更新 cicd：构建后发布 R2 + website 到 GitHub，密钥走配置中心

.gitea/workflows/ci.yaml

@@ -1,12 +1,49 @@
-name: TDevOPsCICD
+name: TDevOpsCICD
 
 on: [push]
 
 jobs:
-  build-image:
+  build-kit:
     runs-on: ubuntu-latest
     steps:
       - uses: https://gitea.com/actions/checkout@v4
+
+      - name: 从配置中心加载密钥
+        env:
+          CONFIG_CENTER_URL: ${{ secrets.CONFIG_CENTER_URL }}
+          CONFIG_CENTER_TOKEN: ${{ secrets.CONFIG_CENTER_TOKEN }}
+        run: |
+          set -e
+          BASE_URL="${CONFIG_CENTER_URL:-http://bh.vps.honor3.com:8008}"
+          AUTH_ARGS=()
+          if [ -n "$CONFIG_CENTER_TOKEN" ]; then
+            AUTH_ARGS=(-H "Authorization: Bearer ${CONFIG_CENTER_TOKEN}")
+          fi
+          curl -fsSL "${AUTH_ARGS[@]}" "$BASE_URL/api/projects" -o /tmp/cc-projects.json
+          node -e '
+            const fs = require("fs");
+            const projects = JSON.parse(fs.readFileSync("/tmp/cc-projects.json", "utf8")).data;
+            const proj = projects.find(p => p.name === "CommonExternalService");
+            if (!proj) { console.error("project CommonExternalService not found"); process.exit(1); }
+            fs.writeFileSync("/tmp/cc-project-id", proj.id);
+          '
+          PROJECT_ID=$(cat /tmp/cc-project-id)
+          curl -fsSL "${AUTH_ARGS[@]}" "$BASE_URL/api/projects/$PROJECT_ID/configs" -o /tmp/cc-configs.json
+          node -e '
+            const fs = require("fs");
+            const data = JSON.parse(fs.readFileSync("/tmp/cc-configs.json", "utf8")).data;
+            const allow = ["CF_API_TOKEN","CF_R2_PUBLIC_URL","CF_R2_BUCKET","GH_TOKEN","GH_OWNER","GH_REPO","GH_BRANCH"];
+            const loaded = [];
+            for (const c of data) {
+              const key = String(c.key).split("/").pop();
+              if (allow.includes(key) && c.value) {
+                fs.appendFileSync(process.env.GITHUB_ENV, `${key}=${c.value}\n`);
+                loaded.push(key);
+              }
+            }
+            console.log("loaded config keys:", loaded.join(", "));
+          '
+
       - name: Setup Bun
         run: |
           curl -fsSL https://bun.sh/install | bash
@@ -14,39 +51,106 @@ jobs:
           export PATH="$BUN_INSTALL/bin:$PATH"
           echo "BUN_INSTALL=$HOME/.bun" >> $GITHUB_ENV
           echo "$HOME/.bun/bin" >> $GITHUB_PATH
-      - name: Build Binary
+
+      - name: Install pkg
+        run: npm i -g pkg
+
+      - name: Install deps
+        run: |
+          cd kit
+          bun i
+
+      - name: Build Windows (bun 交叉编译)
+        run: |
+          cd kit
+          bun run windows
+          ls -la ./dist/windows/
+
+      - name: Build Linux (bun, 现代 glibc)
+        run: |
+          cd kit
+          bun run linux
+          ls -la ./dist/linux/
+
+      - name: Build Linux (pkg, 低版本 glibc / Kylin V10) + 打包 zip
+        run: |
+          set -e
+          cd kit
+          # pkg 首次构建需要从 GitHub 下载 node14 基础运行时，网络不稳时重试
+          for i in 1 2 3; do npm run pkg-linux && break || sleep 5; done
+          test -f ./dist/kylin/kit || { echo "pkg build failed"; exit 1; }
+          if ! command -v zip >/dev/null 2>&1; then
+            (apt-get update -qq && apt-get install -y -qq zip) >/dev/null 2>&1 || true
+          fi
+          command -v zip >/dev/null 2>&1 || { echo "zip not available"; exit 1; }
+          cd ./dist/kylin
+          zip -9 -j kit.zip kit
+          rm -f kit
+          ls -la .
+
+      - name: 上传到 Gitea packages（存档）
         env:
           OBJECT_TOKEN: ${{ secrets.OBJECT_TOKEN }}
           GITEA_BASE_URL: http://git.honor3.com
           PACKAGE_OWNER: Fullstack
           REPO_NAME: kit.program
-          PACKAGE_NAME: kit
           PACKAGE_VERSION: ${{ github.ref_name }}
         run: |
-          set -e  # 遇到错误立即退出
+          set -e
-          echo ----------------------------------------
+          curl -fsSL -X POST -H "Authorization: token $OBJECT_TOKEN" \
-          echo "Branch/Tag: ${{ github.ref_name }}"
+            -F "data=@./kit/dist/windows/kit.exe" \
-          echo "Commit SHA: ${{ github.sha }}"
+            "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit.exe"
-          bun -v
+          curl -fsSL -X POST -H "Authorization: token $OBJECT_TOKEN" \
-          cd kit
+            -F "data=@./kit/dist/linux/kit" \
-          bun i
+            "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit"
-          
+          curl -fsSL -X POST -H "Authorization: token $OBJECT_TOKEN" \
-          echo "=== Building Windows ==="
+            -F "data=@./kit/dist/kylin/kit.zip" \
-          bun run windows
+            "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit-kylin.zip"
-          ls -la ./dist/windows/
+
-          
+      - name: 上传二进制到 Cloudflare R2（公开桶）
-          echo "=== Uploading Windows ==="
+        run: |
-          curl -v -X POST \
+          set -e
-                -H "Authorization: token $OBJECT_TOKEN" \
+          test -n "$CF_API_TOKEN" || { echo "CF_API_TOKEN 未从配置中心加载"; exit 1; }
-                -F "data=@./dist/windows/kit.exe" \
+          npm i -g wrangler
-                "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit.exe"
+          export CLOUDFLARE_API_TOKEN="$CF_API_TOKEN"
-          
+          # 仅需 token，wrangler 会自动从 token 解析账号 ID，无需 CF_ACCOUNT_ID
-          echo "=== Building Linux ==="
+          BUCKET="${CF_R2_BUCKET:-store}"
-          bun run linux
+          wrangler r2 object put "$BUCKET/data/windows/kit.exe" --file ./kit/dist/windows/kit.exe --content-type application/octet-stream --remote
-          ls -la ./dist/linux/
+          wrangler r2 object put "$BUCKET/data/linux/kit" --file ./kit/dist/linux/kit --content-type application/octet-stream --remote
-          
+          wrangler r2 object put "$BUCKET/data/kylin/kit.zip" --file ./kit/dist/kylin/kit.zip --content-type application/zip --remote
-          echo "=== Uploading Linux ==="
+
-          curl -v -X POST \
+      - name: 发布 website 到 GitHub（触发 Cloudflare Pages 自动部署）
-                -H "Authorization: token $OBJECT_TOKEN" \
+        env:
-                -F "data=@./dist/linux/kit" \
+          REF_NAME: ${{ github.ref_name }}
-                "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit"
+          SHA: ${{ github.sha }}
+        run: |
+          set -e
+          test -n "$GH_TOKEN" || { echo "GH_TOKEN 未从配置中心加载"; exit 1; }
+          mkdir -p website/static/data
+          cat > website/static/data/kit.json <<EOF
+          {
+            "version": "${REF_NAME}",
+            "commit": "${SHA}",
+            "updatedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "binaries": {
+              "windows": { "url": "${CF_R2_PUBLIC_URL}/data/windows/kit.exe" },
+              "linux":   { "url": "${CF_R2_PUBLIC_URL}/data/linux/kit" },
+              "kylin":   { "url": "${CF_R2_PUBLIC_URL}/data/kylin/kit.zip" }
+            }
+          }
+          EOF
+          cat website/static/data/kit.json
+          URL="https://x-access-token:${GH_TOKEN}@github.com/${GH_OWNER}/${GH_REPO}.git"
+          rm -rf /tmp/website-pub
+          git clone --depth 1 --branch "${GH_BRANCH:-main}" "${URL}" /tmp/website-pub
+          cp -a website/. /tmp/website-pub/
+          cd /tmp/website-pub
+          git config user.name "kit-ci"
+          git config user.email "kit-ci@honor3.com"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No website changes to publish"
+          else
+            git commit -m "release(website): publish kit ${REF_NAME}"
+            git push origin "${GH_BRANCH:-main}"
+          fi

