name: CI/CD Pipeline for mengning.com.cn
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
 
jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: gitea/runner-images:ubuntu-latest
    steps:
      - name: 拉取代码
        uses: https://devstar.cn/actions/checkout@v4
        with:
          fetch-depth: 0  
 
      - name: 安装依赖
        working-directory: 
        run: |
            npm install
            npm add -D vitepress
 
      - name: 构建项目
        working-directory: 
        run: |
            chmod +x node_modules/.bin/vitepress
            npm run build
 
      - name: 构建 Docker 镜像
        run: |
          docker build -t devstar-docs:${{ gitea.sha }} .
 
      - name: 登录 Docker Registry 并推送镜像
        run: |
          echo "${{ secrets.DOCKER_REGISTRY_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_REGISTRY_USERNAME }} ${{ vars.DOCKER_REGISTRY_ADDRESS }} --password-stdin
          docker tag devstar-docs:${{ gitea.sha }} ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:${{ gitea.sha }}
          docker tag devstar-docs:${{ gitea.sha }} ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:latest
          docker push ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:${{ gitea.sha }}
          docker push ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:latest    

      - name: 📝 Update mengning.com.cn（通过删除/创建 Application CRD）
        env:
          DOCKER_REGISTRY_ADDRESS: ${{ vars.DOCKER_REGISTRY_ADDRESS }}
          DOCKER_REPOSITORY_ARTIFACT: ${{ vars.DOCKER_REPOSITORY_ARTIFACT }}
        run: |
          curl -LO https://mirrors.ustc.edu.cn/kubernetes/core%3A/stable%3A/v1.28/deb/amd64/kubectl_1.28.0-1.1_amd64.deb
          sudo dpkg -i kubectl_1.28.0-1.1_amd64.deb
          kubectl config set-cluster remote-cluster --server=${{ secrets.K8S_URL }} --insecure-skip-tls-verify=true
          kubectl config set-credentials token-user --token=${{ secrets.K8S_TOKEN }}
          kubectl config set-context remote-context --cluster=remote-cluster --user=token-user
          kubectl config use-context remote-context

