从Git Flow到Trunk-Based：一套支撑30人团队的Git分支策略与CI/CD落地配置

main ──●──●──●──●──●──●──●──●──●──●──●──●──  (始终可发布)
        \         \              \
         \         \              release/2.3 ──●──●  (仅cherry-pick hotfix)
          \         \
           feat/A    feat/B  (生命周期≤3天)

# .gitlab/CODEOWNERS
# 默认owner
* @backend-lead @frontend-lead

# 支付模块必须支付组review
/src/payment/ @payment-team

# CI配置变更必须SRE review
/.gitlab-ci.yml @sre-team
/ci/ @sre-team

# 数据库迁移必须DBA review
/migrations/ @dba-team

# .gitlab-ci.yml
stages:
  - lint
  - test
  - build
  - deploy-staging
  - deploy-prod

variables:
  GO_VERSION: "1.22.1"
  NODE_VERSION: "20.11.1"
  DOCKER_DRIVER: overlay2

default:
  image: golang:${GO_VERSION}
  cache:
    key:
      files:
        - go.sum
    paths:
      - .go-cache/
  before_script:
    - export GOPATH=$CI_PROJECT_DIR/.go-cache
    - export PATH=$GOPATH/bin:$PATH

lint:
  stage: lint
  script:
    - go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.56.2
    - golangci-lint run --timeout=5m ./...
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == "main"

test:
  stage: test
  script:
    - go test -race -coverprofile=coverage.out -covermode=atomic ./...
    - go tool cover -func=coverage.out | tail -1
  coverage: '/total:\s+\(statements\)\s+(\d+\.\d+)%/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_BRANCH == "main"

build:
  stage: build
  image: docker:24.0.5
  services:
    - docker:24.0.5-dind
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy-staging:
  stage: deploy-staging
  image: bitnami/kubectl:1.29
  environment:
    name: staging
    url: https://staging.example.com
  script:
    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n staging
    - kubectl rollout status deployment/app -n staging --timeout=120s
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  needs: ["build"]

deploy-prod:
  stage: deploy-prod
  image: bitnami/kubectl:1.29
  environment:
    name: production
    url: https://app.example.com
  script:
    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n prod
    - kubectl rollout status deployment/app -n prod --timeout=180s
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
  when: manual
  needs: ["build"]

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-merge-conflict
      - id: check-yaml
      - id: detect-private-key

  - repo: https://github.com/golangci/golangci-lint
    rev: v1.56.2
    hooks:
      - id: golangci-lint
        args: [--timeout=3m, --fast]

  - repo: local
    hooks:
      - id: branch-name-check
        name: Check branch naming
        entry: bash -c 'git rev-parse --abbrev-ref HEAD | grep -E "^(feat|fix|hotfix|chore|release)/" || (echo "分支名必须符合 feat/ fix/ hotfix/ chore/ release/ 前缀" && exit 1)'
        language: system
        pass_filenames: false

create-tag:
  stage: build
  script:
    - |
      if [ "$CI_COMMIT_BRANCH" = "main" ] && [ -f VERSION ]; then
        VERSION=$(cat VERSION)
        if ! git ls-remote --tags origin "v$VERSION" | grep -q "v$VERSION"; then
          git tag "v$VERSION" $CI_COMMIT_SHA
          git push origin "v$VERSION" -o ci.skip
        fi
      fi
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

## 变更类型
- [ ] feature
- [ ] bugfix
- [ ] hotfix
- [ ] refactor

## 关联Ticket
PROJ-

## 测试情况
- [ ] 单测已补充
- [ ] 本地验证通过
- [ ] 需要QA介入

## 风险点

git config --global merge.conflictStyle zdiff3
git config --global rebase.autoStash true
git config --global pull.rebase false
git config --global push.default current
git config --global alias.lg "log --oneline --graph --decorate --all"
git config --global alias.undo "reset --soft HEAD~1"