.gitignore

@@ -3,3 +3,4 @@ dist
 build.json
 kit/.kit/modules/*
 kit/publish/*
+.wrangler

buildenv/Dockerfile

@@ -1,14 +1,17 @@
-FROM node:latest
+FROM node:20-bookworm
 LABEL authors="hq@gpio.me"
 
-
 WORKDIR /app
-ADD index.js /app
 
 RUN npm config set registry http://registry.npmmirror.com
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git curl zip python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSL https://bun.sh/install | bash \
+    && ln -s /root/.bun/bin/bun /usr/local/bin/bun
+
 RUN npm i pkg -g
-RUN pkg -t node14-alpine-arm64 index.js
-RUN pkg -t node14-linux-arm64 index.js
-
-
 
+ENV PATH="/root/.bun/bin:${PATH}"

kit/package.json

@@ -10,7 +10,8 @@
     "pkg-alpine": "bun build.js && pkg --compress GZip . -t node14-alpine-arm64 -o ./dist/alpine/kit",
     "pkg-windows": "bun build.js && pkg --compress GZip . -t node14-windows-x64 -o ./dist/windows/kit.exe",
     "pkg-arm64": "bun build.js && pkg --compress GZip . -t node14-linux-arm64 -o ./dist/linux/kit",
-    "pkg-linux": "bun build.js && pkg --compress GZip . -t node14-linux-x64 -o ./dist/linux/kit"
+    "pkg-linux": "bun build.js && pkg --compress GZip . -t node14-linux-x64 -o ./dist/kylin/kit",
+    "kylin": "npm run pkg-linux"
   },
   "dependencies": {
     "auto-launch": "^5.0.6",

meta.json

@@ -15,7 +15,7 @@
                 "filename" : "kit.exe"
             },
             "x64|linux" : {
-                "path": "data/20250314003525/kit",
+                "path": "data/linux/kit",
                 "filename" : "kit"
             },
             "x64|linux|kylin V10" : {