Git Flow与Trunk Based双轨制：团队协作中的分支策略与CI/CD集成实践

# .gitlab/gitlab-ci.yml 中的分支保护相关配置（部分）
variables:
  GIT_DEPTH: "50"  # 浅克隆深度，加快拉取速度

stages:
  - validate
  - test
  - build

# 允许合并的规则：仅允许maintainer角色合并，且必须通过pipeline
merge_requests:
  default:
    target_branch: main
    allow_force_push: false
    merge_method: merge_commit  # 使用merge commit而非fast-forward，保留合并轨迹

# 分支保护策略（需在GitLab UI中单独设置，这里展示对应API调用）
# 通过curl调用GitLab API设置保护分支
protect_branches:
  script:
    - curl -X PUT "http://gitlab.example.com/api/v4/projects/${CI_PROJECT_ID}/protected_branches/main" \
      -H "PRIVATE-TOKEN: ${GITLAB_API_TOKEN}" \
      -d "allowed_to_merge[]=access_level:40"  # 仅Maintainer可合并
      -d "allowed_to_push[]=access_level:40"   # 仅Maintainer可推送

// Jenkinsfile (Declarative Pipeline)
pipeline {
    agent { docker { image 'maven:3.9.6-eclipse-temurin-17' } }

    environment {
        MAVEN_OPTS = '-Xmx2g'
        GIT_STRATEGY = 'clone'
    }

    stages {
        stage('Validate') {
            parallel {
                stage('git-diff-check') {
                    steps {
                        sh '''
                            git fetch origin main
                            # 检查合并目标分支前的空白错误
                            if ! git diff --check HEAD...origin/main; then
                                echo "发现空白错误，请执行 git diff --check 本地修复"
                                exit 1
                            fi
                        '''
                    }
                }
                stage('dependency-check') {
                    steps {
                        script {
                            // 仅当pom.xml或package.json变更时执行
                            if (isFileChanged('pom.xml') || isFileChanged('package.json')) {
                                sh '''
                                    mvn org.owasp:dependency-check-maven:check \
                                        -DfailBuildOnCVSS=7.0 \
                                        -Dformat=HTML,JSON \
                                        -DoutputDirectory=reports
                                '''
                            }
                        }
                    }
                }
                stage('static-analysis') {
                    steps {
                        sh '''
                            mvn checkstyle:check -Dcheckstyle.config.location=google_checks.xml
                            npm run lint -- --max-warnings=0 2>&1 | tee eslint-report.txt
                        '''
                    }
                }
            }
        }

        stage('Test') {
            steps {
                sh '''
                    mvn -B test -Djacoco.skip=false
                    # 生成覆盖率报告并上传至SonarQube
                    mvn sonar:sonar -Dsonar.projectKey=core-service \\
                        -Dsonar.host.url=http://sonar.internal:9000 \\
                        -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml
                '''
            }
        }

        stage('Build') {
            steps {
                sh '''
                    # 构建并推送Docker镜像到私有仓库
                    docker build -t registry.internal.com/core-service:${BUILD_NUMBER} .
                    docker push registry.internal.com/core-service:${BUILD_NUMBER}
                    # 保存镜像版本供后续部署使用
                    echo "${BUILD_NUMBER}" > image_version.txt
                '''
            }
        }
    }

    post {
        success {
            // 更新GitLab MR的pipeline状态
            updateGitlabCommitStatus(name: 'pipeline', state: 'success')
        }
        failure {
            updateGitlabCommitStatus(name: 'pipeline', state: 'failed')
        }
    }
}