ci.yml

# OpenBlog：push 到 master 时编译后端、打包前端，并将静态资源与 Docker 相关文件同步到阿里云，在服务器执行 docker.sh 更新 Nginx 容器。
# 后端部署到内网自托管 Runner。
#
# 需在仓库 Settings → Secrets and variables → Actions 中配置：
#   SERVER_SSH_KEY      服务器 SSH 私钥（完整 PEM）
#   SERVER_REMOTE_HOST  公网 IP 或域名
#   SERVER_REMOTE_USER  SSH 登录用户（如 root 或 deploy）
#   SERVER_TARGET       服务器上部署目录绝对路径（如 /opt/openblog/web），该目录下会有 dist、Dockerfile、docker.sh、nginx.conf
#
# 后端 Spring Boot 需在**同一台机器宿主机**上监听 8082（java -jar 或 systemd），容器内 Nginx 通过 host.docker.internal 反代到宿主机。
# 前端容器默认映射宿主机端口 18088 → 容器 80，访问 http://IP:18088/ ，请在安全组放行 TCP 18088。
name: Build and deploy OpenBlog

on:
  workflow_dispatch:
  push:
    branches:
      - master
    paths:
      - 'OpenBlog-business/**'
      - 'OpenBlog-framework*/**'
      - 'vue/**'
      - 'pom.xml'
      - '.github/workflows/ci.yml'

jobs:
  # 检测变更范围，供后续 job 条件判断
  changes:
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            backend:
              - 'OpenBlog-business/**'
              - 'OpenBlog-framework*/**'
              - 'OpenBlog-email/**'
              - 'OpenBlog-email-api/**'
              - 'pom.xml'
            frontend:
              - 'vue/**'

  build-backend:
    needs: changes
    if: ${{ needs.changes.outputs.backend == 'true' || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: "17"
          distribution: "temurin"
          cache: "maven"

      - name: Build backend (Maven)
        run: mvn -B -ntp package -DskipTests -pl OpenBlog-business -am

      - name: Upload backend JAR
        uses: actions/upload-artifact@v4
        with:
          name: backend-jar
          path: OpenBlog-business/target/OpenBlog-business-*.jar
          retention-days: 1

  deploy-backend:
    needs: build-backend
    if: ${{ needs.build-backend.result == 'success' || github.event_name == 'workflow_dispatch' }}
    runs-on: openblog-backend

    steps:
      - name: Download backend JAR
        uses: actions/download-artifact@v4
        with:
          name: backend-jar

      - name: Deploy to internal server
        run: |
          JAR_FILE=$(ls OpenBlog-business-*.jar | head -1)
          TARGET_DIR="/www/wwwroot/java/openblog"
          TARGET_JAR="$TARGET_DIR/OpenBlog-business-1.0.0-SNAPSHOT.jar"
          JAVA_HOME="/www/server/java/jdk-17.0.8"
          SERVICE_NAME="openblog"

          # 确保 systemd service 文件存在
          if [ ! -f /etc/systemd/system/${SERVICE_NAME}.service ]; then
            cat > /etc/systemd/system/${SERVICE_NAME}.service << 'SVC'
          [Unit]
          Description=OpenBlog Backend
          After=network.target

          [Service]
          Type=simple
          User=root
          WorkingDirectory=/www/wwwroot/java/openblog
          ExecStart=/www/server/java/jdk-17.0.8/bin/java -jar -Xmx1024M -Xms256M /www/wwwroot/java/openblog/OpenBlog-business-1.0.0-SNAPSHOT.jar
          Restart=on-failure
          RestartSec=10
          StandardOutput=append:/www/wwwroot/java/openblog/app.log
          StandardError=append:/www/wwwroot/java/openblog/app.log

          [Install]
          WantedBy=multi-user.target
          SVC
            systemctl daemon-reload
          fi

          # 停止旧服务
          systemctl stop ${SERVICE_NAME} || true

          # 备份旧 jar
          if [ -f "$TARGET_JAR" ]; then
            mkdir -p "$TARGET_DIR/backup"
            cp "$TARGET_JAR" "$TARGET_DIR/backup/OpenBlog-business-$(date +%Y%m%d-%H%M%S).jar" 2>/dev/null || true
          fi

          # 复制新 jar
          cp "$JAR_FILE" "$TARGET_JAR"

          # 启动服务
          systemctl start ${SERVICE_NAME}

          echo "Deployed $JAR_FILE → $TARGET_JAR"
          systemctl status ${SERVICE_NAME} --no-pager || true

  build-frontend:
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: vue/package-lock.json

      - name: Install frontend dependencies and build
        working-directory: vue
        run: |
          npm ci
          npm run build

      - name: Prepare release bundle for server
        run: |
          mkdir -p release
          cp -r vue/dist release/dist
          cp vue/Dockerfile vue/docker.sh vue/nginx.conf release/

      - name: Build Docker image on runner
        run: |
          docker build -t openblog-web release/
          docker save openblog-web | gzip > release/openblog-web.tar.gz

      - name: Upload release bundle
        uses: actions/upload-artifact@v4
        with:
          name: release-frontend
          path: release/

  deploy-frontend:
    needs: build-frontend
    if: ${{ needs.build-frontend.result == 'success' }}
    runs-on: ubuntu-latest

    steps:
      - name: Download release bundle
        uses: actions/download-artifact@v4
        with:
          name: release-frontend
          path: release/

      - name: Deploy files to server
        uses: easingthemes/ssh-deploy@v5.1.1
        with:
          SSH_PRIVATE_KEY: ${{ secrets.SERVER_SSH_KEY }}
          ARGS: "-rlgoDzvc --delete --exclude=dist/.user.ini"
          SOURCE: "release/dist release/Dockerfile release/docker.sh release/nginx.conf release/openblog-web.tar.gz"
          REMOTE_HOST: ${{ secrets.SERVER_REMOTE_HOST }}
          REMOTE_USER: ${{ secrets.SERVER_REMOTE_USER }}
          TARGET: ${{ secrets.SERVER_TARGET }}
          SCRIPT_BEFORE: ls -la

      - name: Run Docker commands on server
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.SERVER_REMOTE_HOST }}
          username: ${{ secrets.SERVER_REMOTE_USER }}
          key: ${{ secrets.SERVER_SSH_KEY }}
          command_timeout: 30m
          script: |
            cd ${{ secrets.SERVER_TARGET }}
            sh docker.sh