From da54eef06a5b8e2d1acd3ad70d39d53b2468c262 Mon Sep 17 00:00:00 2001 From: Cheng Zhou Date: Mon, 30 Mar 2026 22:44:19 +0800 Subject: [PATCH 1/2] =?UTF-8?q?release(main):=20=E7=A7=BB=E9=99=A4?= =?UTF-8?q?=E8=85=BE=E8=AE=AF=E4=BA=91=E5=8F=91=E5=B8=83=E9=93=BE=E8=B7=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/publish-images.yml | 83 ---------- README.md | 10 +- docker-compose.yaml | 3 - docs/guides/release-checklist.md | 11 +- docs/plans/2026-03-30-remove-nginx-design.md | 1 - .../2026-03-30-remove-nginx-implementation.md | 26 +--- ...2026-03-30-remove-tcloud-publish-design.md | 18 +++ ...30-remove-tcloud-publish-implementation.md | 88 +++++++++++ ...26-03-30-tcloud-private-registry-design.md | 88 ++--------- .../2026-03-30-tcloud-private-registry.md | 144 +----------------- scripts/build-and-push-registry.sh | 65 -------- 11 files changed, 129 insertions(+), 408 deletions(-) delete mode 100644 .github/workflows/publish-images.yml create mode 100644 docs/plans/2026-03-30-remove-tcloud-publish-design.md create mode 100644 docs/plans/2026-03-30-remove-tcloud-publish-implementation.md delete mode 100644 scripts/build-and-push-registry.sh diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml deleted file mode 100644 index e157dd73..00000000 --- a/.github/workflows/publish-images.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Publish Images - -on: - push: - branches: - - dev - - release - - release/** - - main - -permissions: - contents: read - -concurrency: - group: publish-images-${{ github.ref }} - cancel-in-progress: true - -jobs: - publish: - runs-on: ubuntu-latest - env: - REMOTE_BASE_DIR: /home/zcc/registry/build/ctms-build - SSH_KEY_PATH: /tmp/tcloud_ci_key - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Prepare remote path metadata - id: meta - shell: bash - run: | - echo "repo_name=${GITHUB_REPOSITORY#*/}" >> "$GITHUB_OUTPUT" - echo "branch_name=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT" - echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" - - - name: Install SSH key - shell: bash - run: | - printf '%s\n' '${{ secrets.TCLOUD_SSH_KEY }}' > "${{ env.SSH_KEY_PATH }}" - chmod 600 "${{ env.SSH_KEY_PATH }}" - - - name: Sync repository to Tencent Cloud host - shell: bash - env: - TCLOUD_HOST: ${{ secrets.TCLOUD_HOST }} - TCLOUD_PORT: ${{ secrets.TCLOUD_PORT }} - TCLOUD_USER: ${{ secrets.TCLOUD_USER }} - REMOTE_REPO_DIR: ${{ env.REMOTE_BASE_DIR }}/${{ steps.meta.outputs.repo_name }} - run: | - ssh -i "${{ env.SSH_KEY_PATH }}" -p "${TCLOUD_PORT}" -o StrictHostKeyChecking=no "${TCLOUD_USER}@${TCLOUD_HOST}" \ - "mkdir -p '${REMOTE_REPO_DIR}' && find '${REMOTE_REPO_DIR}' -mindepth 1 -maxdepth 1 -exec rm -rf {} +" - tar --exclude=.git -cf - . | \ - ssh -i "${{ env.SSH_KEY_PATH }}" -p "${TCLOUD_PORT}" -o StrictHostKeyChecking=no "${TCLOUD_USER}@${TCLOUD_HOST}" \ - "tar -xf - -C '${REMOTE_REPO_DIR}'" - - - name: Build and push images on Tencent Cloud host - shell: bash - env: - TCLOUD_HOST: ${{ secrets.TCLOUD_HOST }} - TCLOUD_PORT: ${{ secrets.TCLOUD_PORT }} - TCLOUD_USER: ${{ secrets.TCLOUD_USER }} - BRANCH_NAME: ${{ steps.meta.outputs.branch_name }} - COMMIT_SHA: ${{ github.sha }} - REGISTRY_HOST: ${{ secrets.REGISTRY_HOST }} - REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} - REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} - REMOTE_REPO_DIR: ${{ env.REMOTE_BASE_DIR }}/${{ steps.meta.outputs.repo_name }} - run: | - BRANCH_NAME_B64="$(printf '%s' "${BRANCH_NAME}" | base64)" - COMMIT_SHA_B64="$(printf '%s' "${COMMIT_SHA}" | base64)" - REGISTRY_HOST_B64="$(printf '%s' "${REGISTRY_HOST}" | base64)" - REGISTRY_USERNAME_B64="$(printf '%s' "${REGISTRY_USERNAME}" | base64)" - REGISTRY_PASSWORD_B64="$(printf '%s' "${REGISTRY_PASSWORD}" | base64)" - ssh -i "${{ env.SSH_KEY_PATH }}" -p "${TCLOUD_PORT}" -o StrictHostKeyChecking=no "${TCLOUD_USER}@${TCLOUD_HOST}" " - cd '${REMOTE_REPO_DIR}' - chmod +x scripts/build-and-push-registry.sh - export BRANCH_NAME=\$(printf '%s' '${BRANCH_NAME_B64}' | base64 -d) - export COMMIT_SHA=\$(printf '%s' '${COMMIT_SHA_B64}' | base64 -d) - export REGISTRY_HOST=\$(printf '%s' '${REGISTRY_HOST_B64}' | base64 -d) - export REGISTRY_USERNAME=\$(printf '%s' '${REGISTRY_USERNAME_B64}' | base64 -d) - export REGISTRY_PASSWORD=\$(printf '%s' '${REGISTRY_PASSWORD_B64}' | base64 -d) - ./scripts/build-and-push-registry.sh - " diff --git a/README.md b/README.md index d9f70323..cea2c471 100644 --- a/README.md +++ b/README.md @@ -13,14 +13,6 @@ - `curl -i http://127.0.0.1:4173/` - `curl -i http://127.0.0.1:8000/health` -## 腾讯云私有镜像仓库 -- GitHub Actions 会在推送到 `dev`、`release`、`release/*` 和 `main` 时，通过 SSH 连接腾讯云服务器，在服务器本机完成 `backend` 和 `frontend` 镜像的构建与推送。 -- 私有仓库地址默认使用 `${REGISTRY_HOST}`，仓库命名为 `${REGISTRY_HOST}/ctms/ctms-backend` 和 `${REGISTRY_HOST}/ctms/ctms-frontend`。 -- `dev` 分支发布 `dev-latest` 和 `dev-`，`release` 分支发布 `rc-release` 和 `rc-`，`release/*` 分支发布 `rc-` 和 `rc-`，`main` 分支发布 `latest` 和 `sha-`。 -- 部署机需要先 `docker login :5000`，并使用私有仓库的 `htpasswd` 账号密码完成认证。 -- `backend-init` 复用 `BACKEND_IMAGE`，所以生产机可在设置 `REGISTRY_HOST`，或直接指定 `BACKEND_IMAGE` 和 `FRONTEND_IMAGE` 后执行 `docker compose pull && docker compose run --rm backend-init && docker compose up -d`。 -- 本地开发仍可继续使用 `docker compose up -d --build` 走本地构建。 - ## 账号与注册 - 初始化管理员：`admin@huapont.cn / admin123`（通过生产初始化命令显式创建） - 自助注册：前端 `/register` 提交邮箱、密码、姓名、角色（CRA/PV/IMP/PM）、部门，状态为 PENDING。 @@ -40,7 +32,7 @@ - 后端 API：`http://localhost:8000/api/v1/*` - 生产环境建议通过外部反向代理提供同域访问，前端代码默认请求同域 `/api/v1/*` - 如果本地直接访问 `http://localhost:4173`，可在 `frontend/.env` 中设置 `VITE_API_BASE_URL=http://localhost:8000`，让前端直连后端 API -- `docker compose` 本地构建前端容器时，默认会把 `VITE_API_BASE_URL` 注入为 `http://localhost:8000`；如果是生产构建，请显式覆盖为空值或你的正式 API 地址 +- `docker compose` 本地构建前端容器时，默认会把 `VITE_API_BASE_URL` 注入为 `http://localhost:8000`；如需覆盖，可显式设置 `VITE_API_BASE_URL` ## 仓库治理文档 - 分支治理规范：`docs/branch-governance.md` diff --git a/docker-compose.yaml b/docker-compose.yaml index 160ec7b1..cb38348c 100755 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -21,7 +21,6 @@ services: - ctms_net backend: - image: ${BACKEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-backend:latest} build: context: ./backend dockerfile: Dockerfile @@ -38,7 +37,6 @@ services: - ctms_net backend-init: - image: ${BACKEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-backend:latest} build: context: ./backend dockerfile: Dockerfile @@ -53,7 +51,6 @@ services: - ctms_net frontend: - image: ${FRONTEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-frontend:latest} build: context: ./frontend dockerfile: Dockerfile diff --git a/docs/guides/release-checklist.md b/docs/guides/release-checklist.md index 41bfa740..3a53ea54 100644 --- a/docs/guides/release-checklist.md +++ b/docs/guides/release-checklist.md @@ -9,13 +9,10 @@ - [ ] `cd backend && python3 -m compileall app scripts` - [ ] `cd frontend && npm run build` -## 1.1 腾讯云私有镜像校验 -- [ ] `dev` 推送后，`:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `dev-latest` / `dev-` 标签已出现在私有仓库 -- [ ] `release` 推送后，`:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `rc-release` / `rc-` 标签已出现在私有仓库 -- [ ] `release/*` 推送后，`:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `rc-` / `rc-` 标签已出现在私有仓库 -- [ ] `main` 推送后，`:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `latest` / `sha-` 标签已出现在私有仓库 -- [ ] GitHub Actions 已成功 SSH 登录腾讯云服务器并执行远程构建脚本 -- [ ] 部署机已执行 `docker login :5000`，且使用的是私有仓库 `htpasswd` 账号密码 +## 1.1 容器构建校验 +- [ ] `docker compose config` 渲染成功 +- [ ] `docker compose build backend frontend` 成功 +- [ ] `docker compose run --rm backend-init` 成功 ## 2. 