wangziqi
3bcad138a1
由 OCR（open-codereview.ai，deepseek-v4-flash）审查驱动修复： - serve-proxy：API_TARGET 生效、SPA 404 语义、流式静态文件、hop-by-hop/超时/断连/穿越防护 - migrate.sh：密码不进 argv/不泄漏 pm2、原子锁防重入、DML-only 事务说明、就绪诊断 - deploy.sh/CI：保护 .env、总是 npm ci（迁移依赖 devDeps）、健康检查、并发锁 - ecosystem/oxlint/.env.example：优雅停机、React 版本对齐、TRUST_PROXY 说明 Reviewed-by: OCR (open-codereview.ai)
91 lines
2.7 KiB
YAML
91 lines
2.7 KiB
YAML
# PM2 手动部署工作流
|
||
# 手动触发 → 构建 → rsync → 安装依赖 → 数据库迁移 → PM2 重载
|
||
#
|
||
# 前置准备：
|
||
# 1. 服务器 MySQL 已在运行
|
||
# 2. 服务器已安装 PM2: npm i -g pm2
|
||
# 3. Gitea 仓库 Settings → Secrets 配置：
|
||
# - SSH_PRIVATE_KEY : 部署用 SSH 私钥
|
||
# - SSH_HOST : 服务器地址
|
||
# - SSH_USER : SSH 用户名
|
||
# - SSH_PORT : SSH 端口（默认 22，可选）
|
||
# - REMOTE_DIR : 服务器项目目录，如 /opt/gongxue
|
||
|
||
name: PM2 部署
|
||
|
||
on:
|
||
workflow_dispatch:
|
||
|
||
concurrency:
|
||
group: deploy
|
||
cancel-in-progress: false
|
||
|
||
jobs:
|
||
deploy:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: 检出代码
|
||
uses: actions/checkout@v4
|
||
|
||
- name: 安装 Node.js
|
||
uses: actions/setup-node@v4
|
||
with:
|
||
node-version: '22'
|
||
|
||
- name: 安装依赖 & 构建
|
||
run: |
|
||
npm ci
|
||
npm run build -w @gongxue/server
|
||
npm run build -w @gongxue/admin
|
||
|
||
- name: 配置 SSH
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
# 单引号 EOF 防止 key 中的 $ / 反引号被 shell 插值（YAML 会剥掉缩进，bash 实际收到列首 EOF）
|
||
cat > ~/.ssh/deploy_key <<'EOF'
|
||
${{ secrets.SSH_PRIVATE_KEY }}
|
||
EOF
|
||
chmod 600 ~/.ssh/deploy_key
|
||
cat >> ~/.ssh/config <<'EOF'
|
||
Host deploy-server
|
||
HostName ${{ secrets.SSH_HOST }}
|
||
User ${{ secrets.SSH_USER }}
|
||
Port ${{ secrets.SSH_PORT || '22' }}
|
||
IdentityFile ~/.ssh/deploy_key
|
||
StrictHostKeyChecking accept-new
|
||
EOF
|
||
|
||
- name: 同步代码到服务器
|
||
run: |
|
||
rsync -avz --delete \
|
||
--exclude='node_modules' \
|
||
--exclude='.git' \
|
||
--exclude='*.db' \
|
||
--exclude='.DS_Store' \
|
||
--exclude='logs/' \
|
||
--exclude='.turbo/' \
|
||
--exclude='.claude/' \
|
||
--exclude='.codegraph/' \
|
||
--exclude='.env*' \
|
||
--exclude='data.sql' \
|
||
--exclude='uploads/' \
|
||
./ deploy-server:${{ secrets.REMOTE_DIR }}/
|
||
|
||
- name: 安装依赖 → 迁移 → PM2 重载
|
||
run: |
|
||
ssh deploy-server "
|
||
set -e
|
||
cd ${{ secrets.REMOTE_DIR }}
|
||
mkdir -p logs
|
||
echo '安装依赖...'
|
||
# 注意：migration:run 依赖 ts-node/tsconfig-paths（devDependencies），不能 --omit=dev
|
||
npm ci
|
||
echo '执行数据库迁移...'
|
||
npm run migration:run -w @gongxue/server
|
||
echo 'PM2 重载...'
|
||
pm2 startOrReload ecosystem.config.cjs --update-env
|
||
pm2 save
|
||
echo '=== PM2 状态 ==='
|
||
pm2 status
|
||
"
|