327 lines
13 KiB
YAML
327 lines
13 KiB
YAML
# =============================================================================
|
||
# AWOOOI - Production Deployment Pipeline (Phase 8)
|
||
# =============================================================================
|
||
# 沿用 WOOO AIOps 穩定架構
|
||
# Registry: harbor.wooo.work (192.168.0.110)
|
||
# K8s: 192.168.0.120 (K3s Master)
|
||
# Runner: 192.168.0.110 (Self-Hosted)
|
||
#
|
||
# 鐵律:
|
||
# - 生產環境嚴禁 Docker Compose，K8s 唯一合法部署
|
||
# - 110 金庫 Build + Push
|
||
# - 120 K3s Deploy
|
||
# =============================================================================
|
||
|
||
name: Deploy to Production
|
||
|
||
# 2026-05-12 Codex: GitHub 是唯讀備份，production deploy 只能從 Gitea 進入。
|
||
# 這份歷史 workflow 仍含 Harbor build/push 與 kubectl apply/rollout，會和 Gitea CD 競爭。
|
||
# 保留檔案供稽核，但停用所有 job。
|
||
on:
|
||
workflow_dispatch:
|
||
inputs:
|
||
deploy_api:
|
||
description: 'Deploy API'
|
||
required: false
|
||
default: true
|
||
type: boolean
|
||
deploy_web:
|
||
description: 'Deploy Web'
|
||
required: false
|
||
default: true
|
||
type: boolean
|
||
deploy_worker:
|
||
description: 'Deploy Worker'
|
||
required: false
|
||
default: true
|
||
type: boolean
|
||
skip_tests:
|
||
description: 'Skip smoke tests (emergency only)'
|
||
required: false
|
||
default: false
|
||
type: boolean
|
||
|
||
# 沿用 AIOPS 設計: 新 commit 自動取消舊 workflow
|
||
concurrency:
|
||
group: deploy-prod-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
env:
|
||
# Harbor 金庫 (110 主機) - 使用 IP 避免 TLS 證書問題
|
||
REGISTRY: 192.168.0.110:5000
|
||
HARBOR_PROJECT: library
|
||
# K3s 叢集 (120 主機)
|
||
K8S_NAMESPACE: awoooi-prod
|
||
KUBECONFIG: /home/wooo/.kube/config-120
|
||
# 加速配置 (沿用 AIOPS)
|
||
BASE_REGISTRY: "192.168.0.110:5000/dockerhub-cache"
|
||
PYPI_INDEX_URL: "http://192.168.0.110:3141/root/pypi/+simple/"
|
||
PYPI_TRUSTED_HOST: "192.168.0.110"
|
||
NPM_REGISTRY: "http://192.168.0.110:4873"
|
||
|
||
jobs:
|
||
# ===========================================================================
|
||
# Stage 1: Build & Push Images (110 金庫)
|
||
# ===========================================================================
|
||
build:
|
||
name: "Build Images"
|
||
if: ${{ false }}
|
||
runs-on: [self-hosted, harbor, k8s]
|
||
outputs:
|
||
image_tag: ${{ steps.meta.outputs.tag }}
|
||
api_image: ${{ steps.meta.outputs.api_image }}
|
||
web_image: ${{ steps.meta.outputs.web_image }}
|
||
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Generate Image Tags
|
||
id: meta
|
||
run: |
|
||
SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
|
||
TAG="${SHORT_SHA}-${{ github.run_id }}"
|
||
echo "tag=${TAG}" >> $GITHUB_OUTPUT
|
||
echo "api_image=${{ env.REGISTRY }}/${{ env.HARBOR_PROJECT }}/api:${TAG}" >> $GITHUB_OUTPUT
|
||
echo "web_image=${{ env.REGISTRY }}/${{ env.HARBOR_PROJECT }}/web:${TAG}" >> $GITHUB_OUTPUT
|
||
echo "📦 Image Tag: ${TAG}"
|
||
|
||
- name: Login to Harbor Registry
|
||
run: |
|
||
echo "${{ secrets.HARBOR_PASSWORD }}" | docker login ${{ env.REGISTRY }} -u ${{ secrets.HARBOR_USER }} --password-stdin
|
||
echo "✅ Harbor 登入成功"
|
||
|
||
# ----- Build API Image -----
|
||
# Phase 6.4i: 必須從 monorepo 根目錄建構 (context: .)
|
||
# 因為 Dockerfile 需要複製 packages/lewooogo-* 本地套件
|
||
- name: "Build API Image"
|
||
if: ${{ github.event_name == 'push' || inputs.deploy_api }}
|
||
env:
|
||
DOCKER_BUILDKIT: 1
|
||
run: |
|
||
echo "🐳 Building API image..."