接口与权限回归 - [ ] ADMIN 账号可 `GET/PUT/PUBLISH/IMPORT-EXCEL/EXPORT-EXCEL` diff --git a/docs/plans/2026-03-30-remove-nginx-design.md b/docs/plans/2026-03-30-remove-nginx-design.md index e07bcaa5..f63b8555 100644 --- a/docs/plans/2026-03-30-remove-nginx-design.md +++ b/docs/plans/2026-03-30-remove-nginx-design.md @@ -17,5 +17,4 @@ **Operational Notes** - The frontend still assumes same-origin API access, so the external proxy must route `/api/*` and `/health` to `backend`. -- The repository publish flow should only build and push `ctms-backend` and `ctms-frontend`. - Verification should prove that no runtime, CI, or document references to repository-managed Nginx remain. diff --git a/docs/plans/2026-03-30-remove-nginx-implementation.md b/docs/plans/2026-03-30-remove-nginx-implementation.md index 1c530f5f..c78d57d1 100644 --- a/docs/plans/2026-03-30-remove-nginx-implementation.md +++ b/docs/plans/2026-03-30-remove-nginx-implementation.md @@ -46,26 +46,7 @@ Build from `frontend/Dockerfile`, define a private-registry-backed `FRONTEND_IMA Run: `docker compose config` Expected: only `db`, `backend`, `backend-init`, and `frontend` render. -### Task 3: Update image publishing - -**Files:** -- Modify: `scripts/build-and-push-registry.sh` -- Modify: `.github/workflows/publish-images.yml` - -**Step 1: Publish `frontend` instead of `nginx`** - -Build and push `${REGISTRY_HOST}/ctms/ctms-frontend` alongside `${REGISTRY_HOST}/ctms/ctms-backend`. - -**Step 2: Keep branch-based tag logic unchanged** - -Preserve the existing `dev`, `release`, `release/*`, and `main` tag conventions. - -**Step 3: Verify script syntax** - -Run: `bash -n scripts/build-and-push-registry.sh` -Expected: PASS - -### Task 4: Rewrite docs to match the new topology +### Task 3: Rewrite docs to match the new topology **Files:** - Modify: `README.md` @@ -90,7 +71,7 @@ Describe the runtime as frontend and backend containers behind an external proxy Run: `rg -n --hidden -g '!/.git' -S "nginx|ctms-nginx|NGINX_IMAGE|Nginx" README.md docker-compose.yaml .github scripts docs` Expected: no active repository-managed Nginx references remain. -### Task 5: Remove obsolete nginx files and verify end-to-end cleanup +### Task 4: Remove obsolete nginx files and verify end-to-end cleanup **Files:** - Delete: `nginx/Dockerfile` @@ -105,9 +86,6 @@ Remove the Nginx directory because nothing in the repository should depend on it Run: `docker compose config` Expected: PASS -Run: `bash -n scripts/build-and-push-registry.sh` -Expected: PASS - **Step 3: Validate frontend and backend image references** Run: `sed -n '1,160p' README.md` diff --git a/docs/plans/2026-03-30-remove-tcloud-publish-design.md b/docs/plans/2026-03-30-remove-tcloud-publish-design.md new file mode 100644 index 00000000..986af32d --- /dev/null +++ b/docs/plans/2026-03-30-remove-tcloud-publish-design.md @@ -0,0 +1,18 @@ +# Remove Tencent Cloud Publish Design + +**Goal:** Remove the GitHub-to-Tencent-Cloud image publishing pipeline and all repository-owned private registry defaults so the repository no longer carries any built-in cloud publish path. + +**Decisions** +- Delete the GitHub Actions workflow that SSHes to Tencent Cloud and triggers remote image builds. +- Delete the repository-owned remote build-and-push script. +- Remove default private-registry image references from `docker-compose.yaml` and rely on local builds as the default path. +- Rewrite current documentation and historical plan documents so they no longer describe Tencent Cloud, private registry credentials, or registry-based deploy flows as active repository behavior. + +**Architecture** +- `docker-compose.yaml` remains the deployment entrypoint, but