Git分支策略与CI/CD集成：基于GitLab 16.8的团队协作工作流配置详解

Branch: main
Allowed to merge: Maintainers
Allowed to push: No one
Allowed to force push: false
Code owner approval: true

Branch: develop
Allowed to merge: Developers + Maintainers
Allowed to push: No one
Allowed to force push: false

# .gitlab-ci.yml
stages:
  - build
  - test
  - quality
  - deploy

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  MAVEN_CLI_OPTS: "--batch-mode --errors --fail-at-end"

# 缓存Maven依赖，加速构建
cache:
  key: "$CI_COMMIT_REF_SLUG"
  paths:
    - .m2/repository/

# 只在feature分支和MR上运行的构建
build:
  stage: build
  image: maven:3.9.5-eclipse-temurin-17
  script:
    - mvn $MAVEN_CLI_OPTS clean compile -DskipTests
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
    - if: '$CI_COMMIT_BRANCH == "develop"'
    - if: '$CI_COMMIT_BRANCH == "main"'

# 单元测试，覆盖率必须>=70%
unit-test:
  stage: test
  image: maven:3.9.5-eclipse-temurin-17
  script:
    - mvn $MAVEN_CLI_OPTS test jacoco:report
    - awk -F"," '{ instructions += $4 + $5; covered += $5 } END { print covered, "/", instructions, " instructions covered"; print 100*covered/instructions, "% covered" }' target/site/jacoco/jacoco.csv
  coverage: '/^\d+\.\d+ % covered/'
  artifacts:
    when: always
    reports:
      junit:
        - target/surefire-reports/TEST-*.xml
    expire_in: 1 week
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "develop"'

# 代码质量检查（SonarQube）
sonarqube-check:
  stage: quality
  image: maven:3.9.5-eclipse-temurin-17
  variables:
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
    GIT_DEPTH: "0"
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  script:
    - mvn $MAVEN_CLI_OPTS verify sonar:sonar
      -Dsonar.projectKey=$CI_PROJECT_PATH_SLUG
      -Dsonar.host.url=$SONAR_HOST_URL
      -Dsonar.login=$SONAR_TOKEN
      -Dsonar.qualitygate.wait=true
  allow_failure: false
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "develop"'

# develop分支自动部署到测试环境
deploy-staging:
  stage: deploy
  image: alpine:3.19
  before_script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s)
    - echo "$STAGING_SSH_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo "$STAGING_KNOWN_HOSTS" > ~/.ssh/known_hosts
  script:
    - ssh deploy@staging.example.com "cd /opt/app && ./deploy.sh $CI_COMMIT_SHA"
  environment:
    name: staging
    url: https://staging.example.com
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'

# main分支部署到生产（手动触发）
deploy-production:
  stage: deploy
  image: alpine:3.19
  before_script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s)
    - echo "$PROD_SSH_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo "$PROD_KNOWN_HOSTS" > ~/.ssh/known_hosts
  script:
    - ssh deploy@prod.example.com "cd /opt/app && ./deploy.sh $CI_COMMIT_SHA"
  environment:
    name: production
    url: https://app.example.com
  when: manual
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

# .gitmessage 模板
# (): 
# type: feat|fix|docs|style|refactor|test|chore
# 例如: feat(order): 添加订单导出功能

# 安装commit-msg钩子
cat > .git/hooks/commit-msg (): "
  echo "例如: feat(order): 添加订单导出功能"
  exit 1
fi
EOF

chmod +x .git/hooks/commit-msg

#!/bin/bash
# cleanup-branches.sh - 每周日凌晨执行
# 删除已合并到develop且超过7天未更新的远程分支

git fetch --prune
for branch in $(git branch -r --merged origin/develop | grep -E 'origin/feature/' | sed 's/origin\///'); do
  last_commit_date=$(git log -1 --format=%ct "origin/$branch")
  now=$(date +%s)
  days_old=$(( (now - last_commit_date) / 86400 ))
  if [ $days_old -gt 7 ]; then
    echo "删除分支: $branch (最后提交${days_old}天前)"
    git push origin --delete "$branch"
  fi
done

cache:
  key:
    files:
      - pom.xml
  paths:
    - .m2/repository/

sonarqube-check:
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^hotfix\//'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "develop"'