From cb1561a317b533e63b96e94e7ddbc223e6aba67d Mon Sep 17 00:00:00 2001
From: break <youdang2000@gmail.com>
Date: Sun, 20 Sep 2026 14:42:14 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E5=89=8D=E7=AB=AF?=
 =?UTF-8?q?=E9=83=A8=E7=BD=B2=E8=B5=84=E6=BA=90=E4=BF=9D=E6=8A=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .dockerignore                | 15 +++++++++
 .gitea/workflows/deploy.yaml | 60 +++++++++++++++++++++++++++++++-----
 Dockerfile                   |  4 +++
 docker-compose.prod.yml      | 11 +++----
 4 files changed, 77 insertions(+), 13 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..26d0eaf
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,15 @@
+node_modules
+dist
+.git
+.gitea
+.husky
+.vscode
+.idea
+.DS_Store
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.env.local
+.env.*.local
+openspec
diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index ed338ce..15e2d51 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -10,10 +10,17 @@ on:
       # 如果只是想保留构建（不部署），可以留着，反正部署条件已经只认 iteration/august
       - main
 
+concurrency:
+  group: one-pipe-system-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   REGISTRY: registry.boss160.cn
   IMAGE_NAME: registry.boss160.cn/junhong/cmp-admin-web
   DEPLOY_DIR: /opt/junhong_cmp_web
+  NODE_OPTIONS: --max-old-space-size=1536
+  MIN_AVAILABLE_MEMORY_MB: 2800
+  MIN_AVAILABLE_DISK_GB: 12
 
 jobs:
   build-and-deploy:
@@ -46,8 +53,36 @@ jobs:
 
       - name: 构建前端镜像
         run: |
-          docker build -t ${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }} .
-          docker tag ${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }} ${{ env.IMAGE_NAME }}:${{ github.sha }}
+          command -v flock >/dev/null || {
+            echo "服务器缺少 flock，无法保证构建互斥"
+            exit 1
+          }
+
+          exec 9>/tmp/one-pipe-system-build.lock
+          if ! flock -n 9; then
+            echo "已有 one-pipe-system 构建正在运行，本次任务拒绝并发构建"
+            exit 1
+          fi
+
+          AVAILABLE_MEMORY_MB=$(awk '/MemAvailable:/ { printf "%d", $2 / 1024 }' /proc/meminfo)
+          DOCKER_ROOT_DIR=$(docker info --format '{{.DockerRootDir}}')
+          AVAILABLE_DISK_GB=$(df -Pk "$DOCKER_ROOT_DIR" | awk 'NR == 2 { printf "%d", $4 / 1024 / 1024 }')
+
+          echo "构建前可用内存: ${AVAILABLE_MEMORY_MB} MiB"
+          echo "Docker 所在磁盘可用空间: ${AVAILABLE_DISK_GB} GiB"
+
+          if [ "$AVAILABLE_MEMORY_MB" -lt "${{ env.MIN_AVAILABLE_MEMORY_MB }}" ]; then
+            echo "可用内存不足，拒绝启动前端构建，避免测试服务器失去响应"
+            exit 1
+          fi
+
+          if [ "$AVAILABLE_DISK_GB" -lt "${{ env.MIN_AVAILABLE_DISK_GB }}" ]; then
+            echo "Docker 所在磁盘空间不足，拒绝启动前端构建"
+            exit 1
+          fi
+
+          docker build --build-arg NODE_OPTIONS="${{ env.NODE_OPTIONS }}" -t ${{ env.IMAGE_NAME }}:${{ github.sha }} .
+          docker tag ${{ env.IMAGE_NAME }}:${{ github.sha }} ${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
 
       - name: 推送镜像到 Registry
         run: |
@@ -71,16 +106,27 @@ jobs:
           cd ${{ env.DEPLOY_DIR }}
 
           echo "拉取最新镜像..."
-          docker compose -f docker-compose.prod.yml pull
+          IMAGE_TAG=${{ github.sha }} docker compose -f docker-compose.prod.yml pull
 
           echo "重启服务..."
-          docker compose -f docker-compose.prod.yml up -d
+          IMAGE_TAG=${{ github.sha }} docker compose -f docker-compose.prod.yml up -d
 
-          echo "等待服务启动..."
-          sleep 5
+          echo "等待服务健康检查通过..."
+          for i in $(seq 1 30); do
+            WEB_HEALTH=$(docker inspect junhong-cmp-web --format='{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' 2>/dev/null || true)
+            if [ "$WEB_HEALTH" = "healthy" ]; then
+              break
+            fi
+            if [ "$i" -eq 30 ]; then
+              echo "前端服务在等待窗口内未恢复健康"
+              docker compose -f docker-compose.prod.yml logs web --tail=100
+              exit 1
+            fi
+            sleep 2
+          done
 
           echo "部署完成！"
-          docker compose -f docker-compose.prod.yml ps
+          IMAGE_TAG=${{ github.sha }} docker compose -f docker-compose.prod.yml ps
 
       - name: 构建结果通知
         if: always()
diff --git a/Dockerfile b/Dockerfile
index 9c497c0..a086fc9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,6 +15,10 @@ RUN corepack enable && corepack prepare pnpm@10.15.0 --activate
 # 设置 npm 镜像源
 RUN pnpm config set registry https://registry.npmmirror.com
 
+# 限制 Node 堆，防止前端构建耗尽宿主机内存
+ARG NODE_OPTIONS=--max-old-space-size=1536
+ENV NODE_OPTIONS=${NODE_OPTIONS}
+
 # 复制 package.json 和 pnpm-lock.yaml（利用 Docker 缓存）
 COPY package.json pnpm-lock.yaml ./
 
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 09c4253..a440554 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -1,26 +1,25 @@
-version: '3.8'
 services:
   web:
-    image: registry.boss160.cn/junhong/cmp-admin-web:latest
+    image: registry.boss160.cn/junhong/cmp-admin-web:${IMAGE_TAG:-latest}
     container_name: junhong-cmp-web
     restart: unless-stopped
     ports:
       - '3001:80'
     networks:
       - junhong-network
-    
+
     # === 以下是新增的修复内容 ===
     tmpfs:
       - /run:rw
       - /tmp:rw
-    
+
     healthcheck:
       test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://127.0.0.1:80/health']
       interval: 30s
       timeout: 3s
       retries: 3
       start_period: 5s
-    
+
     logging:
       driver: 'json-file'
       options:
@@ -29,4 +28,4 @@ services:
 
 networks:
   junhong-network:
-    driver: bridge
\ No newline at end of file
+    driver: bridge