CI/CD 持续集成与部署

代码提交 push / PR
      │
      ▼
┌─────────────┐
│  触发流水线  │
└─────────────┘
      │
      ▼
┌─────────────────────────────┐
│ 阶段 1: 代码质量 (可并行)     │
│  · ESLint 代码风格           │
│  · TypeScript 类型检查        │
│  · Prettier 格式检查          │
│  · 单元测试 + 覆盖率          │
└─────────────────────────────┘
      │ 全部通过
      ▼
┌─────────────────────────────┐
│ 阶段 2: 安全扫描 (可并行)     │
│  · 依赖漏洞扫描 (npm audit)   │
│  · SAST 静态代码安全分析      │
│  · 密钥泄露检测               │
└─────────────────────────────┘
      │
      ▼
┌─────────────────────────────┐
│ 阶段 3: 构建                  │
│  · npm run build             │
│  · 产物上传为 artifact        │
│  · 构建 Docker 镜像           │
└─────────────────────────────┘
      │
      ▼
┌─────────────────────────────┐
│ 阶段 4: 部署                  │
│  · 部署预生产 → 冒烟测试       │
│  · 人工/自动批准             │
│  · 部署生产 (金丝雀/蓝绿)     │
└─────────────────────────────┘
      │
      ▼
┌─────────────────────────────┐
│ 阶段 5: 发布后               │
│  · 健康检查                  │
│  · 监控告警                  │
│  · 异常自动回滚              │
└─────────────────────────────┘

# Git Flow 典型命令流程
git checkout develop
git checkout -b feature/user-login       # 从 develop 拉特性分支
# ... 开发与提交 ...
git checkout develop
git merge --no-ff feature/user-login     # 完成后合回 develop

git checkout -b release/1.2.0 develop    # 准备发布
# ... 修 bug、改版本号 ...
git checkout master
git merge --no-ff release/1.2.0
git tag -a v1.2.0 -m "Release 1.2.0"
git checkout develop
git merge --no-ff release/1.2.0          # 发布内容回流 develop

git checkout -b hotfix/1.2.1 master      # 紧急修复
# ... 修复 ...
git checkout master && git merge --no-ff hotfix/1.2.1
git checkout develop && git merge --no-ff hotfix/1.2.1

#!/usr/bin/env bash
# rollback.sh —— Kubernetes 一键回滚脚本示例
set -euo pipefail

DEPLOYMENT="${1:-web-frontend}"
NAMESPACE="${2:-production}"

echo "查看部署历史..."
kubectl rollout history deployment/"${DEPLOYMENT}" -n "${NAMESPACE}"

echo "回滚到上一个版本..."
kubectl rollout undo deployment/"${DEPLOYMENT}" -n "${NAMESPACE}"

echo "等待回滚完成..."
kubectl rollout status deployment/"${DEPLOYMENT}" -n "${NAMESPACE}" --timeout=120s

echo "回滚完成，当前 Pod 状态："
kubectl get pods -n "${NAMESPACE}" -l app="${DEPLOYMENT}"

// featureFlags.ts —— 一个简单的功能开关实现
interface FlagContext {
  userId: string;
  region?: string;
}

interface FlagRule {
  enabled: boolean;
  rolloutPercentage?: number; // 0-100 灰度比例
  allowRegions?: string[];
}

const flags: Record<string, FlagRule> = {
  'new-checkout-flow': { enabled: true, rolloutPercentage: 20 },
  'dark-mode': { enabled: true, allowRegions: ['CN', 'JP'] },
};

// 基于用户 ID 做稳定哈希，保证同一用户体验一致
function hashToPercent(key: string): number {
  let hash = 0;
  for (let i = 0; i < key.length; i++) {
    hash = (hash * 31 + key.charCodeAt(i)) & 0xffffffff;
  }
  return Math.abs(hash) % 100;
}

export function isEnabled(flagName: string, ctx: FlagContext): boolean {
  const rule = flags[flagName];
  if (!rule || !rule.enabled) return false;
  if (rule.allowRegions && ctx.region && !rule.allowRegions.includes(ctx.region)) {
    return false;
  }
  if (rule.rolloutPercentage != null) {
    return hashToPercent(flagName + ':' + ctx.userId) < rule.rolloutPercentage;
  }
  return true;
}

