实战④：测试、CI/CD 与上线交付

@ExtendWith(MockitoExtension.class)class OrderServiceTest {    @Mock private OrderMapper orderMapper;    @Mock private OrderItemMapper orderItemMapper;    @Mock private InventoryService inventoryService;    @InjectMocks private OrderService orderService;    @Test    void createOrder_shouldSucceed_whenStockIsEnough() {        CreateOrderCmd cmd = new CreateOrderCmd(1001L, List.of(new ItemCmd(2001L, 2)));        when(inventoryService.deduct(2001L, 2)).thenReturn(true); // 扣减成功        OrderVO vo = orderService.create("idem-key-001", cmd);        assertThat(vo.orderNo()).startsWith("BO");        assertThat(vo.amount()).isEqualByComparingTo("199.00"); // 金额用 BigDecimal 比较        verify(orderMapper, times(1)).insert(any(Order.class));  // 恰好落库一次    }}

@Testvoid createOrder_shouldFail_whenStockIsNotEnough() {    CreateOrderCmd cmd = new CreateOrderCmd(1001L, List.of(new ItemCmd(2001L, 2)));    when(inventoryService.deduct(2001L, 2)).thenReturn(false); // 扣减失败    BizException ex = assertThrows(BizException.class,            () -> orderService.create("idem-key-002", cmd));    assertThat(ex.getCode()).isEqualTo(ErrorCode.STOCK_NOT_ENOUGH);    verify(orderMapper, never()).insert(any(Order.class)); // 关键：绝不落单}

@Testvoid handleCallback_shouldBeIdempotent_whenDuplicated() {    PayCallback cb = new PayCallback("trade-9f3a", "BO20260207001", new BigDecimal("199.00"));    boolean first  = paymentService.handleCallback(cb);    boolean second = paymentService.handleCallback(cb); // 完全相同的重复回调    assertThat(first).isTrue();          // 第一次真实入账    assertThat(second).isFalse();        // 第二次被幂等挡下，不再改状态    verify(orderMapper, times(1)).markPaid(anyString()); // 状态只流转一次}

@WebMvcTest(OrderController.class)class OrderControllerTest {    @Autowired private MockMvc mockMvc;    @MockBean private OrderService orderService;    @Test    void createOrder_shouldReturn200_withOrderNo() throws Exception {        when(orderService.create(anyString(), any()))                .thenReturn(new OrderVO("BO20260207001", new BigDecimal("199.00"), "CREATED"));        mockMvc.perform(post("/api/orders")                        .header("Idempotency-Key", "idem-key-001")                        .contentType(MediaType.APPLICATION_JSON)                        .content("{\"userId\":1001,\"items\":[{\"productId\":2001,\"quantity\":2}]}"))                .andExpect(status().isOk())                .andExpect(jsonPath("$.code").value(0))                .andExpect(jsonPath("$.data.orderNo").value("BO20260207001"));    }}

@SpringBootTest@Testcontainersclass OrderRepositoryIT {    @Container    static MySQLContainer<?> mysql = new MySQLContainer<>("mysql:8.0")            .withDatabaseName("beeorder").withUsername("bee").withPassword("bee");    @DynamicPropertySource    static void props(DynamicPropertyRegistry r) {        r.add("spring.datasource.url", mysql::getJdbcUrl);        r.add("spring.datasource.username", mysql::getUsername);        r.add("spring.datasource.password", mysql::getPassword);    }    @Autowired private OrderService orderService;    @Test    void shouldNotOversell_underConcurrency() {        // 真库上跑并发下单，验证条件更新真的挡住了超卖    }}

// 弱断言：只证明这行被执行过，算进了覆盖率，什么都没锁住@Testvoid createOrder_any() {    OrderVO vo = orderService.create("k", cmd);    assertThat(vo).isNotNull();}// 强断言：把「金额怎么算、状态怎么流转、副作用几次」全部钉住@Testvoid createOrder_contract() {    OrderVO vo = orderService.create("k", cmd);    assertThat(vo.amount()).isEqualByComparingTo("199.00");    assertThat(vo.status()).isEqualTo("CREATED");    verify(inventoryService, times(1)).deduct(2001L, 2);    verify(notificationService, never()).notify(any());   // 提交前绝不发通知}

