@stackonward/cli 1.4.0 → 1.5.1

package/dist/resources/deploy/ci/github/caller.yml

@@ -0,0 +1,41 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+      - test
+      - stage
+      - staging
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Deployment environment
+        required: true
+        type: environment
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-${{ github.repository }}-${{ github.event_name == 'workflow_dispatch' && inputs.environment || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    uses: 1yhy/stackonward/.github/workflows/deploy.yml@{{stackonwardRef}}
+    with:
+      config: deploy.config.json
+      environment: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || (github.ref_name == 'staging' && 'stage' || github.ref_name) }}
+      revision: ${{ github.sha }}
+      stackonward-ref: "{{stackonwardRef}}"
+      # STACKONWARD_DEPLOY_VARIABLES 是按环境名分包的 JSON，不是扁平键。
+      variables: ${{ vars.STACKONWARD_DEPLOY_VARIABLES || '{}' }}
+    secrets:
+      DEPLOY_REGISTRY_HOST: ${{ secrets.DEPLOY_REGISTRY_HOST }}
+      DEPLOY_REGISTRY_USERNAME: ${{ secrets.DEPLOY_REGISTRY_USERNAME }}
+      DEPLOY_REGISTRY_PASSWORD: ${{ secrets.DEPLOY_REGISTRY_PASSWORD }}
+      DEPLOY_SSH_HOST: ${{ secrets.DEPLOY_SSH_HOST }}
+      DEPLOY_SSH_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
+      DEPLOY_SSH_USER: ${{ secrets.DEPLOY_SSH_USER }}
+      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+      DEPLOY_SSH_KNOWN_HOSTS: ${{ secrets.DEPLOY_SSH_KNOWN_HOSTS }}

package/dist/resources/deploy/ci/onedev/import.yml

@@ -0,0 +1,40 @@
+version: 52
+
+imports:
+  - projectPath: platform/stackonward
+    revision: "{{stackonwardRef}}"
+
+# 导入任务从当前构建解析完整提交和不可变制品身份，调用方只覆盖部署意图。
+properties:
+  - name: stackonwardRef
+    value: "{{stackonwardRef}}"
+  - name: deployConfig
+    value: deploy.config.json
+  - name: deployEnvironment
+    value: production
+  - name: deployRegistryNamespace
+    value: unset
+  - name: deployVariables
+    value: "{}"
+
+# 构建页播放键只列出本仓库 jobs。本地 Build 依赖导入的 Release。
+jobs:
+  - name: Build
+    steps:
+      - type: CommandStep
+        name: complete
+        runInContainer: false
+        interpreter:
+          type: PosixInterpreter
+          shell: bash
+          commands: |
+            echo "ok"
+        useTTY: false
+        condition: SUCCESSFUL
+        optional: false
+    jobDependencies:
+      - jobName: StackOnward Release
+        requireSuccessful: true
+        artifacts: deployments/ci/** static-files/**
+    retryCondition: never
+    timeout: 1800

package/dist/resources/deploy/nginx/cache.conf

@@ -0,0 +1,17 @@
+map "$status:$uri" $site_cache_control {
+    default "no-store";
+
+    "~^[0-9]{3}:/api(?:/|$)" "private, no-store";
+    "~*^(?:200|206|304):/(?:service-worker|sw)\.js$" "no-cache, max-age=0, must-revalidate";
+    "~*^(?:200|206|304):/(?:asset-manifest|manifest)\.json$" "no-cache, max-age=0, must-revalidate";
+    "~*^(?:200|206|304):/manifest\.webmanifest$" "no-cache, max-age=0, must-revalidate";
+    "~*^(?:200|206|304):.*\.html?$" "no-cache, max-age=0, must-revalidate";
+
+    "~*^(?:200|206|304):/(?:_nuxt|_next/static)/" "public, max-age=31536000, immutable";
+    "~*^(?:200|206|304):/assets/.*[._-][A-Za-z0-9_-]{8,}\." "public, max-age=31536000, immutable";
+    "~*^(?:200|206|304):.*/[^/]*[._-][0-9a-f]{8,}(?:[._-][^/]*)?\.(?:avif|css|eot|gif|ico|jpe?g|js|json|map|mjs|mp3|mp4|ogg|otf|pdf|png|svg|ttf|wav|webm|webmanifest|webp|woff2?|xml)$" "public, max-age=31536000, immutable";
+
+    "~*^(?:200|206|304):.*\.(?:avif|eot|gif|ico|jpe?g|mp3|mp4|ogg|otf|pdf|png|svg|ttf|wav|webm|webp|woff2?)$" "public, max-age=86400, stale-while-revalidate=604800";
+    "~*^(?:200|206|304):.*\.(?:css|js|json|map|mjs|txt|webmanifest|xml)$" "public, max-age=3600, must-revalidate";
+    "~^(?:200|304):" "no-cache, max-age=0, must-revalidate";
+}

