Merge remote-tracking branch 'origin/master'

.github/workflows/master.yml

@@ -1,42 +1,78 @@
-name: CI/CD Pipeline
+# 复制到 itfx: .github/workflows/deploy.yml
+#
+# Secrets: SSH_K3S_HOST / SSH_K3S_USERNAME / SSH_K3S_PASSWORD
+# 集群:
+#   GIT_TOKEN=... TCR_USERNAME=... TCR_PASSWORD=... ./scripts/16-setup-kaniko.sh
+#   ./scripts/17-test-github-access.sh   # 选 GIT_FETCH_MODE / KANIKO_NODE_ROLE
+#
+# 构建全程在集群 Pod 内完成（git + kaniko），Actions 只 SSH 触发并跟日志
+#
+name: Build and Deploy
 
 on:
   push:
-    branches:
-      - master  # 监视的分支
+    branches: [master]
+  workflow_dispatch:
+
+env:
+  GIT_URL: https://github.com/xiaoliutral/itfx.git
+  DOCKERFILE: src/InterfaceForward.Api/Dockerfile
+  IMAGE_NAME: interfaceforward_api
+  DEPLOY_NAME: interfaceforward-api
+  CONTAINER_NAME: interfaceforward-api
+  TCR_REGISTRY: ccr.ccs.tencentyun.com
+  TCR_NAMESPACE: ideship
+  K3S_DIR: /data/k3s
+  KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+  NAMESPACE: prod
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
+      - name: Show image
+        id: info
+        run: |
+          TAG="${{ github.sha }}"
+          IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "image=${IMG}" >> "$GITHUB_OUTPUT"
+          echo "Will build: ${IMG}"
 
-      - name: Build to Server
-        uses: appleboy/ssh-action@v0.1.5
+      - name: Build image (Kaniko logs)
+        uses: appleboy/ssh-action@v1.2.0
         with:
-          host: ${{ secrets.SSH_BUILD_HOST }}
-          username: ${{ secrets.SSH_USERNAME }}
-          password: ${{ secrets.SSH_PASSWORD }}
+          host: ${{ secrets.SSH_K3S_HOST }}
+          username: ${{ secrets.SSH_K3S_USERNAME }}
+          password: ${{ secrets.SSH_K3S_PASSWORD }}
+          command_timeout: 50m
+          request_pty: true
+          script_stop: true
           script: |
-            mkdir -p /data/projects
-            cd /data/projects
-            git clone git@github.com:xiaoliutral/itfx.git
-            cd itfx
-            git pull origin master
-            docker build -t interfaceforward_api:latest -f src/InterfaceForward.Api/Dockerfile .
-            # 标记镜像
-            docker tag interfaceforward_api:latest registry.nanafa.com/interfaceforward_api:latest
-            # 推送镜像
-            docker push registry.nanafa.com/interfaceforward_api:latest
-      - name: Deploy to Server
-        uses: appleboy/ssh-action@v0.1.5
-        with:
-          host: ${{ secrets.SSH_MANAGER_HOST }}
-          username: ${{ secrets.SSH_USERNAME }}
-          password: ${{ secrets.SSH_PASSWORD }}
-          script: |
-            cd /data
-            docker stack deploy -c api.yml api # yml没变化不会更新
-            docker service update --force --image registry.nanafa.com/interfaceforward_api:latest api_itfx # 一定要和service name一致  
+            set -euxo pipefail
+            export KUBECONFIG=${{ env.KUBECONFIG }}
+            cd ${{ env.K3S_DIR }}
+            chmod +x scripts/ci-kaniko-build.sh
+            ./scripts/ci-kaniko-build.sh \
+              "${{ env.GIT_URL }}" \
+              "${{ env.DOCKERFILE }}" \
+              "${{ env.IMAGE_NAME }}" \
+              "${{ steps.info.outputs.tag }}" \
+              "${{ steps.info.outputs.tag }}"
 
+      - name: Deploy
+        uses: appleboy/ssh-action@v1.2.0
+        with:
+          host: ${{ secrets.SSH_K3S_HOST }}
+          username: ${{ secrets.SSH_K3S_USERNAME }}
+          password: ${{ secrets.SSH_K3S_PASSWORD }}
+          command_timeout: 5m
+          script_stop: true
+          script: |
+            set -euxo pipefail
+            export KUBECONFIG=${{ env.KUBECONFIG }}
+            IMG="${{ steps.info.outputs.image }}"
+            kubectl -n ${{ env.NAMESPACE }} set image deploy/${{ env.DEPLOY_NAME }} \
+              ${{ env.CONTAINER_NAME }}=${IMG}
+            kubectl -n ${{ env.NAMESPACE }} rollout status deploy/${{ env.DEPLOY_NAME }} --timeout=180s
+            kubectl -n ${{ env.NAMESPACE }} get pods -l app=${{ env.DEPLOY_NAME }} -o wide

src/InterfaceForward.Api/Dockerfile

@@ -1,16 +1,24 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0.421 AS base
-ARG BUILD_CONFIGURATION=Release
+# ===== 阶段1: 基础依赖层（可缓存） =====
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 WORKDIR /src
-COPY . /src
+
+# ✅ 关键优化：只复制 .csproj 文件，让 restore 层可以缓存
+COPY ["src/InterfaceForward.Api/InterfaceForward.Api.csproj", "src/InterfaceForward.Api/"]
 RUN dotnet restore "src/InterfaceForward.Api/InterfaceForward.Api.csproj"
+
+# ===== 阶段2: 构建层 =====
+# ✅ 现在才复制所有代码（这一层变动频繁，但 restore 已经跑完了）
+COPY . .
 WORKDIR "/src/src/InterfaceForward.Api"
+ARG BUILD_CONFIGURATION=Release
 RUN dotnet build "InterfaceForward.Api.csproj" -c $BUILD_CONFIGURATION -o /app/build
 
-FROM base AS publish
+# ===== 阶段3: 发布层 =====
+FROM build AS publish
 ARG BUILD_CONFIGURATION=Release
 RUN dotnet publish "InterfaceForward.Api.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
 
-# 使用运行时镜像
+# ===== 阶段4: 最终运行时（轻量级） =====
 FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS runtime
 WORKDIR /app
 COPY --from=publish /app/publish .