|
||
docker build \
|
||
--push \
|
||
-t ${{ steps.meta.outputs.api_image }} \
|
||
-t ${{ env.REGISTRY }}/${{ env.HARBOR_PROJECT }}/api:latest \
|
||
--build-arg BASE_REGISTRY=${{ env.BASE_REGISTRY }} \
|
||
--build-arg PYPI_INDEX_URL=${{ env.PYPI_INDEX_URL }} \
|
||
--build-arg PYPI_TRUSTED_HOST=${{ env.PYPI_TRUSTED_HOST }} \
|
||
-f apps/api/Dockerfile \
|
||
.
|
||
echo "✅ API Image: ${{ steps.meta.outputs.api_image }}"
|
||
|
||
# ----- Build Web Image -----
|
||
- name: "Build Web Image"
|
||
if: ${{ github.event_name == 'push' || inputs.deploy_web }}
|
||
env:
|
||
DOCKER_BUILDKIT: 1
|
||
run: |
|
||
echo "🎨 Building Web image..."
|
||
docker build \
|
||
--push \
|
||
-t ${{ steps.meta.outputs.web_image }} \
|
||
-t ${{ env.REGISTRY }}/${{ env.HARBOR_PROJECT }}/web:latest \
|
||
--build-arg BASE_REGISTRY=${{ env.BASE_REGISTRY }} \
|
||
--build-arg NEXT_PUBLIC_API_URL=https://awoooi.wooo.work \
|
||
-f apps/web/Dockerfile \
|
||
.
|
||
echo "✅ Web Image: ${{ steps.meta.outputs.web_image }}"
|
||
|
||
# ===========================================================================
|
||
# Stage 2: Deploy to K3s (120 主機)
|
||
# ===========================================================================
|
||
deploy:
|
||
name: "Deploy to K3s"
|
||
needs: build
|
||
if: ${{ false }}
|
||
runs-on: [self-hosted, harbor, k8s]
|
||
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Configure kubectl
|
||
run: |
|
||
export KUBECONFIG=${{ env.KUBECONFIG }}
|
||
export PATH=$HOME/bin:$PATH
|
||
echo "🔌 Connecting to K3s cluster..."
|
||
kubectl cluster-info
|
||
kubectl get nodes -o wide
|
||
|
||
- name: Update Image Tags in Manifests
|
||
run: |
|
||
IMAGE_TAG="${{ needs.build.outputs.image_tag }}"
|
||
echo "🔄 Updating manifests with tag: ${IMAGE_TAG}"
|
||
sed -i "s|IMAGE_TAG_PLACEHOLDER|${IMAGE_TAG}|g" k8s/awoooi-prod/*.yaml
|
||
grep -r "image:" k8s/awoooi-prod/ | head -10
|
||
|
||
- name: Apply Kubernetes Manifests
|
||
run: |
|
||
export KUBECONFIG=${{ env.KUBECONFIG }}
|
||
export PATH=$HOME/bin:$PATH
|
||
echo "📦 Applying K8s manifests..."
|
||
# 排除 kustomization.yaml 與 secrets (Secrets 由手動管理，避免覆蓋)
|
||
for f in k8s/awoooi-prod/*.yaml; do
|
||
BASENAME="$(basename "$f")"
|
||
if [[ "$BASENAME" != "kustomization.yaml" && "$BASENAME" != "03-secrets.yaml" && "$BASENAME" != "03-secrets.example.yaml" ]]; then
|
||
kubectl apply -f "$f" --namespace=${{ env.K8S_NAMESPACE }}
|
||
else
|
||
echo "⏭️ Skipped: $BASENAME (managed separately)"
|
||
fi
|
||
done
|
||
|
||
- name: Rollout Restart Deployments
|
||
run: |
|
||
export KUBECONFIG=${{ env.KUBECONFIG }}
|
||
export PATH=$HOME/bin:$PATH
|
||
echo "🔄 Triggering rolling restart..."
