read Nexus credentials from shared Vault path

.drone.yml

@@ -2,76 +2,166 @@ kind: pipeline
 name: default
 
 clone:
-  disable: true
+  retries: 3
+
+concurrency:
+  limit: 1
 
 steps:
-  - name: clone-cbt-ui
-    image: docker.freeicu.top/alpine/git:latest
-    commands:
-      - >
-        git clone
-        -b proj-shopee-test
-        --depth 1
-        --no-tags
-        https://zwzeng:glpat-nuzkafsdgYKM0KAgvpL4Bm86MQp1OnkH.01.0w0tr4xa1@git.ittx.com.cn/cybertrans/frontend/cbt-ui.git
-
-  - name: build-cbt-ui
-    image: docker.freeicu.top/library/node:22-alpine
+  # 拉取并打包 Shopee WES
+  - name: deploy
+    image: gradle:9-alpine
     pull: if-not-exists
     environment:
+      DOCKER_CONFIG: /home/gradle/.docker
+      JIB_USERNAME:
+        from_secret: docker_username
+      JIB_PASSWORD:
+        from_secret: docker_password
+      NEXUS_USERNAME:
+        from_secret: nexus_username
+      NEXUS_PASSWORD:
+        from_secret: nexus_password
       NPM_USERNAME:
         from_secret: nexus_username
       NPM_PASSWORD:
         from_secret: nexus_password
-      CBT_BUILD_OUTPUT_DIR: dist/release
     commands:
-      - >
-        test -w /cache ||
-        (echo "Cache directory /cache is not mounted or writable" && exit 1)
-      - cd cbt-ui
-      - >
-        sed -i
-        's#https://dl-cdn.alpinelinux.org/alpine#https://mirrors.aliyun.com/alpine#'
-        /etc/apk/repositories
-      - apk add --no-cache expect
-      - corepack enable
       - |
-        node <<'NODE'
-        const fs = require('fs')
-        const workspacePath = 'pnpm-workspace.yaml'
-        const workspace = fs.readFileSync(workspacePath, 'utf8')
-        const updated = workspace.replace(
-          /: set this to true or false$/gm,
-          ': true',
-        )
-
-        if (updated === workspace) {
-          throw new Error('pnpm-workspace.yaml has no allowBuilds placeholders')
+        if grep -qs ' /cache ' /proc/self/mountinfo && [ -w /cache ]; then
+          export GRADLE_USER_HOME=/cache/wes-loghub/gradle-9.6.1
+          export WES_WORKSPACE=/cache/wes-loghub/workspace
+          mkdir -p "$GRADLE_USER_HOME" "$(dirname "$WES_WORKSPACE")"
+          echo "===== persistent Gradle cache enabled: $GRADLE_USER_HOME ====="
+          echo "===== persistent WES workspace enabled: $WES_WORKSPACE ====="
+        else
+          export GRADLE_USER_HOME=/opt/gradle-user-home
+          export WES_WORKSPACE=/drone/src/wes-loghub
+          echo "===== WARNING: /cache is not mounted; using ephemeral Gradle cache ====="
+        fi
+      - git --version
+      - |
+        test -n "${NEXUS_USERNAME:-${NPM_USERNAME:-}}" || {
+          echo "Nexus username secret is missing"
+          exit 1
         }
-        fs.writeFileSync(workspacePath, updated)
-        NODE
-      - pnpm config set store-dir /cache/cbt-ui/pnpm-store
-      - sh install.sh
-      - pnpm build:wes
-      - test -f dist/release/index.html
+        test -n "${NEXUS_PASSWORD:-${NPM_PASSWORD:-}}" || {
+          echo "Nexus password secret is missing"
+          exit 1
+        }
+      - |
+        if [ -d "$WES_WORKSPACE/.git" ]; then
+          echo "===== updating persistent WES workspace ====="
+          time git -C "$WES_WORKSPACE" fetch \
+            --depth 1 \
+            --no-tags \
+            https://zwzeng:glpat-nuzkafsdgYKM0KAgvpL4Bm86MQp1OnkH.01.0w0tr4xa1@git.ittx.com.cn/wms/wes-loghub.git \
+            proj-shopee-test
+          git -C "$WES_WORKSPACE" checkout -B proj-shopee-test FETCH_HEAD
+        else
+          echo "===== creating persistent WES workspace ====="
+          time git clone \
+            -b proj-shopee-test \
+            --depth 1 \
