CI/CD 部署提速实战：从 90 分钟到 5 分钟的全链路优化

# GitLab CI：在 .gitlab-ci.yml 中启用耗时统计
# 不需要额外配置，GitLab 默认记录每个 job 的 started_at 和 finished_at
# 通过 API 获取详细数据：

# 获取最近一次 Pipeline 的各 Job 耗时
# curl --header "PRIVATE-TOKEN: <token>" \
#   "https://gitlab.example.com/api/v4/projects/<project_id>/pipelines/<pipeline_id>/jobs" \
#   | jq '.[] | {name: .name, duration: .duration, status: .status}'

// Jenkins：在 Pipeline 中记录各阶段耗时
pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                script {
                    def startTime = currentBuild.startTimeInMillis
                    echo "Build started at: ${new Date(startTime)}"
                }
                // ... 构建步骤
            }
            post {
                always {
                    script {
                        def duration = (System.currentTimeMillis() - currentBuild.startTimeInMillis) / 1000
                        echo "Total duration: ${duration}s"
                    }
                }
            }
        }
    }
}

# 查询最近 7 天构建耗时的 P95 趋势
histogram_quantile(0.95, 
  sum(rate(ci_build_duration_seconds_bucket[7d])) by (le, stage)
)

# .gitlab-ci.yml
variables:
  # 使用 overlay2 驱动，比 vfs 快 3-5 倍
  DOCKER_DRIVER: overlay2
  # 缓存目录
  CACHE_DIR: "${CI_PROJECT_DIR}/.cache"

# 全局缓存配置
cache:
  # 按分支生成缓存键，避免不同分支互相污染
  key:
    files:
      - package-lock.json    # 锁文件变了就刷新缓存
      - go.sum
    prefix: ${CI_COMMIT_REF_SLUG}
  paths:
    - ${CACHE_DIR}/npm/       # npm 缓存
    - ${CACHE_DIR}/go-build/  # Go 构建缓存
    - ${CACHE_DIR}/go-pkg/    # Go 模块缓存
    - node_modules/           # Node.js 依赖目录

# Go 项目构建 Job
build_go:
  stage: build
  image: golang:1.22-alpine
  variables:
    GOPATH: ${CACHE_DIR}/go-pkg
    GOCACHE: ${CACHE_DIR}/go-build
  script:
    # 设置 Go 代理（国内环境必做）
    - export GOPROXY=https://goproxy.cn,direct
    - go mod download          # 有缓存时跳过网络下载
    - go build -o bin/app ./cmd/server
  artifacts:
    paths:
      - bin/
    expire_in: 1 hour         # 构建产物保留 1 小时

// Jenkinsfile：Kubernetes Agent 挂载持久化缓存
pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: golang
    image: golang:1.22-alpine
    command: ["sleep", "infinity"]
    volumeMounts:
    - name: go-cache
      mountPath: /go/pkg       # Go 模块缓存
    - name: go-build-cache
      mountPath: /root/.cache/go-build  # Go 编译缓存
    env:
    - name: GOPROXY
      value: "https://goproxy.cn,direct"
  volumes:
  - name: go-cache
    persistentVolumeClaim:
      claimName: go-module-cache    # PVC 持久化
  - name: go-build-cache
    persistentVolumeClaim:
      claimName: go-build-cache     # PVC 持久化
'''
        }
    }
    stages {
        stage('Build') {
            steps {
                sh 'go mod download'
                sh 'go build -o bin/app ./cmd/server'
            }
        }
    }
}

<!-- pom.xml：启用增量编译 -->
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-compiler-plugin</artifactId>
    <version>3.11.0</version>
    <configuration>
        <useIncrementalCompilation>true</useIncrementalCompilation>
        <parallelCompilation>true</parallelCompilation>
    </configuration>
</plugin>

# .gitlab-ci.yml：Maven 缓存
build_java:
  image: maven:3.9-eclipse-temurin-17
  cache:
    key:
      files:
        - pom.xml
    paths:
      - .m2/repository/        # Maven 本地仓库
  script:
    # 离线模式优先（有缓存时跳过下载）
    - mvn package -o -DskipTests || mvn package -DskipTests
    # 先离线编译，失败再联网下载依赖
  artifacts:
    paths:
      - target/*.jar

# .gitlab-ci.yml：并行构建多个微服务
stages:
  - build
  - test
  - package

# 并行构建多个服务
build_user_service:
  stage: build
  script:
    - cd services/user && go build -o ../../bin/user ./cmd/server
  rules:
    - changes:
        - services/user/**/*        # 只有 user 服务代码变更才构建

build_order_service:
  stage: build
  script:
    - cd services/order && go build -o ../../bin/order ./cmd/server
  rules:
    - changes:
        - services/order/**/*

build_payment_service:
  stage: build
  script:
    - cd services/payment && go build -o ../../bin/payment ./cmd/server
  rules:
    - changes:
        - services/payment/**/*

