From d8696ae80b517088792fc0bc4c39a175ec76206e Mon Sep 17 00:00:00 2001 From: biss Date: Sat, 25 Jul 2026 20:31:19 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitea/workflows/publish.yml | 162 +++++++++++++++++++++++++++++++++++ README.md | 31 +++++-- 2 files changed, 185 insertions(+), 8 deletions(-) create mode 100644 .gitea/workflows/publish.yml diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml new file mode 100644 index 0000000..30b539f --- /dev/null +++ b/.gitea/workflows/publish.yml @@ -0,0 +1,162 @@ +name: Build and publish packages and Docker images + +on: + push: + tags: + - "v*" + workflow_dispatch: + inputs: + include_extended_platforms: + description: "同时构建 Windows ARM64 和 macOS x64/ARM64" + required: false + default: false + type: boolean + +jobs: + publish: + name: Test, build and publish + runs-on: ubuntu-latest + permissions: + contents: read + releases: write + + steps: + - name: Check out repository + uses: https://github.com/actions/checkout@v4 + + - name: Set up .NET + uses: https://github.com/actions/setup-dotnet@v4 + with: + dotnet-version: "10.0.x" + + - name: Set up Node.js + uses: https://github.com/actions/setup-node@v4 + with: + node-version: "24" + cache: npm + cache-dependency-path: src/Eis.Web/ClientApp/package-lock.json + + - name: Build Vue application + working-directory: src/Eis.Web/ClientApp + run: | + npm ci + npm run build + + - name: Run tests + run: dotnet test Eis.slnx --configuration Release + + - name: Determine package version + id: package_version + shell: bash + env: + INCLUDE_EXTENDED_PLATFORMS: ${{ inputs.include_extended_platforms }} + run: | + set -euo pipefail + if [[ "$GITHUB_REF" == refs/tags/v* ]]; then + version="${GITHUB_REF_NAME#v}" + else + version="0.0.0-dev.${GITHUB_RUN_NUMBER:-0}" + fi + profile=default + if [[ "${INCLUDE_EXTENDED_PLATFORMS:-false}" == "true" ]]; then + profile=all + fi + echo "version=$version" >> "$GITHUB_OUTPUT" + echo "profile=$profile" >> "$GITHUB_OUTPUT" + + - name: Build self-contained platform packages + shell: bash + run: | + bash ./scripts/publish-platform-packages.sh \ + "${{ steps.package_version.outputs.version }}" \ + "artifacts/packages" \ + "${{ steps.package_version.outputs.profile }}" + + - name: Upload platform packages as workflow artifact + uses: https://github.com/christopherHX/gitea-upload-artifact@v4 + with: + name: eis-${{ steps.package_version.outputs.version }}-${{ steps.package_version.outputs.profile }}-platform-packages + path: artifacts/packages/* + if-no-files-found: error + + - name: Set up QEMU + uses: https://github.com/docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: https://github.com/docker/setup-buildx-action@v3 + + - name: Log in to Docker Hub + uses: https://github.com/docker/login-action@v3 + with: + registry: docker.io + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Log in to Gitea Container Registry + uses: https://github.com/docker/login-action@v3 + with: + registry: git.biss.click + username: ${{ vars.