From b65c680595e14d753073fa46fc8521a4aa14b1ca Mon Sep 17 00:00:00 2001 From: eezd Date: Wed, 28 Oct 2026 11:40:44 +0800 Subject: [PATCH] ci: group development instances under Gitea and name containers explicitly --- .gitea/workflows/ci.yml | 4 ++-- AGENTS.md | 2 +- deploy/compose.image.yml | 1 + docs/deployment.md | 4 ++-- docs/deployment.zh-CN.md | 4 ++-- docs/development.md | 2 +- docs/development.zh-CN.md | 2 +- 7 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index eca7802..dbbc3b0 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -112,7 +112,7 @@ jobs: container: image: docker:29-cli volumes: - - /docker/dev/rawmark:/docker/dev/rawmark + - /docker/gitea/dev/rawmark:/docker/gitea/dev/rawmark env: GITEA_API_URL: ${{ gitea.server_url }}/api/v1 GITEA_RELEASE_TOKEN: ${{ secrets.RAWMARK_GITEA_TOKEN }} @@ -135,7 +135,7 @@ jobs: mkdir -p "$DOCKER_CONFIG" chmod 700 "$DOCKER_CONFIG" printf '%s' "$GITEA_RELEASE_TOKEN" | docker login git.134333.xyz --username eezd --password-stdin - python3 scripts/deploy.py development --directory /docker/dev/rawmark \ + python3 scripts/deploy.py development --directory /docker/gitea/dev/rawmark \ --image "$DEPLOY_IMAGE" --commit "$DEPLOY_COMMIT" --version "$DEPLOY_VERSION" \ --client-container "$(hostname)" - name: Remove job credentials diff --git a/AGENTS.md b/AGENTS.md index 75456b6..e402515 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -125,6 +125,6 @@ pnpm -C web build ## CI/CD -Gitea 为主仓库和构建执行方；日常 main push 仅构建 Linux amd64，通过隔离验收后发布开发镜像并更新独立开发实例。开发实例目录为 `/docker/dev/rawmark`，生产实例目录为 `/docker/main/rawmark`。正式发布只从 Gitea 手动入口选择已通过开发 CI 的提交，构建五平台包及 Linux 双架构镜像，同步同一版本至 GitHub/GHCR；GitHub 不执行项目构建，仅允许 Pages 平台部署预构建 Demo。生产仅手动选择完整发布版本并固定 GHCR 摘要，不能随开发推送更新。 +Gitea 为主仓库和构建执行方；日常 main push 仅构建 Linux amd64，通过隔离验收后发布开发镜像并更新独立开发实例。开发实例目录为 `/docker/gitea/dev/rawmark`，开发应用容器名为 `rawmark-dev`，生产实例目录为 `/docker/main/rawmark`。正式发布只从 Gitea 手动入口选择已通过开发 CI 的提交，构建五平台包及 Linux 双架构镜像，同步同一版本至 GitHub/GHCR；GitHub 不执行项目构建，仅允许 Pages 平台部署预构建 Demo。生产仅手动选择完整发布版本并固定 GHCR 摘要，不能随开发推送更新。 runner 保持容量一，最多两个任务同时运行；当前宿主 Docker 执行器只接收受信代码。临时资源按任务标识清理，不全局 prune，不删除部署容器。CI 行为测试为 `python3 -m unittest discover -s scripts/tests -v`；项目检查与打包入口为 `sh scripts/ci-check.sh development|release`、`sh scripts/ci-package.sh development|release`，仅在 CI 工具链容器执行。正式版本、凭据、上传限制、部署目录与回退步骤见双语开发和部署文档。 diff --git a/deploy/compose.image.yml b/deploy/compose.image.yml index 6be861b..dff4685 100644 --- a/deploy/compose.image.yml +++ b/deploy/compose.image.yml @@ -2,6 +2,7 @@ name: ${RAWMARK_PROJECT:?Set RAWMARK_PROJECT} services: rawmark: + container_name: ${RAWMARK_PROJECT:?Set RAWMARK_PROJECT} image: ${RAWMARK_IMAGE:?Set a verified registry image digest} ports: - "${RAWMARK_BIND:-127.0.0.1}:${RAWMARK_PORT:?Set RAWMARK_PORT}:8080" diff --git a/docs/deployment.md b/docs/deployment.md index 5f1b6aa..251634b 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -163,14 +163,14 @@ The Bearer authentication upgrade requires the frontend and backend to be releas ## Managed development and production -The checked-in `deploy/compose.image.yml` is an image-only template. Development lives in `/docker/dev/rawmark`; production lives in `/docker/main/rawmark`. Copy the template to the instance directory as `compose.yml`, with a private mode-600 `.env` beside it. These instances do not depend on a source checkout. Set all required values explicitly: +The checked-in `deploy/compose.image.yml` is an image-only template. Development lives in `/docker/gitea/dev/rawmark`; production lives in `/docker/main/rawmark`. Copy the template to the instance directory as `compose.yml`, with a private mode-600 `.env` beside it. The container name follows `RAWMARK_PROJECT`, so the development container is `rawmark-dev`. These instances do not depend on a source checkout. Set all required values explicitly: ```dotenv RAWMARK_CHANNEL=development RAWMARK_PROJECT=rawmark-dev RAWMARK_BIND=127.0.0.1 RAWMARK_PORT=21001 -RAWMARK_DATA_DIR=/docker/dev/rawmark/data +RAWMARK_DATA_DIR=/docker/gitea/dev/rawmark/data RAWMARK_IMAGE=git.134333.xyz/eezd/rawmark@sha256: ``` diff --git a/docs/deployment.zh-CN.md b/docs/deployment.zh-CN.md index 6ce436f..91bebbd 100644 --- a/docs/deployment.zh-CN.md +++ b/docs/deployment.zh-CN.md @@ -163,14 +163,14 @@ Bearer 认证升级需要前后端一起发布。