DevOps 文化与 CI/CD 进化：平台工程、DevEx 与组织变革

#!/usr/bin/env python3
# deploy_service.py — 部署即配置可观测性
import boto3, os, sys
from datetime import datetime

def deploy_lambda_with_observability(function_name, zip_path):
    client = boto3.client('lambda')
    cloudwatch = boto3.client('cloudwatch')
    with open(zip_path, 'rb') as f:
        resp = client.update_function_code(FunctionName=function_name, ZipFile=f.read(), Publish=True)
    version = resp['Version']
    # 自动配置告警
    cloudwatch.put_metric_alarm(
        AlarmName=f"{function_name}-ErrorRate", MetricName='Errors',
        Namespace='AWS/Lambda', Dimensions=[{'Name':'FunctionName','Value':function_name}],
        Statistic='Sum', Period=60, EvaluationPeriods=2, Threshold=5.0,
        ComparisonOperator='GreaterThanThreshold',
        AlarmActions=[os.environ.get('SNS_TOPIC_ARN')]
    )
    # 启用 X-Ray
    client.update_function_configuration(FunctionName=function_name, TracingConfig={'Mode':'Active'})
    return version

# .github/workflows/pipeline.yml
name: Unified CI/CD
on:
  push:
    branches: [main, develop]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with: { scan-type: 'fs', severity: 'CRITICAL,HIGH' }
  build:
    runs-on: ubuntu-latest
    needs: scan
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci && npm run test:coverage && npm run build
  deploy-staging:
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/develop'
    steps:
      - run: |
          docker build -t app:${{ github.sha }} .
          argocd app set myapp-staging -p image.tag=${{ github.sha }}
          argocd app sync myapp-staging

#!/bin/bash
# blameless-postmortem.sh — 无责复盘模板
INCIDENT_ID=$1; SEVERITY=$2; TITLE=$3; DATE=$(date +%Y-%m-%d)
mkdir -p postmortems
cat > "postmortems/${INCIDENT_ID}.md" <<EOF
# 复盘: ${TITLE}
| 时间 | 事件 |
|------|------|
| T+0m | 告警触发 |

## 根因（5 Whys）
关注系统缺陷，非个人失误。

## Action Items
| 任务 | 负责人 | 截止 |
|------|--------|------|
EOF
echo "Created: postmortems/${INCIDENT_ID}.md"

# terraform/eks.tf
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 19.0"
  cluster_name    = var.cluster_name
  cluster_version = "1.29"
  vpc_id     = var.vpc_id
  subnet_ids = var.private_subnets
  eks_managed_node_groups = {
    general = {
      desired_size = 3; min_size = 2; max_size = 20
      instance_types = ["m6i.xlarge"]; capacity_type = "ON_DEMAND"
      labels = { workload = "general" }
      tags = {
        "k8s.io/cluster-autoscaler/enabled"             = "true"
        "k8s.io/cluster-autoscaler/${var.cluster_name}" = "owned"
      }
    }
  }
  manage_aws_auth_configmap = true
  tags = { ManagedBy = "terraform" }
}

# k8s/canary.yaml
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: payment-api
spec:
  provider: nginx
  targetRef: { apiVersion: apps/v1, kind: Deployment, name: payment-api }
  analysis:
    interval: 30s; threshold: 5; maxWeight: 50; stepWeight: 10
    metrics:
      - name: request-success-rate
        thresholdRange: { min: 99 }
      - name: request-duration
        thresholdRange: { max: 500 }
  service: { port: 8080 }

# calms_dashboard.py
import asyncio, aiohttp
from dataclasses import dataclass

@dataclass
class CALMSScore:
    culture: float; automation: float; lean: float
    measurement: float; sharing: float

class DevOpsMetricsCollector:
    def __init__(self, endpoints):
        self.endpoints = endpoints
    async def fetch_culture_score(self, session):
        async with session.get(f"{self.endpoints['cultureamp']}/api/surveys/engagement") as r:
            return (await r.json())['overall_score'] / 100.0
    async def collect(self):
        async with aiohttp.ClientSession() as session:
            culture = await self.fetch_culture_score(session)
            return CALMSScore(culture=culture, automation=0.85, lean=0.80, measurement=0.72, sharing=0.68)

