Playbook：CI/CD 流水线模板化——3 个标准模板覆盖 80% 服务的端到端实战

#!/usr/bin/env python3
# pipeline-inventory.py — 盘点所有流水线并按命名前缀归类
import os, sys, csv, re
from alibabacloud_devops20210625.client import Client
from alibabacloud_devops20210625 import models
from alibabacloud_tea_openapi.models import Config

AK = os.environ.get("YUNXIAO_AK") or sys.exit("请设置 YUNXIAO_AK")
SK = os.environ.get("YUNXIAO_SK") or sys.exit("请设置 YUNXIAO_SK")
ORG_ID = os.environ.get("YUNXIAO_ORG_ID") or sys.exit("请设置 YUNXIAO_ORG_ID")

client = Client(Config(
    protocol="https",
    region_id="cn-hangzhou",
    endpoint="devops.cn-hangzhou.aliyuncs.com",
    access_key_id=AK,
    access_key_secret=SK,
))

def classify(name: str) -> str:
    if name.startswith("cn-"):     return "cn-only"
    if name.startswith("us-"):     return "us-only"
    if name.startswith("ai-"):     return "ai-only"
    if re.match(r"^(sandbox|p2s)-", name): return "infra"
    return "unified-or-us"   # 无前缀，二次确认

req = models.ListPipelinesRequest(max_results=200)
all_pipelines, next_token = [], None
while True:
    if next_token: req.next_token = next_token
    resp = client.list_pipelines(ORG_ID, req)
    all_pipelines.extend(resp.body.pipelines)
    next_token = resp.body.next_token
    if not next_token: break

with open("pipeline-inventory.csv", "w", newline="") as f:
    w = csv.writer(f)
    w.writerow(["pipeline_id", "name", "category", "create_time"])
    for p in all_pipelines:
        w.writerow([p.pipeline_id, p.name, classify(p.name), p.create_time])

print(f"共 {len(all_pipelines)} 条流水线，已写入 pipeline-inventory.csv")

$ YUNXIAO_AK=xxx YUNXIAO_SK=yyy YUNXIAO_ORG_ID=zzz python3 pipeline-inventory.py
共 84 条流水线，已写入 pipeline-inventory.csv

$ cut -d, -f3 pipeline-inventory.csv | sort | uniq -c
     47 unified-or-us
     23 cn-only
      4 us-only
      3 ai-only
     11 infra
      2 其他

# pipeline-templates/unified-template.yaml
# 双区统一流水线模板：构建 → QA → 审批 → PRE(US|CN) → 审批 → PROD(US|CN)
# 占位符：${PROJECT} ${SERVICE} ${ORG_NAME} 由 create-pipeline.sh 渲染
name: ${PROJECT}-${SERVICE}

# ========== YAML anchors：高频重复段抽离 ==========
x-anchors:
  deploy-runsOn: &deploy-runsOn
    group: private/o3yZdT0POoGmFbak
    container: build-steps-public-registry.cn-beijing.cr.aliyuncs.com/build-steps/alinux3:latest

  fetch-deploy-script: &fetch-deploy-script
    step: Command
    name: 拉取 deploy.py
    with:
      run: |
        set -euo pipefail
        curl -sf -H "PRIVATE-TOKEN: ${CODEUP_PASSWORD}" \
          "https://codeup.aliyun.com/${ORG_ID}/example-org/gitops/raw/master/scripts/deploy.py" \
          -o deploy.py
        chmod +x deploy.py
        python3 -c "import yaml, requests" || pip install -q pyyaml requests

  ding-success: &ding-success
    plugin: DingTalkPlugin
    triggerState: [success]
    with:
      webhook: ${DING_WEBHOOK}
      secret: ${DING_SECRET}
      customContent: |
        部署成功
        服务：${USER_PROJECT}/${USER_SERVICE}
        环境：${USER_REGION}-${ENV}
        镜像：${USER_TAG}
        提交：${CI_COMMIT_TITLE}
        分支：${CI_COMMIT_REF_NAME}
        执行：${BUILD_EXECUTOR}

  ding-fail: &ding-fail
    plugin: DingTalkPlugin
    triggerState: [fail]
    with:
      webhook: ${DING_WEBHOOK}
      secret: ${DING_SECRET}
      customContent: |
        部署失败
        服务：${USER_PROJECT}/${USER_SERVICE}
        环境：${USER_REGION}-${ENV}
        分支：${CI_COMMIT_REF_NAME}
        日志：${CI_PIPELINE_LOG_URL}

  validators-pre: &validators-pre
    - approver-uid-1
    - approver-uid-2
  validators-prod: &validators-prod
    - approver-uid-1
    - approver-uid-2
    - approver-uid-3

# ========== 代码源 ==========
sources:
  repo_0:
    type: codeup
    name: ${SERVICE}
    endpoint: "https://codeup.aliyun.com/${ORG_NAME}/${PROJECT}/${SERVICE}.git"
    branch: master
    triggerEvents: [push]
    branchesFilter: ^(master|main)$       # 见踩坑 1
    cloneDepth: "0"                       # 见踩坑 2，必须字符串
    certificate:
      type: serviceConnection
      serviceConnection: ${CODEUP_CONN_ID}

