Git分支策略与CI/CD集成：一套支撑30人团队日均50次合并的工作流配置

# 保护 main 分支：仅 Maintainer 可合并，禁止直接 push
curl --request POST --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.example.com/api/v4/projects/42/protected_branches" \
  --form "name=main" \
  --form "push_access_level=0" \
  --form "merge_access_level=40" \
  --form "allow_force_push=false" \
  --form "code_owner_approval_required=true"

# release/* 通配保护
curl --request POST --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  "https://gitlab.example.com/api/v4/projects/42/protected_branches" \
  --form "name=release/*" \
  --form "push_access_level=40" \
  --form "merge_access_level=40"

# .gitlab/CODEOWNERS
*                    @team/backend-lead
/services/payment/   @team/payment-owners
/services/auth/      @team/security-owners
/frontend/           @team/frontend-lead

## 变更点


## 影响范围
- [ ] 涉及数据库变更（附迁移脚本链接）
- [ ] 涉及接口变更（附文档链接）
- [ ] 涉及配置变更

## 测试方式


## 回滚方案

# .gitlab-ci.yml
stages:
  - validate
  - build
  - test
  - review-app
  - deploy

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  DOCKER_DRIVER: overlay2
  IMAGE_TAG: "$CI_COMMIT_SHORT_SHA"

# 缓存 Maven 和 node_modules，实测命中后 build 阶段从 4min 降到 1min20s
cache:
  key: "$CI_COMMIT_REF_SLUG"
  paths:
    - .m2/repository/
    - frontend/node_modules/

# ---------- 1. 静态检查 ----------
lint:
  stage: validate
  image: node:20.11-alpine
  script:
    - cd frontend && npm ci --prefer-offline
    - npm run lint -- --max-warnings=0
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH =~ /^(main|release\/.*)$/'

# ---------- 2. 构建 ----------
build-backend:
  stage: build
  image: maven:3.9.6-eclipse-temurin-17
  script:
    - mvn -B -q clean package -DskipTests
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 day
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH =~ /^(main|release\/.*)$/'

# ---------- 3. 测试 ----------
unit-test:
  stage: test
  image: maven:3.9.6-eclipse-temurin-17
  script:
    - mvn -B test
  coverage: '/Total.*?([0-9]{1,3})%/'
  artifacts:
    when: always
    reports:
      junit:
        - target/surefire-reports/TEST-*.xml
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

# ---------- 4. 临时评审环境 ----------
review-app:
  stage: review-app
  image: bitnami/kubectl:1.29
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    url: https://$CI_COMMIT_REF_SLUG.review.example.com
    on_stop: stop-review-app
  script:
    - kubectl -n review set image deploy/app app=harbor.example.com/app:$IMAGE_TAG
    - kubectl -n review rollout status deploy/app --timeout=180s
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
    - if: '$CI_COMMIT_BRANCH =~ /^release\//'

stop-review-app:
  stage: review-app
  image: bitnami/kubectl:1.29
  script:
    - kubectl -n review delete deploy/app --ignore-not-found
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  when: manual
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
      when: manual

# ---------- 5. 部署 ----------
deploy-staging:
  stage: deploy
  image: bitnami/kubectl:1.29
  environment:
    name: staging
    url: https://staging.example.com
  script:
    - kubectl -n staging set image deploy/app app=harbor.example.com/app:$IMAGE_TAG
    - kubectl -n staging rollout status deploy/app --timeout=300s
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

deploy-prod:
  stage: deploy
  image: bitnami/kubectl:1.29
  environment:
    name: production
    url: https://www.example.com
  script:
    - kubectl -n prod set image deploy/app app=harbor.example.com/app:$IMAGE_TAG
    - kubectl -n prod rollout status deploy/app --timeout=300s
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^release\//'
      when: manual

Settings → Merge requests → Merge trains: 勾选
Merge method: Merge commit（保留合并历史，便于追溯）
Squash commits: Allow（feature分支允许squash）