# backstage-component.yaml
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: payment-gateway
  annotations:
    github.com/project-slug: acme/payment-gateway
    prometheus.io/rule: payment_alerts
    grafana/dashboard-selector: "tags @> ['payment']"
  tags: [java, kafka, payments]
spec:
  type: service; lifecycle: production; owner: team-payments
  dependsOn: [component:postgres-transactions, component:kafka-prod]

# database-claim.yaml
apiVersion: platform.acme.io/v1
kind: DatabaseClaim
metadata: { name: payment-db, namespace: payment }
spec:
  compositionSelector: { matchLabels: { provider: aws, tier: prod } }
  parameters:
    engine: postgres; version: "15"; size: large
    highAvailability: true; backupRetentionDays: 30; encryptionAtRest: true

// platform-analytics.ts
interface PlatformEvent {
  eventType: 'scaffold'|'deploy'|'db_provision'|'rollback';
  userId: string; teamId: string; success: boolean; goldenPathId?: string;
}
class PlatformAnalytics {
  constructor(private store: EventStore) {}
  async recordEvent(e: PlatformEvent) {
    await this.store.insert(e);
    if (!e.success && e.goldenPathId) {
      const rate = await this.calcFailureRate(e.goldenPathId, '5m');
      if (rate > 0.25) await this.alert({ severity: 'P1', msg: `${e.goldenPathId} failure: ${(rate*100).toFixed(1)}%` });
    }
  }
  async selfServiceRatio(teamId: string, days=30) {
    const events = await this.store.query({ teamId, since: new Date(Date.now()-days*864e5) });
    const selfSvc = events.filter(e=>['scaffold','deploy','db_provision'].includes(e.eventType)).length;
    return events.length ? selfSvc/events.length : 0;
  }
}

<!-- CONTRIBUTING.md -->
# 贡献指南
1. Fork 并创建分支 `feat/your-feature`
2. 遵循 Conventional Commits：feat/fix/docs/refactor/test/chore
3. Trusted Committer 2 个工作日内响应
4. 合并前需：覆盖率>=80%，CI 通过，1 个 TC Approval，文档已更新

# innersource-metrics.py
from dataclasses import dataclass
from typing import List, Dict

@dataclass
class InnerSourceMetrics:
    repo: str; total_commits: int; cross_team: int; external: int
    avg_merge_hours: float; stale_mr: int

class Analyzer:
    def __init__(self, git, teams): self.git=git; self.teams=teams
    def analyze(self, repo: str) -> InnerSourceMetrics:
        commits = self.git.get_commits(repo, '30 days ago')
        mrs = self.git.get_open_mrs(repo)
        owner = self.teams.get_owner(repo)
        ext = set(); cross = 0
        for c in commits:
            t = self.teams.get_team(c.author)
            if t != owner: ext.add(c.author); cross += 1
        return InnerSourceMetrics(repo, len(commits), cross, len(ext), 12.0,
                                  sum(1 for m in mrs if m.days_idle>7))
    def report(self, repos: List[str]) -> Dict:
        r = [self.analyze(x) for x in repos]
        tc = sum(x.total_commits for x in r)
        return {
            'cross_team_ratio': sum(x.cross_team for x in r)/tc if tc else 0,
            'stale_repos': [x.repo for x in r if x.stale_mr>3],
            'recommendations': [f"{x.repo}: low contribution" for x in r if x.cross_team/max(x.total_commits,1)<0.1]
        }

