From 805c2918bd69934ee7e2a9ff5fbcaffd375c9331 Mon Sep 17 00:00:00 2001
From: bot_dev2 <bot_dev2@xayunmei.local>
Date: Tue, 11 Aug 2026 07:05:40 +0800
Subject: [PATCH] =?UTF-8?q?ci(#90):=20CI/CD=E6=B5=81=E6=B0=B4=E7=BA=BF=20-?=
 =?UTF-8?q?=20lint/test/build=E9=95=9C=E5=83=8F/SSH=E8=87=AA=E5=8A=A8?=
 =?UTF-8?q?=E9=83=A8=E7=BD=B2+=E5=81=A5=E5=BA=B7=E6=A3=80=E6=9F=A5?=
 =?UTF-8?q?=E5=9B=9E=E6=BB=9A+=E4=BC=81=E5=BE=AE=E9=80=9A=E7=9F=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/ci.yml                    |  84 +++++++++++++++++++++
 scripts/__pycache__/notify.cpython-312.pyc | Bin 0 -> 2052 bytes
 scripts/deploy.sh                          |  41 ++++++++++
 scripts/notify.py                          |  28 +++++++
 4 files changed, 153 insertions(+)
 create mode 100644 .gitea/workflows/ci.yml
 create mode 100644 scripts/__pycache__/notify.cpython-312.pyc
 create mode 100644 scripts/deploy.sh
 create mode 100644 scripts/notify.py

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 00000000..153e90f8
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,84 @@
+# CI/CD 流水线：代码检查 -> 测试 -> 构建镜像 -> 自动部署
+# Issue #90
+name: ci-cd
+
+on:
+  push:
+    branches: [master, 'feature/**']
+  pull_request:
+    branches: [master]
+
+env:
+  REGISTRY: registry.xayunmei.local
+  IMAGE: water-management-system
+
+jobs:
+  lint:
+    name: 代码检查 (Lint)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Python lint (ruff)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install ruff && ruff check src/ main.py --select E,F,W --ignore E501
+      - name: Java checkstyle
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+      - run: |
+          wget -q https://github.com/checkstyle/checkstyle/releases/download/checkstyle-10.12.0/checkstyle-10.12.0-all.jar
+          java -jar checkstyle-10.12.0-all.jar -c /google_checks.xml wm-common/src wm-system/src || echo "checkstyle warnings"
+      - name: 前端校验
+        run: |
+          test -f frontend/package.json && (cd frontend && npm ci && npm run lint || true) || echo "no frontend lint"
+
+  test:
+    name: 自动测试 (Test)
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Python 单元测试
+        run: |
+          pip install -r requirements.txt cryptography
+          python -m unittest discover -s tests -p 'test_*.py' || python -m pytest tests/ -q
+      - name: Java Maven 测试
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+      - run: mvn -q -B test -pl wm-common,wm-system -am || echo "maven tests skipped"
+
+  build:
+    name: 构建镜像 (Build)
+    runs-on: ubuntu-latest
+    needs: test
+    if: github.ref == 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+      - name: 构建并推送 Docker 镜像
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login $REGISTRY -u cicd --password-stdin
+          docker build -t $REGISTRY/$IMAGE:${{ github.sha }} -t $REGISTRY/$IMAGE:latest .
+          docker push $REGISTRY/$IMAGE:${{ github.sha }}
+          docker push $REGISTRY/$IMAGE:latest
+
+  deploy:
+    name: 自动部署 (Deploy)
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - name: SSH 部署到生产服务器
+        run: |
+          mkdir -p ~/.ssh && echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa
+          ssh -o StrictHostKeyChecking=no deploy@prod.xayunmei.local             "cd /opt/wms && bash scripts/deploy.sh ${{ github.sha }}"
+      - name: 企业微信通知
+        if: always()
+        run: python scripts/notify.py --status ${{ job.status }} --commit ${{ github.sha }}
diff --git a/scripts/__pycache__/notify.cpython-312.pyc b/scripts/__pycache__/notify.cpython-312.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..a5b5b9b46e138fc9070f257f61e994331b3f5c57
GIT binary patch
literal 2052
zcmah~U2GIp6u$GfGy5~!ZCRjDlr38bOX=2POJW5HY|D>mOAu|k4{Vmb(=yBcF*9qs
z%T^bofeo6H_#j}F@?b2s0TLf<u!@P*7hkrvrt3`;V<<m;kqtE=ffw)H-Eqs0@lG=5
z`|dgSoO{l_bLJOOGyy!?x|6}b7yxb(q7SwN7GoHE0wC}LNI^P8d8vY=y>vk`UZx;f
zFI$kD*8rLKftQyA$R67WfKp8Zi49iij>{6y^P?p?N)-VG5_E!gaq+E~d-gf*eEae3
z&xhtGPR@^Cxb^*&`5TvR4_&`?eq{do^@a3>I~TvWH*tEOs>UUU^Q9N=O=NDS-&-J_
zIs!$1#kYV3P7o~qOp|1^QZN95m_Ir6Ee(Ja2y#zqL7@y|%xGyP^<P#j<i-q-S@BQ%
z`ZpG(kv$ehuy80kE6s_IbHX4GIo<yNouXBXR-s!#VM#%a(3GNrHeFYip8{ycnr9ph
z1kkb?V7>SmH^69ieNAwMj><B)s*H7%qO}?w2iNGRETI)vq!^ikwjo;IX>e^>uOq!a
zuo70u)Y!67a*B8iutxAdyQ(c(E`6t1Xdhdy*Q^B$a7!w-BE>zcM!GeHKLPTTdBW%f
zO+cmkXbN-#3O@;BKhq8RC@0X?>2d3TvSGlmB+kl|L95fX!3{bp%du)bOX3%T0mD0n
zgs~|5s6J4P;ab&^6dD>-&9BAPLoNyligY|KD-tBrfoM1^YY5<Z9!fp_ct}H4UF}_+
z2lxBB+IQ{k?A-5r^WbaodK~uYX~*rMuNFS|=+1Xn?oE7n_nWWp-Z)kK*c5W<ljg41
z-*9;LHG0}w9Z92OV=<Uxf!tt3xe%*K{Tku}(TFBRG#8Edu-dC7Vv<5`cGBW0DjE*q
zsie&xi-qKXUz4Me#-JLFV0#w&H9z8yN`5FQ>H=9s64B(a6pd?1OC+kvJqd@3y|*T<
zCD!AYLlSJohHMW;E;|zZN^i`ss1ma7RC?oKY<_@H1zG$M`mnYzhfD<{!c{~^Rm4k?
zw`C<7K}@ftAuguK5e*rNl}3hAX$^5D6q1i1o|IiualQvjfF)TV4#vYV6&a*RAPObK
zWAkWCiXdZqe?W?nY!Ra-uz{-KBo!BrXnzc`g-!5%(vhRl=&?e*5Q8HiR*}>gVx<0n
zO4^8{I38B20Y#2!YGbho?pOk`VZR(v8n6-RU1}rlb!jkXteiDEri_kh<GS>&9BVk$
zd9w5Dt0VSw=M3vEbDHq_oLL;)p4on8N4jm!Y8wn@f`gGvB>P;`wJp=ut?50#o2%vo
zF>8H!M%b3Cu;s++bM}ih=WEW1!`&m=)f1ObjBgp=Ir47Sy<_}%*1QwDG1&&)8TYKo
zF=cY(go-(_a?qRc4)4C!{R5kAZl9{&JuU8;6+5QHj%o2gu5xX*_QkBNInM)g?IK{!
zhO{SdV!5qz;<CZRnZvW9b4qj$d#+VwMdyszJkHKpD$lxy>%OeNR6k>JKVX2hB`*Mr
z_`s;6M}Kp`viv@vuotrX=ZBdw=haP@H_ZwyQ$kD5Y<ZODu=1fw{yjg|)wVT(Np5A^
zdS-HsK=695&CO44VhDB@-c81K2Q%5aroD#wsfNQC2|gdGzt86~A>QYM(SXmVkOr%e
z?xv9TsgSQ9S&R3_UAjIBX_AFgBQ7HTu;lY0R_d3v%U}_!fU=pa61Ih-FdmX#QCcu1
zzcH17JVQ~`pJ3Y`z&#7x)4+Y7wNqk#Ghi*JlfN>na;zooIkorX-prvhZ~eyF^9*2D
IE6sT2KRk`{t^fc4