# ========== Stages ==========
stages:
  # ---- 1. 构建并双推 ECR + ACR ----
  stage_build:
    name: 构建
    jobs:
      job_build:
        runsOn: *deploy-runsOn
        timeoutMinutes: 30
        steps:
          step_parse:
            step: Command
            name: 解析变量
            with:
              run: |
                set -euo pipefail
                # 流水线名 {PROJECT}-{SERVICE} 拆解
                NAME="${PIPELINE_NAME}"
                PROJECT=$(echo "$NAME" | cut -d'-' -f1)
                SERVICE=$(echo "$NAME" | cut -d'-' -f2-)
                TAG="${CI_COMMIT_SHORT_SHA}-$(date +%Y-%m-%d-%H-%M-%S)"
                echo "USER_PROJECT=$PROJECT"   >> $FLOW_ENV
                echo "USER_SERVICE=$SERVICE"   >> $FLOW_ENV
                echo "USER_TAG=$TAG"           >> $FLOW_ENV
          step_ecr_repo:
            step: Command
            name: 确保 ECR 仓库存在
            with:
              run: |
                set -euo pipefail
                REPO="${USER_PROJECT}/${USER_SERVICE}"
                aws ecr describe-repositories \
                  --repository-names "$REPO" \
                  --region us-west-2 2>/dev/null || \
                  aws ecr create-repository \
                    --repository-name "$REPO" \
                    --region us-west-2 \
                    --image-scanning-configuration scanOnPush=true
          step_build:
            step: DockerBuildPush
            name: 构建并推送
            with:
              dockerfilePath: gitops/dockerfiles/${USER_PROJECT}/${USER_SERVICE}.Dockerfile
              contextPath: .
              imageNames:
                - "${ECR_REGISTRY}/${USER_PROJECT}/${USER_SERVICE}:${USER_TAG}"
                - "${ECR_REGISTRY}/${USER_PROJECT}/${USER_SERVICE}:latest"
                - "${ACR_REGISTRY}/${USER_PROJECT}/${USER_SERVICE}:${USER_TAG}"
                - "${ACR_REGISTRY}/${USER_PROJECT}/${USER_SERVICE}:latest"
              buildArgs: "REGISTRY_PREFIX=${ECR_REGISTRY}"
        plugins:
          - <<: *ding-fail
            name: 构建失败通知

  # ---- 2. QA 部署（仅 US-QA，CN 没有 QA 环境）----
  stage_qa:
    name: QA 部署
    needs: [stage_build]
    jobs:
      job_us_qa:
        runsOn: *deploy-runsOn
        timeoutMinutes: 20
        steps:
          step_fetch: *fetch-deploy-script
          step_deploy:
            step: Command
            name: 部署 us-qa
            with:
              run: |
                set -euo pipefail
                export ENV=qa
                python3 deploy.py \
                  --region us --env qa \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins:
          - <<: *ding-success
          - <<: *ding-fail

  # ---- 3. PRE 审批 ----
  stage_approve_pre:
    name: PRE 审批
    needs: [stage_qa]
    jobs:
      job_approve_pre:
        component: ManualValidate
        with:
          validators: *validators-pre
          message: "请审批 PRE 部署：${USER_PROJECT}/${USER_SERVICE}@${USER_TAG}"

  # ---- 4. PRE 部署（同 stage 双 job → UI 渲染双线，见踩坑 4）----
  stage_pre:
    name: PRE 部署
    needs: [stage_approve_pre]
    jobs:
      job_us_pre:
        runsOn: *deploy-runsOn
        timeoutMinutes: 20
        steps:
          step_fetch: *fetch-deploy-script
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=pre
                python3 deploy.py --region us --env pre \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins:
          - <<: *ding-success
          - <<: *ding-fail
      job_cn_pre:
        runsOn: *deploy-runsOn
        timeoutMinutes: 20
        steps:
          step_fetch: *fetch-deploy-script
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=pre
                python3 deploy.py --region cn --env pre \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins:
          - <<: *ding-success
          - <<: *ding-fail

  # ---- 5. PROD 审批 ----
  stage_approve_prod:
    name: PROD 审批
    needs: [stage_pre]
    jobs:
      job_approve_prod:
        component: ManualValidate
        with:
          validators: *validators-prod
          message: "请审批 PROD 部署：${USER_PROJECT}/${USER_SERVICE}@${USER_TAG}"

  # ---- 6. PROD 部署 ----
  stage_prod:
    name: PROD 部署
    needs: [stage_approve_prod]
    jobs:
      job_us_prod:
        runsOn: *deploy-runsOn
        timeoutMinutes: 30
        steps:
          step_fetch: *fetch-deploy-script
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=prod
                python3 deploy.py --region us --env prod \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins:
          - <<: *ding-success
          - <<: *ding-fail
      job_cn_prod:
        runsOn: *deploy-runsOn
        timeoutMinutes: 30
        steps:
          step_fetch: *fetch-deploy-script
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=prod
                python3 deploy.py --region cn --env prod \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins:
          - <<: *ding-success
          - <<: *ding-fail

# 用 yamllint 校验语法
$ yamllint -d "{extends: default, rules: {line-length: disable}}" \
    gitops/pipeline-templates/unified-template.yaml
# 无输出即通过

# 用 yq 验证 anchors 解析正确
$ yq '.stages.stage_pre.jobs.job_us_pre.plugins | length' \
    gitops/pipeline-templates/unified-template.yaml
2

