32c - AI辅助CI/CD配置

┌─────────────────────────────────────────────────────────┐
│  Level 4：自主管线（Autonomous Pipeline）                  │
│  AI Agent 自主监控、诊断、修复管线故障                       │
│  代表：GitHub Agentic Workflows、CircleCI Chunk            │
├─────────────────────────────────────────────────────────┤
│  Level 3：智能优化（Intelligent Optimization）              │
│  AI 分析构建历史，优化测试选择、缓存策略、资源分配             │
│  代表：CircleCI Smarter Testing、GitLab Auto DevOps        │
├─────────────────────────────────────────────────────────┤
│  Level 2：对话式生成（Conversational Generation）           │
│  通过自然语言对话生成完整管线配置                             │
│  代表：Copilot Chat、GitLab Duo Chat、Claude/GPT           │
├─────────────────────────────────────────────────────────┤
│  Level 1：代码补全（Code Completion）                       │
│  在 IDE 中自动补全 YAML 配置片段                             │
│  代表：Copilot 内联建议、Cursor Tab 补全                    │
├─────────────────────────────────────────────────────────┤
│  Level 0：模板参考（Template Reference）                    │
│  使用预定义模板和文档手动编写                                 │
│  代表：官方 Starter Workflows、社区模板                      │
└─────────────────────────────────────────────────────────┘

# .github/workflows/ci.yml
# 当你输入注释描述意图时，Copilot 会建议完整配置块
 
# Node.js 项目的 CI 工作流：安装依赖、lint、测试、构建
name: CI
 
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
 
# Copilot 会根据上面的注释自动建议以下内容
jobs:
  ci:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20, 22]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm test
      - run: npm run build

用户提示：
"帮我创建一个 GitHub Actions 工作流，要求：
1. 在 PR 和 push 到 main 时触发
2. 使用 matrix 策略测试 Node 18/20/22
3. 包含 lint、单元测试、集成测试三个阶段
4. 集成测试需要 PostgreSQL 服务容器
5. 测试通过后自动部署到 Vercel（仅 main 分支）
6. 添加构建缓存优化"

name: CI/CD Pipeline
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
env:
  NODE_ENV: test
 
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm run type-check
 
  unit-test:
    runs-on: ubuntu-latest
    needs: lint
    strategy:
      matrix:
        node-version: [18, 20, 22]
      fail-fast: false
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - run: npm ci
      - run: npm test -- --coverage
      - name: Upload coverage
        if: matrix.node-version == 20
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: coverage/
 
  integration-test:
    runs-on: ubuntu-latest
    needs: lint
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      - name: Run integration tests
        run: npm run test:integration
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/testdb
 
  deploy:
    runs-on: ubuntu-latest
    needs: [unit-test, integration-test]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Vercel
        uses: amondnet/vercel-action@v25
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
          vercel-args: '--prod'

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  代码提交      │────▶│  CI 构建       │────▶│  测试执行      │
└──────────────┘     └──────────────┘     └──────┬───────┘
                                                  │
                                           ┌──────▼───────┐
                                           │  构建失败？     │
                                           └──────┬───────┘
                                                  │ 是
                                           ┌──────▼───────┐
                                           │  AI 分析日志    │
                                           │  分类根因       │
                                           └──────┬───────┘
                                                  │
                                    ┌─────────────┼─────────────┐
                                    │             │             │
                              ┌─────▼─────┐ ┌────▼────┐ ┌─────▼─────┐
                              │ 瞬态故障    │ │ 代码缺陷  │ │ 环境问题   │
                              │ 自动重试    │ │ 开 Issue │ │ 自动修复   │
                              └───────────┘ └─────────┘ └───────────┘

# .github/workflows/self-healing-ci.yml
name: Self-Healing CI
 
on:
  push:
    branches: [main]
 
jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
      - run: npm ci
      - run: npm test
        id: test
        continue-on-error: true
 
      # AI 驱动的故障分析
      - name: Analyze failure with AI
        if: steps.test.outcome == 'failure'
        uses: actions/github-script@v7
        with:
          script: |
            const { Octokit } = require('@octokit/rest');
 
            // 获取失败日志
            const logs = await github.rest.actions.downloadJobLogsForWorkflowRun({
              owner: context.repo.owner,
              repo: context.repo.repo,
              job_id: context.job
            });
 
            // 调用 AI 模型分析根因
            const response = await fetch('https://models.github.ai/chat/completions', {
              method: 'POST',
              headers: {
                'Authorization': `Bearer ${process.env.GITHUB_TOKEN}`,
                'Content-Type': 'application/json'
              },
              body: JSON.stringify({
                model: 'gpt-4o',
                messages: [{
                  role: 'system',
                  content: '你是 CI/CD 故障分析专家。分析构建日志，分类故障原因为：transient（瞬态）、code_bug（代码缺陷）、environment（环境问题）。提供修复建议。'
                }, {
                  role: 'user',
                  content: `分析以下构建失败日志：\n${logs.data.substring(0, 4000)}`
                }]
              })
            });
 
            const analysis = await response.json();
            const result = analysis.choices[0].message.content;
 
            // 根据分类采取行动
            if (result.includes('transient')) {
              // 瞬态故障：触发重试
              await github.rest.actions.reRunWorkflow({
                owner: context.repo.owner,
                repo: context.repo.repo,
                run_id: context.runId
              });
            } else {
              // 代码缺陷或环境问题：创建 Issue
              await github.rest.issues.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: `🤖 CI 故障自动分析: ${context.sha.substring(0, 7)}`,
                body: `## AI 故障分析报告\n\n${result}\n\n---\n*由 Self-Healing CI 自动生成*`,
                labels: ['ci-failure', 'ai-analysis']
              });
            }