@Testvoid shouldNeverOversell_when100RequestsCompeteFor5Items() throws Exception {    int threads = 100;    ExecutorService pool = Executors.newFixedThreadPool(threads);    CountDownLatch ready = new CountDownLatch(threads);    CountDownLatch start = new CountDownLatch(1);   // 发令枪    CountDownLatch done  = new CountDownLatch(threads);    AtomicInteger success = new AtomicInteger();    for (int i = 0; i < threads; i++) {        final long userId = 1000L + i;        pool.submit(() -> {            ready.countDown();            try {                start.await();                       // 所有线程在此待命，同时放行                orderService.create("key-" + userId,                        new CreateOrderCmd(userId, List.of(new ItemCmd(2001L, 1))));                success.incrementAndGet();            } catch (BizException e) {                // 库存不足，属预期失败            } catch (Exception ignored) {            } finally {                done.countDown();            }        });    }    ready.await();    start.countDown();        // 真正的高并发发生在这之后    done.await(30, TimeUnit.SECONDS);    Integer remain = jdbcTemplate.queryForObject(            "SELECT available FROM inventory WHERE product_id = 2001", Integer.class);    assertThat(success.get()).isEqualTo(5);   // 恰好 5 单成功    assertThat(remain).isZero();              // 库存归零，无超卖}

name: beeorder-cion:  push:    branches: [ main ]    tags: [ 'v*' ]  pull_request:    branches: [ main ]jobs:  build-and-test:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - name: Set up JDK 21        uses: actions/setup-java@v4        with:          distribution: temurin          java-version: '21'          cache: maven                     # 缓存 ~/.m2，依赖下载提速      - name: Run tests        run: mvn -B -ntp clean verify       # 单元 + 切片 + 集成测试一起跑      - name: Upload test report        if: always()        uses: actions/upload-artifact@v4        with:          name: surefire-reports          path: target/surefire-reports  package:    needs: build-and-test                  # 测试不过，镜像不构建    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')    runs-on: ubuntu-latest    permissions:      contents: read      packages: write    steps:      - uses: actions/checkout@v4      - name: Log in to GHCR        uses: docker/login-action@v3        with:          registry: ghcr.io          username: ${{ github.actor }}          password: ${{ secrets.GITHUB_TOKEN }}      - name: Build and push image        uses: docker/build-push-action@v6        with:          context: .          push: true          tags: |            ghcr.io/acme/beeorder:${{ github.sha }}            ghcr.io/acme/beeorder:latest  deploy:    needs: package    if: startsWith(github.ref, 'refs/tags/v')   # 只有打 tag 才真正上线    runs-on: ubuntu-latest    environment: production    steps:      - name: Deploy over SSH        uses: appleboy/ssh-action@v1        with:          host: ${{ secrets.DEPLOY_HOST }}          username: ${{ secrets.DEPLOY_USER }}          key: ${{ secrets.DEPLOY_KEY }}          script: |            cd /opt/beeorder            export IMAGE_TAG=${{ github.sha }}            docker compose pull app            docker compose up -d app            ./scripts/wait-healthy.sh app   # 健康检查通过才认为部署成功

# ---------- 阶段一：构建（带 JDK + Maven，用完即弃） ----------FROM maven:3.9-eclipse-temurin-21 AS builderWORKDIR /buildCOPY pom.xml .RUN mvn -B dependency:go-offline          # 依赖不变 → 这一层永远命中缓存COPY src ./srcRUN mvn -B clean package -DskipTests# 把 fat jar 拆成四层，让依赖层在镜像里也命中缓存RUN java -Djarmode=layertools -jar target/beeorder.jar extract# ---------- 阶段二：运行（只有 JRE，没有 Maven、没有源码） ----------FROM eclipse-temurin:21-jre-jammyWORKDIR /appENV TZ=Asia/Shanghai \    JAVA_TOOL_OPTIONS="-XX:MaxRAMPercentage=75.0 -XX:MaxMetaspaceSize=256m -Xss512k"# 非 root 运行，降低容器逃逸面RUN useradd -r -u 1001 -s /usr/sbin/nologin beeUSER beeCOPY --from=builder /build/dependencies/ ./COPY --from=builder /build/spring-boot-loader/ ./COPY --from=builder /build/snapshot-dependencies/ ./COPY --from=builder /build/application/ ./EXPOSE 8080# exec 形式：java 自己是 PID 1，SIGTERM 才收得到（第八节的前提）ENTRYPOINT ["java", "org.springframework.boot.loader.launch.JarLauncher"]

#!/usr/bin/env bash# scripts/wait-healthy.sh —— 只有 readiness 真的 UP 才返回 0set -euo pipefailSVC="${1:-app}"URL="${HEALTH_URL:-http://127.0.0.1:8080/actuator/health/readiness}"DEADLINE=$((SECONDS + 120))while [ $SECONDS -lt $DEADLINE ]; do  body=$(curl -fsS "$URL" 2>/dev/null || true)  case "$body" in    *'"status":"UP"'*) echo "healthy after ${SECONDS}s"; exit 0 ;;  esac  sleep 3doneecho "not healthy in 120s, dumping logs:" >&2docker compose logs --tail=200 "$SVC" >&2exit 1          # 非 0 → 流水线红 → 后续 stage 不执行，等于自动阻断发布

