构建流水线设计：从CI到CD

# 错误模式：每个阶段重新构建
Commit Stage → build artifact v1 → test v1
Acceptance Stage → build artifact v2 → test v2  # v2 可能与 v1 不同！

# 正确模式：一次构建，多次使用
Commit Stage → build artifact v1 → test v1
Acceptance Stage → use artifact v1 → test v1    # 确保测试的就是部署的

# .github/workflows/ci-cd-pipeline.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  ARTIFACT_NAME: app-${{ github.sha }}

# 并发控制：同一分支只保留最新运行
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ============================================
  # Stage 1: Commit Stage - 快速反馈
  # ============================================
  commit:
    name: Commit Stage
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Unit Tests
        run: npm run test:unit -- --coverage

      - name: Type Check
        run: npm run typecheck

      - name: Upload coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage/

  # ============================================
  # Stage 2: Build - 一次构建，产物共享
  # ============================================
  build:
    name: Build Artifact
    runs-on: ubuntu-latest
    needs: commit
    permissions:
      contents: read
      packages: write
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
      image-digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=
            type=ref,event=branch
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ============================================
  # Stage 3: Acceptance - 验收测试
  # ============================================
  acceptance:
    name: Acceptance Stage
    runs-on: ubuntu-latest
    needs: build
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: testdb
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Integration Tests
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/testdb
          REDIS_URL: redis://localhost:6379
        run: npm run test:integration

      - name: E2E Tests
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/testdb
          REDIS_URL: redis://localhost:6379
        run: npm run test:e2e

  # ============================================
  # Stage 4: Security Scan - 安全扫描
  # ============================================
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      - name: Upload Trivy scan results
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  # ============================================
  # Stage 5: Deploy to Staging
  # ============================================
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: [acceptance, security]
    if: github.ref == 'refs/heads/main'
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup kubectl
        uses: azure/setup-kubectl@v3
        with:
          version: 'v1.29.0'

      - name: Configure kubeconfig
        run: |
          mkdir -p $HOME/.kube
          echo "${{ secrets.KUBE_CONFIG_STAGING }}" | base64 -d > $HOME/.kube/config

      - name: Deploy to Staging
        run: |
          kubectl set image deployment/app \
            app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
            --namespace=staging
          kubectl rollout status deployment/app --namespace=staging --timeout=300s

      - name: Smoke Tests
        run: |
          sleep 30
          curl -f https://staging.example.com/health || exit 1

  # ============================================
  # Stage 6: Deploy to Production
  # ============================================
  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: deploy-staging
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
      url: https://app.example.com
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup kubectl
        uses: azure/setup-kubectl@v3
        with:
          version: 'v1.29.0'

      - name: Configure kubeconfig
        run: |
          mkdir -p $HOME/.kube
          echo "${{ secrets.KUBE_CONFIG_PROD }}" | base64 -d > $HOME/.kube/config

      - name: Canary Deployment (20% traffic)
        run: |
          kubectl apply -f k8s/canary.yml
          kubectl set image deployment/app-canary \
            app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
            --namespace=production
          kubectl rollout status deployment/app-canary --namespace=production --timeout=300s

      - name: Verify Canary Metrics
        run: |
          # 等待指标采集
          sleep 120
          # 检查错误率是否低于阈值
          ERROR_RATE=$(curl -s 'http://prometheus:9090/api/v1/query?query=rate(http_requests_total{status=~"5..",deployment="app-canary"}[2m])/rate(http_requests_total{deployment="app-canary"}[2m])' | jq -r '.data.result[0].value[1]')
          echo "Canary error rate: ${ERROR_RATE}"
          if (( $(echo "$ERROR_RATE > 0.01" | bc -l) )); then
            echo "Error rate exceeds 1% threshold, rolling back canary"
            kubectl delete deployment/app-canary --namespace=production
            exit 1
          fi

      - name: Full Rollout
        run: |
          kubectl set image deployment/app \
            app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
            --namespace=production
          kubectl rollout status deployment/app --namespace=production --timeout=300s
          kubectl delete deployment/app-canary --namespace=production

      - name: Post-Deploy Verification
        run: |
          curl -f https://app.example.com/health || exit 1
          curl -f https://app.example.com/api/v1/status || exit 1