# dora_collector.py
import os, requests
from datetime import datetime, timedelta

class DORACollector:
    def __init__(self):
        self.token = os.environ['GITHUB_TOKEN']
    def deploy_freq(self, repo, env='production', weeks=4):
        url = f"https://api.github.com/repos/{repo}/deployments"
        h = {'Authorization': f'token {self.token}'}
        d = requests.get(url, headers=h, params={'environment':env,'per_page':100}).json()
        since = datetime.utcnow() - timedelta(weeks=weeks)
        ok = [x for x in d if x['status']=='success' and datetime.fromisoformat(x['created_at'].replace('Z','+00:00'))>=since]
        return {'metric':'deployment_frequency','value':len(ok),'is_elite':len(ok)>=weeks*7}
    def change_failure_rate(self, service, start, end, incidents, deploys):
        related = [i for i in incidents if i.get('triggered_by_deployment')]
        rate = len(related)/deploys if deploys else 0
        return {'metric':'change_failure_rate','value':round(rate*100,2),'is_elite':rate<0.05}

# slo.yaml
apiVersion: openslo/v1
kind: SLO
metadata: { name: api-availability }
spec:
  service: payments-api
  budgetingMethod: Occurrences
  objectives:
    - displayName: Availability
      op: gt; target: 0.9995
      ratioMetrics:
        good:
          metricSource: { type: Datadog, query: "sum:hits{service:payments,status:2xx}.as_count()" }
        total:
          metricSource: { type: Datadog, query: "sum:hits{service:payments}.as_count()" }

# platform-contract.yaml
apiVersion: internal.acme.io/v1
kind: PlatformServiceContract
metadata: { name: k8s-contract }
spec:
  provider: { team: platform, service: managed-k8s, version: "2024-Q3" }
  consumers: [{team: payments}, {team: logistics}]
  slo: [{name: api-avail, target: 99.9%}, {name: provision, target: "P95<3m"}]
  operations:
    - { name: namespace, selfService: true, doc: https://internal.io/k8s/ns }
    - { name: net-policy, selfService: false, sla: "2d" }
  escalation: { slack: "#platform-oncall", oncall: "pagerduty://platform" }

# topology-analyzer.py
from dataclasses import dataclass
from typing import List, Dict

@dataclass
class Team:
    name: str; team_type: str; dependencies: List[str]
    cognitive_load: int; services: List[str]

class TopologyAnalyzer:
    def __init__(self, teams): self.teams = {t.name:t for t in teams}
    def bottlenecks(self):
        deps = {}
        for t in self.teams.values():
            for d in t.dependencies: deps[d] = deps.get(d,0)+1
        return [{"team":k,"dependents":v} for k,v in deps.items() if v>5]
    def overload(self):
        return [{"team":t.name,"load":t.cognitive_load}
                for t in self.teams.values() if t.cognitive_load>=8]
    def report(self):
        return {
            "bottlenecks": self.bottlenecks(),
            "overload": self.overload(),
            "tips": ["优先减负防 burnout","平台依赖过高则拆分","每季度审视交互模式"]
        }

# team-topology-policy.yaml
apiVersion: org.acme.io/v1
kind: TeamTopologyPolicy
metadata: { name: default }
spec:
  rules:
    - rule: no-devops-silo
      description: "禁止设立独立 DevOps 审批团队"
      forbidden: [team_type: "DevOps", reports_to: ["Ops"]]
    - rule: platform-team-size
      description: "平台团队不超过 8 人，防止过度扩张"
      max_members: 8
      team_type: "Platform"
    - rule: enabling-duration
      description: "赋能团队任务周期不超过 3 个月"
      max_duration_months: 3
      team_type: "Enabling"

// dx-core-survey.json
{
  "survey": "dx-core-quarterly",
  "dimensions": [
    {
      "id": "dev_env_satisfaction",
      "question": "您对本地开发环境的满意度（1-10）",
      "target": ">=8",
      "trend": "improving"
    },
    {
      "id": "feedback_loop",
      "question": "从 git push 到 CI 反馈的平均时间",
      "target": "<5m",
      "current": "3m 42s"
    },
    {
      "id": "deployment_autonomy",
      "question": "能独立完成生产部署的工程师比例",
      "target": ">=90%",
      "current": "72%"
    }
  ],
  "action_items": [
    "缩短 PR 等待审阅时间至 4 工作小时内",
    "升级 CI runner 规格，减少队列等待"
  ]
}

