nginx/.gitea/workflows/build-ubuntu.yaml

name: Build NGINX on Ubuntu

on: 
  push:
  pull_request:
    branches:
      - main 

env:
  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true

defaults:
  run:
    shell: 'bash -Eeo pipefail -x {0}'

jobs:
  build-nginx:
    runs-on: ubuntu-22.04
    
    steps:
      - name: 检出代码
        uses: actions/checkout@v4

      - name: 更新包管理器
        run: sudo apt update

      - name: 安装编译器和 make 工具
        run: sudo apt install -y gcc make

      - name: 安装依赖库
        run: |
          sudo apt install -y \
            libpcre3-dev \
            zlib1g-dev \
            libssl-dev \
            libxslt1-dev \
            libgd-dev \
            libgeoip-dev \
            libxml2-dev \
            uuid-dev

      - name: 配置构建
        run: |
          echo "当前工作目录: $(pwd)"
          echo "目录内容:"
          chmod +x ./auto/configure
          
          # 按照 README 步骤进行配置，使用 auto/configure 脚本
          ./auto/configure \
            --prefix=/usr/local/nginx \
            --with-http_ssl_module \
            --with-http_realip_module \
            --with-http_addition_module \
            --with-http_sub_module \
            --with-http_dav_module \
            --with-http_flv_module \
            --with-http_mp4_module \
            --with-http_gunzip_module \
            --with-http_gzip_static_module \
            --with-http_random_index_module \
            --with-http_secure_link_module \
            --with-http_stub_status_module \
            --with-http_auth_request_module \
            --with-http_xslt_module=dynamic \
            --with-http_image_filter_module=dynamic \
            --with-http_geoip_module=dynamic \
            --with-threads \
            --with-stream \
            --with-stream_ssl_module \
            --with-stream_ssl_preread_module \
            --with-stream_realip_module \
            --with-stream_geoip_module=dynamic \
            --with-http_slice_module \
            --with-http_v2_module \
            --with-file-aio

      - name: 编译 NGINX
        run: make

      - name: 安装 NGINX
        run: sudo make install

      - name: 验证安装
        run: |
          echo "检查 NGINX 二进制文件..."
          ls -la /usr/local/nginx/sbin/nginx
          
          echo "检查 NGINX 版本..."
          /usr/local/nginx/sbin/nginx -V

      - name: 测试 NGINX
        run: |
          echo "启动 NGINX..."
          sudo /usr/local/nginx/sbin/nginx
          
          echo "等待服务启动..."
          sleep 2
          echo "检查 NGINX 进程..."
          ps aux | grep nginx
          
          echo "测试 HTTP 连接..."
          curl -v localhost || echo "HTTP 测试失败，但继续执行"
          
          echo "停止 NGINX..."
          sudo /usr/local/nginx/sbin/nginx -s quit

      - name: 准备 Docker 构建上下文
        run: |
          echo "复制 nginx 文件到构建上下文..."
          sudo cp -r /usr/local/nginx ./nginx-install
          sudo chown -R $(whoami):$(whoami) ./nginx-install

      - name: 创建 Dockerfile
        run: |
          cat > Dockerfile << 'EOF'
          FROM ubuntu:22.04
          
          # 安装运行时依赖
          RUN apt-get update && \
              apt-get install -y --no-install-recommends \
                libpcre3 \
                zlib1g \
                libssl3 \
                libxslt1.1 \
                libgd3 \
                libgeoip1 \
                libxml2 \
                curl && \
              apt-get clean && \
              rm -rf /var/lib/apt/lists/*
          
          # 复制编译好的 nginx
          COPY nginx-install /usr/local/nginx
          
          # 创建 nginx 用户
          RUN useradd --system --home /var/cache/nginx --shell /sbin/nologin --comment "nginx user" --user-group nginx
          
          # 创建必要的目录
          RUN mkdir -p /var/log/nginx /var/cache/nginx && \
              chown -R nginx:nginx /var/log/nginx /var/cache/nginx
          
          # 暴露端口
          EXPOSE 80 443
          
          # 健康检查
          HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
            CMD curl -f http://localhost/ || exit 1
            # 启动 nginx
          CMD ["/usr/local/nginx/sbin/nginx", "-g", "daemon off;"]
          EOF

      - name: 构建 Docker 镜像
        run: |
          echo "构建 Docker 镜像..."
          docker build -t nginx-local:latest .

