发布质量保障

# PreSync Hook：部署前质量门禁检查
apiVersion: batch/v1
kind: Job
metadata:
  name: pre-release-quality-gate
  namespace: team-a
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      containers:
        - name: quality-gate
          image: quality-gate-checker:v1
          env:
            - name: SERVICE
              value: orders-service
            - name: ENVIRONMENT
              value: staging
          command:
            - /bin/sh
            - -c
            - |
              echo "=== 质量门禁检查 ==="

              # 1. 检查测试覆盖率
              COVERAGE=$(curl -s "https://codecov.example.com/api/repos/team-a/orders-service/commits/${ARGOCD_REVISION}/coverage")
              if [ "$COVERAGE" -lt 80 ]; then
                echo "❌ 测试覆盖率 ${COVERAGE}% < 80%，发布被阻止"
                exit 1
              fi
              echo "✅ 测试覆盖率: ${COVERAGE}%"

              # 2. 检查安全扫描结果
              VULNS=$(curl -s "https://security-scanner.example.com/api/results?service=orders-service&severity=critical")
              if [ "$VULNS" -gt 0 ]; then
                echo "❌ 发现 ${VULNS} 个 Critical 安全漏洞，发布被阻止"
                exit 1
              fi
              echo "✅ 安全扫描: 0 Critical 漏洞"

              # 3. 检查错误预算
              BUDGET=$(curl -s "${PROMETHEUS_URL}/api/v1/query?query=remaining_error_budget{service='orders-service'}" | jq -r '.data.result[0].value[1]')
              if [ "$(echo "$BUDGET < 0" | bc)" -eq 1 ]; then
                echo "❌ 错误预算耗尽，发布被阻止"
                exit 1
              fi
              echo "✅ 错误预算剩余: ${BUDGET}%"

              echo "=== 所有质量门禁检查通过 ==="
      restartPolicy: Never
---
# PostSync Hook：部署后冒烟测试
apiVersion: batch/v1
kind: Job
metadata:
  name: post-release-smoke-test
  namespace: team-a
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      containers:
        - name: smoke-test
          image: smoke-test-runner:v1
          env:
            - name: SERVICE_URL
              value: "https://orders-service.staging.example.com"
          command:
            - /bin/sh
            - -c
            - |
              echo "=== 冒烟测试 ==="

              # 1. 健康检查
              HEALTH=$(curl -s "${SERVICE_URL}/health" | jq -r '.status')
              if [ "$HEALTH" != "healthy" ]; then
                echo "❌ 健康检查失败: ${HEALTH}"
                exit 1
              fi
              echo "✅ 健康检查: ${HEALTH}"

              # 2. API 可达性测试
              STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${SERVICE_URL}/api/v1/orders")
              if [ "$STATUS" -ne 200 ]; then
                echo "❌ API 返回状态码: ${STATUS}"
                exit 1
              fi
              echo "✅ API 可达性: HTTP ${STATUS}"

              # 3. 关键业务流程测试
              CREATE_RESULT=$(curl -s -X POST "${SERVICE_URL}/api/v1/orders" \
                -H "Content-Type: application/json" \
                -d '{"product_id":"test-001","quantity":1}' | jq -r '.id')
              if [ -z "$CREATE_RESULT" ]; then
                echo "❌ 创建订单失败"
                exit 1
              fi
              echo "✅ 创建订单成功: ${CREATE_RESULT}"

              echo "=== 所有冒烟测试通过 ==="
      restartPolicy: Never
---
# SyncFail Hook：部署失败时的回滚操作
apiVersion: batch/v1
kind: Job
metadata:
  name: rollback-on-failure
  namespace: team-a
  annotations:
    argocd.argoproj.io/hook: SyncFail
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      containers:
        - name: rollback
          image: rollback-handler:v1
          command:
            - /bin/sh
            - -c
            - |
              echo "⚠️ 部署失败，执行回滚操作"
              # 通知团队
              curl -X POST "${SLACK_WEBHOOK}" \
                -H "Content-Type: application/json" \
                -d '{"text":"🚨 orders-service 部署失败，正在回滚。请 On-Call 团队关注。"}'

              # ArgoCD 自动回滚已在 SyncPolicy 中配置
              echo "回滚已触发，等待 ArgoCD 完成回滚"
      restartPolicy: Never

{
  "dashboard": {
    "title": "Release Quality Dashboard - Orders Service",
    "tags": ["release", "orders-service"],
    "panels": [
      {
        "title": "Error Rate (Real-time)",
        "type": "stat",
        "gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
        "targets": [
          {
            "expr": "sum(rate(http_requests_total{service='orders-service',code=~'5..'}[5m])) / sum(rate(http_requests_total{service='orders-service'}[5m]))",
            "legendFormat": "Error Rate"
          }
        ],
        "thresholds": [
          { "value": 0.001, "color": "green" },
          { "value": 0.005, "color": "yellow" },
          { "value": 0.01, "color": "red" }
        ]
      },
      {
        "title": "P99 Latency (Real-time)",
        "type": "stat",
        "gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
        "targets": [
          {
            "expr": "histogram_quantile(0.99, sum(rate(http_request_duration_seconds_bucket{service='orders-service'}[5m])) by (le))",
            "legendFormat": "P99 Latency"
          }
        ]
      },
      {
        "title": "Request Rate Comparison (Old vs New)",
        "type": "timeseries",
        "gridPos": { "h": 8, "w": 12, "x": 0, "y": 4 },
        "targets": [
          {
            "expr": "sum(rate(http_requests_total{service='orders-service',version='v2.3.0'}[5m]))",
            "legendFormat": "New Version"
          },
          {
            "expr": "sum(rate(http_requests_total{service='orders-service',version='v2.2.0'}[5m]))",
            "legendFormat": "Old Version"
          }
        ]
      },
      {
        "title": "Error Rate Comparison (Old vs New)",
        "type": "timeseries",
        "gridPos": { "h": 8, "w": 12, "x": 12, "y": 4 },
        "targets": [
          {
            "expr": "sum(rate(http_requests_total{service='orders-service',version='v2.3.0',code=~'5..'}[5m])) / sum(rate(http_requests_total{service='orders-service',version='v2.3.0'}[5m]))",
            "legendFormat": "New Version Error Rate"
          },
          {
            "expr": "sum(rate(http_requests_total{service='orders-service',version='v2.2.0',code=~'5..'}[5m])) / sum(rate(http_requests_total{service='orders-service',version='v2.2.0'}[5m]))",
            "legendFormat": "Old Version Error Rate"
          }
        ]
      }
    ]
  }
}

## 发布质量门禁清单

### 必须通过（阻止发布）
- [ ] 所有单元测试通过，覆盖率 ≥ 80%
- [ ] 代码静态扫描无 Critical/High 问题
- [ ] 依赖扫描无已知高危漏洞
- [ ] 容器镜像扫描无 Critical 漏洞
- [ ] Staging 环境冒烟测试通过
- [ ] SLO 错误预算 > 0

### 建议通过（警告但允许）
- [ ] E2E 测试通过
- [ ] 性能测试无明显退化
- [ ] 回滚预案已确认（回滚步骤 + 数据库兼容性）
- [ ] 变更影响评估为 Low/Medium