# .github/workflows/reusable-test.yml
# 可复用的测试工作流模板
name: Reusable Test Workflow
 
on:
  workflow_call:
    inputs:
      node-version:
        description: 'Node.js 版本'
        required: false
        type: string
        default: '20'
      test-command:
        description: '测试命令'
        required: false
        type: string
        default: 'npm test'
      coverage-threshold:
        description: '覆盖率阈值'
        required: false
        type: number
        default: 80
      enable-integration-tests:
        description: '是否启用集成测试'
        required: false
        type: boolean
        default: false
    secrets:
      DATABASE_URL:
        required: false
      CODECOV_TOKEN:
        required: false
 
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: ${{ inputs.enable-integration-tests && 'postgres:16' || '' }}
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'
      - run: npm ci
      - name: Run tests
        run: ${{ inputs.test-command }}
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
      - name: Check coverage threshold
        run: |
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          if (( $(echo "$COVERAGE < ${{ inputs.coverage-threshold }}" | bc -l) )); then
            echo "❌ 覆盖率 ${COVERAGE}% 低于阈值 ${{ inputs.coverage-threshold }}%"
            exit 1
          fi
          echo "✅ 覆盖率 ${COVERAGE}% 达标"

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
 
jobs:
  unit-tests:
    uses: ./.github/workflows/reusable-test.yml
    with:
      node-version: '20'
      test-command: 'npm run test:unit -- --coverage'
      coverage-threshold: 85
 
  integration-tests:
    uses: ./.github/workflows/reusable-test.yml
    with:
      test-command: 'npm run test:integration'
      enable-integration-tests: true
    secrets:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}

# AI 生成的多维 Matrix 构建策略
jobs:
  test-matrix:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node-version: [18, 20, 22]
        database: [postgres, mysql, sqlite]
        exclude:
          # Windows 上跳过 PostgreSQL（配置复杂）
          - os: windows-latest
            database: postgres
          # Node 18 不测试 MySQL（兼容性已知）
          - node-version: 18
            database: mysql
        include:
          # 添加特定组合的额外配置
          - os: ubuntu-latest
            node-version: 20
            database: postgres
            coverage: true  # 仅此组合收集覆盖率
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - run: npm ci
      - name: Run tests
        run: npm test ${{ matrix.coverage && '-- --coverage' || '' }}
        env:
          DB_TYPE: ${{ matrix.database }}

# .github/workflows/security.yml
name: Security Scanning
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # 每周一早 6 点定期扫描
 
jobs:
  # SAST：静态应用安全测试
  sast:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript
          queries: security-extended
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:javascript-typescript"
 
  # 依赖漏洞扫描
  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
 
  # 密钥泄露检测
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Detect secrets with Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
  # 容器镜像扫描
  container-scan:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4
      - name: Build Docker image
        run: docker build -t app:${{ github.sha }} .
      - name: Run Trivy container scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:${{ github.sha }}'
          format: 'sarif'
          output: 'container-trivy.sarif'
          severity: 'CRITICAL,HIGH'
      - name: Upload container scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'container-trivy.sarif'
 
  # 安全门禁：所有扫描通过才允许合并
  security-gate:
    runs-on: ubuntu-latest
    needs: [sast, dependency-scan, secret-scan]
    steps:
      - name: Security gate passed
        run: echo "✅ 所有安全扫描通过"

# AI 生成的高性能缓存策略
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      # npm 依赖缓存
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
 
      # Turborepo 远程缓存（Monorepo 场景）
      - name: Turbo Cache
        uses: actions/cache@v4
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ hashFiles('**/turbo.json') }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ hashFiles('**/turbo.json') }}-
            turbo-${{ runner.os }}-
 
      # Docker 层缓存
      - name: Docker layer caching
        uses: actions/cache@v4
        with:
          path: /tmp/.buildx-cache
          key: docker-${{ runner.os }}-${{ hashFiles('**/Dockerfile') }}
          restore-keys: docker-${{ runner.os }}-
 
      # Playwright 浏览器缓存
      - name: Playwright cache
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
 
      - run: npm ci
      - run: npx turbo run build test lint --cache-dir=.turbo

# 使用 GitHub Environments 进行分级密钥管理
jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging
        run: |
          echo "部署到 staging 环境"
        env:
          # 从 staging 环境获取密钥
          API_KEY: ${{ secrets.API_KEY }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
 
  deploy-production:
    runs-on: ubuntu-latest
    needs: deploy-staging
    environment:
      name: production
      url: https://example.com
    # 生产环境需要审批
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to production
        run: |
          echo "部署到 production 环境"
        env:
          # 从 production 环境获取密钥（需要审批者批准）
          API_KEY: ${{ secrets.API_KEY }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}