      - name: 登录到 Harbor
        run: |
          echo "登录到 Harbor 仓库..."
          echo "${{ secrets.HARBOR_PASSWORD }}" | docker login ${{ secrets.HARBOR_REGISTRY }} -u "${{ secrets.HARBOR_USERNAME }}" --password-stdin

      - name: 标记并推送 Docker 镜像
        run: |
          echo "标记镜像..."
          docker tag nginx-local:latest ${{ secrets.HARBOR_REGISTRY }}/test/nginx:${{ github.sha }}
          docker tag nginx-local:latest ${{ secrets.HARBOR_REGISTRY }}/test/nginx:latest
          
          echo "推送镜像..."
          docker push ${{ secrets.HARBOR_REGISTRY }}/test/nginx:${{ github.sha }}          docker push ${{ secrets.HARBOR_REGISTRY }}/test/nginx:latest
          
          echo "清理本地镜像..."
          docker rmi nginx-local:latest || true
          docker rmi ${{ secrets.HARBOR_REGISTRY }}/test/nginx:${{ github.sha }} || true
          docker rmi ${{ secrets.HARBOR_REGISTRY }}/test/nginx:latest || true

      - name: 部署到 Kubernetes (可选)
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: |
          echo "开始部署到 Kubernetes..."
          
          # 检查是否配置了 Kubernetes 部署
          if [[ -n "${{ secrets.KUBE_CONFIG }}" ]]; then
            # 检查并安装 kubectl (如果需要)
            if ! command -v kubectl &> /dev/null; then
              echo "kubectl 未安装，开始安装最新版本..."
              KUBECTL_VERSION=$(curl -L -s https://dl.k8s.io/release/stable.txt)
              echo "下载 kubectl 版本: $KUBECTL_VERSION"
              
              if curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"; then
                chmod +x kubectl
                sudo mv kubectl /usr/local/bin/
                echo "kubectl 安装完成，版本: $(kubectl version --client --short 2>/dev/null || kubectl version --client)"
              else
                echo "kubectl 下载失败，尝试使用包管理器安装..."
                sudo apt-get update && sudo apt-get install -y kubectl || (echo "kubectl 安装失败" && exit 1)
              fi
            else
              echo "kubectl 已存在，当前版本: $(kubectl version --client --short 2>/dev/null || kubectl version --client)"
              # 可选：检查版本是否过旧，如果需要可以升级
              # CURRENT_VERSION=$(kubectl version --client -o json 2>/dev/null | jq -r '.clientVersion.gitVersion' || echo "unknown")
              # echo "当前 kubectl 版本: $CURRENT_VERSION"
            fi
            
            # 配置 kubectl
            echo "配置 kubectl 连接信息..."
            mkdir -p ~/.kube
            if echo "${{ secrets.KUBE_CONFIG }}" | base64 -d > ~/.kube/config 2>/dev/null; then
              chmod 600 ~/.kube/config
              echo "kubectl 配置文件创建成功"
            else
              echo "ERROR: kubectl 配置文件创建失败，请检查 KUBE_CONFIG secret 是否正确"
              echo "KUBE_CONFIG 应该是 base64 编码的 kubeconfig 文件内容"
              exit 1
            fi
            
            # 验证 kubectl 连接
            echo "验证 Kubernetes 集群连接..."
            if kubectl cluster-info --short; then
              echo "Kubernetes 集群连接成功"
            else
              echo "ERROR: 无法连接到 Kubernetes 集群"
              echo "请检查:"
              echo "  1. KUBE_CONFIG secret 是否正确"
              echo "  2. 集群是否可访问"
              echo "  3. 证书是否有效"
              exit 1
            fi
            
            # 设置环境变量
            export HARBOR_REGISTRY="${{ secrets.HARBOR_REGISTRY }}"
            export HARBOR_USERNAME="${{ secrets.HARBOR_USERNAME }}"
            export HARBOR_PASSWORD="${{ secrets.HARBOR_PASSWORD }}"
            export NGINX_IMAGE_TAG="${{ github.sha }}"
            export NAMESPACE="${{ secrets.K8S_NAMESPACE || 'default' }}"
            
            # 进入 k8s 目录
            cd k8s
            
            # 运行部署脚本
            chmod +x deploy.sh
            ./deploy.sh
            
            echo "Kubernetes 部署完成"
          else
            echo "跳过 Kubernetes 部署 - 未配置 KUBE_CONFIG"
          fi