# pipeline-templates/us-only-template.yaml
name: us-${PROJECT}-${SERVICE}

x-anchors:
  deploy-runsOn: &deploy-runsOn
    group: private/o3yZdT0POoGmFbak
    container: build-steps-public-registry.cn-beijing.cr.aliyuncs.com/build-steps/alinux3:latest
  ding-success: &ding-success
    plugin: DingTalkPlugin
    triggerState: [success]
    with:
      webhook: ${DING_WEBHOOK}
      secret: ${DING_SECRET}
      customContent: "部署成功 ${USER_PROJECT}/${USER_SERVICE} us-${ENV} ${USER_TAG}"
  ding-fail: &ding-fail
    plugin: DingTalkPlugin
    triggerState: [fail]
    with:
      webhook: ${DING_WEBHOOK}
      secret: ${DING_SECRET}
      customContent: "部署失败 ${USER_PROJECT}/${USER_SERVICE} us-${ENV}"
  validators: &validators
    - approver-uid-1
    - approver-uid-2

sources:
  repo_0:
    type: codeup
    endpoint: "https://codeup.aliyun.com/${ORG_NAME}/${PROJECT}/${SERVICE}.git"
    branch: master
    triggerEvents: [push]
    branchesFilter: ^(master|main)$
    cloneDepth: "0"
    certificate:
      type: serviceConnection
      serviceConnection: ${CODEUP_CONN_ID}

stages:
  stage_build:
    name: 构建（仅 ECR）
    jobs:
      job_build:
        runsOn: *deploy-runsOn
        steps:
          step_parse:
            step: Command
            with:
              run: |
                set -euo pipefail
                NAME="${PIPELINE_NAME#us-}"   # 去掉 us- 前缀
                PROJECT=$(echo "$NAME" | cut -d'-' -f1)
                SERVICE=$(echo "$NAME" | cut -d'-' -f2-)
                echo "USER_PROJECT=$PROJECT" >> $FLOW_ENV
                echo "USER_SERVICE=$SERVICE" >> $FLOW_ENV
                echo "USER_TAG=${CI_COMMIT_SHORT_SHA}-$(date +%Y-%m-%d-%H-%M-%S)" >> $FLOW_ENV
          step_build:
            step: DockerBuildPush
            with:
              dockerfilePath: gitops/dockerfiles/${USER_PROJECT}/${USER_SERVICE}.Dockerfile
              imageNames:
                - "${ECR_REGISTRY}/${USER_PROJECT}/${USER_SERVICE}:${USER_TAG}"
                - "${ECR_REGISTRY}/${USER_PROJECT}/${USER_SERVICE}:latest"

  stage_qa:
    name: QA
    needs: [stage_build]
    jobs:
      job_qa:
        runsOn: *deploy-runsOn
        steps:
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=qa
                python3 deploy.py --region us --env qa \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins: [*ding-success, *ding-fail]

  stage_approve_pre:
    name: PRE 审批
    needs: [stage_qa]
    jobs:
      job_approve:
        component: ManualValidate
        with:
          validators: *validators

  stage_pre:
    name: PRE
    needs: [stage_approve_pre]
    jobs:
      job_pre:
        runsOn: *deploy-runsOn
        steps:
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=pre
                python3 deploy.py --region us --env pre \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins: [*ding-success, *ding-fail]

  stage_approve_prod:
    name: PROD 审批
    needs: [stage_pre]
    jobs:
      job_approve:
        component: ManualValidate
        with:
          validators: *validators

  stage_prod:
    name: PROD
    needs: [stage_approve_prod]
    jobs:
      job_prod:
        runsOn: *deploy-runsOn
        steps:
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=prod
                python3 deploy.py --region us --env prod \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins: [*ding-success, *ding-fail]

# pipeline-templates/cn-only-template.yaml
name: cn-${PROJECT}-${SERVICE}

x-anchors:
  cn-runsOn: &cn-runsOn
    group: public/cn-beijing
    container: build-steps-public-registry.cn-beijing.cr.aliyuncs.com/build-steps/alinux3:latest
    enableDockerDaemon: true
  ding-success: &ding-success
    plugin: DingTalkPlugin
    triggerState: [success]
    with:
      webhook: ${DING_WEBHOOK_CN}
      secret: ${DING_SECRET_CN}
      customContent: "CN 部署成功 ${USER_PROJECT}/${USER_SERVICE} ${ENV} ${USER_TAG}"
  ding-fail: &ding-fail
    plugin: DingTalkPlugin
    triggerState: [fail]
    with:
      webhook: ${DING_WEBHOOK_CN}
      secret: ${DING_SECRET_CN}
      customContent: "CN 部署失败 ${USER_PROJECT}/${USER_SERVICE} ${ENV}"
  validators: &validators
    - cn-approver-uid-1

sources:
  repo_0:
    type: codeup
    endpoint: "https://codeup.aliyun.com/${ORG_NAME}/${PROJECT}/${SERVICE}.git"
    branch: master
    triggerEvents: [push]
    branchesFilter: ^(master|main)$
    cloneDepth: "1"   # CN 浅克隆加速

stages:
  stage_build:
    name: 构建（手动 docker push 到 ACR）
    jobs:
      job_build:
        runsOn: *cn-runsOn
        steps:
          step_parse:
            step: Command
            with:
              run: |
                set -euo pipefail
                NAME="${PIPELINE_NAME#cn-}"
                PROJECT=$(echo "$NAME" | cut -d'-' -f1)
                SERVICE=$(echo "$NAME" | cut -d'-' -f2-)
                echo "USER_PROJECT=$PROJECT" >> $FLOW_ENV
                echo "USER_SERVICE=$SERVICE" >> $FLOW_ENV
                echo "USER_TAG=${CI_COMMIT_SHORT_SHA}-$(date +%Y-%m-%d-%H-%M-%S)" >> $FLOW_ENV
          step_build:
            step: Command
            with:
              run: |
                set -euo pipefail
                # 1. ACR 登录
                docker login -u ${ALIYUN_AK} -p ${ALIYUN_SK} ${ACR_REGISTRY}
                IMG="${ACR_REGISTRY}/${USER_PROJECT}/${USER_SERVICE}"
                # 2. cache pull（忽略失败）
                docker pull "${IMG}:cache" || true
                # 3. 构建（注入 CN 镜像源）
                docker build \
                  --cache-from "${IMG}:cache" \
                  --build-arg REGISTRY_PREFIX=${ACR_REGISTRY} \
                  --build-arg NPM_REGISTRY=https://registry.npmmirror.com \
                  --build-arg PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/ \
                  --build-arg GOPROXY=https://goproxy.cn,direct \
                  -f gitops/dockerfiles/${USER_PROJECT}/${USER_SERVICE}.Dockerfile \
                  -t "${IMG}:${USER_TAG}" \
                  -t "${IMG}:latest" \
                  -t "${IMG}:cache" \
                  .
                # 4. 双 push
                docker push "${IMG}:${USER_TAG}"
                docker push "${IMG}:latest"
                docker push "${IMG}:cache"

