From 929a2df9a45b156dfd2b2ad8c201c2b318244bf9 Mon Sep 17 00:00:00 2001 From: Wenruli Date: Wed, 20 May 2026 16:11:17 +0800 Subject: [PATCH] fix: update ci and nginx configs --- .drone.yml | 506 ++++++------------ docker/nginx/conf.d/default.conf | 4 +- docker/nginx/conf.d/websocket.conf | 4 +- .../versions/v2_5_0_f005_role_menu_quota.py | 3 +- 4 files changed, 170 insertions(+), 347 deletions(-) diff --git a/.drone.yml b/.drone.yml index ad475e6f8..ce9564d3f 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1,348 +1,185 @@ -kind: pipeline # 定义对象类型，还有secret和signature两种类型 -type: docker # 定义流水线类型，还有kubernetes、exec、ssh等类型 -name: cicd # 定义流水线名称 +kind: pipeline +type: docker +name: bisheng_deploy -clone: - disable: true - -steps: # 定义流水线执行步骤，这些步骤将顺序执行 - - name: clone - image: alpine/git - pull: if-not-exists - environment: - http_proxy: - from_secret: PROXY - https_proxy: - from_secret: PROXY - commands: - - git config --global core.compression 0 - - git clone https://github.com/dataelement/bisheng.git . - - git checkout $DRONE_COMMIT - - - name: set poetry - pull: if-not-exists - image: golang - environment: - RELEASE_VERSION: 99.99.99 - NEXUS_PUBLIC: - from_secret: NEXUS_PUBLIC - NEXUS_PUBLIC_PASSWORD: - from_secret: NEXUS_PUBLIC_PASSWORD - REPO: - from_secret: PY_NEXUS - PROXY: - from_secret: APT-GET - volumes: # 将容器内目录挂载到宿主机，仓库需要开启Trusted设置 - - name: bisheng-cache - path: /app/build/ - commands: - - cd ./src/backend - - echo $REPO - - REPO2=$(echo $REPO | sed 's/http:\\/\\///g') - - sed '/apt-get/ s|$| '"$PROXY"'|' Dockerfile - - sed -i.bak 's/uv cache clean.*$/ /' Dockerfile - - sed -i '6i\RUN pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - sed -i '7i\ENV UV_PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - sed -i '8i\ENV UV_DEFAULT_INDEX=https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - sed -i '9i\ENV PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - cat Dockerfile - - - name: build_docker - pull: if-not-exists - image: docker:24.0.6 - privileged: true - volumes: # 将容器内目录挂载到宿主机，仓库需要开启Trusted设置 - - name: apt-cache - path: /var/cache/apt/archives # 将应用打包好的Jar和执行脚本挂载出来 - - name: socket - path: /var/run/docker.sock - - name: pro-cache - path: /root/.local/share/pypoetry - - name: uv-cache - path: /root/.cache/uv - environment: - http_proxy: - from_secret: PROXY - https_proxy: - from_secret: PROXY - no_proxy: 192.168.106.8 - version: release - docker_registry: http://192.168.106.8:6082 - docker_repo: 192.168.106.8:6082/dataelement/bisheng-backend - docker_user: - from_secret: NEXUS_USER - docker_password: - from_secret: NEXUS_PASSWORD - commands: - - cd ./src/backend/ - - docker login -u $docker_user -p $docker_password $docker_registry - - docker build -t $docker_repo:$version . - - docker push $docker_repo:$version - - - name: build_docker_frontend - pull: if-not-exists - image: docker:24.0.6 - privileged: true - volumes: # 将容器内目录挂载到宿主机，仓库需要开启Trusted设置 - - name: apt-cache - path: /var/cache/apt/archives # 将应用打包好的Jar和执行脚本挂载出来 - - name: socket - path: /var/run/docker.sock - environment: - http_proxy: - from_secret: PROXY - https_proxy: - from_secret: PROXY - no_proxy: 192.168.106.8 - version: release - docker_registry: http://192.168.106.8:6082 - docker_repo: 192.168.106.8:6082/dataelement/bisheng-frontend - docker_user: - from_secret: NEXUS_USER - docker_password: - from_secret: NEXUS_PASSWORD - commands: - - cd ./src/frontend/ - - docker login -u $docker_user -p $docker_password $docker_registry - - docker build -t $docker_repo:$version . - - docker push $docker_repo:$version - - - name: ssh deploy - image: appleboy/drone-ssh - pull: if-not-exists - settings: - host: 192.168.106.116 - username: root - password: - from_secret: sshpwd - script: - - echo =======找到目录======= - - cd /opt/server/bisheng-test - - echo =======直接启动======= - - docker compose pull - - docker compose up -d - - - name: notify-start # notify - pull: if-not-exists - image: plugins/webhook - settings: - debug: true - urls: - from_secret: FEISHU_URL - content_type: application/json - template: | - { - "msg_type": "interactive", - "card": { - "type": "template", - "data": { - "template_id": "AAqkI9bnY5FUs", - "template_variable": { - "repo_name": "{{ repo.name }}", - "build_branch": "{{build.branch}}", - "build_author": "{{ DRONE_COMMIT_AUTHOR }}", - "link": "{{build.link}}", - "commit_msg": "{{ trim build.message }}", - "build_tag":"{{build.tag}}", - "build_start":"{{build.started}}", - "status": "{{ build.status }}" - } - } - } - } - when: # 成功 - status: - - success trigger: branch: - - release + - feat/2.5.0-sg event: - - push - -volumes: -- name: bisheng-cache - host: - path: /opt/drone/data/bisheng/ -- name: pro-cache - host: - path: /opt/drone/data/pro/ -- name: apt-cache - host: - path: /opt/drone/data/bisheng/apt/ -- name: socket - host: - path: /var/run/docker.sock - - ---- - -kind: pipeline # 定义对象类型，还有secret和signature两种类型 -type: docker # 定义流水线类型，还有kubernetes、exec、ssh等类型 -name: feat_cicd # 定义流水线名称 + - push clone: - disable: true + depth: 1 -steps: # 定义流水线执行步骤，这些步骤将顺序执行 - - name: clone - image: alpine/git - pull: if-not-exists - environment: - http_proxy: - from_secret: PROXY - https_proxy: - from_secret: PROXY - commands: - - git config --global core.compression 0 - - git clone https://github.com/dataelement/bisheng.git . - - git checkout $DRONE_COMMIT +steps: - - name: set uv mirrors - pull: if-not-exists - image: golang - environment: - PROXY: - from_secret: APT-GET - volumes: - - name: bisheng-cache - path: /app/build/ - commands: - - cd ./src/backend - - sed -i.bak 's/uv cache clean.*$/ /' Dockerfile - - sed -i '6i\RUN pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - sed -i '7i\ENV UV_PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - sed -i '8i\ENV UV_DEFAULT_INDEX=https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - sed -i '9i\ENV PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple' Dockerfile - - cat Dockerfile + # ========================================= + # 前端镜像构建 + # frontend 仍然使用镜像部署 + # ========================================= + - name: build_frontend - - name: build_docker - pull: if-not-exists image: docker:24.0.6 - privileged: true - volumes: - - name: apt-cache - path: /var/cache/apt/archives - - name: socket - path: /var/run/docker.sock - - name: pro-cache - path: /root/.local/share/pypoetry - - name: uv-cache - path: /root/.cache/uv - environment: - http_proxy: - from_secret: PROXY - https_proxy: - from_secret: PROXY - no_proxy: 192.168.106.8 - version: 2.5.0-sg - docker_registry: http://192.168.106.8:6082 - docker_repo: 192.168.106.8:6082/dataelement/bisheng-backend - docker_user: - from_secret: NEXUS_USER - docker_password: - from_secret: NEXUS_PASSWORD - commands: - - echo "old tag is $version" - - version=$(echo $version | sed 's/\\//_/g') - - echo "build image tag is $version" - - cd ./src/backend/ - - docker login -u $docker_user -p $docker_password $docker_registry - - docker build -t $docker_repo:$version . - - docker push $docker_repo:$version - - - name: build_docker_frontend pull: if-not-exists - image: docker:24.0.6 privileged: true - volumes: # 将容器内目录挂载到宿主机，仓库需要开启Trusted设置 - - name: apt-cache - path: /var/cache/apt/archives # 将应用打包好的Jar和执行脚本挂载出来 - - name: socket - path: /var/run/docker.sock - environment: - http_proxy: - from_secret: PROXY - https_proxy: - from_secret: PROXY - no_proxy: 192.168.106.8 - version: 2.5.0-sg - docker_registry: http://192.168.106.8:6082 - docker_repo: 192.168.106.8:6082/dataelement/bisheng-frontend - docker_user: - from_secret: NEXUS_USER - docker_password: - from_secret: NEXUS_PASSWORD - commands: - - echo "old tag is $version" - - version=$(echo $version | sed 's/\\//_/g') - - echo "build image tag is $version" - - cd ./src/frontend/ - - docker login -u $docker_user -p $docker_password $docker_registry - - docker build -t $docker_repo:$version . - - docker push $docker_repo:$version - - name: ssh deploy + volumes: + - name: docker_sock + path: /var/run/docker.sock + + environment: + + DOCKER_REGISTRY: 192.168.106.8:6082 + + DOCKER_REPO: 192.168.106.8:6082/dataelement/bisheng-frontend + + DOCKER_USER: + from_secret: NEXUS_USER + + DOCKER_PASSWORD: + from_secret: NEXUS_PASSWORD + + commands: + + - export VERSION=${DRONE_COMMIT_SHA:0:8} + + - echo "======= build frontend =======" + + - echo "$DOCKER_PASSWORD" | docker login \ + -u "$DOCKER_USER" \ + --password-stdin \ + $DOCKER_REGISTRY + + - cd src/frontend + + - docker build \ + -t $DOCKER_REPO:$VERSION \ + -t $DOCKER_REPO:latest \ + . + + - docker push $DOCKER_REPO:$VERSION + + - docker push $DOCKER_REPO:latest + + # ========================================= + # backend 部署 + # 使用源码映射方式 + # ========================================= + - name: deploy_backend + image: appleboy/drone-ssh pull: if-not-exists + settings: + host: 192.168.106.171 - username: root - password: - from_secret: sshpwd + + # 不建议 root + username: deploy + + key: + from_secret: SSH_KEY + port: 22 - command_timeout: 10m + + command_timeout: 20m + script: | - echo "=======同步 171 源码=======" + + set -e + + echo "======= deploy backend =======" + cd /opt/code/bisheng - git pull - docker-compose -f ./docker/docker-compose.yml up -d - sleep 15 - echo "=======执行数据库迁移=======" - docker exec bisheng-backend sh -lc "cd /app && (alembic upgrade heads || alembic upgrade head)" - echo "=======迁移后再次重启=======" - docker-compose restart backend backend_worker -# - name: ssh deploy frontend -# image: appleboy/drone-ssh -# pull: if-not-exists -# environment: -# NEXUS_USER: -# from_secret: NEXUS_USER -# NEXUS_PASSWORD: -# from_secret: NEXUS_PASSWORD -# settings: -# host: 192.168.106.171 -# username: root -# password: -# from_secret: sshpwd -# port: 22 -# command_timeout: 20m -# envs: -# - NEXUS_USER -# - NEXUS_PASSWORD -# script: | -# echo "=======准备 3003 前端发布=======" -# frontend_container="drone_bisheng_frontend_feat_2_5_0_sg_$(date +%s%N)" -# trap 'docker rm -f "$frontend_container" >/dev/null 2>&1 || true' EXIT -# docker login -u "$NEXUS_USER" -p "$NEXUS_PASSWORD" http://192.168.106.8:6082 || true -# docker pull 192.168.106.8:6082/dataelement/bisheng-frontend:feat_2.5.0-sg || docker pull cr.dataelem.com/dataelement/bisheng-frontend:feat_2.5.0-sg -# docker create --name "$frontend_container" 192.168.106.8:6082/dataelement/bisheng-frontend:feat_2.5.0-sg || docker create --name "$frontend_container" cr.dataelem.com/dataelement/bisheng-frontend:feat_2.5.0-sg -# mkdir -p /data/webroot/bisheng-dev /data/webroot/client-dev -# rm -rf /data/webroot/bisheng-dev/* /data/webroot/client-dev/* -# docker cp "$frontend_container":/usr/share/nginx/html/platform/. /data/webroot/bisheng-dev/ -# docker cp "$frontend_container":/usr/share/nginx/html/client/. /data/webroot/client-dev/ -# docker rm -f "$frontend_container" -# curl -fsI http://127.0.0.1:3003/ -# curl -fsI http://127.0.0.1:3003/workspace/c/new + echo "======= reset local changes =======" - - name: notify-start # notify + # 防止服务器有人改代码导致 pull 冲突 + git reset --hard HEAD + + echo "======= pull latest code =======" + + git pull origin feat/2.5.0-sg + + echo "======= migrate database =======" + + docker compose -f docker/docker-compose.yml \ + exec -T backend \ + sh -lc "cd /app && alembic upgrade head" + + echo "======= restart backend =======" + + docker compose -f docker/docker-compose.yml \ + restart backend backend_worker + + # ========================================= + # frontend 部署 + # ========================================= + - name: deploy_frontend + + image: appleboy/drone-ssh pull: if-not-exists - image: plugins/webhook + settings: - debug: true + + host: 192.168.106.171 + + username: deploy + + key: + from_secret: SSH_KEY + + port: 22 + + command_timeout: 20m + + script: | + + set -e + + echo "======= deploy frontend =======" + + cd /opt/code/bisheng + + echo "======= login docker registry =======" + + docker login 192.168.106.8:6082 \ + -u ${NEXUS_USER} \ + -p ${NEXUS_PASSWORD} + + echo "======= pull frontend image =======" + + docker compose -f docker/docker-compose.yml \ + pull frontend + + echo "======= restart frontend =======" + + docker compose -f docker/docker-compose.yml \ + up -d frontend + + environment: + + NEXUS_USER: + from_secret: NEXUS_USER + + NEXUS_PASSWORD: + from_secret: NEXUS_PASSWORD + + # ========================================= + # 飞书通知 + # ========================================= + - name: notify_result + + image: plugins/webhook + pull: if-not-exists + + settings: + urls: from_secret: FEISHU_URL + content_type: application/json + template: | { "msg_type": "interactive", @@ -352,40 +189,25 @@ steps: # 定义流水线执行步骤，这些步骤将顺序执行 "template_id": "AAqkI9bnY5FUs", "template_variable": { "repo_name": "{{ repo.name }}", - "build_branch": "{{build.branch}}", + "build_branch": "{{ build.branch }}", "build_author": "{{ DRONE_COMMIT_AUTHOR }}", - "link": "{{build.link}}", + "link": "{{ build.link }}", "commit_msg": "{{ trim build.message }}", - "build_tag":"{{build.tag}}", - "build_start":"{{build.started}}", "status": "{{ build.status }}" } } } } + + failure: ignore + when: status: - success - failure -trigger: - branch: - - feat/2.5.0-sg - event: - - push volumes: -- name: bisheng-cache - host: - path: /opt/drone/data/bisheng/ -- name: pro-cache - host: - path: /opt/drone/data/pro/ -- name: apt-cache - host: - path: /opt/drone/data/bisheng/apt/ -- name: socket - host: - path: /var/run/docker.sock -- name: uv-cache - host: - path: /opt/drone/data/uv/ + + - name: docker_sock + host: + path: /var/run/docker.sock diff --git a/docker/nginx/conf.d/default.conf b/docker/nginx/conf.d/default.conf index 191f09fc6..0162e019a 100644 --- a/docker/nginx/conf.d/default.conf +++ b/docker/nginx/conf.d/default.conf @@ -7,7 +7,7 @@ map $http_upgrade $connection_upgrade { upstream backend_server { - server backend:7860; # backend api + server bisheng-backend:7860; # backend api } @@ -66,4 +66,4 @@ server { rewrite ^/workspace(/.*)$ $1 break; proxy_pass http://minio:9000; } -} \ No newline at end of file +} diff --git a/docker/nginx/conf.d/websocket.conf b/docker/nginx/conf.d/websocket.conf index 0971cf4c5..af51003a8 100644 --- a/docker/nginx/conf.d/websocket.conf +++ b/docker/nginx/conf.d/websocket.conf @@ -16,7 +16,7 @@ server { listen 8443; location /api { - proxy_pass http://backend:7860; + proxy_pass http://bisheng-backend:7860; proxy_read_timeout 300s; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; @@ -26,4 +26,4 @@ server { proxy_set_header Connection $connection_upgrade; client_max_body_size 50m; } -} \ No newline at end of file +} diff --git a/src/backend/bisheng/core/database/alembic/versions/v2_5_0_f005_role_menu_quota.py b/src/backend/bisheng/core/database/alembic/versions/v2_5_0_f005_role_menu_quota.py index 177356435..b853d1cfa 100644 --- a/src/backend/bisheng/core/database/alembic/versions/v2_5_0_f005_role_menu_quota.py +++ b/src/backend/bisheng/core/database/alembic/versions/v2_5_0_f005_role_menu_quota.py @@ -32,6 +32,8 @@ depends_on: Union[str, Sequence[str], None] = None def upgrade() -> None: """Extend role table for policy-role model (F005).""" + conn = op.get_bind() + # 1. Add role_type column if not column_exists(conn, 'role', 'role_type'): op.add_column( @@ -68,7 +70,6 @@ def upgrade() -> None: # will not collide with each other). Idempotent: runs only when the # target unique index is not yet present. if not index_exists(conn, 'role', 'uk_tenant_roletype_rolename'): - conn = op.get_bind() conflicts = conn.execute(sa.text(""" SELECT tenant_id, role_type, role_name, COUNT(*) AS cnt FROM role