|
||
kubectl rollout restart deployment/awoooi-api -n ${{ env.K8S_NAMESPACE }} || true
|
||
kubectl rollout restart deployment/awoooi-web -n ${{ env.K8S_NAMESPACE }} || true
|
||
# Worker 暫停，不重啟
|
||
echo "ℹ️ Worker restart skipped"
|
||
|
||
- name: Wait for Rollout
|
||
run: |
|
||
export KUBECONFIG=${{ env.KUBECONFIG }}
|
||
export PATH=$HOME/bin:$PATH
|
||
echo "⏳ Waiting for rollout..."
|
||
kubectl rollout status deployment/awoooi-api -n ${{ env.K8S_NAMESPACE }} --timeout=300s
|
||
kubectl rollout status deployment/awoooi-web -n ${{ env.K8S_NAMESPACE }} --timeout=300s
|
||
# Worker 暫停 (replicas=0)，Phase 6.5 完善後啟用
|
||
echo "ℹ️ Worker deployment skipped (replicas=0)"
|
||
|
||
- name: Verify Deployment
|
||
run: |
|
||
export KUBECONFIG=${{ env.KUBECONFIG }}
|
||
export PATH=$HOME/bin:$PATH
|
||
echo "=== Deployment Status ==="
|
||
kubectl get pods -n ${{ env.K8S_NAMESPACE }} -l system=awoooi -o wide
|
||
echo ""
|
||
echo "=== Services ==="
|
||
kubectl get svc -n ${{ env.K8S_NAMESPACE }} -l system=awoooi
|
||
|
||
# ===========================================================================
|
||
# Stage 3: Smoke Tests
|
||
# ===========================================================================
|
||
smoke-test:
|
||
name: "Smoke Tests"
|
||
needs: deploy
|
||
if: ${{ false }}
|
||
runs-on: [self-hosted, harbor, k8s]
|
||
|
||
steps:
|
||
- name: API Health Check
|
||
run: |
|
||
echo "🏥 Running API health check..."
|
||
for i in {1..10}; do
|
||
if curl -sf http://192.168.0.120:32334/api/v1/health; then
|
||
echo ""
|
||
echo "✅ API is healthy"
|
||
exit 0
|
||
fi
|
||
echo "Attempt $i/10 failed, retrying in 10s..."
|
||
sleep 10
|
||
done
|
||
echo "❌ API health check failed after 10 attempts"
|
||
exit 1
|
||
|
||
- name: Web Health Check
|
||
run: |
|
||
echo "🏥 Running Web health check..."
|
||
for i in {1..5}; do
|
||
if curl -sf http://192.168.0.120:32335/ -o /dev/null; then
|
||
echo "✅ Web is healthy"
|
||
exit 0
|
||
fi
|
||
echo "Attempt $i/5 failed, retrying in 5s..."
