WuYongJie/CaiWuXiTong
1
0
Fork 0
Code Issues Pull Requests 2 Packages Projects Releases Wiki Activity
CaiWuXiTong/scripts/deploy-from-mac.sh

677 lines
28 KiB
Bash
Executable File
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

#!/usr/bin/env bash
#
# macOS 版正式发布：流程与 scripts/deploy-from-workstation.ps1 一致。
# 1. 检查分支与未提交改动；2. 本机构建前端；3. 构建并校验应用镜像；
# 4. 通过 SSH 隧道把新增镜像层推送到服务器本机 Registry；5. 服务器激活并健康检查；
# 6. 校验生产页面脚本与本次构建一致；7. 清理临时文件、隧道与构建缓存。
#
# 用法：bash scripts/deploy-from-mac.sh [选项]
# --server <地址> 默认 218.93.190.75
# --key <私钥路径> 使用 SSH 私钥（可选；不传则用已保存的密码或系统钥匙串）
# --update-password 重新输入并保存服务器密码
# --password-file <文件> 从文件读取服务器密码（文件只允许本人可读）
# --ssh-user <用户> 默认 root
# --remote-path <路径> 默认 /opt/caiwuxitong
# --app-url <地址> 默认 https://caiwu.jiansuntuzhi.cn:8442
# --bootstrap-server 首次初始化服务器
# --configure-dingtalk-callback
# --allow-non-main 允许非 main 分支（测试用）
# --allow-migrations 允许执行待办数据库迁移（需先按 AGENTS.md 核对）
# --skip-regctl 跳过 regctl，直接用 docker 直传镜像
# --keep-images <数量> 默认 2
# --app-version <版本> 默认 3.1.15
#
# 环境变量：CAIWU_COMPOSER_REPO_PACKAGIST 可覆盖 Composer 下载源
# （默认 https://mirrors.cloud.tencent.com/composer/；国内网络访问 GitHub 受限时使用，
# 设为空字符串则使用 Composer 官方源）
#
set -euo pipefail
server='218.93.190.75'
key_path=''
password_file=''
update_password=0
ssh_user='root'
remote_path='/opt/caiwuxitong'
app_url=''
builder_name='caiwu-builder'
buildkit_image='m.daocloud.io/docker.io/moby/buildkit:buildx-stable-1'
database_image='mariadb:11.4'
database_mirror_image='m.daocloud.io/docker.io/library/mariadb:11.4'
keep_images=2
build_cache_max_used_space='24GB'
build_cache_max_age_hours=720
bootstrap_server=0
configure_dingtalk_callback=0
allow_non_main=0
allow_migrations=0
skip_regctl=0
app_version='3.1.15'
# 国内网络访问 GitHub 受限时，composer 的 GitHub dist 会失败；默认走腾讯云镜像。
composer_repo_packagist="${CAIWU_COMPOSER_REPO_PACKAGIST-https://mirrors.cloud.tencent.com/composer/}"
while [ "$#" -gt 0 ]; do
case "$1" in
--server) server="$2"; shift ;;
--key) key_path="$2"; shift ;;
--password-file) password_file="$2"; shift ;;
--update-password) update_password=1 ;;
--ssh-user) ssh_user="$2"; shift ;;
--remote-path) remote_path="$2"; shift ;;
--app-url) app_url="$2"; shift ;;
--builder) builder_name="$2"; shift ;;
--buildkit-image) buildkit_image="$2"; shift ;;
--database-image) database_image="$2"; shift ;;
--database-mirror-image) database_mirror_image="$2"; shift ;;
--keep-images) keep_images="$2"; shift ;;
--build-cache-max-used-space) build_cache_max_used_space="$2"; shift ;;
--build-cache-max-age-hours) build_cache_max_age_hours="$2"; shift ;;
--app-version) app_version="$2"; shift ;;
--bootstrap-server) bootstrap_server=1 ;;
--configure-dingtalk-callback) configure_dingtalk_callback=1 ;;
--allow-non-main) allow_non_main=1 ;;
--allow-migrations) allow_migrations=1 ;;
--skip-regctl) skip_regctl=1 ;;
-h|--help) sed -n '2,20p' "$0"; exit 0 ;;
*) echo "未知参数：$1" >&2; exit 2 ;;
esac
shift
done
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd "$script_dir/.." && pwd)"
