junhong_cmp_fiber/.gitea/workflows/deploy.yaml

name: 构建并部署到测试环境（无 SSH）

on:
  push:
    branches:
      - Iteration/8-11

env:
  REGISTRY: registry.boss160.cn
  API_IMAGE: registry.boss160.cn/junhong/cmp-fiber-api
  WORKER_IMAGE: registry.boss160.cn/junhong/cmp-fiber-worker
  DEPLOY_DIR: /opt/junhong_cmp

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    
    steps:
      - name: 检出代码
        run: |
          # 添加 Nix 路径到 PATH（git 安装在这里）
          export PATH="$HOME/.nix-profile/bin:/usr/local/bin:/usr/bin:/bin:$PATH"
          # 跳过 SSL 验证（内网自签名证书）
          export GIT_SSL_NO_VERIFY=1
          git clone https://git.boss160.cn/csxj2026/junhong_cmp_fiber.git .
          git checkout ${{ github.sha }}

      - name: 设置镜像标签
        id: tag
        run: |
          echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT

      - name: 登录 Docker Registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ env.REGISTRY }}" --username "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

      - name: 构建 API 镜像
        run: |
          docker build -f Dockerfile.api -t ${{ env.API_IMAGE }}:${{ steps.tag.outputs.tag }} .

      - name: 构建 Worker 镜像
        run: |
          docker build -f Dockerfile.worker -t ${{ env.WORKER_IMAGE }}:${{ steps.tag.outputs.tag }} .

      - name: 推送镜像到 Registry
        run: |
          docker push ${{ env.API_IMAGE }}:${{ steps.tag.outputs.tag }}
          docker push ${{ env.WORKER_IMAGE }}:${{ steps.tag.outputs.tag }}

      - name: 部署到测试环境（仅八月迭代分支）
        if: github.ref == 'refs/heads/Iteration/8-11'
        run: |
          # 确保部署目录存在（仅需日志目录，配置已嵌入二进制文件）
          mkdir -p ${{ env.DEPLOY_DIR }}/logs

          umask 077
          {
            printf 'IMAGE_TAG=%s\n' '${{ github.sha }}'
            printf 'JUNHONG_APPROVAL_LEGACY_REFUND_MANUAL_ENABLED=true\n'
            printf 'JUNHONG_APPROVAL_LEGACY_OFFLINE_RECHARGE_PAY_ENABLED=true\n'
            printf 'JUNHONG_WORKER_ROLE=all\n'
            printf 'JUNHONG_WORKER_INSTANCE_NAME=test-worker-all-1\n'
            # 测试环境只读卡：从生产导入做流量采集验证的卡，只允许查询，停复机等写操作在网关出口拦截
            printf 'JUNHONG_GATEWAY_READONLY_ICCIDS=89861590172420410612,89861590172420420169\n'
          } > ${{ env.DEPLOY_DIR }}/.env
          
          # 强制更新 docker-compose.prod.yml（确保使用最新配置）
          echo "📋 更新部署配置文件..."
          cp -v docker-compose.prod.yml ${{ env.DEPLOY_DIR }}/
          
          cd ${{ env.DEPLOY_DIR }}
          
          echo "📥 拉取最新镜像..."
          docker compose -f docker-compose.prod.yml pull
          
          echo "🚀 重启服务..."
          docker compose -f docker-compose.prod.yml up -d --remove-orphans
          
          echo "⏳ 等待 API 健康检查通过..."
          for i in $(seq 1 30); do
            API_HEALTH=$(docker inspect junhong-cmp-api --format='{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' 2>/dev/null || true)
            if [ "$API_HEALTH" = "healthy" ]; then
              break
            fi
            if [ "$i" -eq 30 ]; then
              echo "❌ API 在等待窗口内未恢复健康"
              docker compose -f docker-compose.prod.yml logs api --tail=200
              exit 1
            fi
            sleep 2
          done

          echo "🔎 校验 Worker 与数据库迁移版本..."
          if [ "$(docker inspect junhong-cmp-worker --format='{{.State.Running}}' 2>/dev/null || true)" != "true" ]; then
            echo "❌ Worker 未运行"
            docker compose -f docker-compose.prod.yml logs worker --tail=200
            exit 1
          fi
          docker exec junhong-cmp-api sh -c '
            DB_URL="postgresql://${JUNHONG_DATABASE_USER}:${JUNHONG_DATABASE_PASSWORD}@${JUNHONG_DATABASE_HOST}:${JUNHONG_DATABASE_PORT}/${JUNHONG_DATABASE_DBNAME}?sslmode=${JUNHONG_DATABASE_SSLMODE}"
            migrate -path /app/migrations -database "$DB_URL" version
          '
          docker compose -f docker-compose.prod.yml logs worker --tail=80
          
          echo "✅ 部署完成！"
          docker compose -f docker-compose.prod.yml ps

      - name: 构建结果通知
        if: always()
        run: |
          if [ "${{ job.status }}" = "success" ]; then
            echo "✅ 构建成功: ${{ steps.tag.outputs.tag }}"
            echo "📦 镜像标签: ${{ github.sha }}"
          else
            echo "❌ 构建失败"
          fi