@scemoon/cdh 1.0.8 → 1.0.9-beta.2

package/ai-dlc-skill/providers/aliyun/cli/storage.md

@@ -0,0 +1,315 @@
+# Aliyun CLI: Storage (ossutil)
+
+## When to Use Storage Commands
+
+| Goal | Command | Notes |
+|------|---------|-------|
+| Upload file | `ossutil cp` | Main upload command |
+| Download file | `ossutil cp` | Bidirectional |
+| List files | `ossutil ls` | Path is case-sensitive |
+| Delete file | `ossutil rm` | Permanent deletion |
+| Get metadata | `ossutil stat` | Object info |
+| Generate signed URL | `ossutil sign` | For private buckets |
+| Sync directories | `ossutil sync` | Mirror directories |
+
+## Decision Tree for Storage Operations
+
+```
+Need to work with OSS?
+├── Upload user content → ossutil cp
+├── Download backup/file → ossutil cp
+├── List directory → ossutil ls
+├── Delete old files → ossutil rm
+├── Get public URL → ossutil stat
+├── Large file upload → ossutil cp (multipart)
+└── Sync between buckets → ossutil sync
+```
+
+## Configure ossutil
+
+```bash
+ossutil config
+```
+
+Enter when prompted:
+- AccessKey ID
+- AccessKey Secret
+- Default region (cn-shanghai or other)
+- Output format (json or text)
+
+Or use environment variables:
+```bash
+export ALICLOUD_ACCESS_KEY=your-key
+export ALICLOUD_SECRET_KEY=your-secret
+export ALICLOUD_REGION=cn-shanghai
+```
+
+## List Files
+
+```bash
+ossutil ls oss://my-bucket/
+```
+
+Output:
+```
+LastModifiedTime                   Size(B)  ObjectPath
+2024-01-15 10:30:00 +0800      125000  oss://my-bucket/avatar.jpg
+2024-01-14 15:22:00 +0800     2400000  oss://my-bucket/doc.pdf
+```
+
+### List with Pattern
+
+```bash
+# List all jpg files
+ossutil ls oss://my-bucket/ --pattern "*.jpg"
+
+# List files in specific prefix
+ossutil ls oss://my-bucket/uploads/
+```
+
+### List with Pagination
+
+```bash
+ossutil ls oss://my-bucket/ --max-size 100 --marker <next-marker>
+```
+
+## Upload File
+
+### Basic Upload
+
+```bash
+ossutil cp ./avatar.jpg oss://my-bucket/avatars/avatar.jpg
+```
+
+### Upload with Content-Type
+
+```bash
+ossutil cp ./document.pdf oss://my-bucket/docs/report.pdf \
+  --content-type application/pdf
+```
+
+### Upload Directory
+
+```bash
+ossutil cp -r ./dist oss://my-bucket/ --update
+```
+
+### Upload Options
+
+| Option | Description |
+|--------|-------------|
+| `--update` | Skip if source is older |
+| `--force` | Overwrite without prompt |
+| `--quiet` | Suppress output |
+| `--parallel <num>` | Parallel upload threads |
+| `--part-size <size>` | Multipart size |
+| `--checkpoint-dir <dir>` | Checkpoint file for resume |
+
+### Multipart Upload (Large Files)
+
+```bash
+ossutil cp ./large-file.zip oss://my-bucket/backups/large-file.zip \
+  --part-size 104857600  # 100MB parts
+```
+
+## Download File
+
+### Basic Download
+
+```bash
+ossutil cp oss://my-bucket/avatars/avatar.jpg ./download.jpg
+```
+
+### Download with Progress
+
+```bash
+ossutil cp oss://my-bucket/backups/archive.zip ./archive.zip \
+  --checkpoint-dir ./checkpoint/
+```
+
+## Delete File
+
+### Delete Single File
+
+```bash
+ossutil rm oss://my-bucket/old-file.jpg
+```
+
+### Delete with Confirmation
+
+```bash
+ossutil rm oss://my-bucket/temp/ -r
+```
+
+### Delete by Pattern
+
+```bash
+# Delete all .log files
+ossutil rm oss://my-bucket/logs/ --pattern "*.log"
+```
+
+### Delete Empty Bucket
+
+```bash
+ossutil rm oss://my-bucket/ -a
+```
+
+## Get File URL
+
+### Get Object URL
+
+```bash
+ossutil stat oss://my-bucket/avatars/avatar.jpg
+```
+
+Output:
+```
+Bucket: my-bucket
+Object: /avatars/avatar.jpg
+URL: https://my-bucket.oss-cn-shanghai.aliyuncs.com/avatars/avatar.jpg
+Size: 125000
+LastModified: 2024-01-15 10:30:00
+```
+
+### Generate Signed URL
+
+```bash
+ossutil sign oss://my-bucket/private.pdf --timeout 3600
+```
+
+Returns URL with signature valid for 1 hour.