# 本机私有密码文件（scripts/store-deploy-password.sh 保存的），存在就自动使用。
if [ -z "$password_file" ] && [ -f "$repo_root/runtime/private/deploy-password" ]; then
password_file="$repo_root/runtime/private/deploy-password"
fi
image_name='caiwu_akaunting'
target_platform='linux/amd64'
image_prefix='127.0.0.1:5000/caiwuxitong/app'
keychain_service='CaiWuXiTong-deploy'
keychain_account="$ssh_user@$server"
ssh_target="$ssh_user@$server"
regctl_version='v0.11.5'
temp_root=''
tunnel_pid=''
askpass_dir=''
ssh_control_path=''
remote_archive=''
bootstrap_remote=''
ssh_ready=0
ssh_options=()
tunnel_ssh_options=()
log() { printf '%s\n' "$*"; }
fail() { printf '%s\n' "$*" >&2; exit 1; }
sha256_file() {
if command -v shasum >/dev/null 2>&1; then
shasum -a 256 "$1" | awk '{print $1}'
else
sha256sum "$1" | awk '{print $1}'
fi
}
prune_build_cache() {
docker buildx prune --builder "$builder_name" --filter "until=${build_cache_max_age_hours}h" --force >/dev/null 2>&1 || true
local prune_help
prune_help="$(docker buildx prune --help 2>/dev/null || true)"
if printf '%s' "$prune_help" | grep -q -- '--max-used-space'; then
docker buildx prune --builder "$builder_name" --max-used-space "$build_cache_max_used_space" --force >/dev/null 2>&1 || true
elif printf '%s' "$prune_help" | grep -q -- '--keep-storage'; then
docker buildx prune --builder "$builder_name" --keep-storage "$build_cache_max_used_space" --force >/dev/null 2>&1 || true
fi
}
cleanup() {
local status=$?
set +e
if [ -n "$remote_archive" ] && [ "$ssh_ready" -eq 1 ]; then
ssh "${ssh_options[@]}" -o ConnectTimeout=5 "$ssh_target" "rm -f '$remote_archive'" >/dev/null 2>&1
fi
if [ -n "$bootstrap_remote" ] && [ "$ssh_ready" -eq 1 ]; then
ssh "${ssh_options[@]}" -o ConnectTimeout=5 "$ssh_target" "rm -f '$bootstrap_remote'" >/dev/null 2>&1
fi
if [ -n "$tunnel_pid" ]; then
kill "$tunnel_pid" >/dev/null 2>&1
fi
if [ -n "$temp_root" ] && [ -d "$temp_root" ]; then
rm -rf "$temp_root"
fi
if [ -n "$askpass_dir" ] && [ -d "$askpass_dir" ]; then
rm -rf "$askpass_dir"
fi
if [ -n "$ssh_control_path" ] && [ "$ssh_ready" -eq 1 ]; then
ssh "${ssh_options[@]}" -O exit "$ssh_target" >/dev/null 2>&1
rm -f "$ssh_control_path"
fi
prune_build_cache
docker system df >/dev/null 2>&1
exit "$status"
}
trap cleanup EXIT
# ---- 本机登录信息：私钥 > 已保存的钥匙串密码 > 首次输入 ----
prepare_ssh_auth() {
local options=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
if [ -n "$key_path" ]; then
[ -f "$key_path" ] || fail "找不到私钥文件：$key_path"
options+=(-i "$key_path" -o BatchMode=yes)
ssh_options=("${options[@]}")
return
fi
if ssh "${options[@]}" -o BatchMode=yes "$ssh_target" true >/dev/null 2>&1; then
log '使用本机已有的 SSH 密钥登录服务器。'
ssh_options=("${options[@]}")
return
fi
local password=''
if [ "$update_password" -eq 0 ] && [ -z "$password_file" ] && [ -z "${CAIWU_DEPLOY_PASSWORD:-}" ]; then
password="$(security find-generic-password -s "$keychain_service" -a "$keychain_account" -w 2>/dev/null || true)"
fi
if [ -z "$password" ] && [ -n "$password_file" ]; then
[ -f "$password_file" ] || fail "找不到密码文件：$password_file"