┌─────────────────────────────────────────────────────────┐
│                GitLab Duo Agent Platform                  │
├─────────────────────────────────────────────────────────┤
│                                                          │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌─────────┐ │
│  │ 代码生成   │  │ 安全扫描   │  │ 测试生成   │  │ 根因分析 │ │
│  │ Agent     │  │ Agent     │  │ Agent     │  │ Agent   │ │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬────┘ │
│       │              │              │              │      │
│  ┌────▼──────────────▼──────────────▼──────────────▼────┐│
│  │              共享项目上下文（Git + CI + Issues）         ││
│  └──────────────────────────────────────────────────────┘│
│                                                          │
│  特点：                                                   │
│  • 异步协作：多个 AI Agent 并行处理不同 SDLC 阶段           │
│  • 全上下文：Agent 可访问代码、CI 日志、Issue、MR 等全部数据  │
│  • 安全治理：企业级数据隐私，不使用客户代码训练模型            │
│  • 可扩展：支持 5-100 个专业化 Agent 同时工作               │
│                                                          │
└─────────────────────────────────────────────────────────┘

Duo Chat 提示：
"为一个 Python Django 项目生成 .gitlab-ci.yml，要求：
1. 使用 stages: lint, test, security, build, deploy
2. lint 阶段运行 ruff 和 mypy
3. test 阶段使用 pytest，需要 PostgreSQL 服务
4. security 阶段运行 SAST 和依赖扫描
5. build 阶段构建 Docker 镜像并推送到 GitLab Container Registry
6. deploy 阶段分 staging 和 production，production 需要手动审批
7. 使用 GitLab CI 缓存优化 pip 安装"

# .gitlab-ci.yml
# Django 项目 CI/CD 管线
 
variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  POSTGRES_DB: testdb
  POSTGRES_USER: test
  POSTGRES_PASSWORD: test
  DOCKER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
 
stages:
  - lint
  - test
  - security
  - build
  - deploy
 
# 全局缓存配置
default:
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .cache/pip
      - .venv/
 
# ==================== Lint 阶段 ====================
 
ruff-lint:
  stage: lint
  image: python:3.12-slim
  before_script:
    - pip install ruff
  script:
    - ruff check .
    - ruff format --check .
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 
mypy-check:
  stage: lint
  image: python:3.12-slim
  before_script:
    - pip install -r requirements.txt
    - pip install mypy
  script:
    - mypy src/ --ignore-missing-imports
  allow_failure: true  # 类型检查暂不阻塞管线
 
# ==================== Test 阶段 ====================
 
pytest:
  stage: test
  image: python:3.12-slim
  services:
    - postgres:16
  variables:
    DATABASE_URL: "postgresql://test:test@postgres:5432/testdb"
  before_script:
    - pip install -r requirements.txt
    - pip install pytest pytest-cov pytest-django
  script:
    - pytest --cov=src --cov-report=xml --cov-report=html --junitxml=report.xml
  coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
  artifacts:
    when: always
    reports:
      junit: report.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
    paths:
      - htmlcov/
    expire_in: 7 days
 
# ==================== Security 阶段 ====================
 
include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
 
sast:
  stage: security
 
dependency_scanning:
  stage: security
 
secret_detection:
  stage: security
 
# ==================== Build 阶段 ====================
 
docker-build:
  stage: build
  image: docker:24
  services:
    - docker:24-dind
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build
        --cache-from $CI_REGISTRY_IMAGE:latest
        --tag $DOCKER_IMAGE
        --tag $CI_REGISTRY_IMAGE:latest
        .
    - docker push $DOCKER_IMAGE
    - docker push $CI_REGISTRY_IMAGE:latest
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 
# ==================== Deploy 阶段 ====================
 
deploy-staging:
  stage: deploy
  image: alpine:latest
  environment:
    name: staging
    url: https://staging.example.com
  before_script:
    - apk add --no-cache curl
  script:
    - echo "部署 $DOCKER_IMAGE 到 staging"
    # 使用 kubectl 或云平台 CLI 部署
    - |
      curl -X POST "$DEPLOY_WEBHOOK_STAGING" \
        -H "Content-Type: application/json" \
        -d "{\"image\": \"$DOCKER_IMAGE\", \"env\": \"staging\"}"
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 
deploy-production:
  stage: deploy
  image: alpine:latest
  environment:
    name: production
    url: https://example.com
  before_script:
    - apk add --no-cache curl
  script:
    - echo "部署 $DOCKER_IMAGE 到 production"
    - |
      curl -X POST "$DEPLOY_WEBHOOK_PRODUCTION" \
        -H "Content-Type: application/json" \
        -d "{\"image\": \"$DOCKER_IMAGE\", \"env\": \"production\"}"
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual  # 生产部署需要手动审批
  needs:
    - deploy-staging

# 启用 Auto DevOps（最简配置）
# 在项目设置中启用，或在 .gitlab-ci.yml 中引用
 
include:
  - template: Auto-DevOps.gitlab-ci.yml
 
# Auto DevOps 自动提供：
# ✅ 自动构建（Auto Build）：检测语言，构建 Docker 镜像
# ✅ 自动测试（Auto Test）：运行语言对应的测试框架
# ✅ 自动代码质量（Auto Code Quality）：Code Climate 分析
# ✅ 自动 SAST（Auto SAST）：静态安全扫描
# ✅ 自动依赖扫描（Auto Dependency Scanning）
# ✅ 自动容器扫描（Auto Container Scanning）
# ✅ 自动 Review Apps（Auto Review Apps）：PR 预览环境
# ✅ 自动部署（Auto Deploy）：部署到 Kubernetes
# ✅ 自动监控（Auto Monitoring）：Prometheus 指标
 