# .github/workflows/reusable-ci.yml
name: Reusable CI Pipeline

on:
  workflow_call:
    inputs:
      node-version:
        description: 'Node.js version'
        required: false
        default: '20'
        type: string
      run-lint:
        description: 'Whether to run linting'
        required: false
        default: true
        type: boolean
      test-command:
        description: 'Custom test command'
        required: false
        default: 'npm test'
        type: string
    secrets:
      registry-token:
        description: 'Container registry token'
        required: false
    outputs:
      image-tag:
        description: 'Built image tag'
        value: ${{ jobs.build.outputs.image-tag }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'
      - run: npm ci
      - if: ${{ inputs.run-lint }}
        run: npm run lint
      - run: ${{ inputs.test-command }}

  build:
    needs: test
    runs-on: ubuntu-latest
    outputs:
      image-tag: ${{ steps.meta.outputs.version }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.registry-token || github.token }}
      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: type=sha
      - uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# .github/workflows/ci.yml (Consumer Repository)
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  ci:
    uses: my-org/.github/.github/workflows/reusable-ci.yml@main
    with:
      node-version: '20'
      test-command: 'npm run test:ci'
    secrets:
      registry-token: ${{ secrets.GHCR_TOKEN }}

# .gitlab-ci.yml
stages:
  - build
  - test
  - security
  - deploy

# Build Stage
build-app:
  stage: build
  script:
    - npm ci
    - npm run build
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour

build-docker:
  stage: build
  needs: [build-app]
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

# Test Stage - 并行执行
unit-test:
  stage: test
  needs: [build-app]  # 只依赖 build-app，无需等待 build-docker
  script:
    - npm ci
    - npm run test:unit
  coverage: '/Statements\s*:\s*(\d+\.\d+)%/'

integration-test:
  stage: test
  needs: [build-app]
  services:
    - postgres:16
    - redis:7
  script:
    - npm ci
    - npm run test:integration
  variables:
    POSTGRES_DB: testdb
    POSTGRES_USER: test
    POSTGRES_PASSWORD: test

e2e-test:
  stage: test
  needs: [build-docker]  # 依赖 Docker 镜像
  services:
    - name: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
      alias: app
  script:
    - npm ci
    - npm run test:e2e

# Security Stage - 与测试并行
sast:
  stage: security
  needs: []  # 无依赖，可与 build 并行
  script:
    - npm audit --audit-level=high
  allow_failure: false

container-scan:
  stage: security
  needs: [build-docker]
  script:
    - trivy image --exit-code 1 --severity CRITICAL,HIGH $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

# Deploy Stage
deploy-staging:
  stage: deploy
  needs: [unit-test, integration-test, container-scan]
  script:
    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n staging
  environment:
    name: staging
    url: https://staging.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy-production:
  stage: deploy
  needs: [e2e-test, deploy-staging]
  script:
    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n production
  environment:
    name: production
    url: https://app.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  when: manual  # Continuous Delivery: 需要人工确认

# tekton-task-build.yaml
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: build-and-push
spec:
  params:
    - name: image-tag
      description: 'Docker image tag'
    - name: context-path
      description: 'Build context path'
      default: '.'
  workspaces:
    - name: source
      description: 'Source code workspace'
  results:
    - name: image-digest
      description: 'Digest of the built image'
  steps:
    - name: build
      image: gcr.io/kaniko-project/executor:latest
      env:
        - name: DOCKER_CONFIG
          value: /tekton/home/.docker
      command:
        - /kaniko/executor
      args:
        - --dockerfile=Dockerfile
        - --context=$(workspaces.source.path)/$(params.context-path)
        - --destination=$(params.image-tag)
        - --digest-file=$(results.image-digest.path)
      volumeMounts:
        - name: docker-config
          mountPath: /tekton/home/.docker
  volumes:
    - name: docker-config
      secret:
        secretName: registry-credentials
---
# tekton-pipeline.yaml
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: ci-pipeline
spec:
  params:
    - name: git-repo-url
      type: string
    - name: git-revision
      type: string
    - name: image-name
      type: string
  workspaces:
    - name: shared-workspace
  results:
    - name: image-digest
      value: $(tasks.build-and-push.results.image-digest)
  tasks:
    - name: fetch-repository
      taskRef:
        name: git-clone
        kind: ClusterTask
      workspaces:
        - name: output
          workspace: shared-workspace
      params:
        - name: url
          value: $(params.git-repo-url)
        - name: revision
          value: $(params.git-revision)