password="$(cat "$password_file")"
fi
if [ -z "$password" ] && [ -n "${CAIWU_DEPLOY_PASSWORD:-}" ]; then
password="$CAIWU_DEPLOY_PASSWORD"
fi
if [ -z "$password" ]; then
if [ "$update_password" -eq 1 ]; then
log '更新服务器登录信息。'
else
log '首次部署：请输入服务器密码，之后会自动使用本机钥匙串里保存的登录信息。'
fi
printf '服务器密码：' >&2
read -rs password
printf '\n' >&2
[ -n "$password" ] || fail '未输入服务器密码，已停止部署。'
# -T /usr/bin/security：把读取权限授予 security 工具本身，避免每次连接都弹钥匙串授权。
security add-generic-password -U -s "$keychain_service" -a "$keychain_account" \
-T /usr/bin/security -w "$password" >/dev/null 2>&1 \
|| log '提示：写入系统钥匙串未成功，本次仍会继续发布。'
else
log '正在使用本机已保存的部署登录信息。'
fi
# 密码只在启动时读取一次，写进一个仅本人可读的临时脚本供 ssh 使用，
# 避免每条 SSH 连接都去读钥匙串而反复弹授权窗口。
askpass_dir="$(mktemp -d)"
chmod 700 "$askpass_dir"
local askpass="$askpass_dir/askpass.sh"
printf '%s' "$password" > "$askpass_dir/password"
chmod 600 "$askpass_dir/password"
printf '%s\n' '#!/bin/sh' "cat '$askpass_dir/password'" > "$askpass"
chmod 700 "$askpass"
export SSH_ASKPASS="$askpass"
export SSH_ASKPASS_REQUIRE=force
export DISPLAY='caiwu-deploy'
options+=(-o BatchMode=no -o PreferredAuthentications=password -o PubkeyAuthentication=no -o NumberOfPasswordPrompts=1)
ssh_options=("${options[@]}")
}
scp_to_remote() {
if scp -O "${ssh_options[@]}" "$@" 2>/dev/null; then
return 0
fi
scp "${ssh_options[@]}" "$@"
}
get_regctl_path() {
local tool_root="$HOME/.cache/CaiWuXiTong/tools"
local asset expected_hash arch path
case "$(uname -m)" in
arm64)
asset='regctl-darwin-arm64'
expected_hash='f4d536d64d0c3cc1db7400902175a1c314675991d22e87e15c319501a2676d3f'
;;
x86_64)
asset='regctl-darwin-amd64'
expected_hash='c132fdddda68b9c7584ac19f3b40cd17f71916c2bca8182270ebe65b55198a12'
;;
*) echo "不支持的 macOS 架构：$(uname -m)" >&2; return 1 ;;
esac
path="$tool_root/regctl-$regctl_version"
mkdir -p "$tool_root"
if [ -f "$path" ] && [ "$(sha256_file "$path")" = "$expected_hash" ]; then
chmod +x "$path"
printf '%s' "$path"
return
fi
local download="$path.download"
if ! curl -fsSL --retry 3 --retry-delay 2 -o "$download" \
"https://github.com/regclient/regclient/releases/download/$regctl_version/$asset"; then
echo 'regctl 下载失败。' >&2
return 1
fi
if [ "$(sha256_file "$download")" != "$expected_hash" ]; then
rm -f "$download"
echo 'regctl 校验失败。' >&2
return 1
fi
mv "$download" "$path"
chmod +x "$path"
printf '%s' "$path"
}
pick_free_port() {
if command -v python3 >/dev/null 2>&1; then
python3 - <<'PY'
import socket
s = socket.socket()
s.bind(('127.0.0.1', 0))
print(s.getsockname()[1])
s.close()
PY
return
fi
local port
for port in $(jot -r 20 49152 65535 2>/dev/null || seq 49000 49020); do
if ! nc -z 127.0.0.1 "$port" >/dev/null 2>&1; then
printf '%s' "$port"
return
fi
done
echo '找不到可用的本机端口。' >&2
return 1
}
start_registry_tunnel() {
local local_port="$1"
ssh "${tunnel_ssh_options[@]}" \
-N -o ConnectTimeout=10 -o ExitOnForwardFailure=yes \
-o ServerAliveInterval=15 -o ServerAliveCountMax=20 \
-L "127.0.0.1:${local_port}:127.0.0.1:5000" "$ssh_target" &
tunnel_pid=$!