package/dist/resources/deploy/nginx/compression.conf

@@ -0,0 +1,23 @@
+gzip on;
+gzip_static on;
+gzip_vary on;
+gzip_proxied any;
+gzip_comp_level 6;
+gzip_min_length 1024;
+gzip_types
+    application/atom+xml
+    application/javascript
+    application/json
+    application/ld+json
+    application/manifest+json
+    application/rss+xml
+    application/wasm
+    application/xhtml+xml
+    application/xml
+    image/svg+xml
+    text/css
+    text/csv
+    text/javascript
+    text/plain
+    text/vtt
+    text/xml;

package/dist/resources/deploy/nginx/proxy.conf

@@ -0,0 +1,15 @@
+proxy_http_version 1.1;
+proxy_set_header Connection "";
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Host $host;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Port $server_port;
+
+proxy_connect_timeout 5s;
+proxy_send_timeout 60s;
+proxy_read_timeout 60s;
+proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
+proxy_next_upstream_timeout 10s;
+proxy_next_upstream_tries 2;

package/dist/resources/deploy/profiles/go-service/compose.yaml

@@ -0,0 +1,19 @@
+services:
+  app:
+    image: ${DEPLOY_IMAGE:?set DEPLOY_IMAGE to an immutable repository@sha256 digest}
+    pull_policy: always
+    init: true
+    restart: unless-stopped
+    environment:
+      APP_ENV: production
+      APP_HOST: 0.0.0.0
+      APP_PORT: 3100
+    ports:
+      - "${DEPLOY_BIND_ADDRESS:-127.0.0.1}:${DEPLOY_HOST_PORT:-3100}:3100"
+    healthcheck:
+      test: [CMD, wget, -q, --spider, "http://127.0.0.1:3100/health/readiness"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 10s
+    stop_grace_period: 45s

package/dist/resources/deploy/profiles/nuxt-node/Dockerfile

@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:1.7
+
+FROM node:22.22.1-alpine3.23@sha256:8094c002d08262dba12645a3b4a15cd6cd627d30bc782f53229a2ec13ee22a00 AS runtime
+
+ENV NODE_ENV=production
+ENV NITRO_HOST=0.0.0.0
+ENV NITRO_PORT=3000
+
+WORKDIR /app
+
+COPY --chown=node:node .output ./.output
+
+USER node
+
+EXPOSE 3000
+
+CMD ["node", ".output/server/index.mjs"]

package/dist/resources/deploy/profiles/static-files/nginx/site.conf.template

@@ -0,0 +1,55 @@
+# 站点片段由主机 server 块加载；缓存映射必须先在 http 上下文加载。
+root "{{root}}/current";
+index index.html;
+autoindex off;
+etag on;
+
+gzip on;
+gzip_vary on;
+gzip_proxied any;
+gzip_comp_level 6;
+gzip_min_length 1024;
+gzip_types application/javascript application/json application/manifest+json application/wasm image/svg+xml text/css text/javascript text/plain text/xml;
+
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-Frame-Options "SAMEORIGIN" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+location = /api {
+    add_header Cache-Control "private, no-store" always;
+    try_files $uri =404;
+}
+
+location ^~ /api/ {
+    add_header Cache-Control "private, no-store" always;
+    try_files $uri =404;
+}
+
+location ^~ /.well-known/ {
+    try_files $uri =404;
+}
+
+location ~ /\.(?!well-known(?:/|$)) {
+    deny all;
+}
+
+location ~* \.html?$ {
+    add_header Cache-Control "no-cache, max-age=0, must-revalidate" always;
+    try_files $uri =404;
+}
+
+location ~* \.(?:css|js|mjs|json|map|txt|webmanifest|xml)$ {
+    try_files $uri =404;
+    add_header Cache-Control "public, max-age=3600, must-revalidate" always;
+}
+
+location ~* \.(?:avif|eot|gif|ico|jpe?g|mp3|mp4|ogg|otf|pdf|png|svg|ttf|wav|webm|webp|woff2?)$ {
+    try_files $uri =404;
+    add_header Cache-Control "public, max-age=86400, stale-while-revalidate=604800" always;
+}
+
+location / {
+    add_header Cache-Control "no-cache, max-age=0, must-revalidate" always;
+    try_files $uri $uri/ /index.html;
+}

