Git分支策略与CI/CD集成：从混乱到有序的团队协作重构

main (生产环境，受保护，禁止直接push)
  ├── release/ (预发布分支，从main拉出，测试通过后合回main并打tag)
  ├── develop (集成分支，受保护，所有feature合入这里)
  │     └── feature/xxx (新功能，从develop拉出)
  │     └── bugfix/xxx (缺陷修复，从develop拉出)
  └── hotfix/xxx (紧急生产修复，从main拉出，修复后直接合入main和develop)

分支: main
允许合并: Maintainers
允许push: 无 (禁止直接push)
允许强制push: 否

分支: develop
允许合并: Developers + Maintainers
允许push: 无
允许强制push: 否

审批人数: 1
审批人类型: 非作者 (Code Owner优先)

pipeline {
    agent any
    tools {
        maven 'Maven-3.8.8'  // 在Jenkins全局工具里配置的maven
        jdk 'JDK-17'
    }
    environment {
        SONAR_HOST_URL = 'http://sonarqube.example.com:9000'
        SONAR_TOKEN = credentials('sonar-token')  // Jenkins凭据
        REGISTRY = 'registry.example.com'
        IMAGE_NAME = "${REGISTRY}/myapp:${env.BRANCH_NAME}-${env.BUILD_NUMBER}"
    }
    stages {
        stage('Checkout') {
            steps {
                // 关键：检出MR源分支，而非目标分支
                checkout scm
            }
        }
        stage('Compile') {
            steps {
                sh 'mvn clean compile -DskipTests'
            }
        }
        stage('Unit Test') {
            steps {
                sh 'mvn test'
            }
            post {
                always {
                    junit '**/target/surefire-reports/*.xml'
                }
            }
        }
        stage('SonarQube Analysis') {
            steps {
                // 注意：需在SonarQube配置GitLab的MR插件
                sh """
                    mvn sonar:sonar \
                        -Dsonar.projectKey=myapp \
                        -Dsonar.host.url=${SONAR_HOST_URL} \
                        -Dsonar.token=${SONAR_TOKEN} \
                        -Dsonar.gitlab.commit_sha=${env.CI_COMMIT_SHA} \
                        -Dsonar.gitlab.ref_name=${env.CI_COMMIT_REF_NAME} \
                        -Dsonar.gitlab.merge_request_iid=${env.CI_MERGE_REQUEST_IID}
                """
            }
        }
        stage('Build Image') {
            when { branch 'develop' }  // 仅develop分支构建镜像
            steps {
                sh """
                    docker build -t ${IMAGE_NAME} .
                    docker push ${IMAGE_NAME}
                """
            }
        }
    }
    post {
        failure {
            // 通知团队
            emailext (
                subject: "构建失败: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
                body: "请检查Jenkins构建日志: ${env.BUILD_URL}",
                to: 'dev-team@example.com'
            )
        }
    }
}

stages:
  - ci

ci:
  stage: ci
  script:
    - curl -X POST http://jenkins.example.com:8080/job/myapp-mr-pipeline/buildWithParameters?token=mysecrettoken
  only:
    - merge_requests