local attempt=1
while [ "$attempt" -le 20 ]; do
if ! kill -0 "$tunnel_pid" >/dev/null 2>&1; then
tunnel_pid=''
echo 'SSH 增量传输隧道启动失败。' >&2
return 1
fi
if curl --fail --silent --show-error --max-time 1 "http://127.0.0.1:${local_port}/v2/" >/dev/null 2>&1; then
return 0
fi
sleep 0.5
attempt=$((attempt + 1))
done
echo 'SSH 隧道已建立，但无法访问服务器本机 Registry。' >&2
return 1
}
stop_registry_tunnel() {
if [ -n "$tunnel_pid" ]; then
kill "$tunnel_pid" >/dev/null 2>&1 || true
wait "$tunnel_pid" 2>/dev/null || true
tunnel_pid=''
fi
}
ensure_qiniu_storage_runtime() {
local remote_environment="$remote_path/runtime/qiniu-storage.env"
if ssh "${ssh_options[@]}" "$ssh_target" \
"test -f '$remote_environment' && grep -q '^BUSINESS_STORAGE_DRIVER=qiniu$' '$remote_environment' && grep -q '^QINIU_ACCESS_KEY=.' '$remote_environment' && grep -q '^QINIU_SECRET_KEY=.' '$remote_environment'" >/dev/null 2>&1; then
log '服务器私有业务文件存储配置已存在。'
return
fi
local access_key="${QINIU_ACCESS_KEY:-}"
local secret_key="${QINIU_SECRET_KEY:-}"
if [ -z "$access_key" ] || [ -z "$secret_key" ]; then
local credential_file="$repo_root/runtime/qiniu-business-storage.env"
if [ -f "$credential_file" ]; then
access_key="$(grep -E '^[[:space:]]*QINIU_ACCESS_KEY[[:space:]]*=' "$credential_file" | head -1 | sed -E 's/^[^=]*=[[:space:]]*//; s/^["'\'']//; s/["'\'']$//')"
secret_key="$(grep -E '^[[:space:]]*QINIU_SECRET_KEY[[:space:]]*=' "$credential_file" | head -1 | sed -E 's/^[^=]*=[[:space:]]*//; s/^["'\'']//; s/["'\'']$//')"
fi
fi
if [ -z "$access_key" ] || [ -z "$secret_key" ]; then
fail '服务器尚未配置私有业务文件存储，且本机没有可用的七牛凭据。'
fi
printf 'BUSINESS_STORAGE_DRIVER=qiniu\nQINIU_ACCESS_KEY=%s\nQINIU_SECRET_KEY=%s\n' "$access_key" "$secret_key" \
| ssh "${ssh_options[@]}" "$ssh_target" \
"umask 077; cat > '$remote_environment.pending'; chmod 600 '$remote_environment.pending'; mv '$remote_environment.pending' '$remote_environment'" \
|| fail '写入服务器私有业务文件存储配置失败。'
log '服务器私有业务文件存储配置已安全写入。'
}
remove_old_project_images() {
local current_image="$1" candidate keep kept
kept="$current_image"
while IFS= read -r candidate; do
[ -n "$candidate" ] || continue
if [ "$candidate" = '<none>:<none>' ]; then
continue
fi
case " $kept " in *" $candidate "*) continue ;; esac
if [ "$(printf '%s\n' $kept | wc -l | tr -d ' ')" -ge "$keep_images" ]; then
break
fi
kept="$kept $candidate"
done <<EOF
$(docker image ls "$image_name" --format '{{.Repository}}:{{.Tag}}' | sort -u)
EOF
while IFS= read -r candidate; do
[ -n "$candidate" ] || continue
if [ "$candidate" = '<none>:<none>' ]; then
continue
fi
case " $kept " in
*" $candidate "*) ;;
*) docker image rm "$candidate" >/dev/null 2>&1 || true ;;
