fix: use production logging profile

.gitea/workflows/deploy.yml

@@ -1,37 +1,68 @@
-name: Deploy im-manager (k3s test cluster)
+name: Deploy im-manager production
 
 on:
+  push:
+    branches:
+      - pro
   workflow_dispatch:
-    inputs:
-      image_tag:
-        description: '镜像tag，默认为 test（与集群 kustomization 里的 newTag 一致）'
-        required: false
+
+concurrency:
+  group: production-im-manager
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  REGISTRY: git.olns.shop
+  IMAGE: git.olns.shop/pro/im_manager
+  SERVICE: im-manager
+  DEPLOY_HOST: 145.223.69.9
+  DEPLOY_USER: olns-deploy
 
 jobs:
   deploy:
     runs-on: deploy-host
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
 
-      - name: 确定镜像tag
-        id: vars
+      - name: Log in to Gitea Container Registry
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          TAG="${{ github.event.inputs.image_tag }}"
-          [ -z "$TAG" ] && TAG=test
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u admin --password-stdin
 
-      - name: 登录镜像仓库
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.118im.com -u admin --password-stdin
-
-      - name: 构建并推送镜像(前端+后端一体，自包含多阶段构建)
+      - name: Build and push image
+        env:
+          GITHUB_SHA: ${{ github.sha }}
         run: |
-          docker build -t git.118im.com/im_team/im-manager:${{ steps.vars.outputs.tag }} .
-          docker push git.118im.com/im_team/im-manager:${{ steps.vars.outputs.tag }}
+          set -euo pipefail
+          SHORT_SHA="$(printf '%.12s' "$GITHUB_SHA")"
+          docker build -t "${IMAGE}:pro" -t "${IMAGE}:${SHORT_SHA}" .
+          docker push "$IMAGE:pro"
+          docker push "$IMAGE:$SHORT_SHA"
 
-      - name: 部署到k3s测试集群
+      - name: Deploy Compose service
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          mkdir -p ~/.kube
-          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
-          chmod 600 ~/.kube/config
-          kubectl rollout restart deployment/im-manager -n manager-system
-          kubectl rollout status deployment/im-manager -n manager-system --timeout=120s
+          set -euo pipefail
+          install -d -m 700 "$HOME/.ssh"
+          KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
+          cleanup() {
+            shred -u "$KEY_FILE" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
+          chmod 600 "$KEY_FILE"
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/known_hosts"
+          SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
+          printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "docker login git.olns.shop -u admin --password-stdin"
+          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "cd /opt/olns && docker compose pull im-manager && docker compose up -d --no-deps --wait im-manager"

server/manifest/config/config.template

@@ -3,9 +3,9 @@ system:
   # 应用名称
   appName: "hotgo"
   # debug开关，开启后接口出现错误时会向前端输出堆栈信息，可选：false|true，默认为true
-  debug: true
+  debug: false
   # gf运行模式，可选：not-set|develop|testing|staging|product。product模式下后台【开发工具】菜单自动隐藏
-  mode: "develop"
+  mode: "product"
   # IP归属地解析方法，可选：cz88|whois，默认为whois
   ipMethod: "whois"
   # 是否为演示系统，可选：false|true
@@ -33,7 +33,7 @@ system:
 