package/dist/resources/deploy/profiles/static-nginx/Dockerfile

@@ -0,0 +1,18 @@
+FROM nginxinc/nginx-unprivileged:1.30.4-alpine@sha256:adf5042a17f4ecdd200c595fa9ffd1be37efb18f89a830bd1a00e4ab4d59d42c
+
+ARG STATIC_OUTPUT=__required__
+
+RUN test "${STATIC_OUTPUT}" != "__required__" \
+    || { echo "STATIC_OUTPUT is required" >&2; exit 64; }
+
+COPY --chown=101:0 deployments/stackonward/nginx/ /etc/nginx/policies/
+COPY --chown=101:0 deployments/stackonward/profiles/static-nginx/nginx/default.conf.template /etc/nginx/templates/default.conf.template
+COPY --chown=101:0 ${STATIC_OUTPUT}/ /usr/share/nginx/html/
+
+RUN printf '%s\n' 'include /etc/nginx/policies/cache.conf;' > /etc/nginx/conf.d/00-cache.conf
+
+USER 101
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget --quiet --tries=1 --spider http://127.0.0.1:8080/ || exit 1

package/dist/resources/deploy/profiles/static-nginx/nginx/default.conf.template

@@ -0,0 +1,28 @@
+server {
+  listen 8080 default_server;
+  listen [::]:8080 default_server;
+  server_name _;
+
+  root /usr/share/nginx/html;
+  index index.html;
+  charset utf-8;
+
+  include /etc/nginx/policies/compression.conf;
+  add_header Cache-Control $site_cache_control always;
+
+  location = /api {
+    return 404;
+  }
+
+  location ^~ /api/ {
+    return 404;
+  }
+
+  location ~* \.(?:avif|css|eot|gif|ico|jpe?g|js|json|map|mjs|mp3|mp4|ogg|otf|pdf|png|svg|ttf|txt|wasm|wav|webmanifest|webm|webp|woff2?|xml|zip)$ {
+    try_files $uri =404;
+  }
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+}

package/dist/resources/deploy/targets/compose-host/deploy.config.example.json

@@ -0,0 +1,114 @@
+{
+  "schemaVersion": 1,
+  "name": "application",
+  "profile": "static-nginx",
+  "source": {
+    "verify": {
+      "executable": "pnpm",
+      "args": ["run", "check"]
+    },
+    "build": {
+      "executable": "pnpm",
+      "args": ["run", "build"]
+    },
+    "output": "dist"
+  },
+  "image": {
+    "dockerfile": "Dockerfile",
+    "context": ".",
+    "repository": "application",
+    "platform": "linux/amd64"
+  },
+  "environments": {
+    "production": {
+      "target": "compose-host",
+      "root": "/srv/application",
+      "compose": ["deployments/compose.yaml"],
+      "rollout": {
+        "strategy": "blue-green",
+        "ports": {
+          "blue": [
+            {
+              "service": "app",
+              "host": "127.0.0.1",
+              "targetPort": 3000,
+              "publishedPort": { "env": "DEPLOY_BLUE_PORT" },
+              "protocol": "tcp"
+            }
+          ],
+          "green": [
+            {
+              "service": "app",
+              "host": "127.0.0.1",
+              "targetPort": 3000,
+              "publishedPort": { "env": "DEPLOY_GREEN_PORT" },
+              "protocol": "tcp"
+            }
+          ]
+        },
+        "previewHealth": {
+          "blue": {
+            "url": { "env": "DEPLOY_BLUE_HEALTH_URL" },
+            "method": "GET",
+            "expectedStatus": 200,
+            "attempts": 12,
+            "intervalMs": 5000,
+            "timeoutMs": 5000
+          },
+          "green": {
+            "url": { "env": "DEPLOY_GREEN_HEALTH_URL" },
+            "method": "GET",
+            "expectedStatus": 200,
+            "attempts": 12,
+            "intervalMs": 5000,
+            "timeoutMs": 5000
+          }
+        },
+        "traffic": {
+          "inspect": {
+            "executable": "/usr/local/bin/stackonward-nginx-traffic",
+            "args": ["inspect"],
+            "env": [
+              "DEPLOY_TRAFFIC_STATE",
+              "DEPLOY_NGINX_UPSTREAM",
+              "DEPLOY_BLUE_PORT",
+              "DEPLOY_GREEN_PORT"
+            ]
+          },
+          "activate": {
+            "executable": "/usr/local/bin/stackonward-nginx-traffic",
+            "args": ["activate"],
+            "env": [
+              "DEPLOY_TRAFFIC_STATE",
+              "DEPLOY_NGINX_UPSTREAM",
+              "DEPLOY_BLUE_PORT",
+              "DEPLOY_GREEN_PORT"
+            ]
+          },
+          "recover": {
+            "executable": "/usr/local/bin/stackonward-nginx-traffic",
+            "args": ["recover"],
+            "env": [
+              "DEPLOY_TRAFFIC_STATE",
+              "DEPLOY_NGINX_UPSTREAM",
+              "DEPLOY_BLUE_PORT",
+              "DEPLOY_GREEN_PORT"
+            ]
+          }
+        }
+      },
+      "health": {
+        "url": "https://deployment.invalid/health",
+        "method": "GET",
+        "expectedStatus": 200,
+        "attempts": 12,
+        "intervalMs": 5000,
+        "timeoutMs": 5000
+      },
+      "retention": {
+        "releases": 5,
+        "buildCacheMax": "10gb"
+      }
+    }
+  }
+}