esac
done <<EOF
$(docker image ls "$image_name" --format '{{.Repository}}:{{.Tag}}' | sort -u)
EOF
}
cd "$repo_root"
branch="$(git branch --show-current | tr -d '[:space:]')"
if [ "$allow_non_main" -eq 0 ] && [ "$branch" != 'main' ]; then
fail "当前分支是 ${branch}。正式发布只允许 main；测试分支需显式添加 --allow-non-main。"
fi
if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
fail '工作区存在未提交的受控文件改动，拒绝构建。请先提交或处理清楚。'
fi
if [ "$branch" = 'main' ] && git rev-parse --verify --quiet origin/main >/dev/null 2>&1; then
if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]; then
fail '本地 main 与 origin/main 不一致，请先执行 git pull --ff-only 再发布。'
fi
fi
deploy_sha="$(git rev-parse HEAD | tr -d '[:space:]')"
image_tag="$(printf '%s' "$deploy_sha" | cut -c1-12)"
full_image="$image_name:$image_tag"
build_date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
if [ -z "$app_url" ]; then
if [ "$server" = '218.93.190.75' ]; then
app_url='https://caiwu.jiansuntuzhi.cn:8442'
else
app_url="https://$server"
fi
fi
docker version >/dev/null 2>&1 || fail 'Docker Desktop 未启动或不可用。'
prepare_ssh_auth
attempt=1
while [ "$attempt" -le 3 ]; do
if ssh "${ssh_options[@]}" "$ssh_target" true >/dev/null 2>&1; then
ssh_ready=1
break
fi
if [ "$attempt" -lt 3 ]; then
log "服务器登录失败，正在重试（$attempt/3）。"
sleep 3
fi
attempt=$((attempt + 1))
done
[ "$ssh_ready" -eq 1 ] || fail '服务器登录失败或已取消，已停止部署。'
ssh_control_path="/tmp/caiwu-ssh-$$-$RANDOM.sock"
ssh_options+=(-o ControlMaster=auto -o ControlPersist=600 -o "ControlPath=$ssh_control_path")
tunnel_ssh_options=("${ssh_options[@]}" -o ControlPath=none)
remote_archive="$remote_path/image-$image_tag.tar.gz"
temp_root="$(mktemp -d "${TMPDIR:-/tmp}/caiwu-deploy-XXXXXX")"
local_tar="$temp_root/image.tar"
local_archive="$temp_root/image.tar.gz"
log "发布提交：${deploy_sha}（分支 ${branch}）"
bash "$script_dir/build-frontend.sh"
if ! docker buildx inspect "$builder_name" >/dev/null 2>&1; then
docker buildx create \
--name "$builder_name" \
--driver docker-container \
--driver-opt "image=$buildkit_image" \
--buildkitd-config "$repo_root/deploy/buildkitd.toml" \
--use >/dev/null || fail '创建项目专属 BuildKit 构建器失败。'
fi
docker buildx inspect "$builder_name" --bootstrap >/dev/null || fail '启动 BuildKit 构建器失败。'
build_image() {
docker buildx build \
--builder "$builder_name" \
--platform "$target_platform" \
--load \
--tag "$full_image" \
--build-context 'frontend=.caiwu-build/public' \
--build-arg "VCS_REF=$deploy_sha" \
--build-arg "BUILD_DATE=$build_date" \
--build-arg "APP_VERSION=$app_version" \
--build-arg "COMPOSER_REPO_PACKAGIST=$composer_repo_packagist" \
--label 'com.caiwu.project=CaiWuXiTong' \
--file deploy/Dockerfile \
.
