GitHub Actions 与 GitLab CI 对比

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:  # 手动触发
    inputs:
      environment:
        description: '部署环境'
        type: choice
        options: [test, staging, production]
 
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
 
jobs:
  # ===== 第一层：构建与单元测试 =====
  build-test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      version: ${{ steps.meta.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - uses: actions/setup-python@v5
        with:
          python-version: '3.13'
          cache: 'pip'
 
      - name: 安装依赖
        run: pip install -r requirements.txt
 
      - name: 静态检查
        run: |
          pip install ruff
          ruff check src/
 
      - name: 单元测试 + 覆盖率
        run: |
          pytest tests/unit/ --cov=src --cov-fail-under=80 \
            --cov-report=xml --junitxml=test-results.xml
 
      - name: 上传测试结果
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: test-results.xml
 
      - name: 上传覆盖率到 Codecov
        uses: codecov/codecov-action@v4
        with:
          file: coverage.xml
          token: ${{ secrets.CODECOV_TOKEN }}
 
      - name: 生成版本号
        id: meta
        run: |
          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            echo "version=$(date +%Y%m%d)-${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
          else
            echo "version=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
          fi
 
  # ===== 第二层：集成测试（矩阵并行） =====
  integration-test:
    needs: build-test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.11', '3.12', '3.13']
        database: ['postgres:16', 'mysql:8.4']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
 
      - name: 启动数据库容器
        run: docker run -d --name db -e POSTGRES_PASSWORD=test ${{ matrix.database }}
 
      - name: 集成测试
        run: pytest tests/integration/ -m integration
 
  # ===== 第三层：构建镜像并推送 =====
  docker-build:
    needs: build-test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
 
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ needs.build-test.outputs.version }}
            type=raw,value=latest
 
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
 
  # ===== 第四层：部署（环境保护） =====
  deploy:
    needs: docker-build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment:
      name: ${{ github.event.inputs.environment || 'staging' }}
      url: https://app.staging.example.com
    steps:
      - name: 部署到 K8s
        run: |
          echo "${{ secrets.KUBE_CONFIG }}" > kubeconfig
          export KUBECONFIG=kubeconfig
          kubectl set image deployment/app \
            app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-test.outputs.version }}
          kubectl rollout status deployment/app --timeout=5m

# .gitlab-ci.yml
stages:
  - build
  - test
  - quality
  - deploy
 
variables:
  REGISTRY: registry.gitlab.com
  IMAGE_NAME: $CI_REGISTRY_IMAGE
  PYTHON_VERSION: "3.13"
 
# 默认配置
default:
  image: python:${PYTHON_VERSION}-slim
  cache:
    paths:
      - .pip-cache/
  before_script:
    - pip install --cache-dir .pip-cache -r requirements.txt
 
# ===== Build Stage =====
build:
  stage: build
  script:
    - python -m build
    - pip install dist/*.whl
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour
 
# ===== Test Stage（并行） =====
unit-test:
  stage: test
  script:
    - pip install pytest pytest-cov ruff
    - ruff check src/
    - pytest tests/unit/ --cov=src --cov-fail-under=80 --junitxml=report.xml
  coverage: '/TOTAL.*\s+(\d+\%)$/'
  artifacts:
    reports:
      junit: report.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
 
integration-test:
  stage: test
  services:
    - postgres:16
    - redis:8-alpine
  variables:
    POSTGRES_PASSWORD: test
    DATABASE_URL: postgresql://postgres:test@postgres/test
  script:
    - pytest tests/integration/ -m integration
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
 
# ===== Quality Stage =====
sonarqube:
  stage: quality
  image: sonarsource/sonar-scanner-cli
  script:
    - sonar-scanner
      -Dsonar.projectKey=$CI_PROJECT_NAME
      -Dsonar.host.url=$SONAR_HOST
      -Dsonar.login=$SONAR_TOKEN
  allow_failure: false  # 质量门禁必须通过
 
# ===== Deploy Stage =====
deploy:staging:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl set image deployment/app app=$IMAGE_NAME:$CI_COMMIT_SHORT_SHA -n staging
    - kubectl rollout status deployment/app -n staging --timeout=5m
  environment:
    name: staging
    url: https://app.staging.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  when: manual  # 手动确认部署
 
deploy:production:
  stage: deploy
  extends: deploy:staging  # 继承配置
  environment:
    name: production
    url: https://app.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main" && $CI_COMMIT_TAG
  when: manual
  needs:
    - deploy:staging  # 生产部署依赖预发布成功

# GitHub Actions 缓存
- uses: actions/cache@v4
  with:
    path: |
      ~/.cache/pip
      node_modules
    key: ${{ runner.os }}-deps-${{ hashFiles('**/requirements*.txt', '**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-deps-

# GitLab CI 缓存
cache:
  key:
    files:
      - requirements.txt
      - package-lock.json
  paths:
    - .pip-cache/
    - node_modules/
  policy: pull-push  # 拉取并推送更新

# GitHub Actions 矩阵
strategy:
  fail-fast: false  # 一个失败不取消其他
  matrix:
    os: [ubuntu-latest, macos-latest, windows-latest]
    python: ['3.11', '3.12', '3.13']
    exclude:
      - os: windows-latest
        python: '3.11'  # 排除特定组合
    include:
      - os: ubuntu-latest
        python: '3.14'  # 额外增加组合

# GitLab CI 矩阵（13.x+ 支持）
test:
  parallel:
    matrix:
      - OS: [ubuntu, macos, windows]
        PYTHON: ['3.11', '3.12', '3.13']
  script:
    - pytest tests/ --os=${OS} --python=${PYTHON}