+
+## Sync Directories
+
+### Sync Local to OSS
+
+```bash
+ossutil sync ./dist oss://my-bucket/ --update
+```
+
+### Sync OSS to OSS
+
+```bash
+ossutil sync oss://bucket1/ oss://bucket2/ --update
+```
+
+### Sync with Delete
+
+```bash
+# Delete files in target not in source
+ossutil sync ./dist oss://my-bucket/ --delete
+```
+
+## Set Object Metadata
+
+### Set Cache-Control
+
+```bash
+ossutil set-meta oss://my-bucket/ \
+  -h "Cache-Control:max-age=31536000" \
+  --object "*.js,*.css"
+```
+
+### Set Content-Type
+
+```bash
+ossutil set-meta oss://my-bucket/images/ \
+  -h "Content-Type:image/webp" \
+  --object "*.jpg"
+```
+
+## Create Bucket
+
+```bash
+ossutil mb oss://new-bucket/
+```
+
+### With Storage Class
+
+```bash
+# Create Infrequent Access bucket
+ossutil mb oss://archive-bucket/ --storage-class IA
+
+# Create Archive bucket
+ossutil mb oss://cold-bucket/ --storage-class Archive
+```
+
+## Bucket Policy
+
+### Set Bucket ACL
+
+```bash
+ossutil set-acl oss://my-bucket/ private
+```
+
+| ACL | Access |
+|-----|--------|
+| `private` | Owner only |
+| `public-read` | Anyone read |
+| `public-read-write` | Anyone read/write |
+| `default` | Inherit from bucket |
+
+## Agent Workflows
+
+### Workflow: Upload User Avatar
+
+```bash
+# 1. Upload file
+ossutil cp ./temp_avatar.jpg \
+  oss://my-bucket/avatars/${userId}/avatar.jpg
+
+# 2. Get public URL
+ossutil stat oss://my-bucket/avatars/${userId}/avatar.jpg
+
+# 3. Return URL to frontend
+```
+
+### Workflow: Backup Database
+
+```bash
+# 1. Export database (pseudo-code)
+mysqldump -h ${RDS_HOST} -u ${RDS_USER} -p > backup.sql
+
+# 2. Compress
+gzip backup.sql
+
+# 3. Upload to OSS
+ossutil cp ./backup.sql.gz \
+  oss://my-bucket/backups/db_$(date +%Y%m%d).sql.gz
+
+# 4. Cleanup local file
+rm backup.sql.gz
+```
+
+### Workflow: Static Site Deployment
+
+```bash
+# 1. Upload all files
+ossutil cp -r ./dist oss://my-bucket/ --force
+
+# 2. Set proper cache headers
+ossutil set-meta oss://my-bucket/ \
+  -h "Cache-Control:max-age=31536000" \
+  --object "*.js,*.css,*.png"
+
+# 3. Set short cache for HTML
+ossutil set-meta oss://my-bucket/ \
+  -h "Cache-Control:no-cache" \
+  --object "*.html"
+
+# 4. Refresh CDN
+aliyun cdn RefreshObjectCaches --ObjectType directory \
+  --ObjectPath http://my-bucket.oss-cn-shanghai.aliyuncs.com/
+```
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| `The bucket you access does not exist` | Wrong bucket name | Check bucket name |
+| `The specified object does not exist` | Wrong object path | Check path case-sensitive |
+| `Permission denied` | No write access | Check RAM policy |
+| `Invalid argument` | Path format wrong | Use `oss://bucket/path` format |
+| `Multipart upload failed` | Network issue | Use `--checkpoint-dir` for resume |
+
+For detailed troubleshooting → `../best-practices/troubleshooting.md`

package/ai-dlc-skill/providers/aliyun/deployment.yaml

@@ -0,0 +1,66 @@
+# Aliyun Stack Deployment
+
+Production deployment pipeline for Aliyun. The default is the unified `deploy_stack` orchestrator; per-component deploys are only allowed into isolated dev sandboxes.