}
build_image || fail '本机镜像构建失败。服务器未发生任何变更。'
docker run --rm --network none --user www-data --entrypoint php "$full_image" artisan --version >/dev/null \
|| fail '发布镜像无法引导 Laravel。服务器未发生任何变更。'
for pair in \
"resources/assets/js/components/business/AccountBills.vue:resources/assets/js/components/business/AccountBills.vue" \
".caiwu-build/public/js/business/pages.min.js:public/js/business/pages.min.js" \
".caiwu-build/public/mix-manifest.json:public/mix-manifest.json"; do
local_file="${pair%%:*}"
image_file="${pair##*:}"
expected_hash="$(sha256_file "$repo_root/$local_file")"
image_hash="$(docker run --rm --network none --user www-data --entrypoint sha256sum "$full_image" "$image_file" | awk '{print $1}')"
if [ "$image_hash" != "$expected_hash" ]; then
fail "发布镜像源码或前端资源不匹配：${image_file}。服务器未发生任何变更。"
fi
done
previous_sha="$(ssh "${ssh_options[@]}" "$ssh_target" "cat '$remote_path/.deployed-sha' 2>/dev/null || true" | tr -d '[:space:]')"
if [ -n "$previous_sha" ]; then
if git cat-file -e "${previous_sha}^{commit}" 2>/dev/null; then
previous_sha_exists=1
else
previous_sha_exists=0
fi
if [ "$previous_sha_exists" -eq 0 ] && [ "$allow_migrations" -eq 0 ]; then
fail "本地缺少服务器当前提交 ${previous_sha}，无法安全比较数据库迁移。请先 git fetch 并核对全部待执行迁移，按 AGENTS.md 完成备份后使用 --allow-migrations。"
fi
if [ "$previous_sha_exists" -eq 1 ]; then
migration_changes="$(git diff --diff-filter=ACMRTUXB --name-only "$previous_sha..$deploy_sha" -- database/migrations ':(glob)modules/*/Database/Migrations/*.php')"
if [ -n "$migration_changes" ] && [ "$allow_migrations" -eq 0 ]; then
fail "检测到数据库迁移：$(printf '%s' "$migration_changes" | tr '\n' ' ')。由 Codex 核对全部待执行迁移；本任务镜像迁移完成备份后可直接添加 --allow-migrations，其他迁移按 AGENTS.md 执行。"
fi
fi
fi
if [ "$bootstrap_server" -eq 1 ]; then
bootstrap_remote="/tmp/caiwu-bootstrap-$image_tag.sh"
scp_to_remote "$repo_root/deploy/bootstrap-server.sh" "${ssh_target}:$bootstrap_remote" || fail '上传服务器初始化脚本失败。'
ssh "${ssh_options[@]}" "$ssh_target" "chmod 700 '$bootstrap_remote' && '$bootstrap_remote' '$app_url' '$remote_path' && rm -f '$bootstrap_remote'" \
|| fail '服务器初始化失败。'
bootstrap_remote=''
fi
ssh "${ssh_options[@]}" "$ssh_target" "docker version >/dev/null && docker compose version >/dev/null && install -d -m 700 '$remote_path'" \
|| fail '服务器 Docker 未就绪；首次发布请添加 --bootstrap-server。'
ensure_qiniu_storage_runtime
migration_flag=0
if [ "$allow_migrations" -eq 1 ]; then
migration_flag=1
fi
scp_to_remote \
"$repo_root/compose.jiangling.yml" \
"$repo_root/deploy/activate-release.sh" \
"$repo_root/deploy/activate-incremental-release.sh" \
"$repo_root/deploy/config-db-init.sh" \
"$repo_root/deploy/run-finance-batch.sh" \
"$repo_root/deploy/clickhouse-resource-policy.xml" \
"$repo_root/deploy/update-runtime-url.sh" \
