116 lines
5.2 KiB
YAML
116 lines
5.2 KiB
YAML
name: 生产环境部署 - BlogFlare 至 Cloudflare Pages
|
||
|
||
# 触发规则：当代码推送到 main 主分支，或在 Gitea 后台手动触发(workflow_dispatch)时运行
|
||
on:
|
||
push:
|
||
branches:
|
||
- main
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
deploy:
|
||
name: 构建与自动化上线
|
||
runs-on: ubuntu-latest
|
||
|
||
steps:
|
||
# 1. 检出仓库最新代码 (明确限定 fetch-depth: 1 只取最近一条提交历史)
|
||
- name: 1. 检出源代码
|
||
uses: actions/checkout@v4
|
||
with:
|
||
fetch-depth: 1
|
||
|
||
# 2. 使用与 packageManager 字段一致的 pnpm
|
||
- name: 2. 初始化 pnpm 环境
|
||
uses: pnpm/action-setup@v4
|
||
with:
|
||
version: 11.20.0
|
||
|
||
# 3. 初始化 Node.js 运行环境 (使用 Node 22)
|
||
- name: 3. 初始化 Node.js 环境
|
||
uses: actions/setup-node@v4
|
||
with:
|
||
node-version: '22'
|
||
cache: 'pnpm'
|
||
|
||
# 4. 安装工程依赖包
|
||
- name: 4. 安装工程依赖包
|
||
run: pnpm install --frozen-lockfile
|
||
|
||
# 5. 执行静态代码整洁规则审查及 Svelte/TS 类型质检关卡
|
||
- name: 5. 执行代码规范、类型与自动化测试质检
|
||
run: pnpm run check && pnpm run lint && pnpm run test
|
||
|
||
# 6. 执行类型自检并打包输出静态产物 (产出在 .svelte-kit/cloudflare)
|
||
- name: 6. 构建生产环境打包产物
|
||
run: pnpm run build
|
||
|
||
# 7. 应用 D1 数据库增量迁移至远端生产区
|
||
- name: 7. 应用数据库增量迁移至云端 (D1 Migrations)
|
||
env:
|
||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
||
run: pnpm exec wrangler d1 migrations apply blogflare-db --remote
|
||
|
||
# 8. 将后台认证配置同步到 Pages Production；缺失时阻止发布锁死后台
|
||
- name: 8. 同步 Cloudflare Access 生产环境配置
|
||
env:
|
||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
||
CF_ACCESS_TEAM_DOMAIN: ${{ secrets.CF_ACCESS_TEAM_DOMAIN }}
|
||
CF_ACCESS_AUD: ${{ secrets.CF_ACCESS_AUD }}
|
||
run: |
|
||
if [[ -z "$CF_ACCESS_TEAM_DOMAIN" || -z "$CF_ACCESS_AUD" ]]; then
|
||
echo "::error::缺少 Gitea Secrets：CF_ACCESS_TEAM_DOMAIN 或 CF_ACCESS_AUD"
|
||
exit 1
|
||
fi
|
||
|
||
case "$CF_ACCESS_TEAM_DOMAIN" in
|
||
https://*.cloudflareaccess.com) ;;
|
||
*)
|
||
echo "::error::CF_ACCESS_TEAM_DOMAIN 必须是 https://<team>.cloudflareaccess.com"
|
||
exit 1
|
||
;;
|
||
esac
|
||
|
||
access_secret_file="$(mktemp)"
|
||
trap 'rm -f "$access_secret_file"' EXIT
|
||
chmod 600 "$access_secret_file"
|
||
printf 'CF_ACCESS_TEAM_DOMAIN=%s\nCF_ACCESS_AUD=%s\n' \
|
||
"$CF_ACCESS_TEAM_DOMAIN" "$CF_ACCESS_AUD" > "$access_secret_file"
|
||
pnpm exec wrangler pages secret bulk "$access_secret_file" --project-name=blogflare
|
||
|
||
# 9. 使用本地安装好的 wrangler 直接推送部署
|
||
- name: 9. 自动化推送到 Cloudflare Pages (主分支为生产发布)
|
||
env:
|
||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
||
run: pnpm exec wrangler pages deploy .svelte-kit/cloudflare --project-name=blogflare --branch=main
|
||
|
||
# 10. 构建与发布成功时，用 curl 直联调用 Telegram 官方发送通知接口
|
||
- name: 10. 发送 Telegram 部署成功通知
|
||
if: success()
|
||
env:
|
||
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
|
||
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
|
||
COMMIT_MSG: ${{ gitea.event.head_commit.message || github.event.head_commit.message || '通过控制台手动直接运行' }}
|
||
run: |
|
||
MSG=$(printf "🎉 <b>BlogFlare 自动化部署成功！</b>\n\n📦 <b>提交变动说明：</b>\n<code>%s</code>\n\n🚀 全套改动现已全网完成发布部署！" "$COMMIT_MSG")
|
||
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
|
||
-d "chat_id=${TELEGRAM_CHAT_ID}" \
|
||
-d "parse_mode=HTML" \
|
||
--data-urlencode "text=${MSG}"
|
||
|
||
# 11. 一旦任意步骤发生阻挠或错误，立即发警报知音
|
||
- name: 11. 发送 Telegram 部署失败告警
|
||
if: failure()
|
||
env:
|
||
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
|
||
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
|
||
COMMIT_MSG: ${{ gitea.event.head_commit.message || github.event.head_commit.message || '通过控制台手动直接运行' }}
|
||
run: |
|
||
MSG=$(printf "❌ <b>BlogFlare 构建与发布遭遇失败中断！</b>\n\n📦 <b>本次尝试的修改：</b>\n<code>%s</code>\n\n⚠️ 该步骤未获完全通过，已退离作业；请立刻返回仓库操作屏复对完整运行记录，扫清排查代码层或通讯网络上的潜在卡塞问题。" "$COMMIT_MSG")
|
||
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
|
||
-d "chat_id=${TELEGRAM_CHAT_ID}" \
|
||
-d "parse_mode=HTML" \
|
||
--data-urlencode "text=${MSG}"
|