<!-- 前提二：内置容器改成 provided，否则外部 Tomcat 会和它抢 servlet-api --><dependency>    <groupId>org.springframework.boot</groupId>    <artifactId>spring-boot-starter-tomcat</artifactId>    <scope>provided</scope></dependency>

services:  app:    image: ghcr.io/acme/beeorder:${IMAGE_TAG:-latest}    restart: unless-stopped    env_file: [ .env.production ]    environment:      SPRING_PROFILES_ACTIVE: prod      TZ: Asia/Shanghai      JAVA_TOOL_OPTIONS: "-XX:MaxRAMPercentage=75 -XX:+UseG1GC"      SERVER_SHUTDOWN: graceful                      # 第八节：优雅停机由环境变量注入      SPRING_LIFECYCLE_TIMEOUT_PER_SHUTDOWN_PHASE: 25s    depends_on:      mysql: { condition: service_healthy }      redis: { condition: service_healthy }    ports:      - "127.0.0.1:8080:8080"          # 只暴露给宿主本机，由 Nginx 反代    stop_grace_period: 40s              # docker stop 的 SIGKILL 宽限期，必须大于排空时间    healthcheck:      test: ["CMD", "curl", "-fsS", "http://localhost:8080/actuator/health/readiness"]      interval: 15s      timeout: 5s      retries: 5      start_period: 40s                # 给 JVM 启动留足时间    logging:      driver: json-file      options: { max-size: "20m", max-file: "5" }    deploy:      resources:        limits: { cpus: "2.0", memory: 1g }    networks: [ bee-net ]  mysql:    image: mysql:8.0    restart: unless-stopped    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci    environment:      MYSQL_DATABASE: beeorder      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}      TZ: Asia/Shanghai    volumes:      - mysql-data:/var/lib/mysql      - ./backup:/backup                 # 备份脚本输出目录    healthcheck:      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-p${MYSQL_ROOT_PASSWORD}"]      interval: 10s      retries: 6    networks: [ bee-net ]  redis:    image: redis:7-alpine    restart: unless-stopped    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]    volumes: [ redis-data:/data ]    healthcheck:      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]      interval: 10s      retries: 6    networks: [ bee-net ]networks:  bee-net: { driver: bridge }volumes:  mysql-data:  redis-data:

// 给指标贴业务标签：下单成功率比 QPS 有用得多@Componentpublic class OrderMetrics {    private final MeterRegistry registry;    public OrderMetrics(MeterRegistry registry) {        this.registry = registry;    }    public void recordCreate(String outcome) {          // outcome: success / stock / validation        registry.counter("beeorder.order.create", "outcome", outcome).increment();    }}

server {    listen 80;    server_name api.beeorder.example.com;    # HTTP 一律跳 HTTPS    return 301 https://$host$request_uri;}upstream beeorder {    server app:8080 max_fails=3 fail_timeout=10s;   # 单机只有一个后端，多实例时加行    keepalive 32;}server {    listen 443 ssl;    server_name api.beeorder.example.com;    ssl_certificate     /etc/nginx/certs/fullchain.pem;    ssl_certificate_key /etc/nginx/certs/privkey.pem;    client_max_body_size 20m;        # 商品图片等上传上限    gzip on;    gzip_types application/json text/plain text/css application/javascript;    gzip_min_length 1024;    location / {        proxy_pass http://beeorder;  # app 是 Compose 里的服务名，直接走内网 DNS        proxy_http_version 1.1;        # 透传真实客户端信息，否则应用日志里全是 Nginx 的内网 IP        proxy_set_header Host              $host;        proxy_set_header X-Real-IP         $remote_addr;        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;        proxy_set_header X-Forwarded-Proto $scheme;        proxy_connect_timeout 5s;        proxy_read_timeout    30s;        # 发布瞬间后端正在排空：让 Nginx 换一台重试，而不是把 502 甩给用户        proxy_next_upstream error timeout http_502 http_503;    }    # 健康检查走内网，绝不暴露到公网    location = /healthz {        proxy_pass http://beeorder/actuator/health/readiness;        access_log off;    }}

server:  forward-headers-strategy: framework   # 让 Spring 读取并信任 X-Forwarded-* 头  tomcat:    remoteip:      remote-ip-header: X-Forwarded-For      protocol-header: X-Forwarded-Proto

# 部署新版本：把 tag 写入 .env，再拉起echo "IMAGE_TAG=v1.2.0" >> .envdocker compose pull appdocker compose up -d appdocker compose logs -f --tail=100 app     # 盯一会儿日志# 出问题，回滚到上一版（例如 v1.1.9）—— 只换 tag，不重新构建sed -i 's/^IMAGE_TAG=.*/IMAGE_TAG=v1.1.9/' .envdocker compose pull appdocker compose up -d appcurl -fsS http://127.0.0.1:8080/actuator/health/readiness   # 确认恢复