基于Git Flow与Trunk-Based的分支策略、Code Review及CI/CD集成配置详解**

# .gitlab-ci.yml
stages:
  - test
  - sonar
  - build

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=.m2/repository"
  SONAR_HOST_URL: "http://sonarqube.internal:9000"

# 缓存加速
cache:
  key: "$CI_COMMIT_REF_SLUG"
  paths:
    - .m2/repository/

unit-test:
  stage: test
  image: maven:3.9.6-eclipse-temurin-17
  script:
    - mvn clean test -Dspring.profiles.active=test
  artifacts:
    when: always
    reports:
      junit:
        - target/surefire-reports/TEST-*.xml
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'

sonar-scan:
  stage: sonar
  image: sonarsource/sonar-scanner-cli:5.0
  dependencies:
    - unit-test
  script:
    - sonar-scanner
      -Dsonar.projectKey=$CI_PROJECT_PATH_SLUG
      -Dsonar.qualitygate.wait=true
      -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA
      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
  allow_failure: false
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

build-image:
  stage: build
  image: docker:24.0.7
  services:
    - docker:24.0.7-dind
  script:
    - docker build -t registry.internal/$CI_PROJECT_PATH:$CI_COMMIT_SHORT_SHA .
    - docker push registry.internal/$CI_PROJECT_PATH:$CI_COMMIT_SHORT_SHA
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual  # 需要手动点击部署，防止误触发

// Jenkinsfile
pipeline {
    agent any
    tools {
        maven 'Maven-3.9.6'
        jdk 'JDK-17'
    }
    triggers {
        // 每分钟轮询GitLab，实际生产建议用Webhook
        pollSCM('* * * * *')
    }
    stages {
        stage('Checkout & Build') {
            steps {
                checkout scm
                sh 'mvn clean compile -DskipTests'
            }
        }
        stage('Code Review Gate') {
            steps {
                // 调用GitLab API检查MR的Approve状态
                script {
                    def response = sh(
                        script: "curl -s --header 'PRIVATE-TOKEN: ${GITLAB_TOKEN}' '${GITLAB_URL}/api/v4/projects/${PROJECT_ID}/merge_requests/${CHANGE_ID}/approvals'",
                        returnStdout: true
                    )
                    def json = readJSON text: response
                    if (json.approved_by.size() < 1) {
                        error "Code Review未通过，至少需要1人Approve！当前Approve数: ${json.approved_by.size()}"
                    }
                }
            }
        }
        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv('SonarQube-Server') {
                    sh 'mvn sonar:sonar -Dsonar.qualitygate.wait=true'
                }
            }
        }
        stage('Deploy to Staging') {
            when {
                branch 'main'
            }
            steps {
                sh 'kubectl apply -f k8s/staging/ --record'
            }
        }
    }
    post {
        failure {
            // 钉钉通知
            sh "curl -X POST -H 'Content-Type: application/json' -d '{\"msgtype\": \"text\", \"text\": {\"content\": \"构建失败: ${env.JOB_NAME} - ${env.BUILD_NUMBER}\"}}' ${DINGTALK_WEBHOOK}"
        }
    }
}