+
+## Environments
+
+| Environment | Purpose | Deploy Trigger | Orchestrator |
+|-------------|---------|----------------|--------------|
+| preview | Per-component + cross-stack e2e | Feature branch | `deploy_stack --preview` |
+| staging | Pre-production stack validation | PR merge to main | `deploy_stack --env staging` |
+| production | Live traffic | Release tag + human approval | `deploy_stack --env production` |
+
+## Stack Deploy Steps
+
+```yaml
+staging:
+  orchestrator: deploy_stack
+  steps:
+    - fun deploy --env staging                   # backend
+    - rds migrate --env staging                  # backend (or tablestore)
+    - oss sync ./dist oss://bucket-staging/      # web
+    - cdn refresh --domain staging.example.com   # web
+    - native build with BACKEND_URL injected     # native
+    - desktop build with BACKEND_URL injected    # desktop
+    - wxa build with BACKEND_URL injected        # wxa
+    - mya build with BACKEND_URL injected        # mya
+    - tta build with BACKEND_URL injected        # tta
+    - smoke-test ${STACK_URL}
+
+production:
+  orchestrator: deploy_stack
+  pre_conditions:
+    - human-approval-gate
+  steps:
+    - fun deploy --env production --publish
+    - rds migrate --env production
+    - oss sync ./dist oss://bucket-production/
+    - cdn refresh --domain example.com
+    - native build with BACKEND_URL injected
+    - desktop build with BACKEND_URL injected
+    - wxa build with BACKEND_URL injected
+    - mya build with BACKEND_URL injected
+    - tta build with BACKEND_URL injected
+    - smoke-test ${PRODUCTION_URL}
+    - health-check ${PRODUCTION_URL}/health
+    - bvt ${PRODUCTION_URL}
+```
+
+## Per-Component Dev Sandbox (allowed)
+
+```bash
+# Personal dev sandbox — one user, one component
+fun deploy --function hello --env dev-${USER}
+oss cp -r ./dist oss://{dev-bucket}/ --update
+# Per-component deploys to shared envs (preview/staging/production) are forbidden
+```
+
+## Stack Rollback
+
+```bash
+# Automatic on BVT failure
+deploy_stack --rollback ${LAST_STABLE_STACK_VERSION} --provider aliyun
+
+# Manual on demand
+deploy_stack --rollback --stack-version v1.2.3 --provider aliyun
+```

package/ai-dlc-skill/providers/aliyun/integration/ci-cd.md

@@ -0,0 +1,288 @@
+# Aliyun CI/CD Integration
+
+## When to Use CI/CD vs Manual Deploy
+
+| Scenario | Approach |
+|----------|----------|
+| Production deployment | CI/CD (automated, audited) |
+| Preview on PR | CI/CD (automatic) |
+| Development iteration | CLI (manual) |
+| Personal sandbox | CLI (manual) |
+
+## CI/CD Decision Tree
+
+```
+Need to automate deployment?
+├── Deploy to preview on PR → GitHub Actions (auto)
+├── Deploy to staging on merge → GitHub Actions (on merge)
+├── Deploy to production on tag → GitHub Actions (on tag + approval)
+└── Development iteration → CLI (manual)
+```
+
+## GitHub Actions Example
+
+### Preview Deployment (on PR)
+
+```yaml
+# .github/workflows/preview.yml
+name: Preview Deployment
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  preview:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Setup Aliyun CLI
+        run: |
+          npm install -g @alicloud/fun
+          npm install -g @serverless-devs/s
+
+      - name: Configure credentials
+        run: |
+          fun config --access-key-id ${{ secrets.ALICLOUD_ACCESS_KEY }}
+          fun config --access-key-secret ${{ secrets.ALICLOUD_SECRET_KEY }}
+          fun config --region cn-shanghai
+
+      - name: Deploy Stack
+        run: deploy_stack --preview --provider aliyun
+        env:
+          ALICLOUD_ACCESS_KEY: ${{ secrets.ALICLOUD_ACCESS_KEY }}
+          ALICLOUD_SECRET_KEY: ${{ secrets.ALICLOUD_SECRET_KEY }}
+
+      - name: Run E2E Tests
+        run: |
+          export STACK_URL=$(deploy_stack --preview --provider aliyun --output url)
+          pytest apps/web/tests/e2e/ --base-url $STACK_URL --api-url $STACK_URL
+```
+
+### Staging Deployment (on merge to main)
+
+```yaml
+# .github/workflows/staging.yml
+name: Staging Deployment
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy-staging:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install tools
+        run: |
+          pip install fun
+          pip install ossutil
+
+      - name: Deploy to Staging
+        run: deploy_stack --env staging --provider aliyun
+        env:
