流水线优化 - 最后推送到Harbor 制品库

docs/jenkins/Jenkinsfile-uat-build-deploy.groovy

@@ -26,6 +26,52 @@ def filterHarborPushScope(List allServices, String scope) {
     error("Unknown HARBOR_PUSH_SCOPE: ${scope}")
 }
 
+/** Delete oldest uat-build-* tags in Harbor, keep newest KEEP (never deletes CURRENT_TAG). */
+def pruneHarborUatTags(def script, String reg, String proj, List repoNames, int keepCount, String tagPrefix, String currentTag) {
+    if (repoNames == null || repoNames.isEmpty() || keepCount < 1) {
+        return
+    }
+    def repos = repoNames.join(' ')
+    script.sh """
+        set -e
+        REG='${reg}'
+        PROJ='${proj}'
+        KEEP=${keepCount}
+        PREFIX='${tagPrefix}'
+        CURRENT='${currentTag}'
+        if ! command -v jq >/dev/null 2>&1; then
+          echo '>>> Harbor prune skipped: jq not installed on Jenkins agent'
+          exit 0
+        fi
+        for repo in ${repos}; do
+          enc_repo=\$(printf '%s' "\${repo}" | jq -sRr @uri)
+          mapfile -t tags < <(curl -fsS -u "\${HARBOR_USER}:\${HARBOR_PASS}" \\
+            "http://\${REG}/api/v2.0/projects/\${PROJ}/repositories/\${enc_repo}/artifacts?page_size=100" \\
+            | jq -r '.[] | .tags[]? | .name' | grep "^\${PREFIX}" | sort -t- -k3 -n || true)
+          count=\${#tags[@]}
+          echo ">>> prune \${repo}: \${count} tag(s) matching \${PREFIX}*"
+          if [ "\${count}" -le "\${KEEP}" ]; then
+            continue
+          fi
+          del_count=\$((count - KEEP))
+          i=0
+          while [ "\${i}" -lt "\${del_count}" ]; do
+            t="\${tags[\$i]}"
+            if [ "\${t}" = "\${CURRENT}" ]; then
+              i=\$((i + 1))
+              continue
+            fi
+            echo ">>> DELETE Harbor tag \${repo}:\${t}"
+            if ! curl -fsS -X DELETE -u "\${HARBOR_USER}:\${HARBOR_PASS}" \\
+              "http://\${REG}/api/v2.0/projects/\${PROJ}/repositories/\${enc_repo}/artifacts/\${t}/tags/\${t}"; then
+              echo ">>> WARN: delete failed \${repo}:\${t} (check robot delete permission)"
+            fi
+            i=\$((i + 1))
+          done
+        done
+    """
+}
+
 pipeline {
     agent any
 
@@ -46,8 +92,8 @@ pipeline {
         booleanParam(name: 'ALLOW_SNAPSHOTS', defaultValue: true, description: 'allow SNAPSHOT deps')
         booleanParam(
                 name: 'PUSH_TO_HARBOR',
-                defaultValue: false,
-                description: 'After Maven: docker build + push to 39.105.153.68/alien_cloud (tag uat-build-<BUILD_NUMBER>)'
+                defaultValue: true,
+                description: 'After Maven: docker build + push to Harbor (tag uat-build-<BUILD_NUMBER>). Uncheck for jar-only UAT deploy.'
         )
         choice(
                 name: 'HARBOR_PUSH_SCOPE',
@@ -65,6 +111,13 @@ pipeline {
         )
         string(name: 'HARBOR_REGISTRY', defaultValue: '39.105.153.68', trim: true)
         string(name: 'HARBOR_PROJECT', defaultValue: 'alien_cloud', trim: true)
+        booleanParam(
+                name: 'HARBOR_PRUNE_OLD_TAGS',
+                defaultValue: true,
+                description: 'After push: delete old uat-build-* tags in Harbor, keep last N per repo (not base/*)'
+        )
+        string(name: 'HARBOR_KEEP_TAG_COUNT', defaultValue: '10', trim: true,
+                description: 'How many uat-build-* tags to keep per repository')
     }
 
     environment {
@@ -236,6 +289,13 @@ pipeline {
                                 echo ">>> pushed ${imageRef}"
                             """
                         }
+                        if (params.HARBOR_PRUNE_OLD_TAGS == true) {
+                            def keepN = (params.HARBOR_KEEP_TAG_COUNT ?: '10').trim() as int
+                            pruneHarborUatTags(
+                                this, reg, proj, harborServices*.repo,
+                                keepN, 'uat-build-', tag,
+                            )
+                        }
                     }
                     echo ">>> Harbor tag for prod promote: SOURCE_TAG=${tag}"
                 }

docs/jenkins/README-UAT-HARBOR-PUSH.md

@@ -154,8 +154,18 @@ curl -s -u 'robot$alien_cloud+jenkins-k8s:<TOKEN>' \
 
 | 参数 | 说明 |
 |------|------|
-| `PUSH_TO_HARBOR` | `false`=保持旧行为，只 jar 部署；`true`=增加 Harbor push |
+| `PUSH_TO_HARBOR` | 默认 **`true`**（推 Harbor）；仅 jar 部署 UAT 时 **取消勾选** |
 | `HARBOR_PUSH_SCOPE` | 默认 **`all-java-services`**（七个）；**`gateway-only`** 等只推一个；Maven 须对所选模块打出 jar |
+| `HARBOR_PRUNE_OLD_TAGS` | 默认 **true**：每个仓库只保留最近 **10** 个 `uat-build-*` tag，删更旧的（不删 `base/*`） |
+| `HARBOR_KEEP_TAG_COUNT` | 保留 tag 个数，默认 `10` |
+
+### 旧镜像清理说明
+
+- 每次 push 的是**新 tag**（`uat-build-<构建号>`），Harbor **不会**自动删旧 tag。
+- 脚本在 push 后调 Harbor API 删除最老的 `uat-build-*`，**保留最近 N 个**（含本次）。
+- 机器人需有 **删除制品** 权限；若删除失败，日志会有 `WARN: delete failed`，可在 Harbor 项目里开「标记可删除」或使用项目 **标签保留策略**。
+- **不会**删除 `base/openjdk8-ffmpeg` 等基础镜像。
+- Jenkins 本机 `docker images` 可用 `docker image prune` 另行清理，与 Harbor 无关。
 | `UAT_HARBOR_IMAGE_TAG` | 自动 `uat-build-${BUILD_NUMBER}`，无需手填 |
 
 ---