          # 生成与当前集群中 mengningsoftware Application 一致的 CRD YAML，只更新镜像地址
          cat > /tmp/application-crd.yaml <<EOF
          apiVersion: application.devstar.cn/v1
          kind: Application
          metadata:
            name: mengningsoftware
            namespace: web-servers
            labels:
              app.kubernetes.io/component: web-server
              app.kubernetes.io/managed-by: devstar
              app.kubernetes.io/name: mengningsoftware
          spec:
            environment:
              NGINX_VERSION: "1.24.0"
            expose: true
            networkPolicy:
              gateway:
                enabled: true
                hosts:
                  - "mengning.com.cn"
                ports:
                  - name: http
                    number: 80
                    protocol: HTTP
                  - name: https
                    number: 443
                    protocol: HTTPS
                tls:
                  - hosts:
                      - "mengning.com.cn"
                    minProtocolVersion: "TLSv1_2"
                    mode: SIMPLE
                    certificate: |-
                      -----BEGIN CERTIFICATE----- MIIG6TCCBNGgAwIBAgIQC5URiblBtMr1WphKEQbK8jANBgkqhkiG9w0BAQsFADBb MQswCQYDVQQGEwJDTjElMCMGA1UEChMcVHJ1c3RBc2lhIFRlY2hub2xvZ2llcywg SW5jLjElMCMGA1UEAxMcVHJ1c3RBc2lhIERWIFRMUyBSU0EgQ0EgMjAyNTAeFw0y NTExMTgwMDAwMDBaFw0yNjAyMTUyMzU5NTlaMBoxGDAWBgNVBAMTD21lbmduaW5n LmNvbS5jbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALAsI5JrSXJL xVAbSwNJ+cCyy8P2B+qmZ2mzrF3odKVFKa6MCgp1G1m0ER2sLwH6cjEq7VbHuf2n h9p/r1z9AQtobwepfqbZAiYEWI8hJzLaaDqqFBiWy08M29eQMGcDntYIxiU5YY0c r2enEPTO0aC1U5+dPOxiUEX/Helo6v0u4M9w5M/i5iYHoKaPGTwZHqdc39Ar4kbV ntcj9hUiwzTavCJnEKr/WSNASTxV+CaIaxfmuSqYI33YodLdwspD2Rs8v5kKVfRZ 3974gnKdxIutmgtcPfNc9LNcAJ5pfFdd1nNVs5MjB3dYJbQd+ZiAtjnN5lhaDN8c bDbM1IZYMFsCAwEAAaOCAugwggLkMB8GA1UdIwQYMBaAFLQSKKW0wB2fKXFpPNkR lkp1aVDAMB0GA1UdDgQWBBQgmU8NFGXjjVEiqHzR8tAzx7JjQTAvBgNVHREEKDAm gg9tZW5nbmluZy5jb20uY26CE3d3dy5tZW5nbmluZy5jb20uY24wPgYDVR0gBDcw NTAzBgZngQwBAgEwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5j b20vQ1BTMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATB5Bggr BgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNv bTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL1RydXN0 QXNpYURWVExTUlNBQ0EyMDI1LmNydDAMBgNVHRMBAf8EAjAAMIIBgQYKKwYBBAHW eQIEAgSCAXEEggFtAWsAdwCWl2S/VViXrfdDh2g3CEJ36fA61fak8zZuRqQ/D8qp xgAAAZqVQK8bAAAEAwBIMEYCIQDLoeHo0OXPOHQ1dfwCxBB/HoGBF3xpLCBjMEqE ad8hqwIhAOR5cFSqM/suITZKjWiWimyIT6TQ85MNeNkSKgBfRuWAAHcAZBHEbKQS 7KeJHKICLgC8q08oB9QeNSer6v7VA8l9zfAAAAGalUCvFQAABAMASDBGAiEAoZQ+ ouNAkLXxWgz7w/93cs/CD9x9bUdkoYMI+MFk6l8CIQDSmYFGXVGEFLoz+BUbYXOi Rmj0IxK+6vCmrzR9usgRAAB3AEmcm2neHXzs/DbezYdkprhbrwqHgBnRVVL76esp 