Git工作流演进：分支策略与CI/CD集成实践

master (生产分支，受保护，只允许merge request)
├── develop (集成分支，每日自动构建)
│   ├── feature/order-service-123 (功能分支，从develop创建)
│   └── feature/logistics-api-v2
└── hotfix/prod-issue-456 (热修复分支，从master创建，合并回master和develop)

# .gitlab/merge_request_approvals.yml
approval_rules:
  - name: "必需审批"
    approvals_required: 2
    users:
      - team-leader
      - senior-dev-1
      - senior-dev-2
    # 排除作者自己审批
    prevent_author_approval: true
  - name: "SonarQube质量门禁"
    # 需要SonarQube CI作业通过
    report_approver:
      - name: "sonar-quality-gate"
        # 当SonarQube分析通过后自动审批
        when: "pipeline_succeeded"

#!/bin/bash
# .githooks/pre-push: 强制运行单元测试和代码风格检查
# 安装：git config core.hooksPath .githooks
echo "🔍 运行本地预检查..."
mvn clean verify -q -DskipTests=false -Dcheckstyle.skip=false
if [ $? -ne 0 ]; then
    echo "❌ 本地检查失败：请修复代码风格或失败的测试"
    exit 1
fi
echo "✅ 本地检查通过，允许推送"

# .gitlab-ci.yml (简化版，保留关键配置)
image: maven:3.9.1-eclipse-temurin-17

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  SONAR_HOST_URL: "https://sonar.internal.example.com"
  SONAR_TOKEN: $SONAR_TOKEN  # 从CI/CD变量中获取

stages:
  - build
  - test
  - sonarqube
  - deploy-preview
  - deploy-staging
  - deploy-prod

cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - .m2/repository/
    - target/

# 阶段1：构建
build-job:
  stage: build
  script:
    - mvn compile -q
  artifacts:
    paths:
      - target/*.jar
    expire_in: 2 hours

# 阶段2：单元测试+集成测试
test-job:
  stage: test
  script:
    - mvn test -q
    - mvn verify -Pintegration-test  # 使用Maven profile激活集成测试
  coverage: '/Coverage:\s*([0-9]+\.?[0-9]*%)/'
  artifacts:
    reports:
      junit: target/surefire-reports/TEST-*.xml
      coverage_report:
        coverage_format: cobertura
        path: target/site/jacoco/jacoco.xml

# 阶段3：SonarQube代码质量分析
sonarqube-job:
  stage: sonarqube
  script:
    - mvn sonar:sonar -Dsonar.projectKey=$CI_PROJECT_PATH_SLUG
        -Dsonar.branch.name=$CI_COMMIT_REF_NAME
        -Dsonar.qualitygate.wait=true  # 等待质量门禁结果
  only:
    - develop
    - master
    - /^feature\/.*$/
  allow_failure: false  # 质量门禁必须通过

# 阶段4：部署预览环境（仅feature分支）
deploy-preview:
  stage: deploy-preview
  script:
    - kubectl set image deployment/order-service-preview order-service=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA --namespace=preview
  environment:
    name: preview/$CI_COMMIT_REF_SLUG
    url: https://$CI_COMMIT_REF_SLUG.order-preview.internal.example.com
  only:
    - /^feature\/.*$/
  except:
    - develop
    - master

# 阶段5：部署staging（develop分支合并后触发）
deploy-staging:
  stage: deploy-staging
  script:
    - kubectl apply -f k8s/staging-deployment.yaml --namespace=staging
  environment:
    name: staging
    url: https://staging.order.internal.example.com
  only:
    - develop

# 阶段6：部署生产（master分支合并后触发）
deploy-prod:
  stage: deploy-prod
  script:
    - kubectl apply -f k8s/prod-deployment.yaml --namespace=prod
  environment:
    name: production
    url: https://order.example.com
  only:
    - master
  when: manual  # 生产部署需要手动确认

# 使用GitLab API配置保护分支
curl --request POST "https://gitlab.internal.example.com/api/v4/projects/123/protected_branches" \
  --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "master",
    "push_access_level": 0,  # 禁止直接推送
    "merge_access_level": 40,  # 仅维护者可以合并
    "allow_force_push": false,
    "code_owner_approval_required": true
  }'

# .githooks/pre-commit: 检测敏感信息
#!/bin/bash
echo "🛡️ 检查敏感信息..."
if git diff --cached --name-only | xargs grep -l "password\|token\|secret" 2>/dev/null; then
    echo "❌ 发现敏感信息在暂存区中，请使用 .gitignore 或环境变量"
    exit 1
fi

# 在deploy-preview作业中增加清理逻辑
cleanup-old-preview:
  stage: .post
  script:
    - kubectl delete deployment -n preview -l "age>72h"  # 删除超过72小时的部署
  only:
    - schedules
  variables:
    GIT_STRATEGY: none