84fb01b8a3
- docker-build.yml: main 分支推送 → 构建 OTA 包 → Docker 镜像 → :3002 自动部署 - Dockerfile: node:22-alpine, dist + server + ota-package, healthcheck - android-build.yml: 触发改为 on push (所有分支), 每次提交都构建 - ota-package/README.md 占位, 本地 docker build 不报错 - .gitignore / .dockerignore 调整
100 lines
3.7 KiB
YAML
100 lines
3.7 KiB
YAML
name: Docker Build and Push
|
|
|
|
# 仅 main 分支 push 触发 (每次提交 → 自动部署)
|
|
# 每次主分支提交: 构建前端 + 生成 OTA 升级包 (minisign 签名) → 打进 Docker 镜像 → 部署到 :3002
|
|
# OTA 随镜像发布: 容器内 OTA_PACKAGE_DIR=/app/ota-package 指向打包的 ota-package/
|
|
# 依赖配置注册中心 (bh.vps.honor3.com:8008):
|
|
# - service-wardrobe / ota : MINISIGN_PRIVATE_KEY (整段 .key 内容, 多行)
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- master
|
|
|
|
jobs:
|
|
build-image:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
# VITE_API_BASE 留空 = 前端走同源 /api (OTA server 同进程托管首页 + OTA 接口)
|
|
VITE_API_BASE: ""
|
|
CONFIG_CENTER_URL: '${{ secrets.CONFIG_CENTER_URL }}'
|
|
CONFIG_CENTER_TOKEN: '${{ secrets.CONFIG_CENTER_TOKEN }}'
|
|
REGISTRY_URL_FALLBACK: 'http://bh.vps.honor3.com:8008'
|
|
CFG_PROJECT_SIGNING: 'proj-mtwjnvir-k52zvp'
|
|
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: https://gitea.com/actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Install deps
|
|
run: npm ci --no-audit --no-fund
|
|
|
|
- name: Build frontend
|
|
# dist/ 供 OTA 打包用 (Dockerfile 内也会构建一份)
|
|
run: npm run build
|
|
|
|
- name: Install minisign
|
|
run: sudo apt-get update && sudo apt-get install -y minisign
|
|
|
|
- name: Fetch config center (minisign key)
|
|
run: |
|
|
set -euo pipefail
|
|
export CONFIG_CENTER_URL="${CONFIG_CENTER_URL:-$REGISTRY_URL_FALLBACK}"
|
|
python3 - <<'PYEOF'
|
|
import json, os, urllib.request
|
|
url = os.environ["CONFIG_CENTER_URL"]
|
|
token = os.environ.get("CONFIG_CENTER_TOKEN", "") or ""
|
|
req = urllib.request.Request(f"{url}/api/projects/{os.environ['CFG_PROJECT_SIGNING']}/configs")
|
|
if token:
|
|
req.add_header("Authorization", "Bearer " + token)
|
|
with urllib.request.urlopen(req, timeout=20) as r:
|
|
data = json.load(r).get("data", [])
|
|
wanted = {}
|
|
for cfg in data:
|
|
if cfg.get("key") == "MINISIGN_PRIVATE_KEY":
|
|
wanted[cfg["key"]] = cfg.get("value", "")
|
|
with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
|
|
for k, v in wanted.items():
|
|
if "\n" in v or v.startswith("untrusted comment"):
|
|
f.write(f"{k}<<EOF\n{v}\nEOF\n")
|
|
else:
|
|
f.write(f"{k}={v}\n")
|
|
if "MINISIGN_PRIVATE_KEY" not in wanted:
|
|
raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
|
|
PYEOF
|
|
|
|
- name: Build & sign OTA package
|
|
# 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
|
|
# 产物 ota-package/ (tar.gz + latest.json + .minisig) 进入 docker build context, 由 Dockerfile COPY 进镜像
|
|
env:
|
|
OTA_NOTES: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
node scripts/build-ota.mjs --out ota-package --notes ${OTA_NOTES}
|
|
echo "===== latest.json ====="
|
|
cat ota-package/latest.json
|
|
echo "===== bundle sha256 ====="
|
|
sha256sum ota-package/wardrobe-ota.tar.gz
|
|
|
|
- name: Build Docker image
|
|
run: docker build -t wardrobe:latest .
|
|
|
|
- name: List images
|
|
run: docker images
|
|
|
|
- name: Remove old container
|
|
run: docker rm -vf wardrobe || true
|
|
|
|
- name: Recycle container
|
|
run: docker system prune --volumes -f
|
|
|
|
- name: Run container
|
|
# 一键镜像: 前端 + OTA + 首页, 端口 3002 (与 iboard 的 3001 同机共存)
|
|
run: |
|
|
docker run -d --name wardrobe -p 3002:3002 wardrobe:latest |