+            --no-tags \
+            https://zwzeng:glpat-nuzkafsdgYKM0KAgvpL4Bm86MQp1OnkH.01.0w0tr4xa1@git.ittx.com.cn/wms/wes-loghub.git \
+            "$WES_WORKSPACE"
+        fi
+        git -C "$WES_WORKSPACE" remote set-url origin https://git.ittx.com.cn/wms/wes-loghub.git
+      - git -C "$WES_WORKSPACE" log -1 --format='===== WES commit %H %s ====='
+      - cd "$WES_WORKSPACE"
+      - |
+        (
+          gradle_pids() {
+            for proc_path in /proc/[0-9]*; do
+              [ -r "$proc_path/cmdline" ] || continue
+              proc_cmd=$(tr '\0' ' ' < "$proc_path/cmdline" 2>/dev/null)
+              case "$proc_cmd" in
+                *GradleDaemon*|*GradleWorkerMain*) basename "$proc_path" ;;
+              esac
+            done
+          }
+          heartbeat_count=0
+          while true; do
+            heartbeat_count=$((heartbeat_count + 1))
+            echo "===== build heartbeat $(date -Iseconds) ====="
+            echo "load: $(cat /proc/loadavg)"
+            awk '/MemTotal|MemAvailable/ { printf "%s %s kB  ", $1, $2 } END { print "" }' /proc/meminfo
+            echo "===== active Gradle tasks ====="
+            cat /tmp/gradle-active-tasks 2>/dev/null || echo "none"
+            echo "===== top processes ====="
+            if command -v top >/dev/null 2>&1; then
+              top -b -n 1 2>/dev/null | head -n 20
+            else
+              ps -ef
+            fi
+            echo "===== Gradle JVM I/O ====="
+            for pid in $(gradle_pids); do
+              echo "--- pid=$pid cmd=$(tr '\0' ' ' < /proc/$pid/cmdline 2>/dev/null)"
+              awk '/read_bytes|write_bytes|cancelled_write_bytes/ { printf "%s ", $0 } END { print "" }' "/proc/$pid/io" 2>/dev/null || true
+            done
+            if [ $((heartbeat_count % 15)) -eq 0 ]; then
+              echo "===== Gradle JVM thread dump after $((heartbeat_count * 60)) seconds ====="
+              for pid in $(gradle_pids); do
+                jcmd "$pid" Thread.print -l || true
+              done
+            fi
+            sleep 60
+          done
+        ) &
+        echo $! > /tmp/build-heartbeat.pid
+        trap 'kill "$(cat /tmp/build-heartbeat.pid)" 2>/dev/null || true' EXIT
       - >
-        sed -i
-        's#registry-vpc.cn-hangzhou.aliyuncs.com#registry.cn-hangzhou.aliyuncs.com#'
-        Dockerfile
+        time gradle jib -stacktrace
+        --init-script=/drone/src/gradle-repositories.init.gradle
+        --init-script=/drone/src/gradle-diagnostics.init.gradle
+        --no-daemon
+        --info
+        --console=plain
+        --warning-mode=summary
+        --build-cache
+        --configure-on-demand
+        --parallel
+        --max-workers=8
+        -x test 
+        -PdockerBuild=true  
+        -Dcybertrans.idp.enabled=false 
+        -Djib.disableUpdateChecks=true
+        -Djib.baseImageCache=$GRADLE_USER_HOME/caches/jib/base
+        -Djib.applicationCache=$GRADLE_USER_HOME/caches/jib/application
+        -Djib.from.image=registry.cn-hangzhou.aliyuncs.com/ttx/amazoncorretto:25-alpine3.23-jdk
+        -Djib.from.auth.username=$JIB_USERNAME
+        -Djib.from.auth.password=$JIB_PASSWORD
+        -Djib.to.auth.username=$JIB_USERNAME
+        -Djib.to.auth.password=$JIB_PASSWORD
+        -Djib.to.image=registry.cn-hangzhou.aliyuncs.com/loghub/wes:shopee-wes-test-3
+        -Djib.to.tags=shopee-wes-test-3
+        -Djib.container.entrypoint='INHERIT'
+        -Djib.container.args='java,-Dfile.encoding=utf-8,-Dspring.profiles.active=k8s,-Dserver.port=9210,-cp,/app/resources:/app/classes:/app/libs/*,com.ittx.Application'
+      - >
+        kill "$(cat /tmp/build-heartbeat.pid)" 2>/dev/null || true
 