defaults to local image builds for `backend`, `backend-init`, and `frontend`. +- CI no longer contains any branch-triggered publish job for Tencent Cloud or any self-hosted registry. +- Historical design records are retained only as edited documentation that says the publish path has been removed. + +**Operational Notes** +- Anyone who still wants custom image names can set `BACKEND_IMAGE` or `FRONTEND_IMAGE` explicitly, but the repository no longer provides private-registry defaults or a publish pipeline. +- Verification should prove that no active references to `TCLOUD_*`, `REGISTRY_*`, `publish-images`, or `build-and-push-registry.sh` remain outside of the new cleanup documentation. diff --git a/docs/plans/2026-03-30-remove-tcloud-publish-implementation.md b/docs/plans/2026-03-30-remove-tcloud-publish-implementation.md new file mode 100644 index 00000000..abfeb14e --- /dev/null +++ b/docs/plans/2026-03-30-remove-tcloud-publish-implementation.md @@ -0,0 +1,88 @@ +# Remove Tencent Cloud Publish Implementation Plan + +> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. + +**Goal:** Remove GitHub-to-Tencent-Cloud publishing, private registry defaults, and related documentation from the repository. + +**Architecture:** The repository keeps local Docker build support for `backend`, `backend-init`, and `frontend`, but removes all built-in publish automation and private-registry defaults. Documentation is rewritten so Tencent Cloud and self-hosted registry deployment are no longer described as current behavior. + +**Tech Stack:** GitHub Actions, Docker Compose, FastAPI, Vue/Vite, Markdown documentation + +--- + +### Task 1: Remove publish automation + +**Files:** +- Delete: `.github/workflows/publish-images.yml` +- Delete: `scripts/build-and-push-registry.sh` + +**Step 1: Delete the GitHub workflow** + +Remove the workflow that SSHes into Tencent Cloud and runs remote image publication. + +**Step 2: Delete the remote publish script** + +Remove the repository-owned script that logs into the private registry and pushes images. + +### Task 2: Remove private-registry defaults from compose + +**Files:** +- Modify: `docker-compose.yaml` + +**Step 1: Switch runtime defaults to local image names** + +Remove `REGISTRY_HOST`-based defaults from `backend`, `backend-init`, and `frontend`. + +**Step 2: Keep local build support intact** + +Retain the existing `build:` blocks and any required build args for the frontend. + +**Step 3: Verify rendered compose** + +Run: `docker compose config` +Expected: PASS without any `REGISTRY_HOST`-derived default image names. + +### Task 3: Rewrite active docs + +**Files:** +- Modify: `README.md` +- Modify: `docs/guides/release-checklist.md` + +**Step 1: Remove Tencent Cloud and private registry sections** + +Delete active deployment guidance that references GitHub Actions, Tencent Cloud, `REGISTRY_HOST`, or private registry authentication. + +**Step 2: Keep deployment instructions aligned** + +Document the repository as local-build-first and external-deploy-managed. + +### Task 4: Rewrite historical design records + +**Files:** +- Modify: `docs/plans/2026-03-30-tcloud-private-registry-design.md` +- Modify: `docs/plans/2026-03-30-tcloud-private-registry.md` +- Modify: `docs/plans/2026-03-30-remove-nginx-design.md` +- Modify: `docs/plans/2026-03-30-remove-nginx-implementation.md` + +**Step 1: Mark the Tencent Cloud/private registry path as removed** + +Keep the documents but rewrite them so they no longer read as active implementation guidance. + +**Step 2: Remove references to active publish files** + +Update any references to `.github/workflows/publish-images.yml`, `scripts/build-and-push-registry.sh`, or private-registry defaults if those files/configs no longer exist. + +### Task 5: Verify cleanup + +**Files:** +- Verify only + +**Step 1: Render compose** + +Run: `docker compose config` +Expected: PASS + +**Step 2: Search for active Tencent Cloud/private registry references** + +Run: `rg -n --hidden -g '!