front/.gitea/workflows/deploy.yml

# 复制到 itfx-front 仓库 .gitea/workflows/deploy.yml
# push master → prod；push test → test
# 构建始终用 prod kubeconfig（Kaniko）；仅 deploy 切集群
# 前端镜像：test 分支须传 FRONT_BUILD_SCRIPT=build:test，否则会打进正式 API 域名
# 构建变慢时：确认宿主机 ci-publish-front.sh 已给 Kaniko --cache=true（lock 不变时应跳过 pnpm install）
name: Build and Deploy Front

on:
  push:
    branches: [master, test]

env:
  IMAGE_NAME: itfx-front
  TCR_REGISTRY: ccr.ccs.tencentyun.com
  TCR_NAMESPACE: ideship

jobs:
  deploy:
    runs-on: k3s-host
    steps:
      - name: Build and deploy
        run: |
          set -euxo pipefail
          REF="${{ gitea.ref_name }}"
          case "$REF" in
            test)   TARGET=test ;;
            master) TARGET=prod ;;
            *)      echo "unsupported branch: $REF"; exit 1 ;;
          esac

          SHA="${{ gitea.sha }}"
          REPO="${{ gitea.repository }}"
          test -n "$REPO" && [[ "$REPO" == */* ]]

          case "$TARGET" in
            test) TAG="test-${SHA}" ;;
            *)    TAG="${SHA}" ;;
          esac

          IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}"
          echo "TARGET=$TARGET REF=$REF REPO=$REPO TAG=$TAG host=$(hostname)"

          case "$TARGET" in
            test) export FRONT_BUILD_SCRIPT=build:test ;;
            *)    export FRONT_BUILD_SCRIPT=build ;;
          esac
          echo "FRONT_BUILD_SCRIPT=$FRONT_BUILD_SCRIPT"

          export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
          unset NAMESPACE
          cd /data/k3s
          ./scripts/ci-publish-front.sh "$REPO" "${{ env.IMAGE_NAME }}" "$TAG" "$SHA"

          case "$TARGET" in
            test)
              export KUBECONFIG=/etc/rancher/k3s/k3s-test.yaml
              export NAMESPACE=test
              export MANIFEST_ROOT=/data/k3s-test
              ;;
            *)
              export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
              export NAMESPACE=prod
              export MANIFEST_ROOT=/data/k3s
              ;;
          esac
          if [[ ! -f "$KUBECONFIG" ]]; then
            echo "FAIL: missing KUBECONFIG=$KUBECONFIG host=$(hostname) uid=$(id -u)"
            ls -la /etc/rancher/k3s/ /root/.kube/ 2>/dev/null || true
            exit 1
          fi
          ./scripts/ci-deploy-front.sh "$IMG"