旧 Cookie 页面不能继续 ## 开发与生产托管 -仓库 `deploy/compose.image.yml` 是仅拉镜像的模板。开发实例放在 `/docker/dev/rawmark`，生产实例放在 `/docker/main/rawmark`；将模板复制至对应实例目录并命名为 `compose.yml`，旁边放权限 600 的私有 `.env`。实例不依赖源码工作目录，必须明确填写： +仓库 `deploy/compose.image.yml` 是仅拉镜像的模板。开发实例放在 `/docker/gitea/dev/rawmark`，生产实例放在 `/docker/main/rawmark`；将模板复制至对应实例目录并命名为 `compose.yml`，旁边放权限 600 的私有 `.env`。容器名跟随 `RAWMARK_PROJECT`，开发容器为 `rawmark-dev`。实例不依赖源码工作目录，必须明确填写： ```dotenv RAWMARK_CHANNEL=development RAWMARK_PROJECT=rawmark-dev RAWMARK_BIND=127.0.0.1 RAWMARK_PORT=21001 -RAWMARK_DATA_DIR=/docker/dev/rawmark/data +RAWMARK_DATA_DIR=/docker/gitea/dev/rawmark/data RAWMARK_IMAGE=git.134333.xyz/eezd/rawmark@sha256:<已验证摘要> ``` diff --git a/docs/development.md b/docs/development.md index fca5e8c..10205df 100644 --- a/docs/development.md +++ b/docs/development.md @@ -116,7 +116,7 @@ Gitea is the primary repository and build executor (`origin`). GitHub (`github`) A main push runs `.gitea/workflows/ci.yml`: project checks, CI behavior tests, Linux amd64 packaging, and native lifecycle smoke tests. A dependent Docker job verifies that run's archive and checks the non-root image with synthetic data, including restart/replacement persistence and server-side logout. Only then does it publish `git.134333.xyz/eezd/rawmark:dev-` and deploy its digest to the independent development instance. PRs only run checks and packaging; they receive no publication credentials and do not deploy. The host-Docker runner is for trusted code, not an untrusted-code sandbox; external PRs require maintainer review before execution. -Development uses `raw-dev.134333.xyz`, loopback port 21001, and `/docker/dev/rawmark/data`. Production retains its own data under `/docker/main/rawmark` and port 21000. Before updating development, the deployment lock rechecks main so an old run cannot overwrite a newer deployment. +Development uses `raw-dev.134333.xyz`, loopback port 21001, and `/docker/gitea/dev/rawmark/data`. Production retains its own data under `/docker/main/rawmark` and port 21000. Before updating development, the deployment lock rechecks main so an old run cannot overwrite a newer deployment. `sh scripts/ci-check.sh development` and `sh scripts/ci-package.sh development` are the CI entry points. The `release` argument enables the Demo and five-platform packaging. Run `python3 -m unittest discover -s scripts/tests -v` for artifact and deployment behavior tests. Do not rebuild these artifacts on the deployment host. diff --git a/docs/development.zh-CN.md b/docs/development.zh-CN.md index 64ea67f..5cc75e2 100644 --- a/docs/development.zh-CN.md +++ b/docs/development.zh-CN.md @@ -116,7 +116,7 @@ Gitea 是主仓库和构建执行方（`origin`）；GitHub（`github`）只接 main push 触发 `.gitea/workflows/ci.yml`，执行项目检查、CI 行为测试、Linux amd64 打包和原生生命周期冒烟。后续 Docker job 校验同一运行的包，使用合成数据验证非 root 镜像、重启及重建容器持久化、服务端注销；通过后才发布 `git.134333.xyz/eezd/rawmark:dev-<完整SHA>` 并按摘要更新独立开发实例。PR 仅检查和打包，不注入发布凭据、不部署。宿主 Docker runner 只运行受信代码，并非不可信代码沙箱；外部 PR 运行前须由维护者审查。 -开发使用 `raw-dev.134333.xyz`、回环端口 21001 和 `/docker/dev/rawmark/data`；生产保留 `/docker/main/rawmark` 下的独立数据和 21000 端口。部署锁内再次核对 main，旧运行不能覆盖新部署。 +开发使用 `raw-dev.134333.xyz`、回环端口 21001 和 `/docker/gitea/dev/rawmark/data`；生产保留 `/docker/main/rawmark` 下的独立数据和 21000 端口。部署锁内再次核对 main，旧运行不能覆盖新部署。 CI 入口是 `sh scripts/ci-check.sh development` 和 `sh scripts/ci-package.sh development`；参数换为 `release` 才构建 Demo 和五平台程序。`python3 -m unittest discover -s scripts/tests -v` 验证产物与部署行为。部署宿主不重新编译这些产物。