Git工作流重构记：分支策略与CI/CD流水线的一次落地实践

master: 
  - Allowed to merge: Maintainers（仅Maintainer角色）
  - Allowed to push: No one（禁止直接push）
  - Code owner approval required: true

develop:
  - Allowed to merge: Developers + Maintainers
  - Allowed to push: No one（禁止直接push）
  - Code owner approval required: false

pipeline {
    agent any
    environment {
        // 版本号从pom.xml提取，但为了速度我们直接用git tag
        APP_VERSION = sh(script: "git describe --tags --abbrev=0 2>/dev/null || echo 'dev'", returnStdout: true).trim()
        SONAR_HOST = 'http://10.0.12.5:9000'
        SONAR_TOKEN = credentials('sonar-token')
        DOCKER_REGISTRY = 'harbor.internal.cn'
    }
    stages {
        stage('Checkout') {
            steps {
                // 清理workspace，避免上次构建残留
                deleteDir()
                checkout scm
            }
        }
        stage('Maven Compile & Unit Test') {
            steps {
                sh '''
                    cd service
                    mvn clean package -DskipTests=false -Dmaven.test.failure.ignore=false
                '''
            }
            post {
                failure {
                    // 通知钉钉机器人，具体webhook略
                    dingtalk(accessToken: 'xxx', message: "构建失败: ${env.JOB_NAME}")
                }
            }
        }
        stage('SonarQube Analysis') {
            steps {
                sh '''
                    cd service
                    mvn sonar:sonar \
                        -Dsonar.projectKey=payment-service \
                        -Dsonar.host.url=${SONAR_HOST} \
                        -Dsonar.login=${SONAR_TOKEN} \
                        -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml
                '''
            }
        }
        stage('Quality Gate Check') {
            steps {
                script {
                    // 等待SonarQube分析完成并获取质量门禁状态
                    def qg = waitForQualityGate(abortPipeline: true)
                    // 如果门禁失败，中止流水线，MR将无法合并
                    if (qg.status != 'OK') {
                        error "SonarQube质量门禁未通过: ${qg.status}"
                    }
                }
            }
        }
        stage('Build Docker Image & Push') {
            when {
                // 只有release或master分支才构建镜像
                anyOf {
                    branch 'master'
                    branch 'release/*'
                }
            }
            steps {
                sh '''
                    docker build -t ${DOCKER_REGISTRY}/payment-service:${APP_VERSION} .
                    docker push ${DOCKER_REGISTRY}/payment-service:${APP_VERSION}
                '''
            }
        }
    }
    post {
        always {
            // 清理本地docker镜像，避免磁盘爆满
            sh 'docker system prune -f || true'
        }
    }
}

#!/bin/bash
# .git/hooks/pre-push

remote="$1"
url="$2"

# 获取将要推送的所有提交
while read local_ref local_sha remote_ref remote_sha; do
    if [ "$local_ref" = "refs/heads/develop" ] || [ "$local_ref" = "refs/heads/master" ]; then
        echo "错误：禁止直接推送 $local_ref，请使用Merge Request！" >&2
        exit 1
    fi

    # 检查提交信息是否包含Jira ticket号（如: JIRA-123）
    for commit in $(git rev-list $remote_sha..$local_sha 2>/dev/null); do
        msg=$(git log -1 --format=%s $commit)
        if [[ ! $msg =~ ^[A-Z]+-[0-9]+ ]]; then
            echo "错误：提交信息 '$msg' 缺少Jira ticket号（如JIRA-123）" >&2
            exit 1
        fi
    done
done

exit 0