更新 cicd：构建后发布 R2 + website 到 GitHub，密钥走配置中心

2026-09-08 10:58:16 +08:00 · 2026-09-08 10:58:16 +08:00 · bfc29ea262
commit bfc29ea262
parent 1a929761d5
5 changed files with 149 additions and 40 deletions
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@ -1,12 +1,49 @@
-name: TDevOPsCICD
+name: TDevOpsCICD

 on: [push]

 jobs:
-  build-image:
+  build-kit:
    runs-on: ubuntu-latest
    steps:
      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: 从配置中心加载密钥
+        env:
+          CONFIG_CENTER_URL: ${{ secrets.CONFIG_CENTER_URL }}
+          CONFIG_CENTER_TOKEN: ${{ secrets.CONFIG_CENTER_TOKEN }}
+        run: |
+          set -e
+          BASE_URL="${CONFIG_CENTER_URL:-http://bh.vps.honor3.com:8008}"
+          AUTH_ARGS=()
+          if [ -n "$CONFIG_CENTER_TOKEN" ]; then
+            AUTH_ARGS=(-H "Authorization: Bearer ${CONFIG_CENTER_TOKEN}")
+          fi
+          curl -fsSL "${AUTH_ARGS[@]}" "$BASE_URL/api/projects" -o /tmp/cc-projects.json
+          node -e '
+            const fs = require("fs");
+            const projects = JSON.parse(fs.readFileSync("/tmp/cc-projects.json", "utf8")).data;
+            const proj = projects.find(p => p.name === "CommonExternalService");
+            if (!proj) { console.error("project CommonExternalService not found"); process.exit(1); }
+            fs.writeFileSync("/tmp/cc-project-id", proj.id);
+          '
+          PROJECT_ID=$(cat /tmp/cc-project-id)
+          curl -fsSL "${AUTH_ARGS[@]}" "$BASE_URL/api/projects/$PROJECT_ID/configs" -o /tmp/cc-configs.json
+          node -e '
+            const fs = require("fs");
+            const data = JSON.parse(fs.readFileSync("/tmp/cc-configs.json", "utf8")).data;
+            const allow = ["CF_API_TOKEN","CF_R2_PUBLIC_URL","CF_R2_BUCKET","GH_TOKEN","GH_OWNER","GH_REPO","GH_BRANCH"];
+            const loaded = [];
+            for (const c of data) {
+              const key = String(c.key).split("/").pop();
+              if (allow.includes(key) && c.value) {
+                fs.appendFileSync(process.env.GITHUB_ENV, `${key}=${c.value}\n`);
+                loaded.push(key);
+              }
+            }
+            console.log("loaded config keys:", loaded.join(", "));
+          '
+
      - name: Setup Bun
        run: |
          curl -fsSL https://bun.sh/install | bash
@ -14,39 +51,106 @@ jobs:
          export PATH="$BUN_INSTALL/bin:$PATH"
          echo "BUN_INSTALL=$HOME/.bun" >> $GITHUB_ENV
          echo "$HOME/.bun/bin" >> $GITHUB_PATH
-      - name: Build Binary
+
+      - name: Install pkg
+        run: npm i -g pkg
+
+      - name: Install deps
+        run: |
+          cd kit
+          bun i
+
+      - name: Build Windows (bun 交叉编译)
+        run: |
+          cd kit
+          bun run windows
+          ls -la ./dist/windows/
+
+      - name: Build Linux (bun, 现代 glibc)
+        run: |
+          cd kit
+          bun run linux
+          ls -la ./dist/linux/
+
+      - name: Build Linux (pkg, 低版本 glibc / Kylin V10) + 打包 zip
+        run: |
+          set -e
+          cd kit
+          # pkg 首次构建需要从 GitHub 下载 node14 基础运行时，网络不稳时重试
+          for i in 1 2 3; do npm run pkg-linux && break || sleep 5; done
+          test -f ./dist/kylin/kit || { echo "pkg build failed"; exit 1; }
+          if ! command -v zip >/dev/null 2>&1; then
+            (apt-get update -qq && apt-get install -y -qq zip) >/dev/null 2>&1 || true
+          fi
+          command -v zip >/dev/null 2>&1 || { echo "zip not available"; exit 1; }
+          cd ./dist/kylin
+          zip -9 -j kit.zip kit
+          rm -f kit
+          ls -la .
+
+      - name: 上传到 Gitea packages（存档）
        env:
          OBJECT_TOKEN: ${{ secrets.OBJECT_TOKEN }}
          GITEA_BASE_URL: http://git.honor3.com
          PACKAGE_OWNER: Fullstack
          REPO_NAME: kit.program
-          PACKAGE_NAME: kit
          PACKAGE_VERSION: ${{ github.ref_name }}
        run: |
-          set -e  # 遇到错误立即退出
-          echo ----------------------------------------
-          echo "Branch/Tag: ${{ github.ref_name }}"
-          echo "Commit SHA: ${{ github.sha }}"
-          bun -v
-          cd kit
-          bun i
+          set -e
+          curl -fsSL -X POST -H "Authorization: token $OBJECT_TOKEN" \
+            -F "data=@./kit/dist/windows/kit.exe" \
+            "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit.exe"
+          curl -fsSL -X POST -H "Authorization: token $OBJECT_TOKEN" \
+            -F "data=@./kit/dist/linux/kit" \
+            "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit"
+          curl -fsSL -X POST -H "Authorization: token $OBJECT_TOKEN" \
+            -F "data=@./kit/dist/kylin/kit.zip" \
+            "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit-kylin.zip"

