基于Git Flow与Trunk-Based的分支策略及CI/CD集成配置实践

# 配置main分支保护：只有Maintainer能push，且必须MR
curl --request POST --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.example.com/api/v4/projects/123/protected_branches" \
  --data "name=main&push_access_level=40&merge_access_level=40&allow_force_push=false"

# develop分支：Developer可push但必须MR
curl --request POST --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.example.com/api/v4/projects/123/protected_branches" \
  --data "name=develop&push_access_level=0&merge_access_level=30&allow_force_push=false"

# 开启merge request的pipeline必须成功
curl --request PUT --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.example.com/api/v4/projects/123" \
  --data "only_allow_merge_if_pipeline_succeeds=true&only_allow_merge_if_all_discussions_are_resolved=true&merge_method=ff"

stages:
  - validate
  - test
  - quality
  - build
  - deploy

variables:
  GIT_DEPTH: 50
  MAVEN_OPTS: "-Xmx2g -XX:+UseG1GC"

# 分支规则：feature和develop跑全量，release只跑冒烟
workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "develop"'
    - if: '$CI_COMMIT_BRANCH =~ /^release\/.*/'
    - if: '$CI_COMMIT_BRANCH == "main"'

lint:
  stage: validate
  image: node:20.11.1-alpine
  script:
    - npm ci --prefer-offline
    - npx eslint --max-warnings 0 src/
  cache:
    key: "$CI_COMMIT_REF_SLUG"
    paths: [node_modules/]

unit-test:
  stage: test
  image: maven:3.9.6-eclipse-temurin-21
  script:
    - mvn -B -T 4 test
  artifacts:
    when: always
    reports:
      junit: target/surefire-reports/TEST-*.xml
  coverage: '/Total.*?([0-9]{1,3})%/'

sonar:
  stage: quality
  image: sonarsource/sonar-scanner-cli:5.0.1
  script:
    - sonar-scanner -Dsonar.projectKey=myapp -Dsonar.qualitygate.wait=true
  allow_failure: false

build-image:
  stage: build
  image: docker:24.0.7
  services:
    - docker:24.0.7-dind
  script:
    - docker build -t registry.example.com/myapp:$CI_COMMIT_SHA .
    - docker push registry.example.com/myapp:$CI_COMMIT_SHA
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop" || $CI_COMMIT_BRANCH == "main"'

deploy-staging:
  stage: deploy
  image: bitnami/kubectl:1.28
  script:
    - kubectl set image deployment/myapp myapp=registry.example.com/myapp:$CI_COMMIT_SHA -n staging
    - kubectl rollout status deployment/myapp -n staging --timeout=120s
  environment:
    name: staging
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'

pipeline {
    agent { label 'linux && docker' }
    options {
        timeout(time: 30, unit: 'MINUTES')
        buildDiscarder(logRotator(numToKeepStr: '30'))
    }
    parameters {
        choice(name: 'ENV', choices: ['staging', 'prod'], description: '部署环境')
        string(name: 'VERSION', defaultValue: '', description: 'release版本号，如1.4.2')
    }
    stages {
        stage('Checkout') {
            steps {
                checkout scm
                sh 'git rev-parse --short HEAD > .git_sha'
            }
        }
        stage('Build') {
            steps {
                sh 'mvn -B -DskipTests package'
            }
        }
        stage('Deploy') {
            when { expression { params.VERSION != '' } }
            steps {
                script {
                    if (params.ENV == 'prod') {
                        timeout(time: 15, unit: 'MINUTES') {
                            input message: "确认部署 ${params.VERSION} 到生产？", ok: 'Deploy'
                        }
                    }
                    sh """
                        kubectl set image deployment/myapp \
                          myapp=registry.example.com/myapp:${params.VERSION} \
                          -n ${params.ENV}
                        kubectl rollout status deployment/myapp \
                          -n ${params.ENV} --timeout=180s
                    """
                }
            }
        }
        stage('SmokeTest') {
            steps {
                sh 'bash scripts/smoke-test.sh $ENV'
            }
        }
    }
    post {
        failure {
            slackSend channel: '#ci-alerts', color: 'danger',
              message: "部署失败: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
        }
    }
}