  stage_pre:
    name: CN PRE
    needs: [stage_build]
    jobs:
      job_pre:
        runsOn: *cn-runsOn
        steps:
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=pre
                python3 deploy.py --region cn --env pre \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins: [*ding-success, *ding-fail]

  stage_approve_prod:
    name: CN PROD 审批
    needs: [stage_pre]
    jobs:
      job_approve:
        component: ManualValidate
        with:
          validators: *validators

  stage_prod:
    name: CN PROD
    needs: [stage_approve_prod]
    jobs:
      job_prod:
        runsOn: *cn-runsOn
        steps:
          step_deploy:
            step: Command
            with:
              run: |
                set -euo pipefail
                export ENV=prod
                python3 deploy.py --region cn --env prod \
                  --project "${USER_PROJECT}" --service "${USER_SERVICE}" \
                  --tag "${USER_TAG}" --action all
        plugins: [*ding-success, *ding-fail]

# .github/workflows/_unified-template.yml
name: Unified Pipeline (reusable)

on:
  workflow_call:
    inputs:
      project:    { required: true,  type: string }
      service:    { required: true,  type: string }
      branch:     { required: false, type: string, default: "main" }
      regions:    { required: false, type: string, default: "us,cn" }
    secrets:
      AWS_ROLE_ARN:  { required: true }
      ACR_USER:      { required: true }
      ACR_PASS:      { required: true }
      DING_WEBHOOK:  { required: true }
      DING_SECRET:   { required: true }

permissions:
  id-token: write       # OIDC
  contents: read

jobs:
  # ---------- 构建并双推 ----------
  build:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.parse.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
      - id: parse
        run: |
          set -euo pipefail
          TAG="${GITHUB_SHA::7}-$(date +%Y%m%d-%H%M%S)"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-west-2
      - uses: aws-actions/amazon-ecr-login@v2
        id: ecr
      - name: ACR login
        run: |
          echo "${{ secrets.ACR_PASS }}" | \
            docker login -u "${{ secrets.ACR_USER }}" \
            --password-stdin example-acr-registry.cn-beijing.cr.aliyuncs.com
      - uses: ./.github/actions/docker-build-push   # composite action，见下
        with:
          project:  ${{ inputs.project }}
          service:  ${{ inputs.service }}
          tag:      ${{ steps.parse.outputs.tag }}
          ecr:      ${{ steps.ecr.outputs.registry }}
          acr:      example-acr-registry.cn-beijing.cr.aliyuncs.com

  # ---------- QA（仅 US）----------
  qa:
    needs: build
    if: contains(inputs.regions, 'us')
    uses: ./.github/workflows/_deploy.yml
    with:
      region:  us
      env:     qa
      project: ${{ inputs.project }}
      service: ${{ inputs.service }}
      tag:     ${{ needs.build.outputs.tag }}
    secrets: inherit

  # ---------- PRE 审批（GitHub Environment 提供）----------
  approve-pre:
    needs: qa
    runs-on: ubuntu-latest
    environment: pre-approval     # 在 repo settings → Environments 配 reviewers
    steps:
      - run: echo "PRE approved"

  # ---------- PRE 部署（matrix 多区并行 → UI 直接显示并行 job）----------
  pre:
    needs: approve-pre
    strategy:
      matrix:
        region: ${{ fromJSON(format('[{0}]', inputs.regions == 'us,cn' && '"us","cn"' || inputs.regions == 'us' && '"us"' || '"cn"')) }}
    uses: ./.github/workflows/_deploy.yml
    with:
      region:  ${{ matrix.region }}
      env:     pre
      project: ${{ inputs.project }}
      service: ${{ inputs.service }}
      tag:     ${{ needs.build.outputs.tag }}
    secrets: inherit

  # ---------- PROD 审批 ----------
  approve-prod:
    needs: pre
    runs-on: ubuntu-latest
    environment: prod-approval
    steps:
      - run: echo "PROD approved"

  # ---------- PROD 部署 ----------
  prod:
    needs: approve-prod
    strategy:
      matrix:
        region: ${{ fromJSON(format('[{0}]', inputs.regions == 'us,cn' && '"us","cn"' || inputs.regions == 'us' && '"us"' || '"cn"')) }}
    uses: ./.github/workflows/_deploy.yml
    with:
      region:  ${{ matrix.region }}
      env:     prod
      project: ${{ inputs.project }}
      service: ${{ inputs.service }}
      tag:     ${{ needs.build.outputs.tag }}
    secrets: inherit

# .github/workflows/_deploy.yml
on:
  workflow_call:
    inputs:
      region:  { required: true, type: string }
      env:     { required: true, type: string }
      project: { required: true, type: string }
      service: { required: true, type: string }
      tag:     { required: true, type: string }
    secrets:
      AWS_ROLE_ARN: { required: true }
      DING_WEBHOOK: { required: true }
      DING_SECRET:  { required: true }

