feat: 自动部署 + android 每次提交触发

- docker-build.yml: main 分支推送 → 构建 OTA 包 → Docker 镜像 → :3002 自动部署 - Dockerfile: node:22-alpine, dist + server + ota-package, healthcheck - android-build.yml: 触发改为 on push (所有分支), 每次提交都构建 - ota-package/README.md 占位, 本地 docker build 不报错 - .gitignore / .dockerignore 调整
2026-09-11 17:12:58 +08:00
parent 38b5e3190a
commit 84fb01b8a3
6 changed files with 183 additions and 4 deletions
@@ -0,0 +1,100 @@
+name: Docker Build and Push
+
+# 仅 main 分支 push 触发 (每次提交 → 自动部署)
+# 每次主分支提交: 构建前端 + 生成 OTA 升级包 (minisign 签名) → 打进 Docker 镜像 → 部署到 :3002
+# OTA 随镜像发布: 容器内 OTA_PACKAGE_DIR=/app/ota-package 指向打包的 ota-package/
+# 依赖配置注册中心 (bh.vps.honor3.com:8008):
+#   - service-wardrobe / ota : MINISIGN_PRIVATE_KEY (整段 .key 内容, 多行)
+on:
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  build-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      # VITE_API_BASE 留空 = 前端走同源 /api (OTA server 同进程托管首页 + OTA 接口)
+      VITE_API_BASE: ""
+      CONFIG_CENTER_URL: '${{ secrets.CONFIG_CENTER_URL }}'
+      CONFIG_CENTER_TOKEN: '${{ secrets.CONFIG_CENTER_TOKEN }}'
+      REGISTRY_URL_FALLBACK: 'http://bh.vps.honor3.com:8008'
+      CFG_PROJECT_SIGNING: 'proj-mtwjnvir-k52zvp'
+
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install deps
+        run: npm ci --no-audit --no-fund
+
+      - name: Build frontend
+        # dist/ 供 OTA 打包用 (Dockerfile 内也会构建一份)
+        run: npm run build
+
+      - name: Install minisign
+        run: sudo apt-get update && sudo apt-get install -y minisign
+
+      - name: Fetch config center (minisign key)
+        run: |
+          set -euo pipefail
+          export CONFIG_CENTER_URL="${CONFIG_CENTER_URL:-$REGISTRY_URL_FALLBACK}"
+          python3 - <<'PYEOF'
+          import json, os, urllib.request
+          url = os.environ["CONFIG_CENTER_URL"]
+          token = os.environ.get("CONFIG_CENTER_TOKEN", "") or ""
+          req = urllib.request.Request(f"{url}/api/projects/{os.environ['CFG_PROJECT_SIGNING']}/configs")
+          if token:
+              req.add_header("Authorization", "Bearer " + token)
+          with urllib.request.urlopen(req, timeout=20) as r:
+              data = json.load(r).get("data", [])
+          wanted = {}
+          for cfg in data:
+              if cfg.get("key") == "MINISIGN_PRIVATE_KEY":
+                  wanted[cfg["key"]] = cfg.get("value", "")
+          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
+              for k, v in wanted.items():
+                  if "\n" in v or v.startswith("untrusted comment"):
+                      f.write(f"{k}<<EOF\n{v}\nEOF\n")
+                  else:
+                      f.write(f"{k}={v}\n")
+          if "MINISIGN_PRIVATE_KEY" not in wanted:
+              raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
+          PYEOF
+
+      - name: Build & sign OTA package
+        # 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
+        # 产物 ota-package/ (tar.gz + latest.json + .minisig) 进入 docker build context, 由 Dockerfile COPY 进镜像
+        env:
+          OTA_NOTES: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          node scripts/build-ota.mjs --out ota-package --notes ${OTA_NOTES}
+          echo "===== latest.json ====="
+          cat ota-package/latest.json
+          echo "===== bundle sha256 ====="
+          sha256sum ota-package/wardrobe-ota.tar.gz
+
+      - name: Build Docker image
+        run: docker build -t wardrobe:latest .
+
+      - name: List images
+        run: docker images
+
+      - name: Remove old container
+        run: docker rm -vf wardrobe || true
+
+      - name: Recycle container
+        run: docker system prune --volumes -f
+
+      - name: Run container
+        # 一键镜像: 前端 + OTA + 首页, 端口 3002 (与 iboard 的 3001 同机共存)
+        run: |
+          docker run -d --name wardrobe -p 3002:3002 wardrobe:latest