package/dist/resources/deploy/traffic/nginx/stackonward-nginx-traffic

@@ -0,0 +1,96 @@
+#!/bin/sh
+set -eu
+
+state=${STACKONWARD_TRAFFIC_STATE:?STACKONWARD_TRAFFIC_STATE is required}
+upstream=${STACKONWARD_NGINX_UPSTREAM:?STACKONWARD_NGINX_UPSTREAM is required}
+blue_port=${STACKONWARD_BLUE_PORT:?STACKONWARD_BLUE_PORT is required}
+green_port=${STACKONWARD_GREEN_PORT:?STACKONWARD_GREEN_PORT is required}
+
+read_state() {
+  active=blue
+  release=
+  if [ -f "$state" ]; then
+    active=$(awk -F= '$1 == "active" { print $2 }' "$state")
+    release=$(awk -F= '$1 == "release" { print $2 }' "$state")
+  fi
+  case "$active" in
+    blue|green) ;;
+    *) echo "invalid traffic state" >&2; exit 2 ;;
+  esac
+}
+
+emit() {
+  phase=$1
+  candidate=${2-}
+  printf '{"schemaVersion":1,"status":"succeeded","phase":"%s","active":"%s"' "$phase" "$active"
+  if [ -n "$candidate" ]; then
+    printf ',"candidate":"%s"' "$candidate"
+  fi
+  printf '}\n'
+}
+
+write_route() {
+  slot=$1
+  case "$slot" in
+    blue) port=$blue_port ;;
+    green) port=$green_port ;;
+    *) echo "invalid traffic slot" >&2; exit 2 ;;
+  esac
+  directory=$(dirname "$upstream")
+  mkdir -p "$directory"
+  temporary="$upstream.$$"
+  backup="$upstream.$$.bak"
+  had_upstream=0
+  if [ -f "$upstream" ]; then
+    cp "$upstream" "$backup"
+    had_upstream=1
+  fi
+  printf 'server 127.0.0.1:%s;\n' "$port" > "$temporary"
+  mv -f "$temporary" "$upstream"
+  if ! nginx -t >/dev/null 2>&1 || ! nginx -s reload >/dev/null 2>&1; then
+    rm -f "$temporary"
+    if [ "$had_upstream" -eq 1 ]; then
+      mv -f "$backup" "$upstream"
+      nginx -s reload >/dev/null 2>&1 || true
+    else
+      rm -f "$upstream"
+    fi
+    return 1
+  fi
+  rm -f "$backup"
+}
+
+write_state() {
+  temporary="$state.$$"
+  directory=$(dirname "$state")
+  mkdir -p "$directory"
+  umask 077
+  printf 'active=%s\nrelease=%s\n' "$active" "$release" > "$temporary"
+  mv -f "$temporary" "$state"
+}
+
+read_state
+case "${1-}" in
+  inspect)
+    emit inspect
+    ;;
+  activate|recover)
+    candidate_slot=${STACKONWARD_CANDIDATE_SLOT:?STACKONWARD_CANDIDATE_SLOT is required}
+    candidate_release=${STACKONWARD_CANDIDATE_RELEASE:?STACKONWARD_CANDIDATE_RELEASE is required}
+    previous_active=$active
+    previous_release=$release
+    active=$candidate_slot
+    release=$candidate_release
+    if ! write_route "$active"; then
+      active=$previous_active
+      release=$previous_release
+      exit 1
+    fi
+    write_state
+    emit "$1" "$release"
+    ;;
+  *)
+    echo "usage: stackonward-nginx-traffic inspect|activate|recover" >&2
+    exit 2
+    ;;
+esac