release(main): 移除腾讯云发布链路
This commit is contained in:
Cheng Zhou
@@ -9,13 +9,10 @@
|
||||
- [ ] `cd backend && python3 -m compileall app scripts`
|
||||
- [ ] `cd frontend && npm run build`
|
||||
|
||||
## 1.1 腾讯云私有镜像校验
|
||||
- [ ] `dev` 推送后，`<IP>:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `dev-latest` / `dev-<short_sha>` 标签已出现在私有仓库
|
||||
- [ ] `release` 推送后，`<IP>:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `rc-release` / `rc-<short_sha>` 标签已出现在私有仓库
|
||||
- [ ] `release/*` 推送后，`<IP>:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `rc-<release-branch>` / `rc-<short_sha>` 标签已出现在私有仓库
|
||||
- [ ] `main` 推送后，`<IP>:5000/ctms/ctms-backend` 和 `ctms-frontend` 的 `latest` / `sha-<short_sha>` 标签已出现在私有仓库
|
||||
- [ ] GitHub Actions 已成功 SSH 登录腾讯云服务器并执行远程构建脚本
|
||||
- [ ] 部署机已执行 `docker login <IP>:5000`，且使用的是私有仓库 `htpasswd` 账号密码
|
||||
## 1.1 容器构建校验
|
||||
- [ ] `docker compose config` 渲染成功
|
||||
- [ ] `docker compose build backend frontend` 成功
|
||||
- [ ] `docker compose run --rm backend-init` 成功
|
||||
|
||||
## 2. 接口与权限回归
|
||||
- [ ] ADMIN 账号可 `GET/PUT/PUBLISH/IMPORT-EXCEL/EXPORT-EXCEL`
|
||||
|
||||
@@ -17,5 +17,4 @@
|
||||
|
||||
**Operational Notes**
|
||||
- The frontend still assumes same-origin API access, so the external proxy must route `/api/*` and `/health` to `backend`.
|
||||
- The repository publish flow should only build and push `ctms-backend` and `ctms-frontend`.
|
||||
- Verification should prove that no runtime, CI, or document references to repository-managed Nginx remain.
|
||||
|
||||
@@ -46,26 +46,7 @@ Build from `frontend/Dockerfile`, define a private-registry-backed `FRONTEND_IMA
|
||||
Run: `docker compose config`
|
||||
Expected: only `db`, `backend`, `backend-init`, and `frontend` render.
|
||||
|
||||
### Task 3: Update image publishing
|
||||
|
||||
**Files:**
|
||||
- Modify: `scripts/build-and-push-registry.sh`
|
||||
- Modify: `.github/workflows/publish-images.yml`
|
||||
|
||||
**Step 1: Publish `frontend` instead of `nginx`**
|
||||
|
||||
Build and push `${REGISTRY_HOST}/ctms/ctms-frontend` alongside `${REGISTRY_HOST}/ctms/ctms-backend`.
|
||||
|
||||
**Step 2: Keep branch-based tag logic unchanged**
|
||||
|
||||
Preserve the existing `dev`, `release`, `release/*`, and `main` tag conventions.
|
||||
|
||||
**Step 3: Verify script syntax**
|
||||
|
||||
Run: `bash -n scripts/build-and-push-registry.sh`
|
||||
Expected: PASS
|
||||
|
||||
### Task 4: Rewrite docs to match the new topology
|
||||
### Task 3: Rewrite docs to match the new topology
|
||||
|
||||
**Files:**
|
||||
- Modify: `README.md`
|
||||
@@ -90,7 +71,7 @@ Describe the runtime as frontend and backend containers behind an external proxy
|
||||
Run: `rg -n --hidden -g '!/.git' -S "nginx|ctms-nginx|NGINX_IMAGE|Nginx" README.md docker-compose.yaml .github scripts docs`
|
||||
Expected: no active repository-managed Nginx references remain.
