Git工作流重构记：从分支混乱到CI/CD门禁的30天改造

master（永远在烂）
├── feature/xxx（直接拉自master，生命周期长）
├── hotfix/xxx（偶尔存在，但经常忘记合回dev）
└── dev（形同虚设，没人更新）

#!/bin/bash
# 版本: 1.0.0
# 用途: 规范化创建分支

ACTION=$1
BRANCH_NAME=$2

case $ACTION in
  feature)
    if [[ ! "$BRANCH_NAME" =~ ^feature/(order|payment|user|report)-[0-9]+$ ]]; then
      echo "❌ 分支名必须匹配 feature/(order|payment|user|report)-[0-9]+"
      exit 1
    fi
    git checkout develop && git pull origin develop
    git checkout -b "$BRANCH_NAME"
    echo "✅ 已从最新develop创建分支 $BRANCH_NAME"
    ;;
  release)
    if [[ ! "$BRANCH_NAME" =~ ^release/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
      echo "❌ 分支名必须匹配 release/x.y.z"
      exit 1
    fi
    git checkout develop && git pull origin develop
    git checkout -b "$BRANCH_NAME"
    ;;
  *)
    echo "用法: $0 {feature|release} "
    exit 1
    ;;
esac

# webhook_checker.py (Python 3.10)
from flask import Flask, request, jsonify
import re
import os

app = Flask(__name__)

REQUIRED_FIELDS = ['需求链接', '测试用例', '影响范围']

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    data = request.json
    if data.get('object_attributes', {}).get('action') != 'open':
        return jsonify({'status': 'ignored'})

    description = data['object_attributes']['description']
    missing = [field for field in REQUIRED_FIELDS if field not in description]

    if missing:
        # 调用GitLab API拒绝MR
        project_id = data['project']['id']
        mr_iid = data['object_attributes']['iid']
        # 这里省略调用GitLab API的代码，使用python-gitlab库
        # gl.projects.get(project_id).mergerequests.get(mr_iid).discussions.create(
        #     body=f"⚠️ 缺少必需字段: {', '.join(missing)}"
        # )
        return jsonify({'status': 'rejected', 'missing': missing})

    return jsonify({'status': 'ok'})

# .gitlab-ci.yml (GitLab Runner 15.10)
stages:
  - test
  - build
  - coverage
  - deploy

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  SONAR_TOKEN: $SONAR_TOKEN

cache:
  paths:
    - .m2/repository

# 阶段1: 单元测试 + 静态检查
unit-test:
  stage: test
  image: maven:3.8.8-eclipse-temurin-17
  script:
    - mvn clean test -DskipITs
    - mvn verify -DskipUTs  # 集成测试
  artifacts:
    reports:
      junit: target/surefire-reports/TEST-*.xml
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

# 阶段2: 构建产物（只对主分支和release）
build-artifact:
  stage: build
  image: maven:3.8.8-eclipse-temurin-17
  script:
    - mvn package -DskipTests
    - ls -lh target/*.jar
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 week
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop" || $CI_COMMIT_BRANCH =~ /^release\//'

# 阶段3: 覆盖率门禁（低于85%直接失败）
coverage-check:
  stage: coverage
  image: registry.gitlab.com/haynes/jacoco2cobertura:1.0.8
  script:
    - python /opt/cover2cover.py target/site/jacoco/jacoco.xml src/main/java > target/site/cobertura.xml
    - coverage report --fail-under=85
  coverage: '/TOTAL.*\s([0-9]{1,3})%/'
  artifacts:
    paths:
      - target/site/jacoco/
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  needs: ["unit-test"]

# 阶段4: 自动部署到测试环境
deploy-staging:
  stage: deploy
  image: alpine:3.18
  before_script:
    - apk add --no-cache curl
  script:
    - curl -X POST --fail -F token=$STAGING_DEPLOY_TRIGGER -F ref=master \
      https://gitlab.example.com/api/v4/projects/123/trigger/pipeline
  environment:
    name: staging
    url: https://staging.example.com
  rules:
    - if: '$CI_COMMIT_BRANCH == "develop"'
  needs: ["build-artifact", "coverage-check"]