3fjDAAABmpVArysAAAQDAEgwRgIhAJNOWk2Sw1mDiuPRaebLxldZUIx4z2zYEsdw 9CDpczpCAiEAtzN7sCiwUgsrD3zirT0xh8rLFY8hHlT9cBnHT2s7ZNMwDQYJKoZI hvcNAQELBQADggIBAK75qGfHY9N8yHabhucoiWT6LoHYYwh2r78OfxGX0GZBrmzX xfCFaML5gGqg/juCVOZSVo8rxnLw7Lhynb8ZyrmcSGftgIznqVP7G+TiXFNTsr+V AafwIq9YtQWRlRmS4Me6zpSW7/2mxfTbuvMau1PdOHNyu6MYA7t8gDKxijMtu7mN mFTMxGVdCjr3RxDeFiqSIbON3rKhceQTMGSa7yxSeFwoCfSnxWfrl8dBQI49QlgH GArOKMisTxbkNn+R5z/sOXbDIlyTXHW4FT6Xkrj3avdzkNkNJtAEbrkvhnDELpOh fBXCdrBWHeqvjDCAdlMYXxTxg2OWmbtyIzNdNCcmPY+A1azpnSo+sTh7gMG6Ue9b MZG8ar+eAfs6sFm7o09ijSJ0II1Fc6LqTtOnN91ma3cMlxsDlxNnTIpXAWwTOO2i hSdw3DBVJA6VEV4khc3FD0ixj1m2URt5eoRMyNyjlSctldmFFUnEJBhZjIiqHrzk 5dY4TIgZVyHN7DL6J88+IqTtntGsnombuaolhTVCPE99wFwneergf0nL7FYvv1gG A2rPpsS+pa7cjxCw1WqNXwt2VWHpdrrw7Wu+GzQae8XvLgHBFDW9JTGrBTAotSH9 b98gFY5Ps9bGF3zNzLsDr4p62mxQp2NOV044H5273QGU6C+j2gRu/HYlhJ9j -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFnjCCBIagAwIBAgIQCSYyO0lk42hGFRLe8aXVLDANBgkqhkiG9w0BAQsFADBh MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH MjAeFw0yNTAxMDgwMDAwMDBaFw0zNTAxMDcyMzU5NTlaMFsxCzAJBgNVBAYTAkNO MSUwIwYDVQQKExxUcnVzdEFzaWEgVGVjaG5vbG9naWVzLCBJbmMuMSUwIwYDVQQD ExxUcnVzdEFzaWEgRFYgVExTIFJTQSBDQSAyMDI1MIICIjANBgkqhkiG9w0BAQEF AAOCAg8AMIICCgKCAgEA0fuEmuBIsN6ZZVq+gRobMorOGIilTCIfQrxNpR8FUZ9R /GfbiekbiIKphQXEZ7N1uBnn6tXUuZ32zl6jPkZpHzN/Bmgk1BWSIzVc0npMzrWq /hrbk5+KddXJdsNpeG1+Q8lc8uVMBrztnxaPb7Rh7yQCsMrcO4hgVaqLJWkVvEfW ULtoCHQnNaj4IroG6VxQf1oArQ8bPbwpI02lieSahRa78FQuXdoGVeQcrkhtVjZs ON98vq5fPWZX2LFv7e5J6P9IHbzvOl8yyQjv+2/IOwhNSkaXX3bI+//bqF9XW/p7 +gsUmHiK5YsvLjmXcvDmoDEGrXMzgX31Zl2nJ+umpRbLjwP8rxYIUsKoEwEdFoto Aid59UEBJyw/GibwXQ5xTyKD/N6C8SFkr1+myOo4oe1UB+YgvRu6qSxIABo5kYdX FodLP4IgoVJdeUFs1Usa6bxYEO6EgMf5lCWt9hGZszvXYZwvyZGq3ogNXM7eKyi2 20WzJXYMmi9TYFq2Fa95aZe4wki6YhDhhOO1g0sjITGVaB73G+JOCI9yJhv6+REN D40ZpboUHE8JNgMVWbG1isAMVCXqiADgXtuC+tmJWPEH9cR6OuJLEpwOzPfgAbnn 2MRu7Tsdr8jPjTPbD0FxblX1ydW3RG30vwLF5lkTTRkHG9epMgpPMdYP7nY/08MC AwEAAaOCAVYwggFSMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLQSKKW0 wB2fKXFpPNkRlkp1aVDAMB8GA1UdIwQYMBaAFE4iVCAYlebjbuYP+vq5Eu0GF485 MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw dgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2Vy dC5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEdsb2JhbFJvb3RHMi5jcnQwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDov L2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDARBgNV HSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQELBQADggEBAJ4a3svh316GY2+Z7EYx mBIsOwjJSnyoEfzx2T699ctLLrvuzS79Mg3pPjxSLlUgyM8UzrFc5tgVU3dZ1sFQ I4RM+ysJdvIAX/7Yx1QbooVdKhkdi9X7QN7yVkjqwM3fY3WfQkRTzhIkM7mYIQbR r+y2Vkju61BLqh7OCRpPMiudjEpP1kEtRyGs2g0aQpEIqKBzxgitCXSayO1hoO6/ 71ts801OzYlqYW9OQQQ2GCJyFbD6XHDjdpn+bWUxTKWaMY0qedSCbHE3Kl2QEF0C ynZ7SbC03yR+gKZQDeTXrNP1kk5Qhe7jSXgw+nhbspe0q/M1ZcNCz+sPxeOwdCcC gJE= -----END CERTIFICATE-----
