79 lines
2.2 KiB
PHP
79 lines
2.2 KiB
PHP
<?php
|
|
/**
|
|
* Gitea Webhook 接收器
|
|
* 路径: /var/www/webhook/receiver.php
|
|
* 访问: https://webhook.micecola.top/kb-web.php
|
|
*/
|
|
|
|
// 配置
|
|
const SECRET = 'kb-web-webhook-secret-2024'; // 与 Gitea webhook 配置的密钥一致
|
|
const DEPLOY_SCRIPT = '/var/www/webhook/deploy.sh';
|
|
const LOG_FILE = '/var/log/webhook.log';
|
|
|
|
// 记录日志
|
|
function log_msg($msg) {
|
|
$timestamp = date('Y-m-d H:i:s');
|
|
file_put_contents(LOG_FILE, "[$timestamp] $msg\n", FILE_APPEND);
|
|
}
|
|
|
|
// 验证签名
|
|
function verify_signature($payload, $signature) {
|
|
$expected = 'sha256=' . hash_hmac('sha256', $payload, SECRET);
|
|
return hash_equals($expected, $signature);
|
|
}
|
|
|
|
// 主逻辑
|
|
log_msg("收到 webhook 请求");
|
|
|
|
$payload = file_get_contents('php://input');
|
|
$headers = getallheaders();
|
|
|
|
// 验证 Gitea 签名
|
|
$signature = $headers['X-Gitea-Signature'] ?? $headers['X-Gitea-Signature-Sha256'] ?? '';
|
|
if (!verify_signature($payload, $signature)) {
|
|
log_msg("签名验证失败");
|
|
http_response_code(401);
|
|
echo json_encode(['error' => 'Invalid signature']);
|
|
exit;
|
|
}
|
|
|
|
$data = json_decode($payload, true);
|
|
$repo = $data['repository']['name'] ?? '';
|
|
$branch = basename($data['ref'] ?? '');
|
|
$commit = $data['after'] ?? '';
|
|
|
|
log_msg("仓库: $repo, 分支: $branch, 提交: $commit");
|
|
|
|
// 只处理 kb-web 仓库的 main 分支
|
|
if ($repo !== 'kb-web') {
|
|
log_msg("忽略非目标仓库: $repo");
|
|
echo json_encode(['status' => 'ignored', 'reason' => 'not target repo']);
|
|
exit;
|
|
}
|
|
|
|
// 根据分支决定部署环境
|
|
$env = 'test'; // 默认测试环境
|
|
if ($branch === 'main' || $branch === 'master') {
|
|
// main 分支也先部署到测试环境
|
|
// 正式环境需要手动触发
|
|
$env = 'test';
|
|
}
|
|
|
|
// 执行部署脚本
|
|
log_msg("开始部署到 $env 环境");
|
|
$cmd = sprintf('%s %s %s 2>&1', DEPLOY_SCRIPT, $env, $branch);
|
|
exec($cmd, $output, $return_var);
|
|
|
|
log_msg("部署输出: " . implode("\n", $output));
|
|
log_msg("部署结果: " . ($return_var === 0 ? '成功' : '失败'));
|
|
|
|
// 返回结果
|
|
header('Content-Type: application/json');
|
|
echo json_encode([
|
|
'status' => $return_var === 0 ? 'success' : 'failed',
|
|
'env' => $env,
|
|
'branch' => $branch,
|
|
'commit' => $commit,
|
|
'output' => $output
|
|
], JSON_UNESCAPED_UNICODE);
|