// 使用
if (isEnabled('new-checkout-flow', { userId: 'u_12345', region: 'CN' })) {
  // 展示新版结算流程
}

# .github/workflows/security.yml —— 安全扫描工作流
name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1' # 每周一凌晨定时全量扫描

jobs:
  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Run npm audit
        run: npm audit --audit-level=high

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # 扫描全部历史
      - name: Gitleaks scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  codeql-sast:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

# Dockerfile —— 前端项目多阶段构建
# 阶段一：构建
FROM node:20-alpine AS builder
WORKDIR /app
# 先拷贝依赖清单，利用 Docker 层缓存
COPY package.json package-lock.json ./
RUN npm ci
# 再拷贝源码构建
COPY . .
RUN npm run build

# 阶段二：运行（只保留构建产物 + nginx）
FROM nginx:1.27-alpine AS runner
COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 80
HEALTHCHECK --interval=30s --timeout=3s CMD wget -q -O /dev/null http://localhost/ || exit 1
CMD ["nginx", "-g", "daemon off;"]

# .github/workflows/docker.yml —— 构建并推送 Docker 镜像
name: Build and Push Docker Image

on:
  push:
    branches: [main]
    tags: ['v*']

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha,prefix=sha-

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# k8s/deployment.yaml —— 前端应用的 Deployment 与滚动更新配置
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-frontend
  namespace: production
spec:
  replicas: 4
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # 更新时最多多起 1 个 Pod
      maxUnavailable: 0  # 更新时不允许有不可用 Pod（保证零停机）
  selector:
    matchLabels:
      app: web-frontend
  template:
    metadata:
      labels:
        app: web-frontend
    spec:
      containers:
        - name: web
          image: ghcr.io/acme/web-frontend:sha-abc123
          ports:
            - containerPort: 80
          readinessProbe:      # 就绪探针：通过后才接流量
            httpGet:
              path: /healthz
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:       # 存活探针：失败则重启容器
            httpGet:
              path: /healthz
              port: 80
            initialDelaySeconds: 15
            periodSeconds: 20
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
---
apiVersion: v1
kind: Service
metadata:
  name: web-frontend
  namespace: production
spec:
  selector:
    app: web-frontend
  ports:
    - port: 80
      targetPort: 80

#!/usr/bin/env bash
# canary-deploy.sh —— 金丝雀渐进式发布
set -euo pipefail

NEW_IMAGE="${1:?请提供新镜像标签, 例如 ghcr.io/acme/web:sha-abc123}"
NAMESPACE="${2:-production}"
STAGES=(5 25 50 100)          # 逐步放量比例
CHECK_URL="https://example.com/healthz"

# 更新金丝雀 Deployment 的镜像
kubectl set image deployment/web-canary web="${NEW_IMAGE}" -n "${NAMESPACE}"
kubectl rollout status deployment/web-canary -n "${NAMESPACE}" --timeout=120s

for pct in "${STAGES[@]}"; do
  echo "==> 放量至 ${pct}%"
  # 假设稳定版共 10 个副本，按比例调整金丝雀副本数
  canary_replicas=$(( pct / 10 ))
  stable_replicas=$(( 10 - canary_replicas ))
  kubectl scale deployment/web-canary --replicas="${canary_replicas}" -n "${NAMESPACE}"
  kubectl scale deployment/web-stable --replicas="${stable_replicas}" -n "${NAMESPACE}"

  echo "观察 60 秒，检查健康与错误率..."
  sleep 60

  # 健康检查：连续失败则回滚
  if ! curl -fsS "${CHECK_URL}" > /dev/null; then
    echo "健康检查失败，回滚金丝雀！"
    kubectl scale deployment/web-canary --replicas=0 -n "${NAMESPACE}"
    kubectl scale deployment/web-stable --replicas=10 -n "${NAMESPACE}"
    exit 1
  fi
  echo "${pct}% 阶段正常。"
done

echo "金丝雀全量成功，将稳定版镜像同步为新版本。"
kubectl set image deployment/web-stable web="${NEW_IMAGE}" -n "${NAMESPACE}"
kubectl rollout status deployment/web-stable -n "${NAMESPACE}" --timeout=120s