    - name: run-tests
      runAfter:
        - fetch-repository
      taskRef:
        name: npm-test
      workspaces:
        - name: source
          workspace: shared-workspace

    - name: build-and-push
      runAfter:
        - run-tests
      taskRef:
        name: build-and-push
      workspaces:
        - name: source
          workspace: shared-workspace
      params:
        - name: image-tag
          value: $(params.image-name):$(params.git-revision)

    - name: security-scan
      runAfter:
        - build-and-push
      taskRef:
        name: trivy-scan
      params:
        - name: image-ref
          value: $(params.image-name):$(params.git-revision)

  finally:
    - name: notify
      taskRef:
        name: send-notification
      params:
        - name: status
          value: $(tasks.status)

# .github/workflows/pipeline-governance.yml
# 组织级流水线策略检查
name: Pipeline Governance Check

on:
  pull_request:
    paths:
      - '.github/workflows/**'

jobs:
  check-pipeline:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate all workflows have concurrency control
        run: |
          for file in .github/workflows/*.yml; do
            if ! grep -q "concurrency:" "$file"; then
              echo "ERROR: $file missing concurrency control"
              exit 1
            fi
          done

      - name: Ensure production deployments require approval
        run: |
          for file in .github/workflows/*.yml; do
            if grep -q "environment:.*production" "$file"; then
              # Production environments must have protection rules
              echo "OK: $file has production environment (ensure GitHub settings require approval)"
            fi
          done

      - name: Check no hardcoded secrets
        run: |
          for file in .github/workflows/*.yml; do
            if grep -qE '(password|secret|token|key).*=.*[^\$\{\}]' "$file"; then
              echo "ERROR: $file may contain hardcoded secrets"
              exit 1
            fi
          done

组织级模板 (.github)
  ├── reusable-ci.yml          # 通用 CI 流程
  ├── reusable-cd.yml          # 通用 CD 流程
  └── reusable-security.yml    # 通用安全扫描

团队级模板 (team-config)
  ├── frontend-pipeline.yml    # 前端定制
  ├── backend-pipeline.yml     # 后端定制
  └── ml-pipeline.yml          # ML 定制

服务级配置 (service-repo)
  └── .github/workflows/
      └── ci.yml               # 仅引用模板 + 服务特有参数

# 安全加固的 GitHub Actions 配置
jobs:
  secure-job:
    runs-on: ubuntu-latest
    permissions:
      contents: read        # 最小权限原则
      packages: write       # 仅声明必要权限
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false  # 不保留 Git 凭证

      - name: Verify artifact integrity
        run: |
          # 验证下载的依赖完整性
          npm audit signatures
          # 验证构建产物哈希
          sha256sum dist/bundle.js > checksum.txt

# .github/workflows/pipeline-metrics.yml
name: Pipeline Metrics Collection

on:
  workflow_run:
    workflows: ["CI/CD Pipeline"]
    types:
      - completed

jobs:
  collect-metrics:
    runs-on: ubuntu-latest
    steps:
      - name: Calculate pipeline metrics
        env:
          WORKFLOW_RUN: ${{ toJson(github.event.workflow_run) }}
        run: |
          # 提取关键时间节点
          START_TIME=$(echo "$WORKFLOW_RUN" | jq -r '.run_started_at')
          END_TIME=$(echo "$WORKFLOW_RUN" | jq -r '.updated_at')
          CONCLUSION=$(echo "$WORKFLOW_RUN" | jq -r '.conclusion')

          # 计算流水线耗时（秒）
          START_EPOCH=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$START_TIME" "+%s" 2>/dev/null || date -d "$START_TIME" "+%s")
          END_EPOCH=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$END_TIME" "+%s" 2>/dev/null || date -d "$END_TIME" "+%s")
          DURATION=$((END_EPOCH - START_EPOCH))

          # 输出指标
          echo "pipeline_duration_seconds{workflow=\"ci-cd\"} $DURATION"
          echo "pipeline_result{workflow=\"ci-cd\",conclusion=\"$CONCLUSION\"} 1"

          # 发送到指标系统
          curl -X POST https://metrics.example.com/api/v1/metrics \
            -H "Authorization: Bearer ${{ secrets.METRICS_TOKEN }}" \
            -d "pipeline_duration_seconds $DURATION"