|
||||
|
||||
### Task 5: Remove obsolete nginx files and verify end-to-end cleanup
|
||||
### Task 4: Remove obsolete nginx files and verify end-to-end cleanup
|
||||
|
||||
**Files:**
|
||||
- Delete: `nginx/Dockerfile`
|
||||
@@ -105,9 +86,6 @@ Remove the Nginx directory because nothing in the repository should depend on it
|
||||
Run: `docker compose config`
|
||||
Expected: PASS
|
||||
|
||||
Run: `bash -n scripts/build-and-push-registry.sh`
|
||||
Expected: PASS
|
||||
|
||||
**Step 3: Validate frontend and backend image references**
|
||||
|
||||
Run: `sed -n '1,160p' README.md`
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
# Remove Tencent Cloud Publish Design
|
||||
|
||||
**Goal:** Remove the GitHub-to-Tencent-Cloud image publishing pipeline and all repository-owned private registry defaults so the repository no longer carries any built-in cloud publish path.
|
||||
|
||||
**Decisions**
|
||||
- Delete the GitHub Actions workflow that SSHes to Tencent Cloud and triggers remote image builds.
|
||||
- Delete the repository-owned remote build-and-push script.
|
||||
- Remove default private-registry image references from `docker-compose.yaml` and rely on local builds as the default path.
|
||||
- Rewrite current documentation and historical plan documents so they no longer describe Tencent Cloud, private registry credentials, or registry-based deploy flows as active repository behavior.
|
||||
|
||||
**Architecture**
|
||||
- `docker-compose.yaml` remains the deployment entrypoint, but defaults to local image builds for `backend`, `backend-init`, and `frontend`.
|
||||
- CI no longer contains any branch-triggered publish job for Tencent Cloud or any self-hosted registry.
|
||||
- Historical design records are retained only as edited documentation that says the publish path has been removed.
|
||||
|
||||
**Operational Notes**
|
||||
- Anyone who still wants custom image names can set `BACKEND_IMAGE` or `FRONTEND_IMAGE` explicitly, but the repository no longer provides private-registry defaults or a publish pipeline.
|
||||
- Verification should prove that no active references to `TCLOUD_*`, `REGISTRY_*`, `publish-images`, or `build-and-push-registry.sh` remain outside of the new cleanup documentation.
|
||||
@@ -0,0 +1,88 @@
|
||||
# Remove Tencent Cloud Publish Implementation Plan
|
||||
|
||||
> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
|
||||
|
||||
**Goal:** Remove GitHub-to-Tencent-Cloud publishing, private registry defaults, and related documentation from the repository.
|
||||
|
||||
**Architecture:** The repository keeps local Docker build support for `backend`, `backend-init`, and `frontend`, but removes all built-in publish automation and private-registry defaults. Documentation is rewritten so Tencent Cloud and self-hosted registry deployment are no longer described as current behavior.
|
||||
|
||||
**Tech Stack:** GitHub Actions, Docker Compose, FastAPI, Vue/Vite, Markdown documentation
|
||||
|
||||
---
|
||||
|
||||
### Task 1: Remove publish automation
|
||||
|
||||
**Files:**
|
||||
- Delete: `.github/workflows/publish-images.yml`
|
||||
- Delete: `scripts/build-and-push-registry.sh`
|
||||
|
||||
**Step 1: Delete the GitHub workflow**
|
||||
|
||||
Remove the workflow that SSHes into Tencent Cloud and runs remote image publication.
|
||||
|
||||
**Step 2: Delete the remote publish script**
|
||||
|
||||
Remove the repository-owned script that logs into the private registry and pushes images.
|
||||
|
||||
### Task 2: Remove private-registry defaults from compose
|
||||
|
||||
**Files:**
|
||||
- Modify: `docker-compose.yaml`
|
||||
|
||||
**Step 1: Switch runtime defaults to local image names**
|
||||
|
||||
Remove `REGISTRY_HOST`-based defaults from `backend`, `backend-init`, and `frontend`.
|
||||
|
||||
**Step 2: Keep local build support intact**
|
||||
|
||||
Retain the existing `build:` blocks and any required build args for the frontend.
|
||||
|
||||
**Step 3: Verify rendered compose**
|
||||
|
||||
Run: `docker compose config`
|
||||
Expected: PASS without any `REGISTRY_HOST`-derived default image names.