|
||
sleep 5
|
||
done
|
||
echo "⚠️ Web health check failed"
|
||
|
||
# ===========================================================================
|
||
# Stage 4: Notify (閉環通報)
|
||
# ===========================================================================
|
||
notify:
|
||
name: "Send Notification"
|
||
needs: [build, deploy, smoke-test]
|
||
if: ${{ false }}
|
||
runs-on: [self-hosted, harbor, k8s]
|
||
|
||
steps:
|
||
- name: Determine Status
|
||
id: status
|
||
run: |
|
||
BUILD="${{ needs.build.result }}"
|
||
DEPLOY="${{ needs.deploy.result }}"
|
||
SMOKE="${{ needs.smoke-test.result }}"
|
||
|
||
if [ "$BUILD" = "success" ] && [ "$DEPLOY" = "success" ]; then
|
||
if [ "$SMOKE" = "success" ] || [ "$SMOKE" = "skipped" ]; then
|
||
echo "status=success" >> $GITHUB_OUTPUT
|
||
echo "emoji=✅" >> $GITHUB_OUTPUT
|
||
echo "message=部署成功" >> $GITHUB_OUTPUT
|
||
else
|
||
echo "status=warning" >> $GITHUB_OUTPUT
|
||
echo "emoji=⚠️" >> $GITHUB_OUTPUT
|
||
echo "message=部署完成但健康檢查失敗" >> $GITHUB_OUTPUT
|
||
fi
|
||
else
|
||
echo "status=failure" >> $GITHUB_OUTPUT
|
||
echo "emoji=❌" >> $GITHUB_OUTPUT
|
||
echo "message=部署失敗" >> $GITHUB_OUTPUT
|
||
fi
|
||
|
||
- name: Send Telegram Notification
|
||
# Phase 8: 升級為結構化 HTML + Inline Keyboard UX
|
||
run: |
|
||
STATUS="${{ steps.status.outputs.status }}"
|
||
BUILD_TAG="${{ needs.build.outputs.image_tag }}"
|
||
SHORT_SHA="${{ github.sha }}"
|
||
SHORT_SHA="${SHORT_SHA:0:7}"
|
||
RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
|
||
ACTOR="${{ github.actor }}"
|
||
|
||
# 根據狀態設定 Emoji 與標題
|
||
if [ "$STATUS" = "success" ]; then
|
||
EMOJI="✅"
|
||
TITLE="部署成功"
|
||
elif [ "$STATUS" = "warning" ]; then
|
||
EMOJI="⚠️"
|
||
TITLE="部署警告"
|
||
else
|
||
EMOJI="❌"
|
||
TITLE="部署失敗"
|
||
fi
|
||
|
||
# HTML 結構化訊息 (使用 \n 換行)
|
||
MESSAGE="${EMOJI} <b>AWOOOI 部署通知</b>\n\n━━━━━━━━━━━━━━━━━\n📦 <b>狀態:</b> ${TITLE}\n🌍 <b>環境:</b> Production\n🏷️ <b>版本:</b> <code>${BUILD_TAG}</code>\n🔗 <b>Commit:</b> <code>${SHORT_SHA}</code>\n👤 <b>觸發者:</b> ${ACTOR}\n━━━━━━━━━━━━━━━━━"
|
||
|
||
# Inline Keyboard 按鈕 (成功時多一個按鈕)
|
||
if [ "$STATUS" = "success" ]; then
|
||
KEYBOARD='{"inline_keyboard":[[{"text":"📋 查看部署紀錄","url":"'"${RUN_URL}"'"},{"text":"🚀 開啟正式站","url":"https://awoooi.wooo.work"}]]}'
|
||
else
|
||
KEYBOARD='{"inline_keyboard":[[{"text":"📋 查看部署紀錄","url":"'"${RUN_URL}"'"}]]}'
|
||
fi
|
||
|
||
# 發送 Telegram 訊息 (JSON payload with HTML + Inline Keyboard)
|
||
# 鐵律: Token 必須用 Secrets，禁止硬編碼
|
||
curl -s -X POST "https://api.telegram.org/bot${{ secrets.OPENCLAW_TG_BOT_TOKEN }}/sendMessage" \
|
||
-H "Content-Type: application/json" \
|
||
-d "{\"chat_id\":\"${{ secrets.OPENCLAW_TG_CHAT_ID }}\",\"text\":\"${MESSAGE}\",\"parse_mode\":\"HTML\",\"reply_markup\":${KEYBOARD}}"
|
||
|
||
- name: Send OpenClaw Webhook
|
||
if: always()
|
||
run: |
|
||
curl -sf -X POST "http://192.168.0.188:8088/api/v1/webhook/deploy" \
|
||
-H "Content-Type: application/json" \
|
||
-d "{
|
||
\"event\": \"deploy_${{ steps.status.outputs.status }}\",
|
||
\"system\": \"awoooi\",
|
||
\"env\": \"prod\",
|
||
\"tag\": \"${{ needs.build.outputs.image_tag }}\",
|
||
\"actor\": \"${{ github.actor }}\",
|
||
\"commit\": \"${{ github.sha }}\",
|
||
\"run_url\": \"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\"
|
||
}" || echo "⚠️ OpenClaw webhook 發送失敗 (非阻塞)"
|