# golden-path-fastapi.yaml
apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: fastapi-service
  title: FastAPI 微服务
  description: "基于最佳实践预设的 FastAPI 服务模板"
spec:
  owner: platform-team
  type: service
  parameters:
    - title: 基本信息
      required: [name, owner]
      properties:
        name: { type: string, title: 服务名, pattern: '^[a-z0-9-]+$' }
        owner: { type: string, title: 团队, ui:field: OwnerPicker }
    - title: 基础设施
      properties:
        database: { type: boolean, title: 需要 PostgreSQL, default: true }
        redis: { type: boolean, title: 需要 Redis, default: false }
  steps:
    - id: fetch-base
      name: 拉取基础模板
      action: fetch:template
      input:
        url: ./skeletons/fastapi
        values:
          name: ${{ parameters.name }}
          db_enabled: ${{ parameters.database }}
    - id: publish
      name: 创建仓库
      action: publish:github
      input:
        repoUrl: github.com?owner=acme&repo=${{ parameters.name }}
    - id: register
      name: 注册到目录
      action: catalog:register
      input:
        repoContentsUrl: ${{ steps.publish.output.repoContentsUrl }}
  output:
    links:
      - title: 仓库
        url: ${{ steps.publish.output.remoteUrl }}
      - title: 服务目录
        icon: catalog
        entityRef: ${{ steps.register.output.entityRef }}

#!/bin/bash
# platform-health-dashboard.sh
PLATFORM="platform-k8s"
QUARTER="2024-Q3"

echo "=== $PLATFORM 平台健康度报告: $QUARTER ==="
echo ""
echo "1. 采用率"
echo "   - 注册服务数: $(grep -c 'platform.acme.io' services.yaml)"
echo "   - 活跃服务（30天有部署）: $(cat deployments.log | awk -F, '{print $1}' | sort -u | wc -l)"
echo ""
echo "2. 自助服务率"
echo "   - 自助成功 / 总请求: $(jq '.self_service / .total' metrics.json)"
echo ""
echo "3. 客户满意度"
echo "   - dNPS: $(cat survey.json | jq '.nps')"
echo "   - 主要痛点: $(cat survey.json | jq '.top_frustrations | .[0:3]')"
echo ""
echo "4. 平台可靠性"
echo "   - 平台服务 SLA: $(cat slo.json | jq '.availability')"
echo "   - P1 事件数: $(grep SEV1 incidents.csv | wc -l)"

# ci-l3-pipeline.yaml
name: L3-Mature-CI
on:
  pull_request:
    branches: [main]
jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - name: SonarQube Scan
        uses: sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      - name: Unit Tests
        run: npm test -- --coverage --coverageThreshold='{"global":{"branches":80}}'
      - name: SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
      - name: Check Coverage Gate
        run: |
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
            echo "Coverage $COVERAGE% below 80% threshold"; exit 1
          fi
      - name: Dependency Vuln Scan
        run: npm audit --audit-level=high

# feature-flag-rollout.yaml
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: checkout-experiment
spec:
  provider: flagger-loadtester
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: checkout-v2
  analysis:
    interval: 1m
    threshold: 5
    maxWeight: 30
    stepWeight: 5
    metrics:
      - name: conversion-rate
        thresholdRange:
          min: 0.95
        query: |
          sum(rate(checkout_success_total{version="v2"}[1m]))
          /
          sum(rate(checkout_attempt_total{version="v2"}[1m]))
    webhooks:
      - name: load-test
        type: pre-rollout
        url: http://flagger-loadtester.test/
        timeout: 30s
        metadata:
          cmd: "hey -z 1m -q 10 -c 2 http://checkout-canary/"

# security-pipeline.yaml
jobs:
  secrets-scan:
    steps:
      - uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD
          extra_args: --debug --only-verified