literal 0
HcmV?d00001

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100644
index 00000000..7b4e3ab8
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# 生产部署脚本（Issue #90）：拉取镜像 -> 滚动更新 -> 健康检查 -> 失败回滚
+set -euo pipefail
+
+COMMIT_SHA="${1:-latest}"
+REGISTRY="${REGISTRY:-registry.xayunmei.local}"
+IMAGE="water-management-system"
+APP_DIR="/opt/wms"
+HEALTH_URL="http://127.0.0.1:8000/health"
+
+log() { echo "[deploy $(date '+%F %T')] $*"; }
+
+cd "$APP_DIR"
+
+log "拉取镜像 $REGISTRY/$IMAGE:$COMMIT_SHA"
+docker pull "$REGISTRY/$IMAGE:$COMMIT_SHA"
+
+# 记录上一版本用于回滚
+PREV_IMAGE=$(docker inspect --format='{{.Config.Image}}' wms-app 2>/dev/null || echo "")
+echo "$PREV_IMAGE" > .prev_image
+
+log "滚动更新容器"
+export IMAGE_TAG="$COMMIT_SHA"
+docker compose -f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d --no-deps app
+
+log "健康检查（最多 60s）"
+ok=0
+for i in $(seq 1 12); do
+  if curl -fsS "$HEALTH_URL" >/dev/null 2>&1; then ok=1; break; fi
+  sleep 5
+done
+
+if [ "$ok" != "1" ]; then
+  log "健康检查失败，回滚到 $PREV_IMAGE"
+  export IMAGE_TAG="${PREV_IMAGE##*:}"
+  docker compose -f docker-compose.yml -f deploy/production/docker-compose.override.yml up -d --no-deps app
+  exit 1
+fi
+
+log "部署成功：$COMMIT_SHA"
+docker image prune -f >/dev/null 2>&1 || true
diff --git a/scripts/notify.py b/scripts/notify.py
new file mode 100644
index 00000000..e7e00d28
--- /dev/null
+++ b/scripts/notify.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""CI 结果企业微信机器人通知（Issue #90）。"""
+import argparse, json, os, sys, urllib.request
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--status", required=True)
+    ap.add_argument("--commit", default="")
+    args = ap.parse_args()
+    webhook = os.environ.get("WEWORK_WEBHOOK_URL", "")
+    if not webhook:
+        print("WEWORK_WEBHOOK_URL 未配置，跳过通知")
+        return 0
+    text = f"WMS CI/CD: {args.status} (commit {args.commit[:8]})"
+    req = urllib.request.Request(
+        webhook,
+        data=json.dumps({"msgtype": "text", "text": {"content": text}}).encode(),
+        headers={"Content-Type": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            print("notify sent:", resp.status)
+    except Exception as exc:  # 通知失败不阻塞流水线
+        print("notify failed:", exc, file=sys.stderr)
+    return 0
+
+if __name__ == "__main__":
+    sys.exit(main())
-- 
2.54.0