// .releaserc.json —— semantic-release 配置
{
  "branches": ["main", { "name": "beta", "prerelease": true }],
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    ["@semantic-release/changelog", { "changelogFile": "CHANGELOG.md" }],
    "@semantic-release/npm",
    ["@semantic-release/git", {
      "assets": ["CHANGELOG.md", "package.json"],
      "message": "chore(release): ${nextRelease.version} [skip ci]"
    }],
    "@semantic-release/github"
  ]
}

# .github/workflows/release.yml —— 自动语义化发布
name: Release

on:
  push:
    branches: [main]

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      - run: npm run build
      - name: Semantic Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx semantic-release

# prometheus/alert-rules.yml —— Prometheus 告警规则示例
groups:
  - name: web-frontend-alerts
    rules:
      - alert: HighErrorRate
        expr: |
          sum(rate(http_requests_total{status=~"5.."}[5m]))
          / sum(rate(http_requests_total[5m])) > 0.05
        for: 3m
        labels:
          severity: critical
        annotations:
          summary: "5xx 错误率超过 5%"
          description: "过去 5 分钟服务端错误率为 {{ $value | humanizePercentage }}"

      - alert: HighLatencyP95
        expr: |
          histogram_quantile(0.95, sum(rate(http_request_duration_seconds_bucket[5m])) by (le)) > 1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "P95 延迟超过 1 秒"

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

# 同一分支的旧运行自动取消，节省资源
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # 阶段一：代码质量与测试（多 Node 版本矩阵）
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node-version: [18.x, 20.x]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run linter
        run: npm run lint

      - name: Run type check
        run: npm run type-check

      - name: Run unit tests
        run: npm run test:unit -- --coverage

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage/lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}

  # 阶段二：端到端测试（分片并行）
  e2e:
    runs-on: ubuntu-latest
    needs: test
    strategy:
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20.x
          cache: 'npm'
      - run: npm ci
      - name: Install Playwright browsers
        run: npx playwright install --with-deps chromium
      - name: Run E2E tests (shard ${{ matrix.shard }}/4)
        run: npx playwright test --shard=${{ matrix.shard }}/4

  # 阶段三：构建
  build:
    runs-on: ubuntu-latest
    needs: [test, e2e]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20.x
          cache: 'npm'
      - run: npm ci
      - name: Build project
        run: npm run build
        env:
          NODE_ENV: production
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
          retention-days: 7

  # 阶段四：部署预生产
  deploy-staging:
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/develop'
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Deploy to staging
        run: echo "Deploying to staging environment"

  # 阶段五：部署生产（环境保护 + 人工审批）
  deploy-production:
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/main'
    environment:
      name: production   # 在仓库设置里为该环境配置必需审批人
      url: https://example.com
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Deploy to production
        run: echo "Deploying to production environment"

# .github/workflows/reusable-deploy.yml —— 被复用的工作流
name: Reusable Deploy

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      url:
        required: false
        type: string
    secrets:
      deploy-token:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.environment }}
      url: ${{ inputs.url }}
    steps:
      - uses: actions/checkout@v4
      - name: Deploy
        env:
          DEPLOY_TOKEN: ${{ secrets.deploy-token }}
        run: |
          echo "Deploying to ${{ inputs.environment }}"
          # 实际部署命令

# .github/workflows/caller.yml —— 调用复用工作流
name: Deploy Caller

on:
  push:
    branches: [main]

jobs:
  call-deploy:
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      environment: production
      url: https://example.com
    secrets:
      deploy-token: ${{ secrets.DEPLOY_TOKEN }}

# .github/workflows/deploy-aws.yml
name: Deploy to AWS

on:
  push:
    branches: [main]

permissions:
  id-token: write   # 允许请求 OIDC 令牌
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
          aws-region: ap-southeast-1
      - name: Sync to S3
        run: aws s3 sync ./dist s3://my-web-bucket --delete
      - name: Invalidate CloudFront cache
        run: aws cloudfront create-invalidation --distribution-id ${{ secrets.CF_DIST_ID }} --paths "/*"

# 当需要比 setup-node 内置缓存更精细的控制时
      - name: Cache node_modules
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            ~/.npm
            node_modules
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        if: steps.npm-cache.outputs.cache-hit != 'true'
        run: npm ci

