Git Flow与Trunk Based双轨制：200人团队分支策略与CI/CD联动实践

feature/{JIRA-ID}-{简短描述}
fix/{JIRA-ID}-{简短描述}
release/{version}
hotfix/{version}-{描述}

# 设置main分支保护：禁止任何人直接push，仅允许Maintainer合并
curl --request POST --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
  "https://gitlab.example.com/api/v4/projects/${PROJECT_ID}/protected_branches" \
  --data "name=main&push_access_level=0&merge_access_level=40&unprotect_access_level=0"

# 对release/*分支：开发者可push，但合并必须由Maintainer执行
curl --request POST --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
  "https://gitlab.example.com/api/v4/projects/${PROJECT_ID}/protected_branches" \
  --data "name=release/*&push_access_level=30&merge_access_level=40"

## 变更描述（必填）
- 关联JIRA： [PROJ-1234](https://jira.example.com/browse/PROJ-1234)
- 变更类型： New Feature / Bugfix / Refactor
- 影响范围： 服务名 + 接口名

## 测试清单（勾选）
- [ ] 单元测试通过（`go test ./...` 覆盖率≥80%）
- [ ] 集成测试通过（`docker-compose -f test/docker-compose.yml up`）
- [ ] 本地已跑通 `make lint` 和 `make build`

## 自测截图/日志（粘贴关键输出）

## 部署说明
- 是否需要DB Migration： 是/否
- 是否有破坏性变更（Breaking Change）： 是/否，说明兼容方案

# 核心模块必须由资深工程师review
/services/payment/* @team-payment-lead @backend-lead
/services/order/*  @team-order-lead
# 所有Go文件至少需要两位Approver
*.go @backend-reviewers @xiaoming @xiaohong

pipeline {
    agent { label 'go-builder' }
    environment {
        IMAGE_NAME = "registry.example.com/service/order-service"
        IMAGE_TAG = "${env.BRANCH_NAME}-${env.GIT_COMMIT.take(8)}"
    }
    stages {
        stage('Checkout') {
            steps { checkout scm }
        }
        stage('Unit Test') {
            steps { sh 'go test ./... -coverprofile=coverage.out' }
            post {
                success { junit '**/report.xml' }
            }
        }
        stage('Build & Push') {
            when { branch 'main' }  // 只有main分支合并后构建镜像
            steps {
                sh """
                    docker build -t ${IMAGE_NAME}:${IMAGE_TAG} .
                    docker push ${IMAGE_NAME}:${IMAGE_TAG}
                """
            }
        }
        stage('Update GitOps Repo') {
            when { branch 'main' }
            steps {
                sh """
                    git clone https://token:${GITOPS_TOKEN}@gitlab.example.com/gitops/config.git
                    cd config
                    # 用sed替换镜像tag，然后commit & push
                    sed -i "s|image: registry.example.com/service/order-service:.*|image: ${IMAGE_NAME}:${IMAGE_TAG}|" overlays/prod/order-service/deployment.yaml
                    git commit -m "release: update order-service to ${IMAGE_TAG}"
                    git push origin main
                """
            }
        }
    }
    post {
        failure { 
            // 通知飞书机器人
            sh 'curl -X POST -H "Content-Type: application/json" -d "{\"msg_type\":\"text\",\"content\":{\"text\":\"[CI] ${JOB_NAME} 构建失败\"}}" https://open.feishu.cn/open-apis/bot/v2/hook/xxx'
        }
    }
}

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: order-service-prod
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitlab.example.com/gitops/config.git
    targetRevision: main
    path: overlays/prod/order-service
  destination:
    server: https://kubernetes.default.svc
    namespace: prod
  syncPolicy:
    automated:
      prune: true
      selfHeal: true   # 自愈，K8s状态漂移自动恢复
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
  healthCheck:
    - name: order-service
      kind: Deployment
      liveState: "deployed"

properties([
    pipelineTriggers([pollSCM('')]),
    disableConcurrentBuilds()
])
// 在Jenkins多分支job配置中，限制扫描深度：
// "Advanced" -> "Suppress automatic SCM triggering" 并设置cron为"H/6 * * * *"

spec:
  ignoreDifferences:
  - group: apps
    kind: Deployment
    jsonPointers:
    - /spec/replicas
    - /spec/template/spec/containers/0/image
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      # 添加这个：只同步有变更的资源
      syncOptions:
      - ApplyOutOfSyncOnly=true

# .gitlab-ci.yml 片段
check-mr-size:
  stage: test
  script:
    - |
      DIFF_LINES=$(git diff --numstat origin/main...HEAD | awk '{sum+=$1+$2} END {print sum}')
      echo "MR改动行数: ${DIFF_LINES}"
      if [ "$DIFF_LINES" -gt 500 ]; then
        echo "❌ MR超过500行，请拆分为多个MR"
        exit 1
      fi
  only:
    - merge_requests