# 自定义 Auto DevOps 变量
variables:
  # 自定义构建参数
  AUTO_DEVOPS_BUILD_IMAGE_EXTRA_ARGS: "--build-arg NODE_ENV=production"
  # 部署到指定 K8s 命名空间
  KUBE_NAMESPACE: my-app-production
  # 自定义 Helm values
  HELM_UPGRADE_EXTRA_ARGS: "--set replicas=3 --set resources.limits.memory=512Mi"
  # 启用增量部署
  INCREMENTAL_ROLLOUT_MODE: timed
  INCREMENTAL_ROLLOUT_ENABLED: "true"

# 父管线：根据变更文件动态触发子管线
stages:
  - detect
  - trigger
 
detect-changes:
  stage: detect
  script:
    - |
      # 检测变更的服务
      CHANGED_SERVICES=""
      if git diff --name-only HEAD~1 | grep -q "^services/api/"; then
        CHANGED_SERVICES="$CHANGED_SERVICES api"
      fi
      if git diff --name-only HEAD~1 | grep -q "^services/web/"; then
        CHANGED_SERVICES="$CHANGED_SERVICES web"
      fi
      if git diff --name-only HEAD~1 | grep -q "^services/worker/"; then
        CHANGED_SERVICES="$CHANGED_SERVICES worker"
      fi
      echo "CHANGED_SERVICES=$CHANGED_SERVICES" >> detect.env
  artifacts:
    reports:
      dotenv: detect.env
 
trigger-api:
  stage: trigger
  needs: [detect-changes]
  trigger:
    include: services/api/.gitlab-ci.yml
    strategy: depend
  rules:
    - if: $CHANGED_SERVICES =~ /api/
 
trigger-web:
  stage: trigger
  needs: [detect-changes]
  trigger:
    include: services/web/.gitlab-ci.yml
    strategy: depend
  rules:
    - if: $CHANGED_SERVICES =~ /web/
 
trigger-worker:
  stage: trigger
  needs: [detect-changes]
  trigger:
    include: services/worker/.gitlab-ci.yml
    strategy: depend
  rules:
    - if: $CHANGED_SERVICES =~ /worker/

# .circleci/config.yml
version: 2.1
 
# 使用 Orbs 简化配置（CircleCI 的可复用配置包）
orbs:
  node: circleci/node@6.1
  docker: circleci/docker@2.7
  snyk: snyk/snyk@2.2
  codecov: codecov/codecov@4.1
 
# 自定义参数
parameters:
  run-security-scan:
    type: boolean
    default: true
  deploy-target:
    type: enum
    enum: ["staging", "production", "none"]
    default: "none"
 
# 执行器定义
executors:
  node-executor:
    docker:
      - image: cimg/node:20.18
    resource_class: medium
  node-with-db:
    docker:
      - image: cimg/node:20.18
      - image: cimg/postgres:16.4
        environment:
          POSTGRES_USER: test
          POSTGRES_DB: testdb
          POSTGRES_PASSWORD: test
    resource_class: medium+
 
# 自定义命令
commands:
  install-deps:
    description: "安装依赖并使用缓存"
    steps:
      - checkout
      - node/install-packages:
          pkg-manager: npm
          cache-path: node_modules
          cache-version: v2
 
  run-tests:
    description: "运行测试并收集结果"
    parameters:
      test-type:
        type: string
        default: "unit"
    steps:
      - run:
          name: Run << parameters.test-type >> tests
          command: npm run test:<< parameters.test-type >> -- --ci --coverage
      - store_test_results:
          path: test-results
      - store_artifacts:
          path: coverage
 
# ==================== 工作流定义 ====================
 
workflows:
  ci-cd:
    jobs:
      # Lint 检查
      - lint:
          filters:
            branches:
              ignore: /dependabot\/.*/
 
      # 单元测试（Matrix 策略）
      - unit-test:
          requires: [lint]
          matrix:
            parameters:
              node-version: ["18.20", "20.18", "22.11"]
 
      # 集成测试
      - integration-test:
          requires: [lint]
 
      # 安全扫描
      - security-scan:
          requires: [lint]
          filters:
            branches:
              only: [main, develop]
 
      # 构建 Docker 镜像
      - docker-build:
          requires: [unit-test, integration-test]
          filters:
            branches:
              only: main
 
      # 部署到 staging
      - deploy-staging:
          requires: [docker-build, security-scan]
          filters:
            branches:
              only: main
 
      # 部署到 production（需要审批）
      - hold-for-approval:
          type: approval
          requires: [deploy-staging]
      - deploy-production:
          requires: [hold-for-approval]
 
# ==================== Job 定义 ====================
 
jobs:
  lint:
    executor: node-executor
    steps:
      - install-deps
      - run:
          name: ESLint
          command: npm run lint
      - run:
          name: Type Check
          command: npm run type-check
      - run:
          name: Format Check
          command: npx prettier --check .
 