# .gitlab-ci.yml
stages:
  - test
  - build
  - deploy

variables:
  NODE_ENV: production

# 全局依赖缓存
default:
  image: node:20
  cache:
    key:
      files:
        - package-lock.json
    paths:
      - .npm/
  before_script:
    - npm ci --cache .npm --prefer-offline

# 代码检查与测试
test:
  stage: test
  script:
    - npm run lint
    - npm run type-check
    - npm run test:unit
    - npm run test:coverage
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'
  artifacts:
    when: always
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
      junit: coverage/junit.xml
    expire_in: 1 week

# 端到端测试（并行分片）
e2e:
  stage: test
  parallel: 4
  script:
    - npx playwright install --with-deps chromium
    - npx playwright test --shard=${CI_NODE_INDEX}/${CI_NODE_TOTAL}

# 构建
build:
  stage: build
  script:
    - npm run build
  artifacts:
    paths:
      - dist/
    expire_in: 1 week
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop"'

# 部署预生产
deploy-staging:
  stage: deploy
  environment:
    name: staging
    url: https://staging.example.com
  dependencies:
    - build
  script:
    - echo "Deploying to staging environment"
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'

# 部署生产（手动触发）
deploy-production:
  stage: deploy
  environment:
    name: production
    url: https://example.com
  dependencies:
    - build
  script:
    - echo "Deploying to production environment"
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual

// Jenkinsfile
pipeline {
  agent any

  options {
    timeout(time: 30, unit: 'MINUTES')
    disableConcurrentBuilds()
    buildDiscarder(logRotator(numToKeepStr: '20'))
  }

  environment {
    NODE_VERSION = '20'
    CI = 'true'
  }

  stages {
    stage('Checkout') {
      steps {
        checkout scm
      }
    }

    stage('Install') {
      steps {
        sh 'npm ci'
      }
    }

    stage('Quality') {
      parallel {
        stage('Lint') {
          steps { sh 'npm run lint' }
        }
        stage('Type Check') {
          steps { sh 'npm run type-check' }
        }
        stage('Unit Test') {
          steps { sh 'npm run test:unit' }
          post {
            always {
              junit 'coverage/junit.xml'
              publishHTML(target: [
                reportDir: 'coverage',
                reportFiles: 'index.html',
                reportName: 'Coverage Report'
              ])
            }
          }
        }
      }
    }

    stage('Build') {
      steps {
        sh 'npm run build'
        archiveArtifacts artifacts: 'dist/**', fingerprint: true
      }
    }

    stage('Deploy Staging') {
      when { branch 'develop' }
      steps {
        sh 'npm run deploy:staging'
      }
    }

    stage('Deploy Production') {
      when { branch 'main' }
      steps {
        input message: '确认部署到生产环境?', ok: '部署'
        sh 'npm run deploy:production'
      }
    }
  }

  post {
    success {
      echo 'Pipeline succeeded!'
    }
    failure {
      echo 'Pipeline failed!'
      mail to: 'team@example.com',
           subject: "Jenkins Pipeline Failed: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
           body: "Build failed. Please check: ${env.BUILD_URL}"
    }
    always {
      cleanWs()
    }
  }
}

# .circleci/config.yml
version: 2.1

orbs:
  node: circleci/node@5.2.0

jobs:
  test:
    docker:
      - image: cimg/node:20.11
    steps:
      - checkout
      - node/install-packages:
          pkg-manager: npm
      - run:
          name: Lint
          command: npm run lint
      - run:
          name: Unit Tests
          command: npm run test:unit
      - store_test_results:
          path: coverage

  build:
    docker:
      - image: cimg/node:20.11
    steps:
      - checkout
      - node/install-packages:
          pkg-manager: npm
      - run:
          name: Build
          command: npm run build
      - persist_to_workspace:
          root: .
          paths:
            - dist

  deploy:
    docker:
      - image: cimg/node:20.11
    steps:
      - attach_workspace:
          at: .
      - run:
          name: Deploy
          command: echo "Deploying..."

workflows:
  build-test-deploy:
    jobs:
      - test
      - build:
          requires:
            - test
      - deploy:
          requires:
            - build
          filters:
            branches:
              only: main

#!/usr/bin/env bash
# pipeline-metrics.sh —— 采集近 100 次工作流运行的耗时与成功率
set -euo pipefail