|
||||
|
||||
### Task 3: Rewrite active docs
|
||||
|
||||
**Files:**
|
||||
- Modify: `README.md`
|
||||
- Modify: `docs/guides/release-checklist.md`
|
||||
|
||||
**Step 1: Remove Tencent Cloud and private registry sections**
|
||||
|
||||
Delete active deployment guidance that references GitHub Actions, Tencent Cloud, `REGISTRY_HOST`, or private registry authentication.
|
||||
|
||||
**Step 2: Keep deployment instructions aligned**
|
||||
|
||||
Document the repository as local-build-first and external-deploy-managed.
|
||||
|
||||
### Task 4: Rewrite historical design records
|
||||
|
||||
**Files:**
|
||||
- Modify: `docs/plans/2026-03-30-tcloud-private-registry-design.md`
|
||||
- Modify: `docs/plans/2026-03-30-tcloud-private-registry.md`
|
||||
- Modify: `docs/plans/2026-03-30-remove-nginx-design.md`
|
||||
- Modify: `docs/plans/2026-03-30-remove-nginx-implementation.md`
|
||||
|
||||
**Step 1: Mark the Tencent Cloud/private registry path as removed**
|
||||
|
||||
Keep the documents but rewrite them so they no longer read as active implementation guidance.
|
||||
|
||||
**Step 2: Remove references to active publish files**
|
||||
|
||||
Update any references to `.github/workflows/publish-images.yml`, `scripts/build-and-push-registry.sh`, or private-registry defaults if those files/configs no longer exist.
|
||||
|
||||
### Task 5: Verify cleanup
|
||||
|
||||
**Files:**
|
||||
- Verify only
|
||||
|
||||
**Step 1: Render compose**
|
||||
|
||||
Run: `docker compose config`
|
||||
Expected: PASS
|
||||
|
||||
**Step 2: Search for active Tencent Cloud/private registry references**
|
||||
|
||||
Run: `rg -n --hidden -g '!/.git' -g '!frontend/node_modules/**' -g '!docs/plans/2026-03-30-remove-tcloud-publish-design.md' -g '!docs/plans/2026-03-30-remove-tcloud-publish-implementation.md' -S "Tencent|腾讯云|TCLOUD|publish-images|build-and-push-registry|REGISTRY_HOST|REGISTRY_USERNAME|REGISTRY_PASSWORD" .`
|
||||
Expected: no active repository references remain.
|
||||
@@ -1,81 +1,15 @@
|
||||
# Tencent Cloud Private Registry Design
|
||||
# Tencent Cloud Private Registry Design (Removed)
|
||||
|
||||
**Goal:** Add CI that automatically builds and pushes private `backend` and `frontend` images to a self-hosted Docker Registry running on a Tencent Cloud CVM, with `dev` publishing test tags, `release` and `release/*` publishing release-candidate tags, and `main` publishing formal tags.
|
||||
**Status:** Removed on 2026-03-30.
|
||||
|
||||
**Decisions**
|
||||
- Publish only two runtime images: `<registry-host>/ctms/ctms-backend` and `<registry-host>/ctms/ctms-frontend`.
|
||||
- Keep the private registry on the Tencent Cloud CVM as a self-hosted `registry:2` instance protected by `htpasswd`.
|
||||
- Trigger automation on pushes to `dev`, `release`, `release/*`, and `main`.
|
||||
- Use GitHub Actions only as the orchestrator. Actual Docker build and push happen on the Tencent Cloud server over SSH.
|
||||
- Keep `docker-compose.yaml` compatible with both local `build` workflows and private registry pulls.
|
||||
**Goal:** This document describes a publish path that has since been removed from the repository.
|
||||
|
||||
**Approaches Considered**
|
||||
- Recommended: GitHub Actions connects to the Tencent Cloud server over SSH and runs a server-local build-and-push script. This avoids GitHub-hosted runner limitations around insecure or self-signed private registries and keeps registry access local to the server.
|
||||
- Alternative: GitHub Actions builds and pushes directly to `<IP>:5000`. This is simpler on paper but is fragile when the registry is exposed only as an IP endpoint and may use insecure or non-public TLS.
