持续集成：加固交付分支部署与健康检查

.gitlab-ci.yml

@@ -22,7 +22,7 @@ build_backend:
     - export PATH=/data2/wzb/tools/maven/bin:$JAVA_HOME/bin:$PATH
     - javac -version
     - cd RuoYi-Vue
-    - mvn clean package -DskipTests
+    - mvn clean package
     - echo "=== 后端编译成功 ==="
   artifacts:
     expire_in: 2 days
@@ -57,7 +57,7 @@ deploy_production:
   tags:
     - railway-deploy
   rules:
-    - if: '$CI_COMMIT_BRANCH'
+    - if: '$CI_COMMIT_BRANCH == "feat/cicd-pipeline"'
   script:
     - echo "=== 开始部署应用 ==="
     # 部署前端静态资源到发布目录

deploy/restart-all.sh

@@ -19,6 +19,20 @@ DB_URL="jdbc:kingbase8://192.168.139.218:4321/training?currentSchema=public,sys_
 
 mkdir -p "$BACKEND_DIR" "$FRONTEND_DIR" "$LOG_DIR"
 
+echo "=== 0. 检查运行时安全配置 ==="
+
+if [ -z "${TRAIN_STUDENT_IDENTITY_ENCRYPTION_KEY:-}" ]; then
+    echo "错误：缺少 TRAIN_STUDENT_IDENTITY_ENCRYPTION_KEY"
+    exit 1
+fi
+
+if [ -z "${TRAIN_STUDENT_IDENTITY_HASH_KEY:-}" ]; then
+    echo "错误：缺少 TRAIN_STUDENT_IDENTITY_HASH_KEY"
+    exit 1
+fi
+
+echo "运行时安全配置存在性检查通过"
+
 echo "=== 1. 检查并停止当前用户的旧后端进程 ==="
 TARGET_PID=""
 if [ -f "$PID_FILE" ]; then
@@ -61,15 +75,42 @@ echo "后端已在后台启动，PID: $NEW_PID"
 echo "实时日志: $LOG_PATH"
 
 echo "等待服务启动与健康自检..."
+HEALTH_OK=0
+
 for i in {1..35}; do
     RES=$(curl -s "http://127.0.0.1:${SERVER_PORT}/captchaImage" 2>/dev/null)
+
     if echo "$RES" | grep -q '"code":200'; then
+        HEALTH_OK=1
         echo "后端健康检查通过！验证码接口返回正常！服务已在端口 $SERVER_PORT 成功运行！"
         break
     fi
+
+    if ! kill -0 "$NEW_PID" 2>/dev/null; then
+        echo "错误：后端进程在启动阶段提前退出，请检查 $LOG_PATH"
+        rm -f "$PID_FILE"
+        exit 1
+    fi
+
     sleep 2
 done
 
+if [ "$HEALTH_OK" -ne 1 ]; then
+    echo "错误：后端健康检查超时，请检查 $LOG_PATH"
+
+    if kill -0 "$NEW_PID" 2>/dev/null; then
+        kill -15 "$NEW_PID" 2>/dev/null || true
+        sleep 2
+
+        if kill -0 "$NEW_PID" 2>/dev/null; then
+            kill -9 "$NEW_PID" 2>/dev/null || true
+        fi
+    fi
+
+    rm -f "$PID_FILE"
+    exit 1
+fi
+
 echo "=== 3. 检查并启动/重载前端 Web 服务 (Nginx 8082) ==="
 NGINX_DIR="$DEPLOY_ROOT/nginx"
 NGINX_CONF="$NGINX_DIR/nginx.conf"
@@ -121,12 +162,20 @@ http {
 NGINX_EOF
 fi
 
-if pgrep -u $(whoami) -f "nginx: master" >/dev/null; then
+if pgrep -u "$(whoami)" -f "nginx: master" >/dev/null; then
     echo "平滑重载前端 Nginx 服务..."
-    /usr/sbin/nginx -c "$NGINX_CONF" -s reload
+
+    if ! /usr/sbin/nginx -c "$NGINX_CONF" -s reload; then
+        echo "错误：Nginx 平滑重载失败"
+        exit 1
+    fi
 else
     echo "启动前端 Nginx 服务..."
-    /usr/sbin/nginx -c "$NGINX_CONF"
+
+    if ! /usr/sbin/nginx -c "$NGINX_CONF"; then
+        echo "错误：Nginx 启动失败"
+        exit 1
+    fi
 fi
 
 echo "=== 部署全部就绪！前端访问地址: http://192.168.139.230:8082 ==="