REPO="${1:?用法: pipeline-metrics.sh owner/repo}"
WORKFLOW="${2:-ci-cd.yml}"

# 拉取运行记录（需设置 GH_TOKEN 环境变量）
runs=$(gh api "repos/${REPO}/actions/workflows/${WORKFLOW}/runs?per_page=100" \
  --jq '.workflow_runs[] | {id, conclusion, created_at, updated_at}')

echo "${runs}" | jq -s '
  {
    total: length,
    success: [.[] | select(.conclusion == "success")] | length,
    failure: [.[] | select(.conclusion == "failure")] | length,
    success_rate: (([.[] | select(.conclusion == "success")] | length) / length * 100 | floor),
    avg_duration_sec: (
      [.[] | (( .updated_at | fromdateiso8601) - (.created_at | fromdateiso8601))]
      | add / length | floor
    )
  }
'

# 在 deploy-production Job 的最后追加一步
      - name: 上报部署指标到 Prometheus Pushgateway
        run: |
          # 计算变更前置时间：从提交到当前部署的秒数
          commit_ts=$(git show -s --format=%ct ${{ github.sha }})
          now_ts=$(date +%s)
          lead_time=$(( now_ts - commit_ts ))

          cat <<EOF | curl --data-binary @- \
            https://pushgateway.example.com/metrics/job/deploy/env/production
          # TYPE deployment_total counter
          deployment_total 1
          # TYPE deployment_lead_time_seconds gauge
          deployment_lead_time_seconds ${lead_time}
          EOF

# .github/workflows/turbo-remote-cache.yml —— Turborepo 远程缓存
name: CI with Remote Cache

on: [push, pull_request]

env:
  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
  # 强制开启远程缓存签名，防止缓存投毒
  TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_SIGNATURE_KEY }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2   # 需要上一个提交做 affected 比较
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      # turbo 会自动读写远程缓存，命中则跳过实际执行
      - run: npx turbo run build test lint --cache-dir=.turbo

# syntax=docker/dockerfile:1.7
FROM node:20-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
# 即便 lockfile 变化导致本层重建，~/.npm 缓存目录仍被复用
RUN --mount=type=cache,target=/root/.npm \
    npm ci --prefer-offline

FROM node:20-alpine AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN --mount=type=cache,target=/app/.next/cache \
    npm run build

# 在 CI 中启用 sccache，编译产物缓存到 S3
export RUSTC_WRAPPER=sccache
export SCCACHE_BUCKET=my-sccache-bucket
export SCCACHE_REGION=ap-southeast-1

sccache --start-server
npm run build:native
sccache --show-stats   # 查看命中率，正常应达 70% 以上

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node: [18, 20, 22]
        # 排除无意义或成本高的组合
        exclude:
          - os: macos-latest
            node: 18       # macOS Runner 贵，只测新版本
        # 为特定组合追加额外参数
        include:
          - os: ubuntu-latest
            node: 20
            coverage: true   # 只在这个组合上采集覆盖率
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - run: npm ci
      - run: npm test
      - if: ${{ matrix.coverage }}
        run: npm run test:coverage

jobs:
  detect:
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.set.outputs.packages }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: set
        run: |
          # 找出发生变更的 packages 子目录，拼成 JSON 数组
          changed=$(git diff --name-only origin/main...HEAD \
            | grep '^packages/' | cut -d/ -f2 | sort -u \
            | jq -R . | jq -sc .)
          echo "packages=${changed}" >> "$GITHUB_OUTPUT"

  test:
    needs: detect
    if: ${{ needs.detect.outputs.packages != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        package: ${{ fromJson(needs.detect.outputs.packages) }}
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm test --workspace=packages/${{ matrix.package }}

# arc-runner-set.yaml —— ARC 伸缩配置（简化）
apiVersion: actions.github.com/v1alpha1
kind: AutoscalingRunnerSet
metadata:
  name: web-frontend-runners
  namespace: arc-runners
spec:
  githubConfigUrl: https://github.com/acme/web-frontend
  githubConfigSecret: github-app-secret
  minRunners: 0        # 空闲时缩到 0，不花钱
  maxRunners: 30       # 高峰最多 30 个
  template:
    spec:
      containers:
        - name: runner
          image: ghcr.io/actions/actions-runner:latest
          resources:
            requests:
              cpu: "2"
              memory: 4Gi