  unit-test:
    parameters:
      node-version:
        type: string
    docker:
      - image: cimg/node:<< parameters.node-version >>
    steps:
      - install-deps
      - run-tests:
          test-type: unit
      - codecov/upload:
          file: coverage/lcov.info
 
  integration-test:
    executor: node-with-db
    steps:
      - install-deps
      - run:
          name: Wait for DB
          command: dockerize -wait tcp://localhost:5432 -timeout 30s
      - run-tests:
          test-type: integration
 
  security-scan:
    executor: node-executor
    steps:
      - install-deps
      - snyk/scan:
          severity-threshold: high
          fail-on-issues: true
 
  docker-build:
    executor: docker/docker
    steps:
      - setup_remote_docker:
          version: "24.0"
          docker_layer_caching: true
      - checkout
      - docker/build:
          image: myorg/myapp
          tag: $CIRCLE_SHA1,latest
      - docker/push:
          image: myorg/myapp
          tag: $CIRCLE_SHA1,latest
 
  deploy-staging:
    executor: node-executor
    steps:
      - checkout
      - run:
          name: Deploy to Staging
          command: |
            echo "Deploying $CIRCLE_SHA1 to staging..."
            # 使用 kubectl 或云平台 CLI
            kubectl set image deployment/myapp \
              myapp=myorg/myapp:$CIRCLE_SHA1 \
              --namespace=staging
 
  deploy-production:
    executor: node-executor
    steps:
      - checkout
      - run:
          name: Deploy to Production
          command: |
            echo "Deploying $CIRCLE_SHA1 to production..."
            kubectl set image deployment/myapp \
              myapp=myorg/myapp:$CIRCLE_SHA1 \
              --namespace=production
      - run:
          name: Verify Deployment
          command: |
            kubectl rollout status deployment/myapp \
              --namespace=production --timeout=300s

AI 助手（通过 MCP）可以访问：
├── 最近的提交信息和变更文件列表
├── 当前构建状态和日志
├── 测试结果和失败详情
├── 构建时间趋势和性能指标
└── 配置文件和 Orb 依赖

典型交互场景：
1. "为什么最近的构建失败了？" → AI 分析日志，定位根因
2. "如何优化这个管线的构建时间？" → AI 分析瓶颈，建议并行化
3. "帮我添加安全扫描步骤" → AI 基于当前配置生成兼容的扫描步骤

# AI 推荐的常用 Orbs 组合
orbs:
  # 语言/框架
  node: circleci/node@6.1          # Node.js 项目
  python: circleci/python@2.1      # Python 项目
  rust: circleci/rust@1.6          # Rust 项目
  go: circleci/go@1.11             # Go 项目
 
  # 容器化
  docker: circleci/docker@2.7      # Docker 构建和推送
  aws-ecr: circleci/aws-ecr@9.3   # AWS ECR 推送
 
  # 部署
  aws-eks: circleci/aws-eks@2.2    # AWS EKS 部署
  kubernetes: circleci/kubernetes@1.3  # K8s 通用部署
  heroku: circleci/heroku@2.0      # Heroku 部署
 
  # 安全
  snyk: snyk/snyk@2.2              # Snyk 漏洞扫描
  anchore: anchore/anchore-engine@1.9  # 容器安全扫描
 
  # 质量
  codecov: codecov/codecov@4.1     # 代码覆盖率
  sonarcloud: sonarsource/sonarcloud@2.0  # SonarCloud 分析
 
  # 通知
  slack: circleci/slack@4.13       # Slack 通知
  jira: circleci/jira@2.1          # Jira 集成

提示词：
"为一个 Java Spring Boot 微服务项目生成 Jenkinsfile，要求：
1. 使用声明式管线语法
2. 包含 Build、Test、SonarQube、Docker Build、Deploy 阶段
3. 使用并行阶段加速测试（单元测试和集成测试并行）
4. 集成 SonarQube 质量门禁
5. Docker 镜像推送到 Harbor
6. 部署到 Kubernetes（staging 自动，production 手动审批）
7. 包含失败通知（Slack）和清理步骤"

// Jenkinsfile
pipeline {
    agent any
 
    environment {
        DOCKER_REGISTRY = 'harbor.example.com'
        DOCKER_IMAGE = "${DOCKER_REGISTRY}/myorg/myapp"
        SONAR_HOST = 'https://sonar.example.com'
        KUBE_NAMESPACE_STAGING = 'staging'
        KUBE_NAMESPACE_PROD = 'production'
    }
 
    options {
        timeout(time: 30, unit: 'MINUTES')
        disableConcurrentBuilds()
        buildDiscarder(logRotator(numToKeepStr: '10'))
    }
 
    stages {
        stage('Build') {
            steps {
                sh './gradlew clean build -x test'
            }
        }
 
        stage('Test') {
            parallel {
                stage('Unit Tests') {
                    steps {
                        sh './gradlew test'
                    }
                    post {
                        always {
                            junit 'build/test-results/test/*.xml'
                            jacoco(
                                execPattern: 'build/jacoco/test.exec',
                                classPattern: 'build/classes',
                                sourcePattern: 'src/main/java'
                            )
                        }
                    }
                }
                stage('Integration Tests') {
                    steps {
                        sh './gradlew integrationTest'
                    }
                    post {
                        always {
                            junit 'build/test-results/integrationTest/*.xml'
                        }
                    }
                }
            }
        }
 
