Git工作流落地实践：分支策略、Code Review与CI/CD流水线配置

main ─────●────────────●───────────●─────→  (生产，只接受MR合并)
           \          /           /
release/1.4.0 ─●──●──●           /        (发布候选，只修bug)
              /                  /
feature/user-login ─●──●──●     /          (功能开发)
                              /
hotfix/1.4.1 ─────●──────────●            (紧急修复，同时合回main和release)

Branch: main
  Allowed to merge: Maintainers
  Allowed to push: No one
  Allowed to force push: No
  Code owner approval required: Yes

Branch: release/*
  Allowed to merge: Maintainers
  Allowed to push: No one

## 变更说明


## 关联需求
Jira: PAY-231

## 自查清单
- [ ] 本地 `npm run test` / `mvn test` 通过
- [ ] 无 `console.log` / `System.out.println` 调试代码
- [ ] 无硬编码密钥、IP、测试账号
- [ ] 涉及DB变更已附SQL及回滚方案
- [ ] 新增接口已更新API文档

## 影响范围


## 截图/日志（可选）

# .gitlab-ci.yml  GitLab 16.5
stages:
  - install
  - lint
  - test
  - build
  - deploy

variables:
  NODE_IMAGE: node:18.18.2-alpine
  DOCKER_DRIVER: overlay2
  npm_config_cache: "$CI_PROJECT_DIR/.npm"

# 缓存 node_modules，跨 job 复用
cache:
  key:
    files:
      - package-lock.json
  paths:
    - .npm/
    - node_modules/

install:
  stage: install
  image: $NODE_IMAGE
  script:
    - npm ci --prefer-offline --no-audit
  artifacts:
    paths:
      - node_modules/
    expire_in: 2 hours

lint:
  stage: lint
  image: $NODE_IMAGE
  needs: ["install"]
  script:
    - npx eslint src --max-warnings=0
    - npx prettier --check "src/**/*.{ts,tsx,css}"
  allow_failure: false

test:
  stage: test
  image: $NODE_IMAGE
  needs: ["install"]
  script:
    - npm run test:unit -- --coverage --ci
  coverage: '/Statements\s*:\s*(\d+\.\d+)%/'
  artifacts:
    when: always
    reports:
      junit: coverage/junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml

build:
  stage: build
  image: docker:24.0.7
  services:
    - docker:24.0.7-dind
  needs: ["lint", "test"]
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^release\// || $CI_COMMIT_BRANCH == "main"'
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

# 仅 release/* 分支自动部署到预发环境
deploy:staging:
  stage: deploy
  image: bitnami/kubectl:1.28
  needs: ["build"]
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^release\//'
  environment:
    name: staging
  script:
    - kubectl set image deployment/web-app web-app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA -n staging
    - kubectl rollout status deployment/web-app -n staging --timeout=180s

# main 分支打 tag 后才允许上生产，手动触发
deploy:production:
  stage: deploy
  image: bitnami/kubectl:1.28
  needs: ["build"]
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $CI_COMMIT_TAG'
      when: manual
  environment:
    name: production
  script:
    - kubectl set image deployment/web-app web-app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA -n prod

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-merge-conflict
      - id: check-added-large-files
        args: ["--maxkb=1024"]
      - id: detect-private-key

  - repo: https://github.com/pre-commit/mirrors-eslint
    rev: v8.54.0
    hooks:
      - id: eslint
        files: \.[jt]sx?$
        args: ["--fix", "--max-warnings=0"]