# 用 concurrency 自动取消同分支的过期运行，避免浪费 Runner
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# argocd-application.yaml —— 声明一个由 ArgoCD 管理的应用
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: web-frontend
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/acme/k8s-manifests
    targetRevision: main
    path: apps/web-frontend/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true       # Git 里删掉的资源，集群里也删
      selfHeal: true    # 有人手工改集群，自动拉回 Git 声明的状态
    syncOptions:
      - CreateNamespace=true
    retry:
      limit: 3
      backoff:
        duration: 10s
        factor: 2

#!/usr/bin/env bash
# ci 中更新 manifest 仓库的镜像 tag，触发 GitOps 同步
set -euo pipefail
NEW_TAG="${1:?镜像 tag}"

git clone https://x-access-token:${GH_TOKEN}@github.com/acme/k8s-manifests.git
cd k8s-manifests
# 用 yq 原地修改镜像 tag
yq -i ".spec.template.spec.containers[0].image = \"ghcr.io/acme/web:${NEW_TAG}\"" \
  apps/web-frontend/production/deployment.yaml
git config user.name "ci-bot"
git config user.email "ci@acme.com"
git commit -am "chore: bump web-frontend to ${NEW_TAG}"
git push
# 推送后 ArgoCD 检测到变更，自动同步到集群

# rollout.yaml —— Argo Rollouts 带自动分析的金丝雀
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: web-frontend
spec:
  replicas: 10
  strategy:
    canary:
      steps:
        - setWeight: 5      # 先给 5% 流量
        - pause: { duration: 2m }
        - analysis:          # 自动分析指标，不达标则回滚
            templates:
              - templateName: success-rate
        - setWeight: 25
        - pause: { duration: 5m }
        - setWeight: 50
        - pause: { duration: 5m }
        - setWeight: 100
  selector:
    matchLabels:
      app: web-frontend
  template:
    metadata:
      labels:
        app: web-frontend
    spec:
      containers:
        - name: web
          image: ghcr.io/acme/web:latest
---
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
spec:
  metrics:
    - name: success-rate
      interval: 1m
      count: 5
      # 成功率低于 95% 则判定失败，触发自动回滚
      successCondition: result >= 0.95
      failureLimit: 2
      provider:
        prometheus:
          address: http://prometheus.monitoring:9090
          query: |
            sum(rate(http_requests_total{app="web-frontend",status!~"5.."}[2m]))
            / sum(rate(http_requests_total{app="web-frontend"}[2m]))

      - name: 从 Vault 获取临时数据库凭证
        uses: hashicorp/vault-action@v3
        with:
          url: https://vault.example.com
          method: jwt          # 用 GitHub OIDC JWT 认证，无需存 Vault token
          role: ci-web-frontend
          secrets: |
            database/creds/web-role username | DB_USER ;
            database/creds/web-role password | DB_PASS
      - name: 运行迁移（凭证 1 小时后自动失效）
        run: npm run migrate
        env:
          DATABASE_URL: postgres://${{ env.DB_USER }}:${{ env.DB_PASS }}@db:5432/app

# .github/workflows/supply-chain.yml —— SBOM 生成 + 镜像签名
name: Supply Chain Security

on:
  push:
    tags: ['v*']

permissions:
  contents: read
  packages: write
  id-token: write   # Cosign 无密钥签名需要 OIDC

jobs:
  build-sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 构建镜像
        run: docker build -t ghcr.io/acme/web:${{ github.ref_name }} .