/.git' -g '!frontend/node_modules/**' -g '!docs/plans/2026-03-30-remove-tcloud-publish-design.md' -g '!docs/plans/2026-03-30-remove-tcloud-publish-implementation.md' -S "Tencent|腾讯云|TCLOUD|publish-images|build-and-push-registry|REGISTRY_HOST|REGISTRY_USERNAME|REGISTRY_PASSWORD" .` +Expected: no active repository references remain. diff --git a/docs/plans/2026-03-30-tcloud-private-registry-design.md b/docs/plans/2026-03-30-tcloud-private-registry-design.md index 8e059230..ede105cb 100644 --- a/docs/plans/2026-03-30-tcloud-private-registry-design.md +++ b/docs/plans/2026-03-30-tcloud-private-registry-design.md @@ -1,81 +1,15 @@ -# Tencent Cloud Private Registry Design +# Tencent Cloud Private Registry Design (Removed) -**Goal:** Add CI that automatically builds and pushes private `backend` and `frontend` images to a self-hosted Docker Registry running on a Tencent Cloud CVM, with `dev` publishing test tags, `release` and `release/*` publishing release-candidate tags, and `main` publishing formal tags. +**Status:** Removed on 2026-03-30. -**Decisions** -- Publish only two runtime images: `/ctms/ctms-backend` and `/ctms/ctms-frontend`. -- Keep the private registry on the Tencent Cloud CVM as a self-hosted `registry:2` instance protected by `htpasswd`. -- Trigger automation on pushes to `dev`, `release`, `release/*`, and `main`. -- Use GitHub Actions only as the orchestrator. Actual Docker build and push happen on the Tencent Cloud server over SSH. -- Keep `docker-compose.yaml` compatible with both local `build` workflows and private registry pulls. +**Goal:** This document describes a publish path that has since been removed from the repository. -**Approaches Considered** -- Recommended: GitHub Actions connects to the Tencent Cloud server over SSH and runs a server-local build-and-push script. This avoids GitHub-hosted runner limitations around insecure or self-signed private registries and keeps registry access local to the server. -- Alternative: GitHub Actions builds and pushes directly to `:5000`. This is simpler on paper but is fragile when the registry is exposed only as an IP endpoint and may use insecure or non-public TLS. -- Alternative: move first to a domain-backed HTTPS registry and then push directly from GitHub Actions. This is the clean long-term path but adds infrastructure work that is not required for the current goal. +**Removal Summary** +- The GitHub Actions publish workflow has been deleted. +- The repository-owned remote build-and-push script has been deleted. +- `docker-compose.yaml` no longer defaults to private registry image names. +- Tencent Cloud and private registry deployment are no longer active repository features. -**Architecture** -- A new GitHub Actions workflow triggers on pushes to `dev`, `release`, `release/*`, and `main`. -- The workflow authenticates to the Tencent Cloud server using SSH credentials stored in GitHub Secrets. -- The workflow syncs the repository contents to a fixed build directory such as `/opt/ctms-build/`. -- A server-local script logs in to the private registry, builds `backend` and `frontend`, applies branch-specific tags, and pushes the images to the registry. - -**Registry Naming** -- Backend image: `/ctms/ctms-backend` -- Frontend image: `/ctms/ctms-frontend` - -**Tagging Strategy** -- `dev` branch pushes publish: - - `/ctms/ctms-backend:dev-latest` - - `/ctms/ctms-backend:dev-` - - `/ctms/ctms-frontend:dev-latest` - - `/ctms/ctms-frontend:dev-` -- `release` branch pushes