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-west-2
      - name: deploy
        run: |
          set -euo pipefail
          python3 scripts/deploy.py \
            --region "${{ inputs.region }}" --env "${{ inputs.env }}" \
            --project "${{ inputs.project }}" --service "${{ inputs.service }}" \
            --tag "${{ inputs.tag }}" --action all
      - name: 钉钉通知（始终运行）
        if: always()
        uses: ./.github/actions/dingtalk
        with:
          webhook:  ${{ secrets.DING_WEBHOOK }}
          secret:   ${{ secrets.DING_SECRET }}
          state:    ${{ job.status }}
          project:  ${{ inputs.project }}
          service:  ${{ inputs.service }}
          env:      ${{ inputs.region }}-${{ inputs.env }}
          tag:      ${{ inputs.tag }}

# 仓库 service-foo/.github/workflows/release.yml
name: Release service-foo
on:
  push:
    branches: [main]

jobs:
  pipeline:
    uses: my-org/.github/.github/workflows/_unified-template.yml@v1
    with:
      project: productA
      service: service-foo
      regions: "us,cn"
    secrets: inherit

// vars/unifiedPipeline.groovy
def call(Map cfg) {
    // cfg 必填: project, service; 可选: regions=['us','cn'], branch='main'
    assert cfg.project : 'project 必填'
    assert cfg.service : 'service 必填'
    cfg.regions = cfg.regions ?: ['us', 'cn']

    pipeline {
        agent { label 'docker' }
        options {
            timeout(time: 60, unit: 'MINUTES')
            timestamps()
            ansiColor('xterm')
        }
        environment {
            USER_PROJECT = "${cfg.project}"
            USER_SERVICE = "${cfg.service}"
            USER_TAG     = sh(returnStdout: true, script: """
                echo "${env.GIT_COMMIT.take(7)}-\$(date +%Y%m%d-%H%M%S)"
            """).trim()
        }
        stages {
            stage('Build') {
                steps {
                    dockerBuildPush(
                        project: cfg.project,
                        service: cfg.service,
                        tag:     env.USER_TAG,
                        regions: cfg.regions
                    )
                }
                post { failure { dingtalkNotify(state: 'fail',  stage: 'build', cfg: cfg) } }
            }

            stage('QA') {
                when { expression { 'us' in cfg.regions } }
                steps { deployStep(region: 'us', env: 'qa', cfg: cfg, tag: env.USER_TAG) }
                post {
                    success { dingtalkNotify(state: 'success', stage: 'us-qa', cfg: cfg) }
                    failure { dingtalkNotify(state: 'fail',    stage: 'us-qa', cfg: cfg) }
                }
            }

            stage('Approve PRE') {
                steps {
                    timeout(time: 4, unit: 'HOURS') {
                        input(
                            message: "审批 PRE 部署：${cfg.project}/${cfg.service}@${env.USER_TAG}",
                            submitter: 'approver-1,approver-2'
                        )
                    }
                }
            }

            stage('PRE') {
                parallel {
                    stage('us-pre') {
                        when { expression { 'us' in cfg.regions } }
                        steps { deployStep(region: 'us', env: 'pre', cfg: cfg, tag: env.USER_TAG) }
                    }
                    stage('cn-pre') {
                        when { expression { 'cn' in cfg.regions } }
                        steps { deployStep(region: 'cn', env: 'pre', cfg: cfg, tag: env.USER_TAG) }
                    }
                }
                post {
                    success { dingtalkNotify(state: 'success', stage: 'pre', cfg: cfg) }
                    failure { dingtalkNotify(state: 'fail',    stage: 'pre', cfg: cfg) }
                }
            }

            stage('Approve PROD') {
                steps {
                    timeout(time: 24, unit: 'HOURS') {
                        input(
                            message: "审批 PROD 部署：${cfg.project}/${cfg.service}@${env.USER_TAG}",
                            submitter: 'approver-1,approver-2,approver-3'
                        )
                    }
                }
            }

            stage('PROD') {
                parallel {
                    stage('us-prod') {
                        when { expression { 'us' in cfg.regions } }
                        steps { deployStep(region: 'us', env: 'prod', cfg: cfg, tag: env.USER_TAG) }
                    }
                    stage('cn-prod') {
                        when { expression { 'cn' in cfg.regions } }
                        steps { deployStep(region: 'cn', env: 'prod', cfg: cfg, tag: env.USER_TAG) }
                    }
                }
                post {
                    success { dingtalkNotify(state: 'success', stage: 'prod', cfg: cfg) }
                    failure { dingtalkNotify(state: 'fail',    stage: 'prod', cfg: cfg) }
                }
            }
        }
    }
}

// vars/deployStep.groovy
def call(Map args) {
    // args: region, env, cfg, tag
    withCredentials([
        [$class: 'AmazonWebServicesCredentialsBinding', credentialsId: 'aws-role'],
        string(credentialsId: 'argocd-token-${args.region}', variable: 'ARGOCD_TOKEN')
    ]) {
        sh """
            set -euo pipefail
            python3 scripts/deploy.py \\
              --region ${args.region} --env ${args.env} \\
              --project ${args.cfg.project} --service ${args.cfg.service} \\
              --tag ${args.tag} --action all
        """
    }
}

// vars/dingtalkNotify.groovy
def call(Map args) {
    // args: state ('success'|'fail'), stage, cfg
    def emoji = args.state == 'success' ? '[OK]' : '[FAIL]'
    def text = """
${emoji} ${args.stage}
服务：${args.cfg.project}/${args.cfg.service}
分支：${env.GIT_BRANCH}
镜像：${env.USER_TAG}
执行：${env.BUILD_USER ?: 'jenkins'}
日志：${env.BUILD_URL}
""".trim()
    withCredentials([string(credentialsId: 'dingtalk-webhook', variable: 'WEBHOOK')]) {
        sh """
            curl -fsS -X POST "\$WEBHOOK" \\
              -H 'Content-Type: application/json' \\
              -d '{"msgtype":"text","text":{"content":${groovy.json.JsonOutput.toJson(text)}}}'
        """
    }
}