      - name: 生成 SBOM（CycloneDX 格式）
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/acme/web:${{ github.ref_name }}
          format: cyclonedx-json
          output-file: sbom.cdx.json

      - name: 扫描 SBOM 中的已知漏洞
        uses: anchore/scan-action@v4
        with:
          sbom: sbom.cdx.json
          fail-build: true
          severity-cutoff: high

      - name: 推送镜像
        run: docker push ghcr.io/acme/web:${{ github.ref_name }}

      - name: 用 Cosign 无密钥签名镜像
        run: |
          cosign sign --yes ghcr.io/acme/web:${{ github.ref_name }}
          # 将 SBOM 作为附件绑定到镜像
          cosign attach sbom --sbom sbom.cdx.json \
            ghcr.io/acme/web:${{ github.ref_name }}

jobs:
  deploy-regions:
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 1     # 关键：区域串行，一个稳了再下一个
      matrix:
        region:
          - { name: ap-southeast-1, weight: canary }  # 先发小流量区域
          - { name: ap-northeast-1, weight: normal }
          - { name: us-east-1,      weight: normal }   # 核心区域最后发
    steps:
      - uses: actions/checkout@v4
      - name: 部署到 ${{ matrix.region.name }}
        run: ./deploy.sh --region ${{ matrix.region.name }}
      - name: 区域健康检查
        run: ./healthcheck.sh --region ${{ matrix.region.name }} --timeout 300
      # 任一区域健康检查失败，串行矩阵会中断，避免污染后续区域

#!/usr/bin/env bash
# rollback-drill.sh —— 回滚演练，度量恢复耗时
set -euo pipefail
NAMESPACE="${1:-staging}"
DEPLOY="${2:-web-frontend}"

start=$(date +%s)
echo "[演练] 模拟部署一个坏版本..."
kubectl set image deployment/"${DEPLOY}" web=ghcr.io/acme/web:broken -n "${NAMESPACE}"

echo "[演练] 等待监控检测异常..."
sleep 15

echo "[演练] 执行回滚..."
kubectl rollout undo deployment/"${DEPLOY}" -n "${NAMESPACE}"
kubectl rollout status deployment/"${DEPLOY}" -n "${NAMESPACE}" --timeout=120s

end=$(date +%s)
echo "[演练] 恢复耗时: $(( end - start )) 秒"
echo "[演练] 若超过 SLA（如 300 秒），需优化回滚流程"

# chaos-pod-kill.yaml —— 用 Chaos Mesh 随机杀 Pod，验证自愈
apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata:
  name: pod-kill-experiment
  namespace: staging
spec:
  action: pod-kill
  mode: one          # 每次随机杀一个 Pod
  selector:
    namespaces:
      - staging
    labelSelectors:
      app: web-frontend
  scheduler:
    cron: '@every 10m'   # 每 10 分钟杀一次，验证副本能否自动补齐

# .github/workflows/monorepo-ci.yml —— Nx affected 增量 CI
name: Monorepo CI

on:
  pull_request:
    branches: [main]

jobs:
  affected:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # affected 需要完整历史做 base 比较
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      # 设定 base 与 head，Nx 据此算出受影响项目
      - uses: nrwl/nx-set-shas@v4
      # 只对受影响的项目跑 lint/test/build，未受影响的直接跳过
      - run: npx nx affected -t lint test build --parallel=3

      - name: 部署 PR 预览环境
        id: preview
        run: |
          url=$(npx vercel deploy --token=${{ secrets.VERCEL_TOKEN }} --yes)
          echo "url=${url}" >> "$GITHUB_OUTPUT"
      - name: 在 PR 评论预览链接
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '🚀 预览环境已就绪: ${{ steps.preview.outputs.url }}'
            })

// lighthouserc.json —— 性能预算断言
{
  "ci": {
    "collect": { "numberOfRuns": 3, "url": ["https://preview.example.com"] },
    "assert": {
      "assertions": {
        "categories:performance": ["error", { "minScore": 0.9 }],
        "categories:accessibility": ["error", { "minScore": 0.95 }],
        "largest-contentful-paint": ["error", { "maxNumericValue": 2500 }],
        "total-blocking-time": ["warn", { "maxNumericValue": 300 }],
        "cumulative-layout-shift": ["error", { "maxNumericValue": 0.1 }]
      }
    },
    "upload": { "target": "temporary-public-storage" }
  }
}

      - name: 运行 Lighthouse CI
        run: |
          npm install -g @lhci/cli
          lhci autorun

      - name: 视觉回归测试
        run: npx playwright test --grep @visual --update-snapshots=none
      - name: 包体积检查（超限则 CI 失败）
        run: npx size-limit

// .size-limit.json —— 每个入口的体积预算
[
  { "path": "dist/main.*.js", "limit": "180 KB" },
  { "path": "dist/vendor.*.js", "limit": "250 KB" }
]