202 lines
7.7 KiB
YAML
202 lines
7.7 KiB
YAML
name: Docker Build and Deploy
|
||
|
||
on:
|
||
push:
|
||
branches:
|
||
- dev/add-agent
|
||
paths:
|
||
- 'api/**'
|
||
- '.github/workflows/**'
|
||
workflow_dispatch: # 允许手动触发
|
||
|
||
env:
|
||
IMAGE_NAME: lifecho-api
|
||
REGISTRY: crpi-u2903xccyzd6nqnc.cn-shanghai.personal.cr.aliyuncs.com
|
||
REGISTRY_NAMESPACE: huaga
|
||
|
||
jobs:
|
||
build-and-push:
|
||
name: Build and Push Docker Image
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
contents: read
|
||
|
||
steps:
|
||
- name: Checkout code
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
- name: Log in to Alibaba Cloud Container Registry
|
||
env:
|
||
REGISTRY: ${{ env.REGISTRY }}
|
||
USERNAME: ${{ secrets.ALIYUN_CR_USERNAME }}
|
||
PASSWORD: ${{ secrets.ALIYUN_CR_PASSWORD }}
|
||
run: |
|
||
echo "正在登录到阿里云容器镜像服务..."
|
||
echo "Registry: $REGISTRY"
|
||
echo "Username: $USERNAME"
|
||
echo "Password length: ${#PASSWORD}"
|
||
|
||
# 使用 printf 确保密码正确传递（包括特殊字符）
|
||
printf '%s\n' "$PASSWORD" | docker login "$REGISTRY" --username="$USERNAME" --password-stdin
|
||
|
||
echo "✅ 登录成功！"
|
||
|
||
- name: Extract metadata (tags, labels) for Docker
|
||
id: meta
|
||
uses: docker/metadata-action@v5
|
||
with:
|
||
images: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ env.IMAGE_NAME }}
|
||
tags: |
|
||
type=ref,event=branch
|
||
type=ref,event=pr
|
||
type=semver,pattern={{version}}
|
||
type=semver,pattern={{major}}.{{minor}}
|
||
type=sha,prefix={{branch}}-
|
||
type=raw,value=latest,enable={{is_default_branch}}
|
||
|
||
- name: Build and push Docker image
|
||
uses: docker/build-push-action@v5
|
||
with:
|
||
context: ./api
|
||
file: ./api/Dockerfile
|
||
push: true
|
||
tags: ${{ steps.meta.outputs.tags }}
|
||
labels: ${{ steps.meta.outputs.labels }}
|
||
cache-from: type=gha
|
||
cache-to: type=gha,mode=max
|
||
|
||
deploy:
|
||
name: Deploy to Remote Server
|
||
runs-on: ubuntu-latest
|
||
needs: build-and-push
|
||
if: github.event_name != 'pull_request'
|
||
|
||
steps:
|
||
- name: Checkout code
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Set up SSH
|
||
uses: webfactory/ssh-agent@v0.9.0
|
||
with:
|
||
ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
|
||
|
||
- name: Add server to known hosts
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
ssh-keyscan -H -p ${{ secrets.SSH_PORT || 22 }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts
|
||
|
||
- name: Determine image tag
|
||
id: image_tag
|
||
run: |
|
||
if [ "${{ github.ref_name }}" == "main" ] || [ "${{ github.ref_name }}" == "master" ]; then
|
||
echo "tag=latest" >> $GITHUB_OUTPUT
|
||
else
|
||
# 将分支名中的斜杠替换为破折号，以符合 Docker 标签规范
|
||
BRANCH_TAG=$(echo "${{ github.ref_name }}" | sed 's/\//-/g')
|
||
echo "tag=$BRANCH_TAG" >> $GITHUB_OUTPUT
|
||
fi
|
||
|
||
- name: Deploy to remote server
|
||
env:
|
||
SSH_USER: ${{ secrets.SSH_USER }}
|
||
SSH_HOST: ${{ secrets.SSH_HOST }}
|
||
SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
|
||
IMAGE_TAG: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ steps.image_tag.outputs.tag }}
|
||
COMPOSE_FILE: docker-compose.yml
|
||
COMPOSE_DIR: ${{ secrets.DEPLOY_PATH || '/opt/life-echo' }}
|
||
REGISTRY: ${{ env.REGISTRY }}
|
||
ALIYUN_CR_USERNAME: ${{ secrets.ALIYUN_CR_USERNAME }}
|
||
ALIYUN_CR_PASSWORD: ${{ secrets.ALIYUN_CR_PASSWORD }}
|
||
run: |
|
||
echo "开始部署到远程服务器..."