// service-foo/Jenkinsfile
@Library('shared@v1') _

unifiedPipeline(
    project: 'productA',
    service: 'service-foo',
    regions: ['us', 'cn']
)

#!/usr/bin/env python3
# bind-variable-groups.py — 批量给流水线绑定变量组
# 用法：./bind-variable-groups.py <pipeline_id> <var_group_id_1>,<var_group_id_2>,...
import os, sys, requests

YUNXIAO_TOKEN = os.environ.get("YUNXIAO_USER_TOKEN") or sys.exit("需设置 YUNXIAO_USER_TOKEN")
ORG_ID = os.environ.get("YUNXIAO_ORG_ID") or sys.exit("需设置 YUNXIAO_ORG_ID")
SESSION_COOKIE = os.environ.get("YUNXIAO_SESSION") or sys.exit("需设置 YUNXIAO_SESSION（浏览器 F12 拷）")

def bind(pipeline_id: str, group_ids: list[int]):
    url = f"https://flow.aliyun.com/pipelines/{pipeline_id}/variableGroups"
    headers = {
        "Cookie": SESSION_COOKIE,
        "x-yunxiao-organization-id": ORG_ID,
        "Content-Type": "application/json",
    }
    payload = {"variableGroupIds": group_ids}
    r = requests.post(url, json=payload, headers=headers, timeout=15)
    r.raise_for_status()
    print(f"[OK] pipeline {pipeline_id} 已绑定变量组 {group_ids}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"用法：{sys.argv[0]} <pipeline_id> <gid1,gid2,...>")
        sys.exit(1)
    bind(sys.argv[1], [int(x) for x in sys.argv[2].split(",") if x])

from alibabacloud_devops20210625 import models as devops_models
req = devops_models.AddPipelineRelationsRequest(
    rel_object_type="VARIABLE_GROUP",   # 必须大写
    rel_object_ids="37753"
)
client.add_pipeline_relations(ORG_ID, str(pipeline_id), req)

#!/bin/bash
# var-group-snapshot.sh — 把变量组快照到 git
set -euo pipefail
GROUPS=(37753 37529 37532)
OUT=gitops/variable-groups
mkdir -p "$OUT"
for gid in "${GROUPS[@]}"; do
    python3 -c "
from alibabacloud_devops20210625.client import Client
from alibabacloud_devops20210625 import models
from alibabacloud_tea_openapi.models import Config
import json, os
c = Client(Config(protocol='https', region_id='cn-hangzhou',
    endpoint='devops.cn-hangzhou.aliyuncs.com',
    access_key_id=os.environ['YUNXIAO_AK'], access_key_secret=os.environ['YUNXIAO_SK']))
resp = c.get_variable_group(os.environ['YUNXIAO_ORG_ID'], '$gid')
# 脱敏：value 字段统一替换
data = resp.body.to_map()
for v in data.get('variables', []):
    if v.get('isEncrypted'): v['value'] = '<MASKED>'
print(json.dumps(data, indent=2, ensure_ascii=False))
" > "$OUT/$gid.json"
done

cd gitops && git add variable-groups && \
  git commit -m "snapshot: variable-groups @ $(date +%F)" && \
  git push

#!/bin/bash
# create-pipeline.sh — 一条命令创建新服务流水线
# 用法：./create-pipeline.sh -p productA -s service-foo -t unified -b main
set -euo pipefail

PROJECT=""; SERVICE=""; TYPE="unified"; BRANCH="main"; ORG_NAME=""
DRY_RUN=false
while getopts "p:s:t:b:o:n" opt; do
    case $opt in
        p) PROJECT="$OPTARG" ;;
        s) SERVICE="$OPTARG" ;;
        t) TYPE="$OPTARG" ;;       # unified | us-only | cn-only | unified-canary
        b) BRANCH="$OPTARG" ;;
        o) ORG_NAME="$OPTARG" ;;
        n) DRY_RUN=true ;;
        *) echo "用法：$0 -p <project> -s <service> -t <type> -b <branch> [-o <org_name>] [-n dry-run]"; exit 1 ;;
    esac
done

[[ -z "$PROJECT" || -z "$SERVICE" ]] && { echo "需要 -p 和 -s"; exit 1; }
[[ ! "$TYPE" =~ ^(unified|us-only|cn-only|unified-canary)$ ]] && { echo "type 必须是 unified/us-only/cn-only/unified-canary"; exit 1; }
[[ ! "$BRANCH" =~ ^(main|master)$ ]] && { echo "branch 必须是 main 或 master"; exit 1; }

# 依赖检查
command -v python3 >/dev/null || { echo "需要 python3"; exit 1; }
python3 -c "import alibabacloud_devops20210625, jinja2" 2>/dev/null \
  || { echo "缺依赖：pip install alibabacloud-devops20210625==2.0.0 jinja2"; exit 1; }
[[ -n "${YUNXIAO_AK:-}" && -n "${YUNXIAO_SK:-}" && -n "${YUNXIAO_ORG_ID:-}" ]] \
  || { echo "需要环境变量 YUNXIAO_AK / YUNXIAO_SK / YUNXIAO_ORG_ID"; exit 1; }

TEMPLATE_DIR="$(dirname "$0")/../pipeline-templates"
TEMPLATE_FILE="$TEMPLATE_DIR/$TYPE-template.yaml"
[[ -f "$TEMPLATE_FILE" ]] || { echo "模板不存在：$TEMPLATE_FILE"; exit 1; }

# 渲染流水线 yaml
RENDERED=$(mktemp /tmp/pipeline-XXXX.yaml)
trap 'rm -f "$RENDERED"' EXIT
python3 - <<PY
import jinja2
env = jinja2.Environment(
    loader=jinja2.FileSystemLoader("$TEMPLATE_DIR"),
    undefined=jinja2.StrictUndefined,
    keep_trailing_newline=True
)
tmpl = env.get_template("$TYPE-template.yaml")
out = tmpl.render(
    PROJECT="$PROJECT",
    SERVICE="$SERVICE",
    BRANCH="$BRANCH",
    ORG_NAME="${ORG_NAME:-example}"
)
open("$RENDERED", "w").write(out)
PY

# 模板渲染合法性校验
python3 -c "import yaml; yaml.safe_load(open('$RENDERED'))" \
  || { echo "[FAIL] 渲染后的 yaml 无效"; cat "$RENDERED"; exit 1; }

if $DRY_RUN; then
    echo "===== DRY RUN: 渲染结果 ====="
    cat "$RENDERED"
    exit 0
fi

# 调云效 API 创建
PIPELINE_ID=$(python3 - <<PY
from alibabacloud_devops20210625.client import Client
from alibabacloud_devops20210625 import models
from alibabacloud_tea_openapi.models import Config
import os
c = Client(Config(protocol="https", region_id="cn-hangzhou",
    endpoint="devops.cn-hangzhou.aliyuncs.com",
    access_key_id=os.environ["YUNXIAO_AK"],
    access_key_secret=os.environ["YUNXIAO_SK"]))
prefix = {"unified": "", "unified-canary": "", "us-only": "us-", "cn-only": "cn-"}["$TYPE"]
name = f"{prefix}$PROJECT-$SERVICE"
content = open("$RENDERED").read()
resp = c.create_pipeline(os.environ["YUNXIAO_ORG_ID"],
    models.CreatePipelineRequest(name=name, content=content))
# 注意 typo: pipelin_id（云效 SDK 字段名）
print(resp.body.pipelin_id)
PY
)
echo "[OK] 流水线已创建：pipeline_id=$PIPELINE_ID"

# 关联变量组
case "$TYPE" in
    unified|unified-canary) VAR_GROUPS="37753,37529,37532" ;;
    us-only)                VAR_GROUPS="37753,37529" ;;
    cn-only)                VAR_GROUPS="37753,37532" ;;
esac

for gid in ${VAR_GROUPS//,/ }; do
    python3 - <<PY
from alibabacloud_devops20210625.client import Client
from alibabacloud_devops20210625 import models
from alibabacloud_tea_openapi.models import Config
import os
c = Client(Config(protocol="https", region_id="cn-hangzhou",
    endpoint="devops.cn-hangzhou.aliyuncs.com",
    access_key_id=os.environ["YUNXIAO_AK"],
    access_key_secret=os.environ["YUNXIAO_SK"]))
c.add_pipeline_relations(os.environ["YUNXIAO_ORG_ID"], "$PIPELINE_ID",
    models.AddPipelineRelationsRequest(rel_object_type="VARIABLE_GROUP", rel_object_ids="$gid"))
print(f"[OK] 已绑定变量组 $gid")
PY
done

# 备份 yaml 到 gitops/pipelines/
BACKUP_DIR="$(dirname "$0")/../pipelines"
mkdir -p "$BACKUP_DIR"
cp "$RENDERED" "$BACKUP_DIR/${PROJECT}-${SERVICE}.yaml"
echo "[OK] 已备份到 $BACKUP_DIR/${PROJECT}-${SERVICE}.yaml"

# 输出验收清单
cat <<EOF

===== 验收清单 =====
[ ] gitops/dockerfiles/${PROJECT}/${SERVICE}.Dockerfile 存在
[ ] gitops/base/${PROJECT}/${SERVICE}/ 4 件套齐全 (kustomization/deployment/service/pdb)
[ ] gitops/clusters/{us-qa,us-pre,us-prod,cn-pre,cn-prod}/applications/${PROJECT}/${SERVICE}/ overlay 齐全
[ ] ECR 仓库 ${PROJECT}/${SERVICE} 已创建（或在流水线里有自动创建步骤）
[ ] 流水线变量组关联完整（VAR_GROUPS=$VAR_GROUPS）
[ ] 触发分支与代码仓库 default branch 一致（$BRANCH）

下一步：往代码仓库 push 一次提交，验证流水线自动触发
EOF

# Dry run（不真的创建）
$ YUNXIAO_AK=xxx YUNXIAO_SK=yyy YUNXIAO_ORG_ID=zzz \
    ./create-pipeline.sh -p productA -s service-foo -t unified -b main -n
===== DRY RUN: 渲染结果 =====
name: productA-service-foo
sources:
  ...

# 真的创建
$ YUNXIAO_AK=xxx YUNXIAO_SK=yyy YUNXIAO_ORG_ID=zzz \
    ./create-pipeline.sh -p productA -s service-foo -t unified -b main
[OK] 流水线已创建：pipeline_id=4810123
[OK] 已绑定变量组 37753
[OK] 已绑定变量组 37529
[OK] 已绑定变量组 37532
[OK] 已备份到 .../pipelines/productA-service-foo.yaml

# 删除创建的流水线
python3 -c "
from alibabacloud_devops20210625.client import Client
from alibabacloud_devops20210625 import models
from alibabacloud_tea_openapi.models import Config
import os
c = Client(Config(protocol='https', region_id='cn-hangzhou',
    endpoint='devops.cn-hangzhou.aliyuncs.com',
    access_key_id=os.environ['YUNXIAO_AK'], access_key_secret=os.environ['YUNXIAO_SK']))
c.delete_pipeline(os.environ['YUNXIAO_ORG_ID'], '4810123')
print('[OK] 已删除')
"