# .gitlab-ci.yml：测试并行化
test_unit:
  stage: test
  parallel: 4               # 拆成 4 个并行 Job
  script:
    # Go 测试自带并行能力，配合 -parallel 控制并发数
    - go test -parallel 4 -count=1 -coverprofile=coverage.out ./...
    # GitLab 会自动把测试用例均匀分配到 4 个并行 Job 中

// Jenkinsfile：并行测试
stage('Test') {
    parallel {
        stage('Unit Tests') {
            steps {
                sh 'go test -short ./...'
            }
        }
        stage('Integration Tests') {
            steps {
                sh 'go test -run Integration ./test/integration/...'
            }
        }
        stage('Lint') {
            steps {
                sh 'golangci-lint run ./...'
            }
        }
    }
}

# .gitlab-ci.yml：用 needs 打破阶段依赖
stages:
  - build
  - test
  - deploy

build:
  stage: build
  script: go build -o bin/app ./cmd/server

test_unit:
  stage: test
  needs: ["build"]          # 只依赖 build，不等其他 test Job
  script: go test -short ./...

test_integration:
  stage: test
  needs: ["build"]          # 和 test_unit 并行执行
  script: go test -run Integration ./...

deploy_staging:
  stage: deploy
  needs: ["test_unit"]      # 只等 unit test 通过就部署，不等 integration
  script: kubectl apply -f k8s/staging/

# Dockerfile：多阶段构建（Go 项目示例）

# 阶段1：构建环境（有完整 Go 工具链）
FROM golang:1.22-alpine AS builder

WORKDIR /app

# 关键：先复制 go.mod 和 go.sum，再 go mod download
# 这样只要依赖没变，这一层的缓存就能命中
COPY go.mod go.sum ./
RUN go mod download

# 再复制源码（源码经常变，但依赖层缓存不受影响）
COPY . .

# 编译（CGO 禁用，生成静态二进制）
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /app/bin/server ./cmd/server

# 阶段2：运行环境（极简镜像，不含 Go 工具链）
FROM gcr.io/distroless/static-debian12:nonroot

COPY --from=builder /app/bin/server /server

USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/server"]

# .gitlab-ci.yml：启用 BuildKit
variables:
  DOCKER_BUILDKIT: "1"
  # 或者用 buildx
  BUILDX_BUILDER: "default"

build_image:
  stage: package
  image: docker:24.0
  services:
    - docker:24.0-dind
  script:
    # 启用 BuildKit
    - export DOCKER_BUILDKIT=1
    - docker build 
        --build-arg BUILDKIT_INLINE_CACHE=1 
        --cache-from type=registry,ref=$CI_REGISTRY_IMAGE:cache
        --cache-to type=registry,ref=$CI_REGISTRY_IMAGE:cache,mode=max
        -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA 
        -t $CI_REGISTRY_IMAGE:latest
        .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE:latest

# K8s 配置热更新（不需要重建 Pod）
# 修改 ConfigMap 后，Pod 内的配置文件会自动更新（如果用了 configmap volume）
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  config.yaml: |
    log_level: debug       # 从 info 改成 debug，不用重建 Pod
    max_connections: 1000    

# 只修改 ConfigMap，不触发 Pod 重建
kubectl create configmap app-config --from-file=config.yaml -o yaml --dry-run=client | kubectl apply -f -

# 如果应用支持热加载（如 Go 的 viper 库），配置立即生效
# 如果不支持，需要重启 Pod 但不用重新构建镜像
kubectl rollout restart deployment/app

# 针对不同服务调优滚动更新参数
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
spec:
  replicas: 10
  strategy:
    type: RollingUpdate
    rollingUpdate:
      # API 网关：快速更新（无状态服务）
      maxUnavailable: 50%      # 一次替换一半，快但风险高
      maxSurge: 50%
  template:
    spec:
      containers:
      - name: app
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 2     # 别等 30 秒，应用启动快就直接检查
          periodSeconds: 2           # 2 秒检查一次
          successThreshold: 1        # 1 次成功就绪
          failureThreshold: 3        # 3 次失败才判失败

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-service
spec:
  replicas: 6
  strategy:
    type: RollingUpdate
    rollingUpdate:
      # 支付服务：保守更新（有状态、强一致）
      maxUnavailable: 0            # 不允许减少可用 Pod
      maxSurge: 1                  # 最多多 1 个 Pod
  template:
    spec:
      containers:
      - name: app
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
          successThreshold: 1
          failureThreshold: 5

# .gitlab-ci.yml：优化后的完整流水线（目标 5 分钟内完成）

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_BUILDKIT: "1"
  GOPROXY: "https://goproxy.cn,direct"

# 全局缓存
cache:
  key:
    files: [go.sum, package-lock.json]
    prefix: ${CI_COMMIT_REF_SLUG}
  paths:
    - .cache/go-build/
    - .cache/go-pkg/
    - node_modules/
  policy: pull-push           # 先拉取再推送

stages:
  - check
  - build
  - test
  - package
  - deploy

# 1. 代码检查（lint + 安全扫描，并行）
lint:
  stage: check
  image: golangci/golangci-lint:v1.57
  script: golangci-lint run --timeout 2m ./...
  needs: []                   # 不依赖任何前置 Job，立即开始

security_scan:
  stage: check
  image: aquasec/trivy:latest
  script: trivy fs --severity HIGH,CRITICAL --exit-code 1 .
  needs: []                   # 和 lint 并行