"$repo_root/deploy/configure-dingtalk-callback.sh" \
"$repo_root/deploy/host-nginx-8442-dingtalk.conf" \
"$repo_root/deploy/setup-incremental-registry.sh" \
"$repo_root/deploy/registry-config.yml" \
"${ssh_target}:$remote_path/" || fail '上传运行配置失败。'
ssh "${ssh_options[@]}" "$ssh_target" "chmod 700 '$remote_path/update-runtime-url.sh' && '$remote_path/update-runtime-url.sh' '$app_url' '$remote_path'" \
|| fail '更新服务器访问地址失败。'
if [ "$bootstrap_server" -eq 1 ]; then
if ! docker image inspect "$database_image" >/dev/null 2>&1; then
if ! docker image inspect "$database_mirror_image" >/dev/null 2>&1; then
docker pull "$database_mirror_image" || fail '下载数据库运行镜像失败。'
fi
docker tag "$database_mirror_image" "$database_image" || fail '标记数据库运行镜像失败。'
fi
docker save --output "$local_tar" "$full_image" "$database_image" || fail '导出应用与数据库运行镜像失败。'
gzip -1 -c "$local_tar" > "$local_archive"
rm -f "$local_tar"
archive_size="$(du -m "$local_archive" | awk '{print $1}')"
log "首次初始化全量包：${archive_size} MiB"
scp_to_remote "$local_archive" "${ssh_target}:$remote_archive" || fail '上传镜像失败。'
ssh "${ssh_options[@]}" "$ssh_target" "chmod 700 '$remote_path/'*.sh && chmod 644 '$remote_path/config-db-init.sh' && '$remote_path/activate-release.sh' '$remote_archive' '$image_tag' '$remote_path' '$deploy_sha' '$migration_flag' '$keep_images' && '$remote_path/setup-incremental-registry.sh' '$remote_path' '$remote_path/registry-config.yml'" \
|| fail '服务器激活、健康检查或增量仓库初始化失败。'
else
ssh "${ssh_options[@]}" -o ConnectTimeout=10 -o ConnectionAttempts=1 "$ssh_target" \
"chmod 700 '$remote_path/'*.sh && chmod 644 '$remote_path/config-db-init.sh' && (curl -fsS -o /dev/null http://127.0.0.1:5000/v2/ || '$remote_path/setup-incremental-registry.sh' '$remote_path' '$remote_path/registry-config.yml')" \
|| fail '服务器增量镜像仓库初始化失败。'
docker buildx build \
--builder "$builder_name" \
--platform "$target_platform" \
--output "type=oci,dest=$local_tar" \
--tag "$full_image" \
--build-context 'frontend=.caiwu-build/public' \
--build-arg "VCS_REF=$deploy_sha" \
--build-arg "BUILD_DATE=$build_date" \
--build-arg "APP_VERSION=$app_version" \
--build-arg "COMPOSER_REPO_PACKAGIST=$composer_repo_packagist" \
--label 'com.caiwu.project=CaiWuXiTong' \
--file deploy/Dockerfile \
. || fail '导出稳定分层的 OCI 应用镜像失败。'
server_registry_image="$image_prefix:$image_tag"
before_bytes="$(ssh "${ssh_options[@]}" "$ssh_target" "du -sb /var/lib/docker-registry 2>/dev/null | cut -f1" | tr -dc '0-9')"
: "${before_bytes:=0}"
upload_start="$(date +%s)"
upload_ok=0
if [ "$skip_regctl" -eq 0 ]; then
if regctl_path="$(get_regctl_path)"; then
if local_registry_port="$(pick_free_port)" && start_registry_tunnel "$local_registry_port"; then
registry_image="127.0.0.1:${local_registry_port}/caiwuxitong/app:$image_tag"