        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv('SonarQube') {
                    sh './gradlew sonarqube'
                }
            }
        }
 
        stage('Quality Gate') {
            steps {
                timeout(time: 5, unit: 'MINUTES') {
                    waitForQualityGate abortPipeline: true
                }
            }
        }
 
        stage('Docker Build & Push') {
            when {
                branch 'main'
            }
            steps {
                script {
                    def imageTag = "${DOCKER_IMAGE}:${env.BUILD_NUMBER}"
                    docker.withRegistry("https://${DOCKER_REGISTRY}", 'harbor-credentials') {
                        def image = docker.build(imageTag, '--no-cache .')
                        image.push()
                        image.push('latest')
                    }
                }
            }
        }
 
        stage('Deploy Staging') {
            when {
                branch 'main'
            }
            steps {
                withKubeConfig([credentialsId: 'k8s-staging']) {
                    sh """
                        kubectl set image deployment/myapp \
                            myapp=${DOCKER_IMAGE}:${env.BUILD_NUMBER} \
                            --namespace=${KUBE_NAMESPACE_STAGING}
                        kubectl rollout status deployment/myapp \
                            --namespace=${KUBE_NAMESPACE_STAGING} \
                            --timeout=300s
                    """
                }
            }
        }
 
        stage('Deploy Production') {
            when {
                branch 'main'
            }
            input {
                message '确认部署到生产环境？'
                ok '部署'
                submitter 'admin,devops-team'
            }
            steps {
                withKubeConfig([credentialsId: 'k8s-production']) {
                    sh """
                        kubectl set image deployment/myapp \
                            myapp=${DOCKER_IMAGE}:${env.BUILD_NUMBER} \
                            --namespace=${KUBE_NAMESPACE_PROD}
                        kubectl rollout status deployment/myapp \
                            --namespace=${KUBE_NAMESPACE_PROD} \
                            --timeout=300s
                    """
                }
            }
        }
    }
 
    post {
        failure {
            slackSend(
                channel: '#ci-alerts',
                color: 'danger',
                message: "❌ 构建失败: ${env.JOB_NAME} #${env.BUILD_NUMBER}\n${env.BUILD_URL}"
            )
        }
        success {
            slackSend(
                channel: '#ci-notifications',
                color: 'good',
                message: "✅ 构建成功: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
            )
        }
        always {
            cleanWs()
        }
    }
}

# azure-pipelines.yml
# AI 生成的 .NET 项目 CI/CD 管线
 
trigger:
  branches:
    include:
      - main
      - develop
  paths:
    exclude:
      - '**/*.md'
      - 'docs/**'
 
pr:
  branches:
    include:
      - main
 
pool:
  vmImage: 'ubuntu-latest'
 
variables:
  buildConfiguration: 'Release'
  dotnetVersion: '8.0.x'
  dockerRegistry: 'myacr.azurecr.io'
  imageName: 'myapp'
 
stages:
  # ==================== Build & Test ====================
  - stage: Build
    displayName: 'Build & Test'
    jobs:
      - job: BuildAndTest
        displayName: 'Build, Test & Analyze'
        steps:
          - task: UseDotNet@2
            displayName: 'Install .NET SDK'
            inputs:
              packageType: 'sdk'
              version: $(dotnetVersion)
 
          - task: DotNetCoreCLI@2
            displayName: 'Restore packages'
            inputs:
              command: 'restore'
              projects: '**/*.csproj'
 
          - task: DotNetCoreCLI@2
            displayName: 'Build'
            inputs:
              command: 'build'
              projects: '**/*.csproj'
              arguments: '--configuration $(buildConfiguration) --no-restore'
 
          - task: DotNetCoreCLI@2
            displayName: 'Run tests'
            inputs:
              command: 'test'
              projects: '**/*Tests.csproj'
              arguments: '--configuration $(buildConfiguration) --collect:"XPlat Code Coverage" --results-directory $(Agent.TempDirectory)/TestResults'
 
          - task: PublishCodeCoverageResults@2
            displayName: 'Publish coverage'
            inputs:
              summaryFileLocation: '$(Agent.TempDirectory)/TestResults/**/coverage.cobertura.xml'
 
  # ==================== Security ====================
  - stage: Security
    displayName: 'Security Scanning'
    dependsOn: Build
    jobs:
      - job: SecurityScan
        steps:
          - task: CredScan@3
            displayName: 'Credential Scan'
 
          - task: ComponentGovernanceComponentDetection@0
            displayName: 'Dependency Scan'
 
          - task: PublishSecurityAnalysisLogs@3
            displayName: 'Publish Security Results'
 
  # ==================== Docker Build ====================
  - stage: DockerBuild
    displayName: 'Build & Push Docker Image'
    dependsOn: [Build, Security]
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - job: DockerBuildPush
        steps:
          - task: Docker@2
            displayName: 'Build and push'
            inputs:
              containerRegistry: 'AzureContainerRegistry'
              repository: $(imageName)
              command: 'buildAndPush'
              Dockerfile: '**/Dockerfile'
              tags: |
                $(Build.BuildId)
                latest
 
  # ==================== Deploy Staging ====================
  - stage: DeployStaging
    displayName: 'Deploy to Staging'
    dependsOn: DockerBuild
    jobs:
      - deployment: DeployStaging
        displayName: 'Deploy to Staging'
        environment: 'staging'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureWebAppContainer@1
                  displayName: 'Deploy to Azure Web App'
                  inputs:
                    azureSubscription: 'AzureServiceConnection'
                    appName: 'myapp-staging'
                    containers: '$(dockerRegistry)/$(imageName):$(Build.BuildId)'
 
  # ==================== Deploy Production ====================
  - stage: DeployProduction
    displayName: 'Deploy to Production'
    dependsOn: DeployStaging
    condition: succeeded()
    jobs:
      - deployment: DeployProduction
        displayName: 'Deploy to Production'
        environment: 'production'  # 在 Azure DevOps 中配置审批门禁
        strategy:
          canary:
            increments: [10, 50]
            deploy:
              steps:
                - task: AzureWebAppContainer@1
                  inputs:
                    azureSubscription: 'AzureServiceConnection'
                    appName: 'myapp-production'
                    containers: '$(dockerRegistry)/$(imageName):$(Build.BuildId)'
            on:
              failure:
                steps:
                  - script: echo "金丝雀部署失败，自动回滚"
              success:
                steps:
                  - script: echo "金丝雀部署成功，完成全量发布"

