet-4-6
          TESTING: "true"
          JWT_SECRET: test-secret-key
        run: |
          cd backend
          pytest --cov=app --cov-report=xml --cov-report=term --cov-fail-under=50 -v

  # ── Job 2: Build and Push Docker Image ──────��─────────────────────────────
  build-and-push:
    name: Build and Push to Local Harbor
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || github.ref == 'refs/heads/develop')
    timeout-minutes: 30
    outputs:
      image_name: ${{ steps.meta.outputs.image_name }}
      image_ref: ${{ steps.meta.outputs.image_ref }}
      image_tag: ${{ steps.meta.outputs.image_tag }}
      image_digest: ${{ steps.build.outputs.digest }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Resolve metadata
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          IMAGE_NAME="${HARBOR_HOST}/${HARBOR_PROJECT}/${IMAGE_NAME}"
          IMAGE_TAG="${GITHUB_SHA:0:7}"
          {
            echo "image_name=${IMAGE_NAME}"
            echo "image_ref=${IMAGE_NAME}:${IMAGE_TAG}"
            echo "image_tag=${IMAGE_TAG}"
          } >> "$GITHUB_OUTPUT"

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.HARBOR_HOST }}
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v6
        id: build
        with:
          context: .
          file: backend/Dockerfile
          push: true
          tags: |
            ${{ steps.meta.outputs.image_ref }}
            ${{ steps.meta.outputs.image_name }}:latest
          cache-from: type=gha,scope=backend
          cache-to: type=gha,scope=backend,mode=max
          platforms: linux/amd64

  # ── Job 3: Update Deploy Repository ───────────────────────────────────────
  update-deploy:
    name: Update Local Deploy Repo
    runs-on: ubuntu-latest
    needs: build-and-push
    timeout-minutes: 10

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install PyYAML
        shell: bash
        run: python3 -m pip install --quiet pyyaml

      - name: Resolve deploy config
        id: cfg
        shell: bash
        run: |
          set -euo pipefail
          {
            echo "deploy_repo=ljwx/ljwx-deploy"
            echo "overlay_file=apps/ljwx-shiti/overlays/prod-local/kustomization.yaml"
          } >> "$GITHUB_OUTPUT"

      - name: Clone deploy repo
        env:
          DEPLOY_REPO_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_HOST: ${{ secrets.GITEA_HOST }}
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${DEPLOY_REPO_TOKEN:-}" ]; then
            echo "DEPLOY_REPO_TOKEN is required" && exit 1
          fi
          git clone \
            "https://oauth2:${DEPLOY_REPO_TOKEN}@${GITEA_HOST}/${{ steps.cfg.outputs.deploy_repo }}.git" \
            deploy-repo

      - name: Update overlay kustomization
        env:
          OVERLAY_FILE: ${{ steps.cfg.outputs.overlay_file }}
          IMAGE_NAME: ${{ needs.build-and-push.outputs.image_name }}
          IMAGE_TAG: ${{ needs.build-and-push.outputs.image_tag }}
        shell: bash
        run: |
          set -euo pipefail
          python3 - <<'PY'
          import os
          from pathlib import Path
          import yaml

          overlay = Path("deploy-repo") / os.environ["OVERLAY_FILE"]

          # 如果文件不存在，创建基础结构
          if not overlay.exists():
              overlay.parent.mkdir(parents=True, exist_ok=True)
              data = {
                  "apiVersion": "kustomize.config.k8s.io/v1beta1",
                  "kind": "Kustomization",
                  "namespace": "ljwx-shiti",
                  "resources": ["../../base"],
                  "images": []
              }
          else:
              data = yaml.safe_load(overlay.read_text()) or {}

          # 确保 images 字段存在
          if "images" not in data:
              data["images"] = []

          # 更新或添加镜像配置
          image_name = os.environ["IMAGE_NAME"]
          image_tag = os.environ["IMAGE_TAG"]

          found = False
          for img in data["images"]:
              if img.get("name") == image_name or img.get("newName") == image_name:
                  img["newTag"] = image_tag
                  found = True
                  break

          if not found:
              data["images"].append({
                  "name": image_name,
                  "newTag": image_tag
              })

          overlay.write_text(yaml.safe_dump(data, sort_keys=False))
          print(f"Updated {overlay} with image tag: {image_tag}")
          PY

      - name: Create deploy PR
        working-directory: deploy-repo
        env:
          GH_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GIT_SHA: ${{ github.sha }}
          IMAGE_REF: ${{ needs.build-and-push.outputs.image_ref }}
          IMAGE_DIGEST: ${{ needs.build-and-push.outputs.image_digest }}
        shell: bash
        run: |
          set -euo pipefail
          SHA_SHORT="${GIT_SHA:0:7}"
          BRANCH="bot/release-ljwx-shiti-${GITHUB_RUN_ID}"

          git config user.name "gitea-actions[bot]"
          git config user.email "gitea-actions[bot]@users.noreply.gitea.io"
          git checkout -b "${BRANCH}"
          git add "${{ steps.cfg.outputs.overlay_file }}"

          # 检查是否有变更
          if git diff --staged --quiet; then
            echo "No changes to commit"
            exit 0
          fi

          git commit -m "release(ljwx-shiti): ${SHA_SHORT}"
          git push origin "${BRANCH}"

          # 使用 Gitea API 创建 PR（如果 Gitea 支持）
          # 或者手动通知管理员

  # ── Job 4: Summary ─────────────────────────────────────────────────────────
  summary:
    name: CI/CD Summary
    runs-on: ubuntu-latest
    needs: [test, build-and-push, update-deploy]
    if: always()
    steps:
      - name: Generate summary
        run: |
          echo "## Local CI/CD Pipeline Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Test**: ${{ needs.test.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Build**: ${{ needs.build-and-push.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Deploy**: ${{ needs.update-deploy.result }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ needs.build-and-push.result }}" == "success" ]; then
            echo "**Image**: \`${{ needs.build-and-push.outputs.image_ref }}\`" >> $GITHUB_STEP_SUMMARY
          fi