 # 统一默认日志配置
 defaultLogger: &defaultLogger
-  level: "all"
+  level: "info"
   flags: 42
   file: "{Y-m-d}.log"                     # 日志文件格式。默认为"{Y-m-d}.log"
   stdoutColorDisabled: false              # 关闭终端的颜色打印。可选：false|true，默认false
@@ -54,13 +54,13 @@ server:
   ErrorStack: true                            # 当Server捕获到异常时是否记录堆栈信息到日志中。默认为true
   ErrorLogEnabled: true                       # 是否记录异常日志信息到日志中。默认为true
   errorLogPattern: "error/{Y-m-d}.log"        # 异常错误日志文件格式。默认为"error-{Ymd}.log"
-  accessLogEnabled: true                      # 是否记录访问日志。默认为false
+  accessLogEnabled: false                     # 是否记录访问日志。默认为false
   accessLogPattern: "access/{Y-m-d}.log"      # 访问日志文件格式。默认为"access-{Ymd}.log"
   maxHeaderBytes: "100KB"                     # 请求头大小限制，请求头包括客户端提交的Cookie数据，默认设置为100KB
   clientMaxBodySize: "200MB"                  # 客户端提交的Body大小限制，同时也影响文件上传大小，默认设置为200MB
   serverAgent: "HG HTTP Server"               # 服务端Agent信息。默认为"HG HTTP Server"
   # PProf配置
-  pprofEnabled: true                          # 是否开启PProf性能调试特性。默认为false
+  pprofEnabled: false                         # 是否开启PProf性能调试特性。默认为false
   pprofPattern: "/pprof"                      # 开启PProf时有效，表示PProf特性的页面访问路径，对当前Server绑定的所有域名有效。
   # 服务日志配置
   logger:
@@ -235,10 +235,10 @@ database:
   logger:
     path: "logs/database"                       # 日志文件路径。默认为空，表示关闭，仅输出到终端
     <<: *defaultLogger
-    stdout: true
+    stdout: false
   default:
     link: "$MYSQL_DSN"
-    debug: true
+    debug: false
     Prefix: "hg_"
     maxOpen: 10
     maxIdle: 5

tests/test_actions_workflow.py

@@ -0,0 +1,56 @@
+from pathlib import Path
+import unittest
+
+
+WORKFLOW = Path(__file__).resolve().parents[1] / ".gitea/workflows/deploy.yml"
+CONFIG_TEMPLATE = Path(__file__).resolve().parents[1] / "server/manifest/config/config.template"
+
+
+class DeployWorkflowContractTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.workflow = WORKFLOW.read_text(encoding="utf-8")
+
+    def test_targets_pro_branch_and_single_runner(self):
+        self.assertIn("push:", self.workflow)
+        self.assertIn("- pro", self.workflow)
+        self.assertIn("workflow_dispatch:", self.workflow)
+        self.assertIn("runs-on: deploy-host", self.workflow)
+        self.assertIn("concurrency:", self.workflow)
+
+    def test_builds_and_pushes_pro_image(self):
+        self.assertIn("git.olns.shop/pro/im_manager", self.workflow)
+        self.assertIn("docker push", self.workflow)
+        self.assertIn(":pro", self.workflow)
+
+    def test_deploys_compose_service_with_pinned_host_key(self):
+        self.assertIn("DEPLOY_SSH_KEY", self.workflow)
+        self.assertIn("DEPLOY_KNOWN_HOSTS", self.workflow)
+        self.assertIn("StrictHostKeyChecking=yes", self.workflow)
+        self.assertIn("docker compose pull im-manager", self.workflow)
+        self.assertIn("docker compose up -d --no-deps --wait im-manager", self.workflow)
+
+    def test_removes_old_kubernetes_and_registry_targets(self):
+        self.assertNotIn("kubectl", self.workflow)
+        self.assertNotIn("KUBECONFIG", self.workflow)
+        self.assertNotIn("git.118im.com", self.workflow)
+
+
+class ProductionConfigContractTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.config = CONFIG_TEMPLATE.read_text(encoding="utf-8")
+
+    def test_disables_debug_surfaces_and_verbose_request_logging(self):
+        self.assertIn("  debug: false", self.config)
+        self.assertNotIn("debug: true", self.config)
+        self.assertIn('  mode: "product"', self.config)
+        self.assertIn('  level: "info"', self.config)
+        self.assertIn("  accessLogEnabled: false", self.config)
+        self.assertIn("  pprofEnabled: false", self.config)
+        self.assertIn("    stdout: false", self.config)
+
+
+if __name__ == "__main__":
+    unittest.main()
+