fix(ci): 修复部署流水线配置

- 使用 Git commit hash 作为镜像标签
- 修复 Docker 网络配置（先连接 traefik-public，再附加 mysql 网络）
- 增加健康检查超时到 120 秒
- 添加镜像清理阶段（保留 7 天）
- 修复 Gitea Actions: github.sha → gitea.sha
- 添加 Docker Registry 认证
- kubectl 版本修正为 v1.30.0
- JDK 安装添加 sudo 权限
- 添加部署失败自动回滚机制

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -23,28 +23,32 @@ jobs:
       - name: Checkout code
         run: |
           git clone $REPO_URL .
-          git checkout ${{ github.sha }}
+          git checkout ${{ gitea.sha }}
 
       - name: Set up JDK 17
         run: |
-          apt-get update -qq
+          sudo apt-get update -qq
-          apt-get install -y -qq openjdk-17-jdk
+          sudo apt-get install -y -qq openjdk-17-jdk
           java -version
 
       - name: Build with Maven
         run: ./mvnw package -DskipTests -B
 
+      - name: Login to Docker Registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login $REGISTRY -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
       - name: Build & Push Docker image
         run: |
           apt-get install -y -qq docker.io
-          TAG=${{ github.sha }}
+          TAG=${{ gitea.sha }}
           docker build -t $REGISTRY/$APP:$TAG -t $REGISTRY/$APP:${{ inputs.environment }} .
           docker push $REGISTRY/$APP:$TAG
           docker push $REGISTRY/$APP:${{ inputs.environment }}
 
       - name: Setup kubectl
         run: |
-          curl -sLO "https://dl.k8s.io/release/v1.36.0/bin/linux/amd64/kubectl"
+          curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
           chmod +x kubectl
           mv kubectl /usr/local/bin/
           mkdir -p ~/.kube
@@ -52,6 +56,12 @@ jobs:
 
       - name: Deploy to K8s
         run: |
-          TAG=${{ github.sha }}
+          TAG=${{ gitea.sha }}
-          kubectl set image deployment/$APP $APP=$REGISTRY/$APP:$TAG -n lpt-${{ inputs.environment }}
+          kubectl set image deployment/$APP $APP=$REGISTRY/$APP:$TAG -n lpt-${{ inputs.environment }} --record
+          kubectl rollout status deployment/$APP -n lpt-${{ inputs.environment }} --timeout=5m
+
+      - name: Rollback on failure
+        if: failure()
+        run: |
+          kubectl rollout undo deployment/$APP -n lpt-${{ inputs.environment }}
           kubectl rollout status deployment/$APP -n lpt-${{ inputs.environment }}

Jenkinsfile

@@ -1,7 +1,7 @@
 pipeline {
-    agent none  // 全局不指定，局部自己声明
+    agent none
     environment {
-        IMAGE_NAME = 'lpt-prod:0.0'
+        IMAGE_NAME = "lpt-prod:${env.GIT_COMMIT?.take(8) ?: '0.0'}"
         CONTAINER_NAME = 'LPT-prod'
         CONTAINER_PORT = '8888'
     }
@@ -31,23 +31,24 @@ pipeline {
                 sh '''
                   docker network create traefik-public || true
                   docker rm -f $CONTAINER_NAME || true
-                  docker run -d --name $CONTAINER_NAME --network mysql-prod_mysql-prod \\
+                  docker run -d --name $CONTAINER_NAME \
-                  --restart=always \\
+                  --network traefik-public \
-                   -e SPRING_PROFILES_ACTIVE=prod \\
+                  --restart=always \
-                      --label "traefik.enable=true" \\
+                   -e SPRING_PROFILES_ACTIVE=prod \
-                      --label "traefik.docker.network=traefik-public" \\
+                      --label "traefik.enable=true" \
-                      --label 'traefik.http.routers.lpt-api.rule=Host(`lpt.cat-shark.xyz`) && PathPrefix(`/api`)' \\
+                      --label "traefik.docker.network=traefik-public" \
-                      --label "traefik.http.routers.lpt-api.entrypoints=websecure" \\
+                      --label 'traefik.http.routers.lpt-api.rule=Host(`lpt.cat-shark.xyz`) && PathPrefix(`/api`)' \
-                      --label "traefik.http.routers.lpt-api.tls.certresolver=le" \\
+                      --label "traefik.http.routers.lpt-api.entrypoints=websecure" \
-                      --label "traefik.http.routers.lpt-api.priority=100" \\
+                      --label "traefik.http.routers.lpt-api.tls.certresolver=le" \
-                      --label "traefik.http.routers.lpt-api.service=lpt-api" \\
+                      --label "traefik.http.routers.lpt-api.priority=100" \
-                      --label "traefik.http.routers.lpt-api.middlewares=lpt-api-strip" \\
+                      --label "traefik.http.routers.lpt-api.service=lpt-api" \
-                      --label "traefik.http.middlewares.lpt-api-strip.stripprefix.prefixes=/api" \\
+                      --label "traefik.http.routers.lpt-api.middlewares=lpt-api-strip" \
-                      --label "traefik.http.services.lpt-api.loadbalancer.server.port=$CONTAINER_PORT" \\
+                      --label "traefik.http.middlewares.lpt-api-strip.stripprefix.prefixes=/api" \
-                      --log-driver=loki \\
+                      --label "traefik.http.services.lpt-api.loadbalancer.server.port=$CONTAINER_PORT" \
-                      --log-opt loki-url="http://192.168.123.199:3100/loki/api/v1/push" \\
+                      --log-driver=loki \
+                      --log-opt loki-url="http://192.168.123.199:3100/loki/api/v1/push" \
                    $IMAGE_NAME
-                  docker network connect traefik-public $CONTAINER_NAME || true
+                  docker network connect mysql-prod_mysql-prod $CONTAINER_NAME || true
                 '''
             }
         }
@@ -57,7 +58,7 @@ pipeline {
             steps {
                 script {
                     def lastStatus = ''
-                    timeout(time: 60, unit: 'SECONDS') {
+                    timeout(time: 120, unit: 'SECONDS') {
                         waitUntil {
                             def status = sh(
                                     script: "docker inspect -f '{{.State.Health.Status}}' $CONTAINER_NAME || echo 'unhealthy'",
@@ -74,5 +75,12 @@ pipeline {
                 }
             }
         }
+
+        stage('清理旧镜像') {
+            agent any
+            steps {
+                sh 'docker image prune -af --filter "until=168h" || true'
+            }
+        }
     }
 }