|
||||
- Alternative: move first to a domain-backed HTTPS registry and then push directly from GitHub Actions. This is the clean long-term path but adds infrastructure work that is not required for the current goal.
|
||||
**Removal Summary**
|
||||
- The GitHub Actions publish workflow has been deleted.
|
||||
- The repository-owned remote build-and-push script has been deleted.
|
||||
- `docker-compose.yaml` no longer defaults to private registry image names.
|
||||
- Tencent Cloud and private registry deployment are no longer active repository features.
|
||||
|
||||
**Architecture**
|
||||
- A new GitHub Actions workflow triggers on pushes to `dev`, `release`, `release/*`, and `main`.
|
||||
- The workflow authenticates to the Tencent Cloud server using SSH credentials stored in GitHub Secrets.
|
||||
- The workflow syncs the repository contents to a fixed build directory such as `/opt/ctms-build/<repo>`.
|
||||
- A server-local script logs in to the private registry, builds `backend` and `frontend`, applies branch-specific tags, and pushes the images to the registry.
|
||||
|
||||
**Registry Naming**
|
||||
- Backend image: `<registry-host>/ctms/ctms-backend`
|
||||
- Frontend image: `<registry-host>/ctms/ctms-frontend`
|
||||
|
||||
**Tagging Strategy**
|
||||
- `dev` branch pushes publish:
|
||||
- `<registry-host>/ctms/ctms-backend:dev-latest`
|
||||
- `<registry-host>/ctms/ctms-backend:dev-<short_sha>`
|
||||
- `<registry-host>/ctms/ctms-frontend:dev-latest`
|
||||
- `<registry-host>/ctms/ctms-frontend:dev-<short_sha>`
|
||||
- `release` branch pushes publish:
|
||||
- `<registry-host>/ctms/ctms-backend:rc-release`
|
||||
- `<registry-host>/ctms/ctms-backend:rc-<short_sha>`
|
||||
- `<registry-host>/ctms/ctms-frontend:rc-release`
|
||||
- `<registry-host>/ctms/ctms-frontend:rc-<short_sha>`
|
||||
- `release/*` branch pushes publish:
|
||||
- `<registry-host>/ctms/ctms-backend:rc-<release-branch>`
|
||||
- `<registry-host>/ctms/ctms-backend:rc-<short_sha>`
|
||||
- `<registry-host>/ctms/ctms-frontend:rc-<release-branch>`
|
||||
- `<registry-host>/ctms/ctms-frontend:rc-<short_sha>`
|
||||
- `main` branch pushes publish:
|
||||
- `<registry-host>/ctms/ctms-backend:latest`
|
||||
- `<registry-host>/ctms/ctms-backend:sha-<short_sha>`
|
||||
- `<registry-host>/ctms/ctms-frontend:latest`
|
||||
- `<registry-host>/ctms/ctms-frontend:sha-<short_sha>`
|
||||
|
||||
**Server Requirements**
|
||||
- Docker installed on the Tencent Cloud server.
|
||||
- A private `registry:2` instance listening on `<IP>:5000`.
|
||||
- `htpasswd` authentication configured for the registry.
|
||||
- SSH access from GitHub Actions to the server.
|
||||
- A writable build directory such as `/opt/ctms-build`.
|
||||
|
||||
**GitHub Secrets**
|
||||
- `TCLOUD_HOST`
|
||||
- `TCLOUD_PORT`
|
||||
- `TCLOUD_USER`
|
||||
- `TCLOUD_SSH_KEY`
|
||||
- `REGISTRY_HOST`
|
||||
- `REGISTRY_USERNAME`
|
||||
- `REGISTRY_PASSWORD`
|
||||
|
||||
**Compose Integration**
|
||||
- `docker-compose.yaml` should define `image:` for `backend`, `backend-init`, and `frontend`, with defaults based on private registry variables such as `REGISTRY_HOST`.
|
||||
- Existing `build:` blocks stay in place so local `docker compose up -d --build` continues to work.
|
||||
- Deployment hosts can export `REGISTRY_HOST`, then run `docker login`, `docker compose pull`, `docker compose run --rm backend-init`, and `docker compose up -d`.
|
||||
|
||||
**Operational Notes**
|
||||
- This design assumes the server-local script runs on the same machine that can log in to the private registry reliably.