|
||
echo "镜像标签: $IMAGE_TAG"
|
||
echo "部署目录: $COMPOSE_DIR/api"
|
||
|
||
# 登录到阿里云容器仓库
|
||
echo "$ALIYUN_CR_PASSWORD" | ssh -p $SSH_PORT $SSH_USER@$SSH_HOST \
|
||
"docker login $REGISTRY --username=$ALIYUN_CR_USERNAME --password-stdin"
|
||
|
||
# 创建部署目录（如果不存在）
|
||
ssh -p $SSH_PORT $SSH_USER@$SSH_HOST \
|
||
"mkdir -p $COMPOSE_DIR/api"
|
||
|
||
# 第一步：强制停止并删除所有旧容器
|
||
echo "停止并删除旧容器..."
|
||
ssh -p $SSH_PORT $SSH_USER@$SSH_HOST "
|
||
# 先尝试使用 docker-compose down
|
||
cd $COMPOSE_DIR/api 2>/dev/null && docker-compose -f '$COMPOSE_FILE' down --remove-orphans 2>/dev/null || true
|
||
|
||
# 强制停止并删除所有 life-echo 相关容器（按名称匹配）
|
||
echo '强制清理所有 life-echo 容器...'
|
||
docker ps -a --filter 'name=life-echo' --format '{{.ID}}' | xargs -r docker rm -f 2>/dev/null || true
|
||
|
||
# 再次确保指定容器被删除
|
||
echo '确保指定容器被删除...'
|
||
docker rm -f life-echo-api-prod life-echo-celery-worker life-echo-postgres life-echo-redis life-echo-celery-beat life-echo-flower 2>/dev/null || true
|
||
|
||
# 等待容器完全停止
|
||
sleep 3
|
||
|
||
# 验证容器已删除
|
||
echo '验证容器状态...'
|
||
docker ps -a --filter 'name=life-echo' || true
|
||
"
|
||
|
||
# 第二步：先删除远程旧配置，再复制仓库中的 docker-compose.yml（强制覆盖）
|
||
echo "删除远程旧 docker-compose 配置以确保使用仓库版本..."
|
||
ssh -p $SSH_PORT $SSH_USER@$SSH_HOST \
|
||
"rm -f $COMPOSE_DIR/api/$COMPOSE_FILE $COMPOSE_DIR/api/${COMPOSE_FILE}.bak 2>/dev/null || true"
|
||
echo "复制配置文件（覆盖远程 docker-compose.yml）..."
|
||
scp -P $SSH_PORT ./api/$COMPOSE_FILE $SSH_USER@$SSH_HOST:$COMPOSE_DIR/api/
|
||
|
||
# 复制 .env.production 到远程服务器（重命名为 .env.prod）
|
||
echo "复制 .env.production 文件..."
|
||
scp -P $SSH_PORT ./api/.env.production $SSH_USER@$SSH_HOST:$COMPOSE_DIR/api/.env.prod
|
||
|
||
# 第三步：在远程服务器上执行部署操作
|
||
ssh -p $SSH_PORT $SSH_USER@$SSH_HOST "
|
||
set -e
|
||
cd $COMPOSE_DIR/api
|
||
|
||
echo '拉取最新镜像: $IMAGE_TAG'
|
||
docker pull '$IMAGE_TAG' || true
|
||
|
||
echo '备份并更新 docker-compose.yml 中的镜像标签...'
|
||
cp '$COMPOSE_FILE' '${COMPOSE_FILE}.bak'
|
||
|
||
# 更新所有包含 lifecho-api 或 life-echo-api 的 image 行
|
||
sed -i.tmp 's|image:.*lifecho-api.*|image: $IMAGE_TAG|g' '$COMPOSE_FILE'
|
||
sed -i.tmp 's|image:.*life-echo-api.*|image: $IMAGE_TAG|g' '$COMPOSE_FILE'
|
||
|
||
# 清理临时文件
|
||
rm -f '${COMPOSE_FILE}.tmp' 2>/dev/null || true
|
||
|
||
echo '启动新容器...'
|
||
docker-compose -f '$COMPOSE_FILE' pull || true
|
||
docker-compose -f '$COMPOSE_FILE' up -d
|
||
|
||
echo '等待容器启动...'
|
||
sleep 15
|
||
|
||
echo '清理旧镜像...'
|
||
docker image prune -f || true
|
||
|
||
echo '部署完成！'
|
||
|
||
echo '检查容器状态...'
|
||
docker-compose -f '$COMPOSE_FILE' ps
|
||
"
|
||
|
||
- name: Verify deployment
|
||
env:
|
||
SSH_USER: ${{ secrets.SSH_USER }}
|
||
SSH_HOST: ${{ secrets.SSH_HOST }}
|
||
SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
|
||
COMPOSE_DIR: ${{ secrets.DEPLOY_PATH || '/opt/life-echo' }}
|
||
run: |
|
||
echo "验证部署状态..."
|
||
ssh -p $SSH_PORT $SSH_USER@$SSH_HOST \
|
||
"cd $COMPOSE_DIR/api && docker-compose ps && docker-compose logs --tail=50 api" |