+          ALICLOUD_ACCESS_KEY: ${{ secrets.ALICLOUD_ACCESS_KEY }}
+          ALICLOUD_SECRET_KEY: ${{ secrets.ALICLOUD_SECRET_KEY }}
+          ALICLOUD_REGION: cn-shanghai
+
+      - name: Run Staging E2E
+        run: |
+          export STACK_URL=$(deploy_stack --env staging --output url)
+          pytest aidlc/tests/cross-stack/ --stack-url $STACK_URL
+```
+
+### Production Deployment (on release tag)
+
+```yaml
+# .github/workflows/production.yml
+name: Production Deployment
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  deploy-production:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Deploy to Production
+        run: deploy_stack --env production --provider aliyun
+        env:
+          ALICLOUD_ACCESS_KEY: ${{ secrets.ALICLOUD_ACCESS_KEY }}
+          ALICLOUD_SECRET_KEY: ${{ secrets.ALICLOUD_SECRET_KEY }}
+          ALICLOUD_REGION: cn-shanghai
+
+      - name: Run BVT
+        run: |
+          export PRODUCTION_URL=$(deploy_stack --env production --output url)
+          pytest aidlc/tests/bvt/ --stack-url $PRODUCTION_URL
+```
+
+## Secrets Configuration
+
+In GitHub repository Settings → Secrets:
+
+| Secret | Description |
+|--------|-------------|
+| `ALICLOUD_ACCESS_KEY` | Aliyun AccessKey ID |
+| `ALICLOUD_SECRET_KEY` | Aliyun AccessKey Secret |
+| `ALICLOUD_REGION` | Default region |
+| `OSS_BUCKET` | OSS bucket name |
+| `FC_SERVICE` | Function Compute service name |
+
+## Database Migration in CI/CD
+
+### Migration Workflow
+
+```yaml
+- name: Run RDS Migration
+  run: |
+    mysql -h ${{ secrets.RDS_HOST }} \
+      -P ${{ secrets.RDS_PORT }} \
+      -u ${{ secrets.RDS_USER }} \
+      -p'${{ secrets.RDS_PASSWORD }}' \
+      ${{ secrets.RDS_DATABASE }} < migrations/001.sql
+```
+
+### Migration File Structure
+
+```
+migrations/
+├── 001_create_users.sql
+├── 002_add_indexes.sql
+└── 003_create_orders.sql
+```
+
+## Rollback Strategy
+
+### Automatic Rollback on Failure
+
+```yaml
+- name: Deploy Stack
+  id: deploy
+  run: |
+    if ! deploy_stack --env production --provider aliyun; then
+      echo "Deployment failed, rolling back..."
+      deploy_stack --rollback ${{ env.LAST_STABLE_VERSION }} --provider aliyun
+      exit 1
+    fi
+```
+
+### Manual Rollback
+
+```bash
+# List recent versions
+fun list functions --service my-service
+
+# Rollback specific function
+fun deploy --function hello --service my-service --code-url s3://backup/hello-v1.zip
+```
+
+## Build Environment Injection
+
+### Inject Backend URL during Build
+
+```yaml
+- name: Build Web App
+  run: |
+    cd apps/web
+    BACKEND_URL=${{ env.STACK_URL }} npm run build
+  env:
+    BACKEND_URL: ${{ env.STACK_URL }}
+```
+
+## Cache Strategy
+
+### Cache Node Modules
+
+```yaml
+- name: Cache node_modules
+  uses: actions/cache@v4
+  with:
+    path: node_modules
+    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+```
+
+### Cache Build Artifacts
+
+```yaml
+- name: Cache dist
+  uses: actions/cache@v4
+  with:
+    path: |
+      apps/web/dist
+      apps/backend/functions
+    key: ${{ runner.os }}-build-${{ github.sha }}
+```
+
+## Using serverless devs (s.yaml)
+
+```yaml
+edition: 1.0.0
+services:
+  my-app:
+    component: fc
+    props:
+      region: ${{ ALICLOUD_REGION }}
+      access: default
+      service:
+        name: ${{ FC_SERVICE }}
+      function:
+        name: hello
+        runtime: nodejs16
+        handler: index.handler
+    hooks:
+      post-deploy:
+        - run: ossutil cp -r ./dist oss://${{ OSS_BUCKET }}/ --force
+```
+
+## Best Practices
+
+1. **Separate environments** - preview, staging, production
+2. **Use secrets** - Never hardcode credentials
+3. **Idempotent deploys** - Can be run multiple times safely
+4. **Atomic deployments** - All or nothing
+5. **Rollback plan** - Always have a way to revert
+6. **Test after deploy** - Run smoke tests or BVT
+7. **Notify on failure** - Slack/email on deployment failure
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| `InvalidAccessKeyId` | Secrets not set | Add Aliyun secrets to GitHub |
+| `Deploy timeout` | Build takes too long | Optimize build, increase timeout |
+| `E2E tests fail` | Deployment issue | Check function logs |
+| `RDS connection fails` | Network/VPC issue | Check RDS endpoint and security group |
+
+For general troubleshooting → `../best-practices/troubleshooting.md`