perf: multi-stage Dockerfile + remove Maven from CI — Docker layer caching instead

.gitea/workflows/deploy.yml

@@ -19,13 +19,8 @@ env:
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
-    container:
-      image: maven:3.9-eclipse-temurin-17
-      volumes:
-        - maven-cache:/root/.m2
     steps:
       - name: Validate branch ↔ environment
-        shell: bash
         run: |
           set -euo pipefail
           REF="${{ gitea.ref }}"
@@ -65,39 +60,17 @@ jobs:
           esac
 
       - name: Checkout code
-        shell: bash
         run: |
           set -euo pipefail
-          # maven 容器可能无 git
-          if ! command -v git >/dev/null 2>&1; then
-            apt-get update -qq
-            apt-get install -y -qq git
-          fi
           git clone "$REPO_URL" .
           git checkout "${{ gitea.sha }}"
 
-      - name: Install Docker CLI
-        shell: bash
-        run: |
-          set -euo pipefail
-          apt-get update -qq
-          apt-get install -y -qq docker.io
-          docker --version
-
-      - name: Build with Maven
-        shell: bash
-        run: |
-          set -euo pipefail
-          mvn clean package -DskipTests -B
-
       - name: Login to Docker Registry
-        shell: bash
         run: |
           set -euo pipefail
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
       - name: Build & Push Docker image
-        shell: bash
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"
@@ -106,19 +79,12 @@ jobs:
           docker build -t "$REGISTRY/$APP:$TAG" -t "$REGISTRY/$APP:$ENV" .
           docker push "$REGISTRY/$APP:$TAG"
           docker push "$REGISTRY/$APP:$ENV"
-          if [ -n "${GITHUB_ENV:-}" ]; then
-            echo "IMAGE_TAG=$TAG" >> "$GITHUB_ENV"
-          fi
-          if [ -n "${GITEA_ENV:-}" ]; then
-            echo "IMAGE_TAG=$TAG" >> "$GITEA_ENV"
-          fi
+          echo "IMAGE_TAG=$TAG"
           echo "$TAG" > image_tag.txt
           mkdir -p /tmp/lpt-ci
           echo "$TAG" > /tmp/lpt-ci/image_tag.txt
-          echo "IMAGE_TAG=$TAG"
 
       - name: Setup kubectl
-        shell: bash
         run: |
           set -euo pipefail
           curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
@@ -128,7 +94,6 @@ jobs:
           echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > ~/.kube/config
 
       - name: Create/Update imagePullSecret
-        shell: bash
         run: |
           set -euo pipefail
           kubectl create secret docker-registry regcred \
@@ -139,23 +104,15 @@ jobs:
             --dry-run=client -o yaml | kubectl apply -f -
 
       - name: Deploy to K8s
-        shell: bash
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"
-          IMAGE_TAG="${IMAGE_TAG:-}"
-          if [ -z "$IMAGE_TAG" ] && [ -f image_tag.txt ]; then
-            IMAGE_TAG="$(cat image_tag.txt)"
-          fi
-          if [ -z "$IMAGE_TAG" ] && [ -f /tmp/lpt-ci/image_tag.txt ]; then
-            IMAGE_TAG="$(cat /tmp/lpt-ci/image_tag.txt)"
-          fi
+          IMAGE_TAG="$(cat image_tag.txt 2>/dev/null || cat /tmp/lpt-ci/image_tag.txt 2>/dev/null || echo '')"
           if [ -z "$IMAGE_TAG" ]; then
             echo "ERROR: IMAGE_TAG 为空，无法部署"
             exit 1
           fi
           echo "Deploying $REGISTRY/$APP:$IMAGE_TAG -> namespace lpt-$ENV"
-          # Spring profile 由 K8s Deployment 的 SPRING_PROFILES_ACTIVE 控制，镜像本身不区分
           kubectl set image "deployment/$APP" \
             "$APP=$REGISTRY/$APP:$IMAGE_TAG" \
             -n "lpt-$ENV" --record
@@ -164,7 +121,6 @@ jobs:
 
       - name: Debug on failure
         if: failure()
-        shell: bash
         run: |
           ENV="${{ inputs.environment }}"
           echo "=== Deployment Status ==="
@@ -187,7 +143,6 @@ jobs:
 
       - name: Rollback on failure
         if: failure()
-        shell: bash
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"

Dockerfile

@@ -1,17 +1,24 @@
-# 使用官方 OpenJDK 作为基础镜像
-FROM eclipse-temurin:17-jre
-
-# 设置工作目录
+# Stage 1: Maven 构建（Docker 层缓存自动缓存依赖）
+FROM maven:3.9-eclipse-temurin-17 AS builder
 WORKDIR /app
 
-# 拷贝打包好的 JAR 文件到容器
-COPY target/LPT.jar LPT.jar
+# 先复制 pom.xml，单独一层 —— 只要依赖不变，这层就被缓存
+COPY pom.xml .
+RUN mvn dependency:go-offline -B -q
+
+# 再复制源码构建
+COPY src/ ./src/
+RUN mvn package -DskipTests -B -q
+
+# Stage 2: 运行时（精简 JRE）
+FROM eclipse-temurin:17-jre
+WORKDIR /app
+
+COPY --from=builder /app/target/LPT.jar LPT.jar
 
-# 暴露应用运行的端口
 EXPOSE 8888
 
-# 启动应用
 ENTRYPOINT ["java", "-jar", "LPT.jar"]
 
-# 健康检查
-HEALTHCHECK --interval=10s --timeout=5s CMD curl --fail http://localhost:8888/actuator/health || exit 1
+HEALTHCHECK --interval=10s --timeout=5s \
+  CMD curl --fail http://localhost:8888/actuator/health || exit 1