代码提交 ──▶ SAST ──▶ SCA ──▶ 密钥检测 ──▶ 构建 ──▶ 容器扫描 ──▶ DAST ──▶ 部署
              │        │        │                      │           │
              ▼        ▼        ▼                      ▼           ▼
           代码漏洞  依赖漏洞  泄露密钥              镜像漏洞    运行时漏洞
              │        │        │                      │           │
              └────────┴────────┴──────────────────────┴───────────┘
                                        │
                                   安全仪表板
                                   统一告警

# .github/workflows/security-full.yml
name: Full Security Scan
 
on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 2 * * 1'  # 每周一凌晨 2 点
 
jobs:
  sast-semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@v4
      - run: semgrep scan --config auto --sarif --output semgrep.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif
 
  sca-snyk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high
 
  dast-zap:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: 'https://staging.example.com'
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a'

# GitLab 内置安全扫描模板（一行启用）
include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/DAST.gitlab-ci.yml
 
# 自定义 DAST 目标
dast:
  variables:
    DAST_WEBSITE: https://staging.example.com
    DAST_FULL_SCAN_ENABLED: "true"

# CircleCI 安全扫描配置
orbs:
  snyk: snyk/snyk@2.2
 
jobs:
  security:
    docker:
      - image: cimg/node:20.18
    steps:
      - checkout
      - run: npm ci
      - snyk/scan:
          severity-threshold: high
          fail-on-issues: true
          monitor-on-build: true
      - run:
          name: Trivy filesystem scan
          command: |
            curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
            trivy fs --severity HIGH,CRITICAL --exit-code 1 .

你是一位资深 DevOps 工程师，精通 [GitHub Actions / GitLab CI / CircleCI] 配置。

请为以下项目生成完整的 CI/CD 管线配置：

项目信息：
- 语言/框架：[例如：Node.js + TypeScript + Next.js]
- 包管理器：[npm / yarn / pnpm]
- 测试框架：[Jest / Vitest / Pytest / Go testing]
- 数据库：[PostgreSQL / MySQL / MongoDB / 无]
- 部署目标：[Vercel / AWS ECS / Kubernetes / Railway]
- 代码仓库：[Monorepo / 单仓库]

要求：
1. 包含以下阶段：lint → test → security → build → deploy
2. 测试阶段使用 matrix 策略覆盖 [指定版本]
3. 集成安全扫描（SAST + 依赖扫描 + 密钥检测）
4. 使用缓存优化构建速度
5. staging 自动部署，production 需要手动审批
6. 包含失败通知（[Slack / Email / Teams]）
7. 遵循最小权限原则管理密钥

请提供完整的 YAML 配置文件，并在关键步骤添加中文注释说明。

分析以下 CI/CD 管线配置，找出性能瓶颈和优化机会：

```yaml
[粘贴现有管线配置]

### 8.3 管线故障诊断

[粘贴错误日志]

[粘贴相关配置片段]

### 8.4 安全扫描集成

### 8.5 Monorepo CI/CD 配置

[项目根目录]/
├── apps/
│   ├── web/          # Next.js 前端
│   ├── api/          # Express 后端
│   └── admin/        # React Admin 面板
├── packages/
│   ├── ui/           # 共享 UI 组件库
│   ├── utils/        # 共享工具函数
│   └── types/        # 共享类型定义
├── turbo.json
└── package.json

### 8.6 管线迁移

[粘贴源平台配置]

---

## 9. 实战案例：全栈 SaaS 项目 CI/CD 管线

### 案例背景

一个全栈 SaaS 项目，技术栈为 Next.js + tRPC + Prisma + PostgreSQL，使用 GitHub Actions 构建完整的 CI/CD 管线。

### 完整管线配置

```yaml
# .github/workflows/ci-cd.yml
name: SaaS CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '20'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

permissions:
  contents: read
  packages: write
  security-events: write
  pull-requests: write

jobs:
  # ==================== 变更检测 ====================
  changes:
    runs-on: ubuntu-latest
    outputs:
      app: ${{ steps.filter.outputs.app }}
      db: ${{ steps.filter.outputs.db }}
      infra: ${{ steps.filter.outputs.infra }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            app:
              - 'src/**'
              - 'package.json'
              - 'tsconfig.json'
            db:
              - 'prisma/**'
            infra:
              - 'Dockerfile'
              - 'docker-compose*.yml'
              - '.github/workflows/**'

  # ==================== 代码质量 ====================
  quality:
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.app == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci

      - name: ESLint
        run: npm run lint -- --format @microsoft/eslint-formatter-sarif --output-file eslint-results.sarif
        continue-on-error: true
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: eslint-results.sarif
          wait-for-processing: true

      - name: Type Check
        run: npm run type-check

      - name: Format Check
        run: npx prettier --check .

