「DeployLite」第十章：附录

version: 1
name: Full Build & Deploy

trigger:
  on:
    push: ["main"]
    tag: ["v*"]

env:
  BUILD_MODE: release
  REGISTRY: registry.example.com

stages:
  - name: build
    runs_on: docker-runner
    steps:
      - checkout
      - run: go build -o bin/app ./cmd
      - cache:
          path: ~/.cache/go-build
      - artifact: upload
        path: bin/app
        name: binary

  - name: test
    needs: [build]
    steps:
      - run: go test ./... -v

  - name: package
    needs: [test]
    steps:
      - run: docker build -t ${{ env.REGISTRY }}/app:${{ git.tag }} .
      - run: docker push ${{ env.REGISTRY }}/app:${{ git.tag }}

  - name: deploy
    approval: maintainers
    needs: [package]
    steps:
      - k8s.deploy:
          file: k8s/deployment.yaml
          image: ${{ env.REGISTRY }}/app:${{ git.tag }}
          namespace: prod

openapi: 3.1.0
info:
  title: DeployLite API
  version: 1.0.0
paths:
  /projects:
    get:
      summary: 获取项目列表
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: "#/components/schemas/Project"
  /pipelines/{id}/run:
    post:
      summary: 触发流水线运行
      parameters:
        - name: id
          in: path
          required: true
          schema: { type: integer }
      responses:
        "201":
          description: Created
components:
  schemas:
    Project:
      type: object
      properties:
        id: { type: integer }
        name: { type: string }
        repo_url: { type: string }
        created_at: { type: string, format: date-time }

CREATE TABLE projects (
  id SERIAL PRIMARY KEY,
  name VARCHAR(128) NOT NULL,
  repo_url TEXT NOT NULL,
  description TEXT,
  owner_id BIGINT NOT NULL,
  created_at TIMESTAMP DEFAULT NOW(),
  updated_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE pipelines (
  id SERIAL PRIMARY KEY,
  project_id BIGINT REFERENCES projects(id),
  yaml TEXT NOT NULL,
  status VARCHAR(20) DEFAULT 'pending',
  started_at TIMESTAMP,
  finished_at TIMESTAMP,
  created_by BIGINT,
  logs_url TEXT
);

CREATE TABLE runners (
  id SERIAL PRIMARY KEY,
  name VARCHAR(128),
  token TEXT,
  status VARCHAR(20) DEFAULT 'offline',
  last_heartbeat TIMESTAMP,
  capacity INT DEFAULT 1,
  region VARCHAR(64)
);

CREATE TABLE artifacts (
  id SERIAL PRIMARY KEY,
  project_id BIGINT REFERENCES projects(id),
  name VARCHAR(128),
  version VARCHAR(64),
  storage_path TEXT,
  hash CHAR(64),
  size BIGINT,
  created_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE policies (
  id SERIAL PRIMARY KEY,
  name VARCHAR(128),
  type VARCHAR(32),
  content TEXT,
  enabled BOOLEAN DEFAULT TRUE,
  created_at TIMESTAMP DEFAULT NOW()
);

CREATE TABLE audit_logs (
  id BIGSERIAL PRIMARY KEY,
  actor_id BIGINT,
  action VARCHAR(128),
  resource_type VARCHAR(64),
  resource_id BIGINT,
  status VARCHAR(32),
  timestamp TIMESTAMP DEFAULT NOW(),
  trace_id UUID
);

server:
  host: 0.0.0.0
  port: 8080
  log_level: info
  enable_tls: true

database:
  driver: postgres
  dsn: postgres://user:pass@db:5432/deploylite?sslmode=disable

redis:
  addr: redis:6379
  db: 0

storage:
  provider: s3
  endpoint: http://minio:9000
  access_key: minio
  secret_key: minio123
  bucket: deploylite-artifacts

security:
  jwt_secret: "changeme"
  admin_user: "admin"
  admin_password: "admin123"

runner:
  concurrency: 5
  labels: ["docker", "x86_64"]

metrics:
  enable: true
  endpoint: /metrics

{
  "time": "2025-10-22T14:02:11Z",
  "level": "info",
  "module": "pipeline",
  "trace_id": "a7c3e8c2",
  "pipeline_id": 4021,
  "message": "stage build completed in 42.3s",
  "fields": {
    "runner": "runner-01",
    "status": "success"
  }
}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-deploylite
spec:
  replicas: 3
  selector:
    matchLabels:
      app: app-deploylite
  template:
    metadata:
      labels:
        app: app-deploylite
    spec:
      containers:
        - name: app
          image: registry.example.com/app:v1.0.0
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef:
                name: app-config

name: notify-slack
version: 1.0.0
type: notify
entrypoint: "plugins/notify/slack/main.go"
inputs:
  - name: webhook
    type: string
  - name: message
    type: string
outputs:
  - name: status
    type: string

AGPL-3.0 License

Copyright (C) 2025 DeployLite

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License, version 3.
You must make the source code available to users who interact with it
over a network.

For commercial usage (SaaS or OEM), please contact: legal@deploylite.io

stages:
  - name: security-scan
    steps:
      - run: semgrep --config=auto .
      - run: trivy image ${{ env.REGISTRY }}/app:${{ git.tag }}
      - run: syft packages dir:. -o spdx-json > sbom.spdx.json
      - run: grype sbom.spdx.json --fail-on critical