publish: - - `/ctms/ctms-backend:rc-release` - - `/ctms/ctms-backend:rc-` - - `/ctms/ctms-frontend:rc-release` - - `/ctms/ctms-frontend:rc-` -- `release/*` branch pushes publish: - - `/ctms/ctms-backend:rc-` - - `/ctms/ctms-backend:rc-` - - `/ctms/ctms-frontend:rc-` - - `/ctms/ctms-frontend:rc-` -- `main` branch pushes publish: - - `/ctms/ctms-backend:latest` - - `/ctms/ctms-backend:sha-` - - `/ctms/ctms-frontend:latest` - - `/ctms/ctms-frontend:sha-` - -**Server Requirements** -- Docker installed on the Tencent Cloud server. -- A private `registry:2` instance listening on `:5000`. -- `htpasswd` authentication configured for the registry. -- SSH access from GitHub Actions to the server. -- A writable build directory such as `/opt/ctms-build`. - -**GitHub Secrets** -- `TCLOUD_HOST` -- `TCLOUD_PORT` -- `TCLOUD_USER` -- `TCLOUD_SSH_KEY` -- `REGISTRY_HOST` -- `REGISTRY_USERNAME` -- `REGISTRY_PASSWORD` - -**Compose Integration** -- `docker-compose.yaml` should define `image:` for `backend`, `backend-init`, and `frontend`, with defaults based on private registry variables such as `REGISTRY_HOST`. -- Existing `build:` blocks stay in place so local `docker compose up -d --build` continues to work. -- Deployment hosts can export `REGISTRY_HOST`, then run `docker login`, `docker compose pull`, `docker compose run --rm backend-init`, and `docker compose up -d`. - -**Operational Notes** -- This design assumes the server-local script runs on the same machine that can log in to the private registry reliably. -- The GitHub workflow should not embed long shell logic inline; the repository should own a script under `scripts/` so the build logic stays versioned and testable. -- Direct verification of actual image publication depends on GitHub Actions reaching the Tencent Cloud server and cannot be proven locally without those secrets and network access. - -**Verification** -- Push to `dev` and confirm both images appear with `dev-latest` and `dev-`. -- Push to `release` and confirm both images appear with `rc-release` and `rc-`. -- Push to `release/*` and confirm both images appear with `rc-` and `rc-`. -- Push to `main` and confirm both images appear with `latest` and `sha-`. -- Run `docker compose config` after compose changes and confirm the private registry defaults render correctly. -- Parse the workflow YAML successfully and inspect the remote build script for the expected tag logic and registry login behavior. +**Current Replacement** +- Use local `docker compose build` workflows inside this repository. +- If deployment needs a registry in the future, reintroduce it as a fresh design rather than relying on the removed Tencent Cloud path. diff --git a/docs/plans/2026-03-30-tcloud-private-registry.md b/docs/plans/2026-03-30-tcloud-private-registry.md index 23dfb0c6..ed9971bf 100644 --- a/docs/plans/2026-03-30-tcloud-private-registry.md +++ b/docs/plans/2026-03-30-tcloud-private-registry.md @@ -1,146 +1,12 @@ -# Tencent Cloud Private Registry Implementation Plan +# Tencent Cloud Private Registry Implementation Plan (Removed) -> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. +**Status:** Removed on 2026-03-30. -**Goal:** Add CI that triggers remote builds on a Tencent Cloud CVM and pushes private `backend` and `frontend` images into a self-hosted Docker Registry protected by `htpasswd`, for `dev`, `release`, `release/*`, and `main`. +**Goal:** This implementation plan is retained only as historical record. The Tencent Cloud publish path and private registry defaults have been removed from the repository. -**Architecture:** GitHub Actions runs on pushes to `dev`, `release`, `release/*`, and `main`, connects to the Tencent Cloud server over SSH, syncs the repository into a fixed build directory, and