jiu/.gitea/workflows/deploy-client.yml at 7328d85912f418b1a52afd0c290dba56500abbec

Files

T

wangjia 824992fe6e devops: 备案通过回切 https 域名 + 流水线 Ali 单轨

- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、
  ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除
- 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/
  release-client/notify）
- 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、
  seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

2026-07-03 09:58:30 +08:00

201 lines

6.2 KiB

YAML

Raw Blame History

 name: Deploy Client
 on:
   push:
     tags:
       - 'client-v[0-9]*.[0-9]*.[0-9]*'
 concurrency:
   group: deploy-client
   cancel-in-progress: false
 jobs:
   build-client-web:
     runs-on: mac
     env:
       GOPROXY: https://goproxy.cn,direct
       PUB_HOSTED_URL: https://pub.flutter-io.cn
       FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
     steps:
       - uses: actions/checkout@v4
       - name: Provision (idempotent — auto-runs if host not initialized)
         run: sh scripts/ci/provision-mac.sh
       - name: Compile (Flutter Web)
         run: sh scripts/ci/compile-client-web.sh "${{ gitea.ref_name }}"
       - name: Upload web artifacts
         uses: actions/upload-artifact@v3
         with:
           name: client-web
           path: dist/
   build-macos:
     needs: build-client-web
     runs-on: mac
     env:
       PUB_HOSTED_URL: https://pub.flutter-io.cn
       FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
     steps:
       - uses: actions/checkout@v4
       - name: Provision (idempotent — auto-runs if host not initialized)
         run: sh scripts/ci/provision-mac.sh
       - name: Compile (Flutter macOS)
         env:
           MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }}
           MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }}
           APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
           APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
           APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
         run: sh scripts/ci/compile-macos.sh "${{ gitea.ref_name }}"
       - name: Upload macos artifacts
         uses: actions/upload-artifact@v3
         with:
           name: macos
           path: dist/
   build-android:
     needs: build-macos
     runs-on: mac
     env:
       PUB_HOSTED_URL: https://pub.flutter-io.cn
       FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
     steps:
       - uses: actions/checkout@v4
       - name: Provision (idempotent — auto-runs if host not initialized)
         run: sh scripts/ci/provision-mac.sh
       - name: Compile (Flutter Android APK)
         env:
           ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
           ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
           ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
           ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: sh scripts/ci/compile-android.sh "${{ gitea.ref_name }}"
       - name: Upload android artifacts
         uses: actions/upload-artifact@v3
         with:
           name: android
           path: dist/
   build-ios:
     needs: build-android
     runs-on: mac
     env:
       PUB_HOSTED_URL: https://pub.flutter-io.cn
       FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
     steps:
       - uses: actions/checkout@v4
       - name: Provision (idempotent — auto-runs if host not initialized)
         run: sh scripts/ci/provision-mac.sh
       - name: Compile & upload to TestFlight (Flutter iOS)
         env:
           IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
           IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
           IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}
           IOS_TEAM_ID: ${{ secrets.IOS_TEAM_ID }}
           APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
           APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
           APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
         run: sh scripts/ci/compile-ios.sh "${{ gitea.ref_name }}"
   build-windows:
     runs-on: windows
     env:
       GOPROXY: https://goproxy.cn,direct
       PUB_HOSTED_URL: https://pub.flutter-io.cn
       FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
     steps:
       - uses: actions/checkout@v4
       - name: Provision (idempotent — auto-runs if host not initialized)
         shell: bash
         run: sh scripts/ci/provision-windows.sh
       - name: Compile (Flutter Windows)
         shell: bash
         run: sh scripts/ci/compile-windows.sh "${{ gitea.ref_name }}"
       - name: Upload windows artifacts
         uses: actions/upload-artifact@v3
         with:
           name: windows
           path: dist/
   release-deploy-client:
     needs: [build-client-web, build-macos, build-android, build-ios, build-windows]
     runs-on: mac
     env:
       GOPROXY: https://goproxy.cn,direct
       PUB_HOSTED_URL: https://pub.flutter-io.cn
       FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
     steps:
       - uses: actions/checkout@v4
       - name: Download web artifacts
         uses: actions/download-artifact@v3
         with:
           name: client-web
           path: dist/
       - name: Download macos artifacts
         uses: actions/download-artifact@v3
         with:
           name: macos
           path: dist/
       - name: Download android artifacts
         uses: actions/download-artifact@v3
         with:
           name: android
           path: dist/
       - name: Download windows artifacts
         uses: actions/download-artifact@v3
         with:
           name: windows
           path: dist/
       - name: Test (flutter analyze)
         run: sh scripts/ci/test.sh client
       - name: Release
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
         run: sh scripts/ci/release-client.sh "${{ gitea.ref_name }}"
       # 2026-07-03 割接后阿里机即唯一发布目标（EC2 轨移除；EC2 仅保留
       # jiu.51yanmei.com 反代桥接到 ali，见 baize 台账）。
       - name: Deploy → Ali
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
           DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
           DEPLOY_HOST: ${{ secrets.ALI_HOST }}
           DEPLOY_USER: ${{ secrets.ALI_USER }}
         run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
       - name: Notify
         if: always()
         env:
           TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
         run: sh scripts/ci/notify.sh "${{ gitea.ref_name }}" "${{ job.status }}"

201 lines 6.2 KiB YAML Raw Blame History

201 lines

6.2 KiB

YAML

Raw Blame History