  # ==================== 单元测试 ====================
  unit-test:
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.app == 'true'
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - name: Run unit tests (shard ${{ matrix.shard }}/4)
        run: npx vitest run --coverage --shard=${{ matrix.shard }}/4
      - uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.shard }}
          path: coverage/

  # ==================== 集成测试 ====================
  integration-test:
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.app == 'true' || needs.changes.outputs.db == 'true'
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: saas_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7
        ports:
          - 6379:6379
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - name: Run database migrations
        run: npx prisma migrate deploy
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/saas_test
      - name: Run integration tests
        run: npm run test:integration
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/saas_test
          REDIS_URL: redis://localhost:6379

  # ==================== E2E 测试 ====================
  e2e-test:
    runs-on: ubuntu-latest
    needs: [quality, unit-test]
    if: github.event_name == 'pull_request'
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: saas_e2e
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - name: Install Playwright
        run: npx playwright install --with-deps chromium
      - name: Setup database
        run: npx prisma migrate deploy
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/saas_e2e
      - name: Build application
        run: npm run build
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/saas_e2e
      - name: Run E2E tests
        run: npx playwright test
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/saas_e2e
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: playwright-report
          path: playwright-report/

  # ==================== 安全扫描 ====================
  security:
    runs-on: ubuntu-latest
    needs: changes
    steps:
      - uses: actions/checkout@v4
      - name: CodeQL Analysis
        uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript
      - uses: github/codeql-action/analyze@v3
      - name: Dependency audit
        run: npm audit --audit-level=high
        continue-on-error: true
      - name: Secret detection
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ==================== 数据库迁移检查 ====================
  db-migration-check:
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.db == 'true'
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: migration_test
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - name: Test migration forward
        run: npx prisma migrate deploy
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/migration_test
      - name: Validate schema
        run: npx prisma validate
      - name: Check for drift
        run: npx prisma migrate diff --from-migrations ./prisma/migrations --to-schema-datamodel ./prisma/schema.prisma --exit-code

  # ==================== 构建 Docker 镜像 ====================
  docker-build:
    runs-on: ubuntu-latest
    needs: [unit-test, integration-test, security]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ==================== 部署 Staging ====================
  deploy-staging:
    runs-on: ubuntu-latest
    needs: docker-build
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging
        run: |
          echo "Deploying ${{ github.sha }} to staging..."
          # 实际部署命令（kubectl / fly deploy / railway up 等）

  # ==================== 部署 Production ====================
  deploy-production:
    runs-on: ubuntu-latest
    needs: deploy-staging
    environment:
      name: production
      url: https://example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to production
        run: |
          echo "Deploying ${{ github.sha }} to production..."
          # 实际部署命令

  # ==================== 部署后验证 ====================
  post-deploy-verify:
    runs-on: ubuntu-latest
    needs: deploy-production
    steps:
      - name: Health check
        run: |
          for i in {1..10}; do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://example.com/api/health)
            if [ "$STATUS" = "200" ]; then
              echo "✅ 健康检查通过"
              exit 0
            fi
            echo "等待服务就绪... ($i/10)"
            sleep 10
          done
          echo "❌ 健康检查失败"
          exit 1
      - name: Smoke test
        run: |
          # 基本功能验证
          curl -f https://example.com/ || exit 1
          curl -f https://example.com/api/health || exit 1
          echo "✅ 冒烟测试通过"

## CI/CD 迁移检查清单
 
### 准备阶段
- [ ] 列出所有现有管线和工作流
- [ ] 记录所有密钥和环境变量
- [ ] 记录所有外部服务集成（通知、部署目标等）
- [ ] 确认目标平台的功能等价性
- [ ] 评估迁移风险和回滚计划
 
### 配置迁移
- [ ] 转换管线配置语法
- [ ] 迁移密钥和环境变量
- [ ] 配置缓存策略
- [ ] 配置制品存储
- [ ] 配置并行和矩阵策略
- [ ] 配置审批门禁和环境保护
 
### 安全迁移
- [ ] 迁移安全扫描配置
- [ ] 验证密钥不在配置中硬编码
- [ ] 配置最小权限原则
- [ ] 设置分支保护规则
 
### 验证阶段
- [ ] 在非生产分支测试新管线
- [ ] 对比新旧管线的构建结果
- [ ] 验证部署流程正确
- [ ] 验证通知和集成正常
- [ ] 性能基准对比（构建时间、资源使用）
 
### 切换阶段
- [ ] 通知团队迁移计划
- [ ] 并行运行新旧管线一段时间
- [ ] 确认新管线稳定后停用旧管线
- [ ] 更新文档和团队培训

# 优化前：串行执行，无缓存（约 15 分钟）
# jobs:
#   build:
#     steps:
#       - checkout
#       - run: npm install        # 3 分钟
#       - run: npm run lint       # 2 分钟
#       - run: npm test           # 5 分钟
#       - run: npm run build      # 3 分钟
#       - run: docker build       # 2 分钟
 
# 优化后：并行执行 + 缓存（约 5 分钟）
jobs:
  lint:                           # 1 分钟（缓存后）
    steps:
      - checkout
      - setup-node (with cache)   # 缓存命中：10 秒
      - run: npm ci               # 缓存命中：15 秒
      - run: npm run lint
 
  test:                           # 2 分钟（4 分片并行）
    strategy:
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - checkout
      - setup-node (with cache)
      - run: npm ci
      - run: npx vitest --shard=${{ matrix.shard }}/4
 
  build:                          # 2 分钟（Docker 层缓存）
    needs: [lint, test]           # lint 和 test 并行
    steps:
      - checkout
      - docker/build (with layer cache)
 
# 总时间：max(lint, test) + build = max(1, 2) + 2 = 4 分钟
# 优化效果：15 分钟 → 4 分钟（减少 73%）