Git Flow与Trunk-Based对决：团队协作分支策略及CI/CD落地实践

main (v1.2.0) ---> [CI: build & test] ---> [deploy to staging] ---> [Tag: v1.2.0] ---> [deploy to prod]
    |                                        |
    +--- feature/支付宝支付 (合并后开启开关) ---+
    +--- feature/新首页改版 (合并后关闭开关) ---+

## MR 描述模板（强制要求）

### 变更类型
- [ ] 功能新增
- [ ] Bug修复
- [ ] 性能优化
- [ ] 重构

### 测试自查
- [ ] 已编写/更新单元测试，覆盖率不低于 **80%**（基于JaCoCo报告）
- [ ] 已通过本地 `mvn verify` 全部测试
- [ ] 已添加或更新集成测试脚本（`/tests/integration`）

### 影响范围
- 涉及模块：__________________
- 是否涉及数据库变更：是 / 否 (若选是，必须附上迁移脚本)
- 是否需要更新文档：是 / 否

# .gitlab-ci.yml (核心片段)
stages:
  - build
  - test
  - sonar
  - deploy

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  DOCKER_REGISTRY: "registry.example.com/library"
  APP_NAME: "order-service"

cache:
  key: "$CI_COMMIT_REF_SLUG"
  paths:
    - .m2/repository/

# 构建阶段：只在代码变化时触发
build:jar:
  stage: build
  image: maven:3.8-openjdk-11
  script:
    - mvn clean package -DskipTests -q
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 hour
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'  # MR事件触发，但不部署
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_TAG'  # 打Tag触发

# 测试阶段：跑全部单测+集成测试
test:unit:
  stage: test
  image: maven:3.8-openjdk-11
  script:
    - mvn verify  # 包含JaCoCo覆盖率报告
  coverage: '/Coverage: \d+%/'
  artifacts:
    reports:
      junit: target/surefire-reports/TEST-*.xml
      cobertura: target/site/jacoco/jacoco.xml
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'

# 代码扫描（SonarQube）
sonar-analysis:
  stage: sonar
  image: maven:3.8-openjdk-11
  script:
    - mvn sonar:sonar -Dsonar.host.url=$SONAR_URL -Dsonar.login=$SONAR_TOKEN -Dsonar.qualitygate.wait=true
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

# 部署到预发布环境（staging）
deploy:staging:
  stage: deploy
  image: docker:latest
  services:
    - docker:dind
  variables:
    ENVIRONMENT: staging
  script:
    - docker build -t $DOCKER_REGISTRY/$APP_NAME:$CI_COMMIT_SHORT_SHA .
    - docker push $DOCKER_REGISTRY/$APP_NAME:$CI_COMMIT_SHORT_SHA
    - kubectl set image deployment/$APP_NAME $APP_NAME=$DOCKER_REGISTRY/$APP_NAME:$CI_COMMIT_SHORT_SHA -n staging --record
  environment:
    name: staging
    url: https://staging.example.com
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

# 部署到生产环境（production）—— 手动触发 + 仅限Tag
deploy:production:
  stage: deploy
  image: docker:latest
  services:
    - docker:dind
  variables:
    ENVIRONMENT: production
  script:
    - docker build -t $DOCKER_REGISTRY/$APP_NAME:$CI_COMMIT_TAG .
    - docker push $DOCKER_REGISTRY/$APP_NAME:$CI_COMMIT_TAG
    - kubectl set image deployment/$APP_NAME $APP_NAME=$DOCKER_REGISTRY/$APP_NAME:$CI_COMMIT_TAG -n production --record
  environment:
    name: production
    url: https://example.com
  rules:
    - if: '$CI_COMMIT_TAG'  # 只有打Tag才触发生产部署
  when: manual  # 需要运维确认后手动点击

# 提取覆盖率并判断
coverage=$(grep -oP 'Total.*?(\d+\.?\d*)%' target/site/jacoco/index.html | head -1 | grep -oP '\d+\.?\d*')
if (( $(echo "$coverage < 80.0" | bc -l) )); then
  echo "Coverage $coverage% is below threshold 80%"
  exit 1
fi