invokes a repository-owned shell script that logs in to the private registry, builds the images locally on the server, tags them according to branch, and pushes them. +**Removal Outcome:** The workflow file, remote publish script, and private-registry-based compose defaults have been deleted. Local build-based workflows are now the only repository-owned path. **Tech Stack:** GitHub Actions, SSH, Docker, self-hosted `registry:2`, Docker Compose, FastAPI, Node.js --- - -### Task 1: Replace GHCR Workflow with Tencent Registry Publish Workflow - -**Files:** -- Modify: `.github/workflows/publish-images.yml` - -**Step 1: Define push triggers and remote execution secrets** - -Ensure the workflow triggers on pushes to `dev`, `release`, `release/*`, and `main`, and uses repository secrets for SSH host, port, user, SSH key, registry host, registry username, and registry password. - -**Step 2: Sync repository content to the Tencent Cloud server** - -Use an SSH-capable action or shell step to create the remote build directory and copy the current repository contents into `/opt/ctms-build/`. - -**Step 3: Invoke the remote publish script** - -Run the repository-owned remote script over SSH with environment values for: -- branch name -- commit SHA -- registry host -- registry credentials - -**Step 4: Verify workflow structure** - -Run: `ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-images.yml")'` -Expected: PASS - -### Task 2: Add Remote Build-And-Push Script - -**Files:** -- Create: `scripts/build-and-push-registry.sh` - -**Step 1: Implement branch-aware tag logic** - -For `dev`, compute: -- `dev-latest` -- `dev-` - -For `release`, compute: -- `rc-release` -- `rc-` - -For `release/*`, compute: -- `rc-` -- `rc-` - -For `main`, compute: -- `latest` -- `sha-` - -Fail fast for unsupported branches. - -**Step 2: Implement registry login and image builds** - -Log in to `${REGISTRY_HOST}` using the supplied username and password, then build: -- `${REGISTRY_HOST}/ctms/ctms-backend` -- `${REGISTRY_HOST}/ctms/ctms-frontend` - -**Step 3: Push both tags for both images** - -Push every computed tag explicitly so the branch and immutable tags are both published. - -**Step 4: Verify script syntax** - -Run: `bash -n scripts/build-and-push-registry.sh` -Expected: PASS - -### Task 3: Point Compose Defaults at the Private Registry - -**Files:** -- Modify: `docker-compose.yaml` - -**Step 1: Replace GHCR defaults with private registry defaults** - -Set: -- `backend.image` to `${BACKEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-backend:latest}` -- `backend-init.image` to `${BACKEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-backend:latest}` -- `frontend.image` to `${FRONTEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-frontend:latest}` - -Keep the current `build:` blocks intact. - -**Step 2: Verify rendered compose** - -Run: `docker compose config` -Expected: PASS with private registry image defaults rendered. - -### Task 4: Update Deployment Documentation - -**Files:** -- Modify: `README.md` -- Modify: `docs/guides/release-checklist.md` - -**Step 1: Document the Tencent registry flow** - -Explain that GitHub Actions triggers remote builds on the Tencent Cloud server and publishes to the private registry at `:5000`. - -**Step 2: Document deployment commands** - -Show that deployment hosts must run: -- `docker login :5000` -- `docker compose pull` -- `docker compose run --rm backend-init` -- `docker compose up -d` - -**Step 3: Update release checklist** - -Add checks for remote publish success on `dev`, `release`, `release/*`, and `main`, and for deployment-host registry authentication. - -### Task 5: End-To-End Local Verification - -**Files:** -- Verify only - -**Step 1: Parse the