更新

.gitea/workflows/publish.yml

@@ -0,0 +1,162 @@
+name: Build and publish packages and Docker images
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      include_extended_platforms:
+        description: "同时构建 Windows ARM64 和 macOS x64/ARM64"
+        required: false
+        default: false
+        type: boolean
+
+jobs:
+  publish:
+    name: Test, build and publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      releases: write
+
+    steps:
+      - name: Check out repository
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Set up .NET
+        uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Set up Node.js
+        uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: src/Eis.Web/ClientApp/package-lock.json
+
+      - name: Build Vue application
+        working-directory: src/Eis.Web/ClientApp
+        run: |
+          npm ci
+          npm run build
+
+      - name: Run tests
+        run: dotnet test Eis.slnx --configuration Release
+
+      - name: Determine package version
+        id: package_version
+        shell: bash
+        env:
+          INCLUDE_EXTENDED_PLATFORMS: ${{ inputs.include_extended_platforms }}
+        run: |
+          set -euo pipefail
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            version="${GITHUB_REF_NAME#v}"
+          else
+            version="0.0.0-dev.${GITHUB_RUN_NUMBER:-0}"
+          fi
+          profile=default
+          if [[ "${INCLUDE_EXTENDED_PLATFORMS:-false}" == "true" ]]; then
+            profile=all
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "profile=$profile" >> "$GITHUB_OUTPUT"
+
+      - name: Build self-contained platform packages
+        shell: bash
+        run: |
+          bash ./scripts/publish-platform-packages.sh \
+            "${{ steps.package_version.outputs.version }}" \
+            "artifacts/packages" \
+            "${{ steps.package_version.outputs.profile }}"
+
+      - name: Upload platform packages as workflow artifact
+        uses: https://github.com/christopherHX/gitea-upload-artifact@v4
+        with:
+          name: eis-${{ steps.package_version.outputs.version }}-${{ steps.package_version.outputs.profile }}-platform-packages
+          path: artifacts/packages/*
+          if-no-files-found: error
+
+      - name: Set up QEMU
+        uses: https://github.com/docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: https://github.com/docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to Gitea Container Registry
+        uses: https://github.com/docker/login-action@v3
+        with:
+          registry: git.biss.click
+          username: ${{ vars.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Generate image tags and labels
+        id: metadata
+        uses: https://github.com/docker/metadata-action@v5
+        with:
+          images: |
+            docker.io/${{ vars.DOCKERHUB_IMAGE }}
+            git.biss.click/biss/eis-dotnet
+          flavor: latest=auto
+          tags: |
+            type=sha,format=short,prefix=sha-
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push image
+        uses: https://github.com/docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          cache-from: type=registry,ref=docker.io/${{ vars.DOCKERHUB_IMAGE }}:buildcache
+          cache-to: type=registry,ref=docker.io/${{ vars.DOCKERHUB_IMAGE }}:buildcache,mode=max
+
+      - name: Detect release type
+        id: release_type
+        if: gitea.ref_type == 'tag'
+        shell: bash
+        run: |
+          case "$GITHUB_REF_NAME" in
+            *-*) prerelease=true ;;
+            *) prerelease=false ;;
+          esac
+          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
+
+      - name: Create Gitea release
+        if: gitea.ref_type == 'tag'
+        uses: https://github.com/akkuman/gitea-release-action@v1
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          tag_name: ${{ gitea.ref_name }}
+          name: ${{ gitea.ref_name }}
+          prerelease: ${{ steps.release_type.outputs.prerelease }}
+          files: |
+            artifacts/packages/*
+          body: |
+            已发布以下自包含程序包，无需预装 .NET 运行时：
+
+            - Windows x64：下载对应的 `.zip`
+            - Linux x64 / ARM64：下载对应的 `.tar.gz`
+            - 使用 `SHA256SUMS` 校验下载文件
+
+            Windows ARM64 与 macOS Intel / Apple Silicon 包可在 Actions 页面选择扩展平台后手动构建。
+
+            Docker 多架构镜像（linux/amd64、linux/arm64）：
+
+            ```text
+            docker pull docker.io/${{ vars.DOCKERHUB_IMAGE }}:${{ steps.metadata.outputs.version }}
+            docker pull git.biss.click/biss/eis-dotnet:${{ steps.metadata.outputs.version }}
+            ```

README.md

@@ -47,19 +47,31 @@ dotnet run --project src/Jiaowu.Api
 
 ## MySQL 8.4 生产部署
 
-非 Development 环境只允许使用 MySQL。`dotnet publish` 会自动执行 `npm ci` 和 `npm run build`，并将 Vue 静态文件放入发布目录的 `wwwroot`：
+非 Development 环境只允许使用 MySQL。构建发布包与数据库配置相互独立：
+`dotnet publish` 不需要数据库连接串、JWT 密钥或生产环境变量，也不会把这些配置写入发布包。
+它会自动执行 `npm ci` 和 `npm run build`，并将 Vue 静态文件放入发布目录的
+`wwwroot`：
 
 ```powershell
-$env:ASPNETCORE_ENVIRONMENT = 'Production'
-$env:Database__Provider = 'MySql'
-$env:ConnectionStrings__MySql = 'Server=db.example.edu.cn;Port=3306;Database=jiaowu;User=YOUR_USER;Password=YOUR_PASSWORD;SslMode=VerifyFull;SslCa=C:\certs\mysql-ca.pem;'
-$env:Jwt__Key = '至少32字节的随机生产密钥'
-$env:AllowedHosts = 'jiaowu.example.edu.cn'
 dotnet publish src/Jiaowu.Api -c Release -o .artifacts/publish
 ```
 
 如需在特殊流水线中跳过自动前端构建，可传入 `-p:BuildFrontendOnPublish=false`。
 
+将发布包复制到目标服务器后，再通过 Windows 服务、容器编排平台或密钥管理系统，
+为 **应用运行进程** 注入配置。下面仅演示在当前 PowerShell 会话中配置；变量只对该
+会话及其启动的子进程生效：
+
+```powershell
+$env:ASPNETCORE_ENVIRONMENT = 'Production'
+$env:Database__Provider = 'MySql'
+$env:Jwt__Key = '至少32字节的随机生产密钥'
+$env:AllowedHosts = 'jiaowu.example.edu.cn'
+```
+
+这些值由 `Jiaowu.Api` 在每次启动时读取。不要把真实连接串或密钥写入仓库中的
+`appsettings*.json`，证书路径也必须是目标服务器上的实际路径。
+
 数据库应明确使用 `utf8mb4`；MySQL 8.4 的默认排序规则为
 `utf8mb4_0900_ai_ci`。新建数据库时可执行：
 
@@ -69,15 +81,18 @@ CREATE DATABASE `jiaowu`
   COLLATE utf8mb4_0900_ai_ci;
 ```
 
-发布前使用具备 DDL 权限的迁移账号单独执行迁移：
+首次部署或版本升级时，先在目标服务器设置具备 DDL 权限的迁移账号连接串，并单独
+执行迁移：
 
 ```powershell
+$env:ConnectionStrings__MySql = 'Server=db.example.edu.cn;Port=3306;Database=jiaowu;User=MIGRATION_USER;Password=MIGRATION_PASSWORD;SslMode=VerifyFull;SslCa=C:\certs\mysql-ca.pem;'
 & '.artifacts\publish\Jiaowu.Api.exe' --migrate-only
 ```
 
-迁移成功后，改用仅具备应用所需 DML 权限的运行账号并启动服务：
+迁移成功后，将连接串替换为仅具备应用所需 DML 权限的运行账号，再启动服务：
 
 ```powershell
+$env:ConnectionStrings__MySql = 'Server=db.example.edu.cn;Port=3306;Database=jiaowu;User=APP_USER;Password=APP_PASSWORD;SslMode=VerifyFull;SslCa=C:\certs\mysql-ca.pem;'
 & '.artifacts\publish\Jiaowu.Api.exe'
 ```