Git分支策略与CI/CD集成：一套支撑30人团队日均80次合并的工作流配置

## 变更类型
- [ ] 新功能  - [ ] Bug修复  - [ ] 重构  - [ ] 配置变更

## 变更说明


## 自测情况
- [ ] 本地单测通过  - [ ] 涉及接口已用Postman验证
- [ ] 涉及DB变更已附SQL  - [ ] 涉及配置变更已同步到config仓库

## Review Checklist（提交者自查）
- [ ] 没有硬编码密钥/密码/token
- [ ] 新增public方法有Javadoc
- [ ] 异常分支有日志且日志含traceId
- [ ] 单测覆盖率不低于60%（新增代码）

# .gitlab-ci.yml
stages:
  - build
  - test
  - review
  - deploy

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  DOCKER_DRIVER: overlay2
  IMAGE_TAG: "$CI_COMMIT_SHORT_SHA"

# 缓存Maven和pnpm依赖，实测能省2分半
cache:
  key:
    files:
      - pom.xml
      - frontend/pnpm-lock.yaml
  paths:
    - .m2/repository/
    - frontend/node_modules/

build-backend:
  stage: build
  image: maven:3.9.4-eclipse-temurin-17
  script:
    - mvn -B clean package -DskipTests
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 day
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH =~ /^(develop|release\/.*|main)$/'

test-backend:
  stage: test
  image: maven:3.9.4-eclipse-temurin-17
  script:
    - mvn -B test
    - mvn -B jacoco:report
  coverage: '/Total.*?([0-9]{1,3})%/'
  artifacts:
    reports:
      junit: target/surefire-reports/TEST-*.xml
    paths:
      - target/site/jacoco/
    expire_in: 7 days

sonar-check:
  stage: test
  image: sonarsource/sonar-scanner-cli:5.0
  script:
    - sonar-scanner
      -Dsonar.projectKey=our-platform
      -Dsonar.host.url=$SONAR_URL
      -Dsonar.login=$SONAR_TOKEN
      -Dsonar.qualitygate.wait=true
  allow_failure: false
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

deploy-review:
  stage: review
  image: bitnami/kubectl:1.26
  script:
    - kubectl set image deployment/app app=$HARBOR_URL/app:$IMAGE_TAG -n review-$CI_MERGE_REQUEST_IID
    - kubectl rollout status deployment/app -n review-$CI_MERGE_REQUEST_IID --timeout=180s
  environment:
    name: review/$CI_MERGE_REQUEST_IID
    url: https://mr-$CI_MERGE_REQUEST_IID.review.ourdomain.com
    on_stop: stop-review
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "develop"'

stop-review:
  stage: review
  image: bitnami/kubectl:1.26
  script:
    - kubectl delete namespace review-$CI_MERGE_REQUEST_IID --ignore-not-found
  environment:
    name: review/$CI_MERGE_REQUEST_IID
    action: stop
  when: manual
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

# deploy-prod（独立项目，仅Maintainer可触发）
deploy-production:
  stage: deploy
  image: bitnami/kubectl:1.26
  script:
    - |
      if [ "$CI_COMMIT_BRANCH" != "main" ]; then
        echo "只有main分支允许部署生产"; exit 1
      fi
    - kubectl set image deployment/app app=$HARBOR_URL/app:$IMAGE_TAG -n prod
    - kubectl rollout status deployment/app -n prod --timeout=300s
    - |
      if [ $? -ne 0 ]; then
        echo "滚动更新失败，执行回滚"
        kubectl rollout undo deployment/app -n prod
        exit 1
      fi
  environment:
    name: production
  when: manual
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "develop" && $CI_PIPELINE_SOURCE == "push"'
    - if: '$CI_COMMIT_BRANCH =~ /^release\/.*/ && $CI_PIPELINE_SOURCE == "push"'
    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'