                    privateKey: |-
                      -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAsCwjkmtJckvFUBtLA0n5wLLLw/YH6qZnabOsXeh0pUUprowK CnUbWbQRHawvAfpyMSrtVse5/aeH2n+vXP0BC2hvB6l+ptkCJgRYjyEnMtpoOqoU GJbLTwzb15AwZwOe1gjGJTlhjRyvZ6cQ9M7RoLVTn5087GJQRf8d6Wjq/S7gz3Dk z+LmJgegpo8ZPBkep1zf0CviRtWe1yP2FSLDNNq8ImcQqv9ZI0BJPFX4JohrF+a5 Kpgjfdih0t3CykPZGzy/mQpV9Fnf3viCcp3Ei62aC1w981z0s1wAnml8V13Wc1Wz kyMHd1gltB35mIC2Oc3mWFoM3xxsNszUhlgwWwIDAQABAoIBAQCYa4fXPUWNQqsS 1JpA3TbdFpQfFfThelkMZawij2SkPMOERZrGU213XchVMMx23LUBfw9avnBXWiO6 0i/ptue5dABj06xFNImcVLQ+GUPtxnLZFp9OauC5ovltdk26QrKgoXS1bgDNctz7 Q9rywyEw9tDDzumP5rtm5AOAFwsAQqZcB3pmQl0+agR5BQE6NWUhwkfgUeZzaZ8C Z5IpbYJSfrGMVqzGJwe3FN+5wJDXuHu0o9xS0B/D7x3Cy6l/aF4oWiYXicxmm1d+ js6vExgDRKPTDq4k0a07vr1ph3THmBEcSzCQxKBxDDvAGhMKX/7hYs8J0qZRR3QE Zn8uw47BAoGBAOri5zNgY2X1TY85LDYdV61T8Ex2MLjyl6eB/dXyF4h+dsHI/II/ KB4Jc4dBk/FpiCBdH96Qf+uGNuvJ1/GXkaZKWtDC6xR7uD6M48C2JRSDCsYH/qSz fzNZVm6wJLHW1ka6isHjGp+ntxI+JLb6ejsj4OQt0N1OFKfwkVWBojI7AoGBAMAC I0+gLKQMfAUo/NuskPJMUyddmmKmI0EHhqSLs3TBkutVIW2EcYGIa+nrjOWMQbYH yiHEdwwWLPPLjN/6wu7HCeWeTgMvqZuIcHLzmFGW1Iqcb9jUqjxCWaaJG7MNJ/to 7n/pe/WO5C/DZ7r96IhBAQVp/o8wKyBLHX8YDvhhAoGAPqnCHIa+fdjvlCIglV9G oMsf9IYjgXPW2a1oVsd7V8LFU/WWx/ipbzn+RDtOiL0qv9eYRPwv5FmuFUGIBr/0 73QuvjsCFDjdcnKL4EG3qr07BpHjcXUhnkVbNbRwVbGHAN+LXSaFV8qaoJdLnDU+ nsB3ouhGLIREJnmbjEBFUTkCgYAKUxMbAP3lhFZW4LFYDptsq/X8s+fNTimvIXx3 9JsduBryVI2LmgeQc4l59pSI81XFN/4CetH78GVSZquYj59Tv5gkpLKFMVbpahjB 1Z9nI7kiCu9otWbB/r9bWRwIMLjpp+bLMf7cYWabuuIlB+otCXHInL53bJulDOT1 JJIJgQKBgQCo03WqkCLibNYe8r+wksgMliYA7ZxNali1qm6l+aPdrDYefaocFMvV +/lNFRkqpU1dBa3qFQKcnhxW4ioUhTBJPUOVffJFZ0koagMhIeYEl4mF2m6erNZf iwS0V/RO2rxE7te7PkC7oh9JCSz6nFPXye/+lmy7Y7HUhxoK4YhYOA== -----END RSA PRIVATE KEY-----
                    secretName: mengningsoftware-tls
            replicas: 2
            resources:
              cpu: "500m"
              memory: "512Mi"
            service:
              enabled: true
              type: ClusterIP
              ports:
                - name: http
                  port: 80
                  protocol: TCP
                  targetPort: http
            template:
              type: stateless
              image: ${DOCKER_REGISTRY_ADDRESS}/${DOCKER_REPOSITORY_ARTIFACT}:latest
              ports:
                - name: http
                  port: 80
                  protocol: TCP
          EOF

          # 删除旧的 Application CRD（如果存在，忽略错误）
          kubectl delete application mengningsoftware -n web-servers --ignore-not-found=true || true

          # 创建新的 Application CRD
          kubectl apply -f /tmp/application-crd.yaml