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Semgrep SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/cwe-top-25
            p/security-audit
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: semgrep-results.sarif

  sca:
    steps:
      - uses: actions/checkout@v4
      - uses: anchore/scan-action@v3
        with:
          path: "."
          fail-build: true
          severity-cutoff: high

  iac-scan:
    steps:
      - uses: actions/checkout@v4
      - name: Checkov IaC Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform,kubernetes,dockerfile
          output_format: sarif
          output_file_path: reports/checkov.sarif

#!/bin/bash
# generate-sbom.sh
IMAGE="acme/payments-api:v1.2.3"
SBOM_FILE="sbom-${IMAGE//\//_}.json"

# 生成 SPDX 格式 SBOM
syft $IMAGE -o spdx-json=$SBOM_FILE

# 签名 SBOM
cosign sign-blob --key env://COSIGN_PRIVATE_KEY \
  --output-signature "${SBOM_FILE}.sig" \
  $SBOM_FILE

# 验证
# cosign verify-blob --key cosign.pub --signature "${SBOM_FILE}.sig" $SBOM_FILE

# 上传到制品库
oras push "registry.acme.io/sbom/${IMAGE}" \
  --artifact-type "application/spdx+json" \
  $SBOM_FILE "${SBOM_FILE}.sig"

echo "SBOM generated and signed: $SBOM_FILE"

// .devcontainer/devcontainer.json
{
  "name": "Payment Service Dev",
  "dockerComposeFile": "docker-compose.dev.yml",
  "service": "app",
  "workspaceFolder": "/workspace",
  "features": {
    "ghcr.io/devcontainers/features/docker-in-docker:2": {},
    "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {}
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "ms-python.python",
        "ms-python.black-formatter",
        "ms-azuretools.vscode-docker",
        "redhat.vscode-yaml"
      ],
      "settings": {
        "python.defaultInterpreterPath": "/workspace/.venv/bin/python",
        "editor.formatOnSave": true
      }
    }
  },
  "postCreateCommand": "pip install -e '.[dev]' && pre-commit install"
}

# docker-compose.dev.yml
version: "3.8"
services:
  app:
    build:
      context: .
      dockerfile: Dockerfile.dev
    volumes:
      - .:/workspace:cached
      - /workspace/.venv
      - /workspace/node_modules
    ports:
      - "8000:8000"
      - "5678:5678"  # debugpy
    environment:
      - POSTGRES_URL=postgresql://dev:dev@postgres:5432/payments
      - REDIS_URL=redis://redis:6379
    depends_on:
      - postgres
      - redis
      - kafka
  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: dev
      POSTGRES_DB: payments
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
  kafka:
    image: confluentinc/cp-kafka:7.5
    # 简化配置用于本地开发

volumes:
  pgdata:

#!/bin/bash
# fast-feedback.sh — 本地快速验证脚本
set -e

echo "[1/4] Linting (并行)..."
black --check src/ & black_pid=$!
ruff check src/ & ruff_pid=$!
wait $black_pid $ruff_pid

echo "[2/4] Type check (增量)..."
mypy --incremental src/

echo "[3/4] Unit tests (仅变更模块)..."
pytest --testmon -x -q src/

echo "[4/4] Security scan (仅新增依赖)..."
if git diff --name-only | grep -q requirements; then
  pip-audit --requirement requirements.txt
fi

echo "All checks passed in $(date +%s.%N -d '0')s"

# mkdocs.yml
site_name: Platform Developer Docs
site_url: https://docs.internal.acme.io
nav:
  - 首页: index.md
  - 快速开始:
    - 环境搭建: getting-started/setup.md
    - 第一个服务: getting-started/first-service.md
  - 黄金路径:
    - FastAPI: golden-paths/fastapi.md
    - React SPA: golden-paths/react.md
  - 运维手册:
    - 上线检查单: runbooks/deployment-checklist.md
    - 故障响应: runbooks/incident-response.md
plugins:
  - search
  - git-authors
  - swagger-ui-tag:
      openapi_url: /api/openapi.json
theme:
  name: material
  palette:
    primary: indigo
    accent: indigo
extra:
  social:
    - icon: fontawesome/brands/slack
      link: https://acme.slack.com/archives/platform