-          echo "=== Building Windows ==="
-          bun run windows
-          ls -la ./dist/windows/
+      - name: 上传二进制到 Cloudflare R2（公开桶）
+        run: |
+          set -e
+          test -n "$CF_API_TOKEN" || { echo "CF_API_TOKEN 未从配置中心加载"; exit 1; }
+          npm i -g wrangler
+          export CLOUDFLARE_API_TOKEN="$CF_API_TOKEN"
+          # 仅需 token，wrangler 会自动从 token 解析账号 ID，无需 CF_ACCOUNT_ID
+          BUCKET="${CF_R2_BUCKET:-store}"
+          wrangler r2 object put "$BUCKET/data/windows/kit.exe" --file ./kit/dist/windows/kit.exe --content-type application/octet-stream --remote
+          wrangler r2 object put "$BUCKET/data/linux/kit" --file ./kit/dist/linux/kit --content-type application/octet-stream --remote
+          wrangler r2 object put "$BUCKET/data/kylin/kit.zip" --file ./kit/dist/kylin/kit.zip --content-type application/zip --remote

-          echo "=== Uploading Windows ==="
-          curl -v -X POST \
-                -H "Authorization: token $OBJECT_TOKEN" \
-                -F "data=@./dist/windows/kit.exe" \
-                "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit.exe"
-          
-          echo "=== Building Linux ==="
-          bun run linux
-          ls -la ./dist/linux/
-          
-          echo "=== Uploading Linux ==="
-          curl -v -X POST \
-                -H "Authorization: token $OBJECT_TOKEN" \
-                -F "data=@./dist/linux/kit" \
-                "$GITEA_BASE_URL/api/packages/$PACKAGE_OWNER/generic/$REPO_NAME/$PACKAGE_VERSION/kit"
+      - name: 发布 website 到 GitHub（触发 Cloudflare Pages 自动部署）
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -e
+          test -n "$GH_TOKEN" || { echo "GH_TOKEN 未从配置中心加载"; exit 1; }
+          mkdir -p website/static/data
+          cat > website/static/data/kit.json <<EOF
+          {
+            "version": "${REF_NAME}",
+            "commit": "${SHA}",
+            "updatedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "binaries": {
+              "windows": { "url": "${CF_R2_PUBLIC_URL}/data/windows/kit.exe" },
+              "linux":   { "url": "${CF_R2_PUBLIC_URL}/data/linux/kit" },
+              "kylin":   { "url": "${CF_R2_PUBLIC_URL}/data/kylin/kit.zip" }
+            }
+          }
+          EOF
+          cat website/static/data/kit.json
+          URL="https://x-access-token:${GH_TOKEN}@github.com/${GH_OWNER}/${GH_REPO}.git"
+          rm -rf /tmp/website-pub
+          git clone --depth 1 --branch "${GH_BRANCH:-main}" "${URL}" /tmp/website-pub
+          cp -a website/. /tmp/website-pub/
+          cd /tmp/website-pub
+          git config user.name "kit-ci"
+          git config user.email "kit-ci@honor3.com"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No website changes to publish"
+          else
+            git commit -m "release(website): publish kit ${REF_NAME}"
+            git push origin "${GH_BRANCH:-main}"
+          fi
--- a/.gitignore
+++ b/.gitignore
@ -3,3 +3,4 @@ dist
 build.json
 kit/.kit/modules/*
 kit/publish/*
+.wrangler
--- a/buildenv/Dockerfile
+++ b/buildenv/Dockerfile
@ -1,14 +1,17 @@
-FROM node:latest
+FROM node:20-bookworm
 LABEL authors="hq@gpio.me"

-
 WORKDIR /app
-ADD index.js /app

 RUN npm config set registry http://registry.npmmirror.com
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git curl zip python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSL https://bun.sh/install | bash \
+    && ln -s /root/.bun/bin/bun /usr/local/bin/bun
+
 RUN npm i pkg -g
-RUN pkg -t node14-alpine-arm64 index.js
-RUN pkg -t node14-linux-arm64 index.js
-
-

+ENV PATH="/root/.bun/bin:${PATH}"
--- a/kit/package.json
+++ b/kit/package.json
@ -10,7 +10,8 @@
    "pkg-alpine": "bun build.js && pkg --compress GZip . -t node14-alpine-arm64 -o ./dist/alpine/kit",
    "pkg-windows": "bun build.js && pkg --compress GZip . -t node14-windows-x64 -o ./dist/windows/kit.exe",
    "pkg-arm64": "bun build.js && pkg --compress GZip . -t node14-linux-arm64 -o ./dist/linux/kit",
-    "pkg-linux": "bun build.js && pkg --compress GZip . -t node14-linux-x64 -o ./dist/linux/kit"
+    "pkg-linux": "bun build.js && pkg --compress GZip . -t node14-linux-x64 -o ./dist/kylin/kit",
+    "kylin": "npm run pkg-linux"
  },
  "dependencies": {
    "auto-launch": "^5.0.6",
--- a/meta.json
+++ b/meta.json
@ -15,7 +15,7 @@
                "filename" : "kit.exe"
            },
            "x64|linux" : {
-                "path": "data/20250314003525/kit",
+                "path": "data/linux/kit",
                "filename" : "kit"
            },
            "x64|linux|kylin V10" : {