workflow YAML** - -Run: `ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-images.yml")'` -Expected: PASS - -**Step 2: Verify script syntax** - -Run: `bash -n scripts/build-and-push-registry.sh` -Expected: PASS - -**Step 3: Render compose** - -Run: `docker compose config` -Expected: PASS - -**Step 4: Inspect documentation** - -Run: `sed -n '1,120p' README.md` -Expected: PASS with Tencent private registry deployment steps present. - -Run: `sed -n '1,120p' docs/guides/release-checklist.md` -Expected: PASS with private registry release verification present. +This plan is no longer executable as written because the referenced workflow, script, and compose defaults have been removed. diff --git a/scripts/build-and-push-registry.sh b/scripts/build-and-push-registry.sh deleted file mode 100644 index b1c25b8c..00000000 --- a/scripts/build-and-push-registry.sh +++ /dev/null @@ -1,65 +0,0 @@ -#!/usr/bin/env bash - -set -euo pipefail - -required_vars=( - BRANCH_NAME - COMMIT_SHA - REGISTRY_HOST - REGISTRY_USERNAME - REGISTRY_PASSWORD -) - -for var_name in "${required_vars[@]}"; do - if [[ -z "${!var_name:-}" ]]; then - echo "Missing required environment variable: ${var_name}" >&2 - exit 1 - fi -done - -short_sha="${COMMIT_SHA:0:7}" - -case "${BRANCH_NAME}" in - dev) - mutable_tag="dev-latest" - immutable_tag="dev-${short_sha}" - ;; - release) - mutable_tag="rc-release" - immutable_tag="rc-${short_sha}" - ;; - release/*) - release_name="${BRANCH_NAME#release/}" - release_slug="${release_name//\//-}" - mutable_tag="rc-${release_slug}" - immutable_tag="rc-${short_sha}" - ;; - main) - mutable_tag="latest" - immutable_tag="sha-${short_sha}" - ;; - *) - echo "Unsupported branch for publishing: ${BRANCH_NAME}" >&2 - exit 1 - ;; -esac - -backend_image="${REGISTRY_HOST}/ctms/ctms-backend" -frontend_image="${REGISTRY_HOST}/ctms/ctms-frontend" - -echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY_HOST}" --username "${REGISTRY_USERNAME}" --password-stdin - -docker build \ - -t "${backend_image}:${mutable_tag}" \ - -t "${backend_image}:${immutable_tag}" \ - ./backend - -docker build \ - -t "${frontend_image}:${mutable_tag}" \ - -t "${frontend_image}:${immutable_tag}" \ - ./frontend - -docker push "${backend_image}:${mutable_tag}" -docker push "${backend_image}:${immutable_tag}" -docker push "${frontend_image}:${mutable_tag}" -docker push "${frontend_image}:${immutable_tag}" From 38b9838d631aeeaa7ece3667dc8b669801db2427 Mon Sep 17 00:00:00 2001 From: Cheng Zhou Date: Tue, 31 Mar 2026 08:52:46 +0800 Subject: [PATCH 2/2] =?UTF-8?q?hotfix:=20=E4=BF=AE=E5=A4=8D=E7=94=9F?= =?UTF-8?q?=E4=BA=A7=E5=89=8D=E7=AB=AF=20API=20=E9=BB=98=E8=AE=A4=E5=9C=B0?= =?UTF-8?q?=E5=9D=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- docker-compose.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cea2c471..b4a134db 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ - 后端 API：`http://localhost:8000/api/v1/*` - 生产环境建议通过外部反向代理提供同域访问，前端代码默认请求同域 `/api/v1/*` - 如果本地直接访问 `http://localhost:4173`，可在 `frontend/.env` 中设置 `VITE_API_BASE_URL=http://localhost:8000`，让前端直连后端 API -- `docker compose` 本地构建前端容器时，默认会把 `VITE_API_BASE_URL` 注入为 `http://localhost:8000`；如需覆盖，可显式设置 `VITE_API_BASE_URL` +- `docker compose` 构建前端容器时，默认不注入 `VITE_API_BASE_URL`，生产会走同域 `/api/v1/*`；仅在本地直连后端时才显式设置 `VITE_API_BASE_URL=http://localhost:8000` ## 仓库治理文档 - 分支治理规范：`docs/branch-governance.md` diff --git a/docker-compose.yaml b/docker-compose.yaml index cb38348c..a537a1c5 100755 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -55,7 +55,7 @@ services: context: ./frontend dockerfile: Dockerfile args: - VITE_API_BASE_URL: ${VITE_API_BASE_URL:-http://localhost:8000} + VITE_API_BASE_URL: ${VITE_API_BASE_URL:-} container_name: ctms_frontend restart: always ports: