CI/CD：持续集成与持续部署

什么是工作流？#

工作流是一系列相互关联的步骤或任务的自动化序列，用于完成特定的业务目标。在软件开发中，工作流通常包括：

代码检查：自动运行代码质量检查
测试执行：自动运行单元测试、集成测试
构建打包：自动编译和打包应用程序
部署发布：自动将应用程序部署到目标环境

CI/CD：持续集成与持续部署#

持续集成（CI）#

持续集成是一种开发实践，要求开发人员频繁地（通常是每天多次）将代码集成到主分支中。每次集成都通过自动化构建来验证，包括编译、测试等步骤。

CI的核心原则：

频繁提交代码
自动化构建和测试
快速反馈
保持主分支稳定

持续部署（CD）#

持续部署是持续集成的延伸，指的是将通过所有测试的代码自动部署到生产环境。

CD的两种形式：

持续交付（Continuous Delivery）：自动化部署到预生产环境，手动部署到生产环境
持续部署（Continuous Deployment）：全自动化部署到生产环境

主流工作流平台#

1. GitHub Actions#

GitHub Actions是GitHub提供的CI/CD平台，与GitHub仓库深度集成。

基本配置示例：

1
name: CI/CD Pipeline
2

3
on:
4
  push:
5
    branches: [ main, develop ]
6
  pull_request:
7
    branches: [ main ]
8

9
jobs:
10
  test:
11
    runs-on: ubuntu-latest
12

13
    steps:
14
    - uses: actions/checkout@v3
15

16
    - name: Setup Node.js
17
      uses: actions/setup-node@v3
18
      with:
19
        node-version: '18'
20
        cache: 'npm'
21

22
    - name: Install dependencies
23
      run: npm ci
24

25
    - name: Run tests
26
      run: npm test
27

28
    - name: Run linting
29
      run: npm run lint
30

31
  build:
32
    needs: test
33
    runs-on: ubuntu-latest
34

35
    steps:
36
    - uses: actions/checkout@v3
37

38
    - name: Setup Node.js
39
      uses: actions/setup-node@v3
40
      with:
41
        node-version: '18'
42
        cache: 'npm'
43

44
    - name: Install dependencies
45
      run: npm ci
46

47
    - name: Build application
48
      run: npm run build
49

50
    - name: Upload build artifacts
51
      uses: actions/upload-artifact@v3
52
      with:
53
        name: build-files
54
        path: dist/

2. GitLab CI/CD#

GitLab CI/CD使用.gitlab-ci.yml文件定义工作流。

配置示例：

1
stages:
2
  - test
3
  - build
4
  - deploy
5

6
variables:
7
  NODE_VERSION: "18"
8

9
before_script:
10
  - apt-get update -qq && apt-get install -y -qq git curl
11
  - curl -sL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash -
12
  - apt-get install -y nodejs
13

14
test:
15
  stage: test
16
  script:
17
    - npm ci
18
    - npm run test
19
    - npm run lint
20
  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'
21

22
build:
23
  stage: build
24
  script:
25
    - npm ci
26
    - npm run build
27
  artifacts:
28
    paths:
29
      - dist/
30
    expire_in: 1 hour
31

32
deploy:
33
  stage: deploy
34
  script:
35
    - echo "Deploying application..."
36
    - # 部署脚本
37
  only:
38
    - main

3. Jenkins#

Jenkins是最老牌的CI/CD工具，具有丰富的插件生态系统。

Jenkinsfile示例：

1
pipeline {
2
    agent any
3

4
    tools {
5
        nodejs "18"
6
    }
7

8
    stages {
9
        stage('Checkout') {
10
            steps {
11
                git 'https://github.com/your-repo.git'
12
            }
13
        }
14

15
        stage('Install') {
16
            steps {
17
                sh 'npm ci'
18
            }
19
        }
20

21
        stage('Test') {
22
            parallel {
23
                stage('Unit Tests') {
24
                    steps {
25
                        sh 'npm run test:unit'
26
                    }
27
                }
28
                stage('Linting') {
29
                    steps {
30
                        sh 'npm run lint'
31
                    }
32
                }
33
            }
34
        }
35

36
        stage('Build') {
37
            steps {
38
                sh 'npm run build'
39
                archiveArtifacts artifacts: 'dist/**', fingerprint: true
40
            }
41
        }
42

43
        stage('Deploy') {
44
            when {
45
                branch 'main'
46
            }
47
            steps {
48
                sh 'echo "Deploying to production..."'
49
                // 部署脚本
50
            }
51
        }
52
    }
53

54
    post {
55
        always {
56
            cleanWs()
57
        }
58
        failure {
59
            mail to: 'team@company.com',
60
                 subject: "Build Failed: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
61
                 body: "Build failed. Check console output."
62
        }
63
    }
64
}

工作流最佳实践#

1. 分支策略#

Git Flow策略：

main：生产环境代码
develop：开发分支
feature/*：功能开发分支
release/*：发布准备分支
hotfix/*：紧急修复分支

GitHub Flow策略：

main：始终可部署的代码
feature/*：功能分支，通过PR合并到main

2. 测试策略#

1
# 多层测试策略
2
test-pyramid:
3
  unit-tests:
4
    description: "快速、大量的单元测试"
5
    tools: ["Jest", "Mocha", "Vitest"]
6

7
  integration-tests:
8
    description: "验证组件间协作"
9
    tools: ["Cypress", "Playwright"]
10

11
  e2e-tests:
12
    description: "端到端功能测试"
13
    tools: ["Selenium", "Puppeteer"]

3. 部署策略#

蓝绿部署：

1
deploy:
2
  blue-green:
3
    steps:
4
      - name: "Deploy to Green Environment"
5
        script: deploy-green.sh
6
      - name: "Health Check"
7
        script: health-check.sh
8
      - name: "Switch Traffic"
9
        script: switch-traffic.sh
10
      - name: "Cleanup Blue Environment"
11
        script: cleanup-blue.sh

金丝雀部署：

1
deploy:
2
  canary:
3
    strategy:
4
      canary:
5
        steps:
6
        - setWeight: 10
7
        - pause: {duration: 300s}
8
        - setWeight: 50
9
        - pause: {duration: 300s}
10
        - setWeight: 100

监控和日志#

工作流监控#

1
monitoring:
2
  metrics:
3
    - build_duration
4
    - test_success_rate
5
    - deployment_frequency
6
    - mean_time_to_recovery
7

8
  alerts:
9
    - name: "Build Failure"
10
      condition: "build_status == 'failed'"
11
      notification: "slack, email"
12

13
    - name: "Long Build Time"
14
      condition: "build_duration > 30m"
15
      notification: "slack"

日志管理#

1
logging:
2
  structured_logs:
3
    format: "json"
4
    fields:
5
      - timestamp
6
      - level
7
      - message
8
      - build_id
9
      - commit_hash
10

11
  aggregation:
12
    tools: ["ELK Stack", "Fluentd", "Grafana"]

安全考虑#

密钥管理#

1
secrets:
2
  storage:
3
    - github_secrets
4
    - vault
5
    - k8s_secrets
6

7
  best_practices:
8
    - never_commit_secrets
9
    - rotate_regularly
10
    - principle_of_least_privilege

安全扫描#

1
security_scanning:
2
  dependency_check:
3
    tools: ["npm audit", "Snyk", "OWASP Dependency Check"]
4

5
  code_analysis:
6
    tools: ["SonarQube", "CodeQL", "ESLint Security"]
7

8
  container_scanning:
9
    tools: ["Trivy", "Clair", "Docker Bench"]

工作流优化技巧#

1. 缓存策略#

1
# GitHub Actions缓存示例
2
- name: Cache dependencies
3
  id: cache
4
  uses: actions/cache@v3
5
  with:
6
    path: ~/.npm
7
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
8
    restore-keys: |
9
      ${{ runner.os }}-node-

2. 并行化#

1
# 并行执行测试
2
jobs:
3
  test:
4
    strategy:
5
      matrix:
6
        node-version: [16, 18, 20]
7
        os: [ubuntu-latest, windows-latest, macos-latest]

3. 条件执行#

1
# 只在特定条件下执行
2
- name: Deploy
3
  if: github.ref == 'refs/heads/main'
4
  run: npm run deploy

总结#

工作流是现代软件开发的基石，它通过自动化减少了人为错误，提高了开发效率，并确保了代码质量。选择合适的工作流平台和策略，结合最佳实践，可以显著提升团队的开发体验和产品质量。

记住，好的工作流应该是：

简单易懂：团队成员容易理解和维护
快速反馈：能够快速发现和定位问题
可靠稳定：减少误报和中断
安全可控：确保代码和部署的安全性

通过不断优化和改进工作流，我们可以构建更加高效和可靠的软件开发流程。