upload_attempt=1
while [ "$upload_attempt" -le 2 ]; do
if [ "$upload_attempt" -gt 1 ]; then
stop_registry_tunnel
local_registry_port="$(pick_free_port)" || break
start_registry_tunnel "$local_registry_port" || break
registry_image="127.0.0.1:${local_registry_port}/caiwuxitong/app:$image_tag"
fi
if "$regctl_path" --host "reg=127.0.0.1:${local_registry_port},tls=disabled" image import "$registry_image" "$local_tar"; then
upload_ok=1
break
fi
if [ "$upload_attempt" -eq 1 ]; then
log '增量镜像隧道在上传期间中断，正在重新建立隧道并重试一次。'
fi
upload_attempt=$((upload_attempt + 1))
done
fi
else
log 'regctl 无法准备（本机安全软件可能拦截了未签名程序）。'
fi
else
log '已指定 --skip-regctl：跳过 regctl，直接用 docker 直传镜像。'
fi
stop_registry_tunnel
if [ "$upload_ok" -eq 0 ]; then
if [ "$skip_regctl" -eq 0 ]; then
log '改用 docker 直传方式上传镜像（与 regctl 增量导入等效，只是传输完整镜像包）。'
fi
rm -f "$local_tar"
docker save --output "$local_tar" "$full_image" || fail '导出应用镜像失败。'
gzip -1 -c "$local_tar" > "$local_archive"
rm -f "$local_tar"
log "docker 直传镜像包：$(du -m "$local_archive" | awk '{print $1}') MiB"
scp_to_remote "$local_archive" "${ssh_target}:$remote_archive" || fail '上传镜像失败。'
ssh "${ssh_options[@]}" "$ssh_target" \
"gunzip -cf '$remote_archive' | docker load && docker tag '$full_image' '$server_registry_image' && docker push '$server_registry_image'" \
|| fail '服务器加载镜像或推入本机 Registry 失败。'
upload_ok=1
fi
[ "$upload_ok" -eq 1 ] || fail '增量镜像层上传失败。'
upload_seconds=$(( $(date +%s) - upload_start ))
after_bytes="$(ssh "${ssh_options[@]}" "$ssh_target" "du -sb /var/lib/docker-registry 2>/dev/null | cut -f1" | tr -dc '0-9')"
: "${after_bytes:=0}"
incremental_mib="$(awk -v a="$after_bytes" -v b="$before_bytes" 'BEGIN { v = (a - b) / 1048576; if (v < 0) v = 0; printf "%.2f", v }')"
log "增量新增镜像层：${incremental_mib} MiB；传输耗时：${upload_seconds} 秒"
ssh "${ssh_options[@]}" "$ssh_target" "'$remote_path/activate-incremental-release.sh' '$server_registry_image' '$image_tag' '$remote_path' '$deploy_sha' '$migration_flag' '$keep_images'" \
|| fail '服务器增量激活或健康检查失败。'
fi
expected_page_hash="$(sha256_file "$repo_root/.caiwu-build/public/js/business/pages.min.js")"
deployed_page_hash="$(ssh "${ssh_options[@]}" "$ssh_target" "docker exec caiwu_app sha256sum /var/www/html/public/js/business/pages.min.js | cut -d ' ' -f1" | tr -d '[:space:]')"
if [ "$deployed_page_hash" != "$expected_page_hash" ]; then
fail '生产容器中的业务页签脚本与本次构建不一致。'
fi
if [ "$configure_dingtalk_callback" -eq 1 ]; then
ssh "${ssh_options[@]}" "$ssh_target" "chmod 700 '$remote_path/configure-dingtalk-callback.sh' && '$remote_path/configure-dingtalk-callback.sh' '$server' '$remote_path'" \
|| fail '钉钉 HTTP 回调 Nginx 配置失败。'
fi
remove_old_project_images "$full_image"
log "发布完成：$full_image -> $app_url"
Reference in New Issue View Git Blame Copy Permalink