Repository navigation
feat: 鉴微 AI 技术追踪与深度解析知识库 v1.0.0 全栈落地 #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| # 三种触发方式： | |
| # 1) 提交触发 —— push 到 master 分支 | |
| # 2) 网页触发 —— Actions 页面 "Run workflow"（workflow_dispatch，可选 environment） | |
| # 3) 脚本/API 触发 —— repository_dispatch（event_type=deploy）， | |
| # 例：gh api repos/<owner>/<repo>/dispatches -f event_type=deploy | |
| on: | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: 目标环境 | |
| type: choice | |
| options: [master, dev] | |
| default: master | |
| repository_dispatch: | |
| types: [deploy] | |
| env: | |
| # 默认推送到 GitHub Container Registry（零配置，用内置 GITHUB_TOKEN）； | |
| # 阿里云生产可改为 ACR：设置 secrets.REGISTRY 并在登录步骤替换。 | |
| REGISTRY: ${{ secrets.REGISTRY != '' && secrets.REGISTRY || format('ghcr.io/{0}', github.repository_owner) }} | |
| IMAGE_TAG: ${{ github.sha }} | |
| jobs: | |
| # ---------------- 构建并推送镜像 ---------------- | |
| build-push: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: 登录镜像仓库 | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ startsWith(env.REGISTRY, 'ghcr.io') && 'ghcr.io' || secrets.REGISTRY_HOST }} | |
| username: ${{ startsWith(env.REGISTRY, 'ghcr.io') && github.actor || secrets.REGISTRY_USERNAME }} | |
| password: ${{ startsWith(env.REGISTRY, 'ghcr.io') && secrets.GITHUB_TOKEN || secrets.REGISTRY_PASSWORD }} | |
| - name: 构建并推送 api 镜像 | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./backend | |
| file: ./backend/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: | | |
| ${{ env.REGISTRY }}/api:${{ env.IMAGE_TAG }} | |
| ${{ env.REGISTRY }}/api:latest | |
| - name: 构建并推送 crawler 镜像 | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./backend | |
| file: ./backend/Dockerfile.crawler | |
| platforms: linux/amd64 | |
| push: true | |
| tags: | | |
| ${{ env.REGISTRY }}/crawler:${{ env.IMAGE_TAG }} | |
| ${{ env.REGISTRY }}/crawler:latest | |
| - name: 构建并推送 frontend 镜像 | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./frontend | |
| file: ./frontend/Dockerfile | |
| target: prod | |
| platforms: linux/amd64 | |
| push: true | |
| tags: | | |
| ${{ env.REGISTRY }}/frontend:${{ env.IMAGE_TAG }} | |
| ${{ env.REGISTRY }}/frontend:latest | |
| # ---------------- SSH 部署到阿里云 ECS ---------------- | |
| deploy: | |
| needs: build-push | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: 检查部署密钥是否配置 | |
| id: gate | |
| run: | | |
| if [ -z "${{ secrets.ECS_HOST }}" ]; then | |
| echo "未配置 ECS_HOST 等密钥，跳过远程部署（镜像已推送，可手动部署）" | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: SSH 部署 | |
| if: steps.gate.outputs.enabled == 'true' | |
| uses: appleboy/ssh-action@v1 | |
| with: | |
| host: ${{ secrets.ECS_HOST }} | |
| username: ${{ secrets.ECS_USER }} | |
| key: ${{ secrets.ECS_SSH_KEY }} | |
| script: | | |
| set -e | |
| cd ${{ secrets.ECS_PATH }} # 服务器上的仓库目录（含 .env） | |
| git pull --ff-only || true | |
| export REGISTRY="${{ env.REGISTRY }}" | |
| export TAG="${{ env.IMAGE_TAG }}" | |
| # 若用 GHCR 私有镜像，服务器需先登录（凭证经 secrets 注入环境亦可） | |
| docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file .env pull | |
| docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file .env up -d --remove-orphans | |
| sleep 8 | |
| curl -fsS -k https://localhost/api/health || curl -fsS http://localhost/api/health | |
| echo "部署完成 TAG=$TAG" |