|
||||
- The GitHub workflow should not embed long shell logic inline; the repository should own a script under `scripts/` so the build logic stays versioned and testable.
|
||||
- Direct verification of actual image publication depends on GitHub Actions reaching the Tencent Cloud server and cannot be proven locally without those secrets and network access.
|
||||
|
||||
**Verification**
|
||||
- Push to `dev` and confirm both images appear with `dev-latest` and `dev-<short_sha>`.
|
||||
- Push to `release` and confirm both images appear with `rc-release` and `rc-<short_sha>`.
|
||||
- Push to `release/*` and confirm both images appear with `rc-<release-branch>` and `rc-<short_sha>`.
|
||||
- Push to `main` and confirm both images appear with `latest` and `sha-<short_sha>`.
|
||||
- Run `docker compose config` after compose changes and confirm the private registry defaults render correctly.
|
||||
- Parse the workflow YAML successfully and inspect the remote build script for the expected tag logic and registry login behavior.
|
||||
**Current Replacement**
|
||||
- Use local `docker compose build` workflows inside this repository.
|
||||
- If deployment needs a registry in the future, reintroduce it as a fresh design rather than relying on the removed Tencent Cloud path.
|
||||
|
||||
@@ -1,146 +1,12 @@
|
||||
# Tencent Cloud Private Registry Implementation Plan
|
||||
# Tencent Cloud Private Registry Implementation Plan (Removed)
|
||||
|
||||
> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
|
||||
**Status:** Removed on 2026-03-30.
|
||||
|
||||
**Goal:** Add CI that triggers remote builds on a Tencent Cloud CVM and pushes private `backend` and `frontend` images into a self-hosted Docker Registry protected by `htpasswd`, for `dev`, `release`, `release/*`, and `main`.
|
||||
**Goal:** This implementation plan is retained only as historical record. The Tencent Cloud publish path and private registry defaults have been removed from the repository.
|
||||
|
||||
**Architecture:** GitHub Actions runs on pushes to `dev`, `release`, `release/*`, and `main`, connects to the Tencent Cloud server over SSH, syncs the repository into a fixed build directory, and invokes a repository-owned shell script that logs in to the private registry, builds the images locally on the server, tags them according to branch, and pushes them.
|
||||
**Removal Outcome:** The workflow file, remote publish script, and private-registry-based compose defaults have been deleted. Local build-based workflows are now the only repository-owned path.
|
||||
|
||||
**Tech Stack:** GitHub Actions, SSH, Docker, self-hosted `registry:2`, Docker Compose, FastAPI, Node.js
|
||||
|
||||
---
|
||||
|
||||
### Task 1: Replace GHCR Workflow with Tencent Registry Publish Workflow
|
||||
|
||||
**Files:**
|
||||
- Modify: `.github/workflows/publish-images.yml`
|
||||
|
||||
**Step 1: Define push triggers and remote execution secrets**
|
||||
|
||||
Ensure the workflow triggers on pushes to `dev`, `release`, `release/*`, and `main`, and uses repository secrets for SSH host, port, user, SSH key, registry host, registry username, and registry password.
|
||||
|
||||
**Step 2: Sync repository content to the Tencent Cloud server**
|
||||
|
||||
Use an SSH-capable action or shell step to create the remote build directory and copy the current repository contents into `/opt/ctms-build/<repo>`.
|
||||
|
||||
**Step 3: Invoke the remote publish script**
|
||||
|
||||
Run the repository-owned remote script over SSH with environment values for:
|
||||
- branch name
|
||||
- commit SHA
|
||||
- registry host
|
||||
- registry credentials
|
||||
|
||||
**Step 4: Verify workflow structure**
|
||||
|
||||
Run: `ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-images.yml")'`
|
||||
Expected: PASS
|
||||
|
||||
### Task 2: Add Remote Build-And-Push Script
|
||||
|
||||
**Files:**
|
||||
- Create: `scripts/build-and-push-registry.sh`
|
||||
|
||||
**Step 1: Implement branch-aware tag logic**
|
||||
|
||||
For `dev`, compute:
|
||||
- `dev-latest`
|
||||
- `dev-<short_sha>`
|
||||
|
||||
For `release`, compute:
|
||||
- `rc-release`
|
||||
- `rc-<short_sha>`
|
||||
|
||||
For `release/*`, compute:
|
||||
- `rc-<release-branch>`
|
||||
- `rc-<short_sha>`
|
||||
|
||||
For `main`, compute:
|
||||
- `latest`
|
||||
- `sha-<short_sha>`
|
||||
|
||||
Fail fast for unsupported branches.
|
||||
|
||||
**Step 2: Implement registry login and image builds**
|
||||
|
||||
Log in to `${REGISTRY_HOST}` using the supplied username and password, then build:
|
||||
- `${REGISTRY_HOST}/ctms/ctms-backend`
|
||||
- `${REGISTRY_HOST}/ctms/ctms-frontend`
|
||||
|
||||
**Step 3: Push both tags for both images**
|
||||
|
||||
Push every computed tag explicitly so the branch and immutable tags are both published.
|
||||
|
||||
**Step 4: Verify script syntax**
|
||||
|
||||
Run: `bash -n scripts/build-and-push-registry.sh`
|
||||
Expected: PASS
|
||||
|
||||
### Task 3: Point Compose Defaults at the Private Registry
|
||||
|
||||
**Files:**
|
||||
- Modify: `docker-compose.yaml`
|
||||
|
||||
**Step 1: Replace GHCR defaults with private registry defaults**
|
||||
|
||||
Set:
|
||||
- `backend.image` to `${BACKEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-backend:latest}`
|
||||
- `backend-init.image` to `${BACKEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-backend:latest}`
|
||||
- `frontend.image` to `${FRONTEND_IMAGE:-${REGISTRY_HOST:-127.0.0.1:5000}/ctms/ctms-frontend:latest}`
|
||||
|
||||
Keep the current `build:` blocks intact.
|
||||
|
||||
**Step 2: Verify rendered compose**
|
||||
|
||||
Run: `docker compose config`
|
||||
Expected: PASS with private registry image defaults rendered.
|
||||
|
||||
### Task 4: Update Deployment Documentation
|
||||
|
||||
**Files:**
|
||||
- Modify: `README.md`
|
||||
- Modify: `docs/guides/release-checklist.md`
|
||||
|
||||
**Step 1: Document the Tencent registry flow**
|
||||
|
||||
Explain that GitHub Actions triggers remote builds on the Tencent Cloud server and publishes to the private registry at `<IP>:5000`.
|
||||
|
||||
**Step 2: Document deployment commands**
|
||||
|
||||
Show that deployment hosts must run:
|
||||
- `docker login <IP>:5000`
|
||||
- `docker compose pull`
|
||||
- `docker compose run --rm backend-init`
|
||||
- `docker compose up -d`
|
||||
|
||||
**Step 3: Update release checklist**
|
||||
|
||||
Add checks for remote publish success on `dev`, `release`, `release/*`, and `main`, and for deployment-host registry authentication.
|
||||
|
||||
### Task 5: End-To-End Local Verification
|
||||
|
||||
**Files:**
|
||||
- Verify only
|
||||
|
||||
**Step 1: Parse the workflow YAML**
|
||||
|
||||
Run: `ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-images.yml")'`
|
||||
Expected: PASS
|
||||
|
||||
**Step 2: Verify script syntax**
|
||||
|
||||
Run: `bash -n scripts/build-and-push-registry.sh`
|
||||
Expected: PASS
|
||||
|
||||
**Step 3: Render compose**
|
||||
|
||||
Run: `docker compose config`
|
||||
Expected: PASS
|
||||
|
||||
**Step 4: Inspect documentation**
|
||||
|
||||
Run: `sed -n '1,120p' README.md`
|
||||
Expected: PASS with Tencent private registry deployment steps present.
|
||||
|
||||
Run: `sed -n '1,120p' docs/guides/release-checklist.md`
|
||||
Expected: PASS with private registry release verification present.
|
||||
This plan is no longer executable as written because the referenced workflow, script, and compose defaults have been removed.
|
||||
|
||||
Reference in New Issue
Block a user