-  - name: package-cbt-ui
-    image: docker.freeicu.top/plugins/docker:latest
-    settings:
-      context: ./cbt-ui
-      dockerfile: ./cbt-ui/Dockerfile
-      registry: registry.cn-hangzhou.aliyuncs.com
-      repo: registry.cn-hangzhou.aliyuncs.com/loghub/wes
-      tags:
-        - shopee-ui-test-1
-      cache_from:
-        - registry.cn-hangzhou.aliyuncs.com/loghub/wes:shopee-ui-test-1
-      username:
-        from_secret: docker_username
-      password:
-        from_secret: docker_password
-      purge: true
+---
+kind: secret
+name: docker_username
+get:
+  path: drone/data/docker_username
+  name: docker_username
+---
+kind: secret
+name: docker_password
+get:
+  path: drone/data/docker_password
+  name: docker_password
+---
+kind: secret
+name: nexus_username
+get:
+  path: drone/data/nexus
+  name: nexus_username
+---
+kind: secret
+name: nexus_password
+get:
+  path: drone/data/nexus
+  name: nexus_password

gradle-diagnostics.init.gradle

@@ -0,0 +1,34 @@
+import java.util.concurrent.ConcurrentHashMap
+import org.gradle.api.tasks.compile.GroovyCompile
+
+def taskStartNanos = new ConcurrentHashMap<String, Long>()
+def activeTasksFile = new File('/tmp/gradle-active-tasks')
+
+def writeActiveTasks = {
+    synchronized (taskStartNanos) {
+        def activeTasks = taskStartNanos.keySet().sort()
+        activeTasksFile.text = activeTasks
+                ? activeTasks.join(System.lineSeparator()) + System.lineSeparator()
+                : "none${System.lineSeparator()}"
+    }
+}
+
+gradle.beforeProject { project ->
+    project.tasks.withType(GroovyCompile).configureEach {
+        options.forkOptions.memoryMaximumSize = '1g'
+    }
+}
+
+gradle.taskGraph.beforeTask { task ->
+    taskStartNanos.put(task.path, System.nanoTime())
+    writeActiveTasks()
+    println "[TASK START] ${task.path}"
+}
+
+gradle.taskGraph.afterTask { task, state ->
+    def startedAt = taskStartNanos.remove(task.path)
+    def elapsedMs = startedAt == null ? 0 : (System.nanoTime() - startedAt) / 1_000_000
+    def outcome = state.failure ? 'FAILED' : state.skipped ? 'SKIPPED' : 'DONE'
+    println "[TASK END] ${task.path} ${outcome} ${elapsedMs} ms"
+    writeActiveTasks()
+}

gradle-repositories.init.gradle

@@ -0,0 +1,71 @@
+def nexusUsername = System.getenv('NEXUS_USERNAME') ?: System.getenv('NPM_USERNAME')
+def nexusPassword = System.getenv('NEXUS_PASSWORD') ?: System.getenv('NPM_PASSWORD')
+
+if (!nexusUsername || !nexusPassword) {
+    throw new GradleException('Nexus credentials are not configured')
+}
+
+buildscript {
+    repositories {
+        mavenLocal()
+        maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+        maven {
+            url = 'https://nexus.loghub.com/repository/public/'
+            credentials {
+                username = nexusUsername
+                password = nexusPassword
+            }
+        }
+        maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+        maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+    }
+}
+
+allprojects {
+    buildscript {
+        repositories {
+            mavenLocal()
+            maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+            maven {
+                url = 'https://nexus.loghub.com/repository/public/'
+                credentials {
+                    username = nexusUsername
+                    password = nexusPassword
+                }
+            }
+            maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+            maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+        }
+    }
+    repositories {
+        mavenLocal()
+        maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+        maven {
+            url = 'https://nexus.loghub.com/repository/public/'
+            credentials {
+                username = nexusUsername
+                password = nexusPassword
+            }
+        }
+        maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+        maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+    }
+}
+
+settingsEvaluated { settings ->
+    settings.pluginManagement {
+        repositories {
+            mavenLocal()
+            maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+            maven {
+                url = 'https://nexus.loghub.com/repository/public/'
+                credentials {
+                    username = nexusUsername
+                    password = nexusPassword
+                }
+            }
+            maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+            maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+        }
+    }
+}