# 2. 编译（有缓存，秒级完成）
build:
  stage: build
  image: golang:1.22-alpine
  variables:
    GOCACHE: ${CI_PROJECT_DIR}/.cache/go-build
    GOPATH: ${CI_PROJECT_DIR}/.cache/go-pkg
  script:
    - go mod download
    - go build -ldflags="-s -w" -o bin/server ./cmd/server
  artifacts:
    paths: [bin/]
    expire_in: 1 hour

# 3. 测试（拆分并行，4 路并行）
test_unit:
  stage: test
  image: golang:1.22-alpine
  parallel: 4
  needs: ["build"]
  script:
    - go test -parallel 4 -count=1 -coverprofile=cov.out ./...
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: cov.out

# 4. 镜像构建（多阶段 + BuildKit + 远程缓存）
docker_build:
  stage: package
  image: docker:24.0
  services: [docker:24.0-dind]
  needs: ["build"]            # 不等 test，和 test 并行
  script:
    - export DOCKER_BUILDKIT=1
    - docker build
        --cache-from type=registry,ref=$CI_REGISTRY_IMAGE:cache
        --cache-to type=registry,ref=$CI_REGISTRY_IMAGE:cache,mode=max
        -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
        .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

# 5. 部署（按环境渐进）
deploy_staging:
  stage: deploy
  image: bitnami/kubectl:1.29
  needs: ["test_unit", "docker_build"]
  script:
    - kubectl set image deployment/app-staging
        app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - kubectl rollout status deployment/app-staging --timeout=120s
  environment:
    name: staging

deploy_production:
  stage: deploy
  image: bitnami/kubectl:1.29
  needs: ["deploy_staging"]
  script:
    - kubectl set image deployment/app-prod
        app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - kubectl rollout status deployment/app-prod --timeout=180s
  environment:
    name: production
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual             # 生产环境手动确认

// DAG 调度引擎核心结构（简化版）
type TaskNode struct {
    ID           string
    ServiceName  string
    Priority     int          // 1=高优先级（核心业务），5=低优先级
    DependsOn    []string     // 依赖的其他 Task ID
    Status       TaskStatus   // pending / running / success / failed
    ResourceReq  ResourceSpec // CPU/内存需求
}

type Scheduler struct {
    nodes      map[string]*TaskNode
    runnerPool chan *Runner         // Runner 资源池
    maxParallel int                  // 最大并行度
}

// 调度核心逻辑：优先级 + 依赖 + 资源三维度决策
func (s *Scheduler) Schedule() {
    for {
        // 找出所有依赖已满足的 pending 任务
        ready := s.findReadyTasks()
        
        // 按优先级排序
        sort.Slice(ready, func(i, j int) bool {
            return ready[i].Priority < ready[j].Priority
        })
        
        // 尝试为每个就绪任务分配 Runner
        for _, task := range ready {
            runner := s.tryAcquireRunner(task.ResourceReq)
            if runner != nil {
                go s.execute(task, runner)
            }
        }
    }
}

# 构建耗时超过 10 分钟告警
ci_build_duration_seconds{stage="total"} > 600

# 缓存命中率低于 50% 告警
1 - (
  ci_build_cache_miss_total / ci_build_total
) < 0.5

# 错误：用 commit SHA 做缓存键，每次提交都不同，缓存永远不命中
cache:
  key: ${CI_COMMIT_SHA}
  paths: [node_modules/]

# 正确：用锁文件的 hash 做缓存键
cache:
  key:
    files: [package-lock.json]
  paths: [node_modules/]

# 错误：多个并行测试 Job 连同一个数据库，数据互相覆盖
# test_unit_job_1 INSERT INTO users (id=1)
# test_unit_job_2 INSERT INTO users (id=1)  → 冲突

# 正确：每个并行 Job 用独立的数据库实例
test_unit:
  parallel: 4
  services:
    - name: postgres:15
      alias: db
      # 每个并行 Job 自动获得独立的 db 实例
  variables:
    DATABASE_URL: "postgres://test:test@db:5432/test_$CI_NODE_INDEX"

# 错误：先 COPY 源码，每次改代码都触发 go mod download 重新执行
COPY . .
RUN go mod download

# 正确：先 COPY 依赖文件，再 go mod download，最后 COPY 源码
COPY go.mod go.sum ./
RUN go mod download
COPY . .

# 危险：maxUnavailable: 100% 意味着先删掉所有旧 Pod 再创建新 Pod
# 如果新 Pod 启动失败，服务完全不可用
strategy:
  rollingUpdate:
    maxUnavailable: 100%    # 别这么干
    maxSurge: 0

# 每次构建都生成产物，不清不删，一个月后磁盘就满了
artifacts:
  paths: [bin/]
  expire_in: 1 hour        # 必须设过期时间