78 lines
1.7 KiB
Markdown
78 lines
1.7 KiB
Markdown
# Delivery Pipeline
|
|
|
|
## Scope
|
|
|
|
Operational pipeline baseline for image build/push, staging deploy, production promotion, and rollback.
|
|
|
|
## Registry Credentials Strategy
|
|
|
|
Use scoped Gitea secrets:
|
|
|
|
- `CMS_IMAGE_REGISTRY`
|
|
- `CMS_IMAGE_NAMESPACE`
|
|
- `CMS_IMAGE_REGISTRY_USER`
|
|
- `CMS_IMAGE_REGISTRY_PASSWORD`
|
|
|
|
Policy:
|
|
|
|
- credentials only in CI secrets
|
|
- no plaintext credentials in repo
|
|
- least privilege: push/pull for target namespace only
|
|
|
|
## Build and Push Flow
|
|
|
|
- Workflow: `.gitea/workflows/release.yml`
|
|
- Trigger:
|
|
- tag push `vX.Y.Z`
|
|
- manual `workflow_dispatch`
|
|
- Steps:
|
|
1. validate tag vs root `package.json` version
|
|
2. generate changelog
|
|
3. docker login
|
|
4. build and push `cms-web` and `cms-admin` images
|
|
|
|
## Staging Deployment Automation
|
|
|
|
- Workflow: `.gitea/workflows/deploy.yml`
|
|
- Manual input:
|
|
- `environment=staging`
|
|
- `image_tag=vX.Y.Z`
|
|
- Remote deployment uses SSH + compose file:
|
|
- `docker-compose.staging.yml`
|
|
|
|
Required secrets:
|
|
|
|
- `CMS_STAGING_HOST`
|
|
- `CMS_STAGING_USER`
|
|
- `CMS_DEPLOY_KEY`
|
|
- `CMS_REMOTE_DEPLOY_PATH`
|
|
|
|
## Production Promotion and Rollback
|
|
|
|
Promotion:
|
|
|
|
- run deploy workflow with:
|
|
- `environment=production`
|
|
- `image_tag=vX.Y.Z`
|
|
|
|
Rollback:
|
|
|
|
- release workflow supports rollback placeholder by image tag
|
|
- deploy workflow supports `rollback_tag` input
|
|
- recovery action:
|
|
- rerun deploy with previous known-good tag
|
|
|
|
## Deployment Verification
|
|
|
|
After deploy:
|
|
|
|
1. app health checks (web/admin)
|
|
2. auth smoke flow
|
|
3. i18n smoke flow
|
|
4. critical route checks (`/`, `/login`, `/todo`)
|
|
|
|
## Notes
|
|
|
|
- Current workflows are production-oriented scaffolds and require secret provisioning in Gitea.
|
|
- Host hardening, network ACLs, and backup policy remain mandatory operational controls.
|