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_TOKEN }} + + - name: Generate image tags and labels + id: metadata + uses: https://github.com/docker/metadata-action@v5 + with: + images: | + docker.io/${{ vars.DOCKERHUB_IMAGE }} + git.biss.click/biss/eis-dotnet + flavor: latest=auto + tags: | + type=sha,format=short,prefix=sha- + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + + - name: Build and push image + uses: https://github.com/docker/build-push-action@v6 + with: + context: . + file: ./Dockerfile + platforms: linux/amd64,linux/arm64 + push: true + tags: ${{ steps.metadata.outputs.tags }} + labels: ${{ steps.metadata.outputs.labels }} + cache-from: type=registry,ref=docker.io/${{ vars.DOCKERHUB_IMAGE }}:buildcache + cache-to: type=registry,ref=docker.io/${{ vars.DOCKERHUB_IMAGE }}:buildcache,mode=max + + - name: Detect release type + id: release_type + if: gitea.ref_type == 'tag' + shell: bash + run: | + case "$GITHUB_REF_NAME" in + *-*) prerelease=true ;; + *) prerelease=false ;; + esac + echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT" + + - name: Create Gitea release + if: gitea.ref_type == 'tag' + uses: https://github.com/akkuman/gitea-release-action@v1 + with: + token: ${{ secrets.GITEA_TOKEN }} + tag_name: ${{ gitea.ref_name }} + name: ${{ gitea.ref_name }} + prerelease: ${{ steps.release_type.outputs.prerelease }} + files: | + artifacts/packages/* + body: | + 已发布以下自包含程序包，无需预装 .NET 运行时： + + - Windows x64：下载对应的 `.zip` + - Linux x64 / ARM64：下载对应的 `.tar.gz` + - 使用 `SHA256SUMS` 校验下载文件 + + Windows ARM64 与 macOS Intel / Apple Silicon 包可在 Actions 页面选择扩展平台后手动构建。 + + Docker 多架构镜像（linux/amd64、linux/arm64）： + + ```text + docker pull docker.io/${{ vars.DOCKERHUB_IMAGE }}:${{ steps.metadata.outputs.version }} + docker pull git.biss.click/biss/eis-dotnet:${{ steps.metadata.outputs.version }} + ``` diff --git a/README.md b/README.md index 897e953..6db5cf0 100644 --- a/README.md +++ b/README.md @@ -47,19 +47,31 @@ dotnet run --project src/Jiaowu.Api ## MySQL 8.4 生产部署 -非 Development 环境只允许使用 MySQL。`dotnet publish` 会自动执行 `npm ci` 和 `npm run build`，并将 Vue 静态文件放入发布目录的 `wwwroot`： +非 Development 环境只允许使用 MySQL。构建发布包与数据库配置相互独立： +`dotnet publish` 不需要数据库连接串、JWT 密钥或生产环境变量，也不会把这些配置写入发布包。 +它会自动执行 `npm ci` 和 `npm run build`，并将 Vue 静态文件放入发布目录的 +`wwwroot`： ```powershell -$env:ASPNETCORE_ENVIRONMENT = 'Production' -$env:Database__Provider = 'MySql' -$env:ConnectionStrings__MySql = 'Server=db.example.edu.cn;Port=3306;Database=jiaowu;User=YOUR_USER;Password=YOUR_PASSWORD;SslMode=VerifyFull;SslCa=C:\certs\mysql-ca.pem;' -$env:Jwt__Key = '至少32字节的随机生产密钥' -$env:AllowedHosts = 'jiaowu.example.edu.cn' dotnet publish src/Jiaowu.Api -c Release -o .artifacts/publish ``` 如需在特殊流水线中跳过自动前端构建，可传入 `-p:BuildFrontendOnPublish=false`。 +将发布包复制到目标服务器后，再通过 Windows 服务、容器编排平台或密钥管理系统， +为 **应用运行进程** 注入配置。下面仅演示在当前 PowerShell 会话中配置；变量只对该 +会话及其启动的子进程生效： + +```powershell +$env:ASPNETCORE_ENVIRONMENT = 'Production' +$env:Database__Provider = 'MySql' +$env:Jwt__Key = '至少32字节的随机生产密钥' +$env:AllowedHosts = 'jiaowu.example.edu.cn' +``` + +这些值由 `Jiaowu.Api` 在每次启动时读取。不要把真实连接串或密钥写入仓库中的 +`appsettings*.json`，证书路径也必须是目标服务器上的实际路径。 + 数据库应明确使用 `utf8mb4`；MySQL 8.4 的默认排序规则为 `utf8mb4_0900_ai_ci`。新建数据库时可执行： @@ -69,15 +81,18 @@ CREATE DATABASE `jiaowu` COLLATE utf8mb4_0900_ai_ci; ``` -发布前使用具备 DDL 权限的迁移账号单独执行迁移： +首次部署或版本升级时，先在目标服务器设置具备 DDL 权限的迁移账号连接串，并单独 +执行迁移： ```powershell +$env:ConnectionStrings__MySql = 'Server=db.example.edu.cn;Port=3306;Database=jiaowu;User=MIGRATION_USER;Password=MIGRATION_PASSWORD;SslMode=VerifyFull;SslCa=C:\certs\mysql-ca.pem;' & '.artifacts\publish\Jiaowu.Api.exe' --migrate-only ``` -迁移成功后，改用仅具备应用所需 DML 权限的运行账号并启动服务： +迁移成功后，将连接串替换为仅具备应用所需 DML 权限的运行账号，再启动服务： ```powershell +$env:ConnectionStrings__MySql = 'Server=db.example.edu.cn;Port=3306;Database=jiaowu;User=APP_USER;Password=APP_PASSWORD;SslMode=VerifyFull;SslCa=C:\certs\mysql-ca.pem;' & '.artifacts\publish\Jiaowu.Api.exe' ```