#!/bin/bash
# tests/regression-templates.sh — 模板回归测试
set -euo pipefail
TEMPLATES_DIR="$(git rev-parse --show-toplevel)/gitops/pipeline-templates"
TYPES=(unified unified-canary us-only cn-only)
TEST_PROJECT="testproj"
TEST_SERVICE="testsvc"
PASS=0; FAIL=0

for t in "${TYPES[@]}"; do
    echo "==== 测试 $t ===="

    # 1. yaml 解析
    rendered=$(mktemp)
    python3 - <<PY > "$rendered"
import jinja2
env = jinja2.Environment(loader=jinja2.FileSystemLoader("$TEMPLATES_DIR"),
                        undefined=jinja2.StrictUndefined)
print(env.get_template("$t-template.yaml").render(
    PROJECT="$TEST_PROJECT", SERVICE="$TEST_SERVICE",
    BRANCH="main", ORG_NAME="testorg"))
PY
    if python3 -c "import yaml; yaml.safe_load(open('$rendered'))" 2>/dev/null; then
        echo "  [OK] yaml 解析通过"
    else
        echo "  [FAIL] yaml 解析失败"
        cat "$rendered"
        FAIL=$((FAIL+1))
        continue
    fi

    # 2. anchor 完整性：每个 anchor 必须被引用至少一次
    if grep -q "^x-anchors:" "$rendered"; then
        for anchor in $(grep -oE "&[a-z][a-z-]+" "$rendered" | sort -u); do
            ref="*${anchor:1}"
            count=$(grep -cF "$ref" "$rendered" || true)
            if [[ "$count" == "0" ]]; then
                echo "  [WARN] anchor $anchor 未被引用"
            fi
        done
    fi

    # 3. 关键字段断言
    if ! grep -q 'cloneDepth: "0"' "$rendered" 2>/dev/null \
       && ! grep -q 'cloneDepth: "1"' "$rendered" 2>/dev/null; then
        echo "  [FAIL] cloneDepth 缺失或非字符串"
        FAIL=$((FAIL+1))
        continue
    fi
    if ! grep -qE 'branchesFilter: \^?\(?(master|main)' "$rendered"; then
        echo "  [FAIL] branchesFilter 格式不对"
        FAIL=$((FAIL+1))
        continue
    fi

    # 4. 临时创建 + 立即删除（验证云效 schema 通过）
    if [[ "${RUN_LIVE_TEST:-false}" == "true" ]]; then
        pid=$(python3 - <<PY
from alibabacloud_devops20210625.client import Client
from alibabacloud_devops20210625 import models
from alibabacloud_tea_openapi.models import Config
import os
c = Client(Config(protocol='https', region_id='cn-hangzhou',
    endpoint='devops.cn-hangzhou.aliyuncs.com',
    access_key_id=os.environ['YUNXIAO_AK'], access_key_secret=os.environ['YUNXIAO_SK']))
resp = c.create_pipeline(os.environ['YUNXIAO_ORG_ID'],
    models.CreatePipelineRequest(name='test-${t}-$$',
                                 content=open('$rendered').read()))
print(resp.body.pipelin_id)
PY
        )
        echo "  [OK] live 创建成功 pid=$pid，立即清理"
        python3 -c "
from alibabacloud_devops20210625.client import Client
from alibabacloud_devops20210625 import models
from alibabacloud_tea_openapi.models import Config
import os
c = Client(Config(protocol='https', region_id='cn-hangzhou',
    endpoint='devops.cn-hangzhou.aliyuncs.com',
    access_key_id=os.environ['YUNXIAO_AK'], access_key_secret=os.environ['YUNXIAO_SK']))
c.delete_pipeline(os.environ['YUNXIAO_ORG_ID'], '$pid')
"
    fi

    PASS=$((PASS+1))
    rm -f "$rendered"
done

echo
echo "==== 总结 ===="
echo "通过: $PASS / 失败: $FAIL"
[[ $FAIL -eq 0 ]] || exit 1

# 错误：硬编码单一分支
branchesFilter: main

# 正确：兼容两种主流写法
branchesFilter: ^(master|main)$

# 创建前先查仓库 default branch
DEFAULT_BRANCH=$(curl -fsS -H "PRIVATE-TOKEN: ${CODEUP_PASSWORD}" \
  "https://codeup.aliyun.com/api/v4/projects/${ORG_ID}%2F${PROJECT}%2F${SERVICE}" \
  | jq -r '.default_branch')
[[ "$DEFAULT_BRANCH" =~ ^(master|main)$ ]] \
  || { echo "default branch 不是 master/main，模板需调整 branchesFilter"; exit 1; }

cloneDepth: "0"     # 字符串，0 代表全量克隆

step_run:
  step: Command
  with:
    envs:
      FOO: bar         # 静默丢弃
    run: echo $FOO     # 输出空

step_run:
  step: Command
  with:
    run: |
      set -euo pipefail
      export FOO=bar
      echo "$FOO"          # 输出 bar
      ./do_something.sh

# 错：US/CN 各一个 stage 用 needs 分叉
stages:
  stage_qa: {...}
  stage_us_pre: { needs: [stage_qa] }
  stage_cn_pre: { needs: [stage_qa] }   # UI 仍然线性
  stage_approve: { needs: [stage_us_pre, stage_cn_pre] }

# 对：同 stage 内 2 个 job
stages:
  stage_qa: {...}
  stage_pre:
    needs: [stage_qa]
    jobs:
      job_us_pre: {...}
      job_cn_pre: {...}     # 视觉双线 + AND 等待
  stage_approve:
    needs: [stage_pre]