#故障预防措施

name: PR Quality Gates
on:
  pull_request:
    branches: [main]

jobs:
  quality-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Run tests
        run: npm test

      - name: Check branch protection
        run: |
          # 强制要求至少 1 人 approval
          approvals=$(gh pr view ${{ github.event.pull_request.number }} --json reviews -q '.reviews[] | select(.state == "APPROVED") | .author.login' | wc -l)
          if [ "$approvals" -lt 1 ]; then
            echo "需要至少 1 人审批才能合并"
            exit 1
          fi

groups:
  - name: business_health
    rules:
      # 核心接口成功率
      - alert: CoreApiSuccessRateLow
        expr: |
          sum(rate(http_requests_total{status=~"2.."}[5m]))
          / sum(rate(http_requests_total[5m])) < 0.99
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "核心接口成功率低于 99%"
          description: "{{ $labels.job }} 接口 {{ $labels.path }} 成功率 {{ $value | humanizePercentage }}"

      # 数据库慢查询
      - alert: DatabaseSlowQueryHigh
        expr: |
          sum(rate(mysql_slow_queries_total[5m])) > 10
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "数据库慢查询过多"
          description: "过去 5 分钟慢查询速率 {{ $value }}/s"

      # 缓存命中率
      - alert: CacheHitRateLow
        expr: |
          sum(rate(cache_hits_total[5m]))
          / sum(rate(cache_requests_total[5m])) < 0.8
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "缓存命中率低于 80%"
          description: "当前命中率 {{ $value | humanizePercentage }}"

sentinel:
  rules:
    # 支付接口限流：每秒最多 1000 次调用
    flow:
      - resource: /api/payment
        grade: 1              # QPS 模式
        count: 1000
        controlBehavior: 0    # 直接拒绝

    # 外部渠道熔断：当错误率 > 30% 时熔断 10 秒
    degrade:
      - resource: payment-gateway
        grade: 1              # 错误率模式
        count: 0.3
        timeWindow: 10        # 熔断持续 10 秒
        minRequestAmount: 10  # 至少 10 个请求才触发熔断

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: order-service
spec:
  replicas: 10
  strategy:
    canary:
      steps:
        - setWeight: 5      # 初始 5% 流量到新版本
        - pause: {duration: 10m}  # 观察 10 分钟
        - setWeight: 20     # 扩大到 20%
        - pause: {duration: 10m}
        - setWeight: 50     # 扩大到 50%
        - pause: {duration: 10m}
        - setWeight: 100    # 全量
      canaryMetadata:
        labels:
          role: canary
      stableMetadata:
        labels:
          role: stable
      trafficRouting:
        nginx:
          stableIngress: stable-ingress
          additionalIngressAnnotations:
            canary-by-header: X-Canary

# 自动回滚触发条件
rollback:
  triggers:
    - type: ErrorRate
      threshold: 0.05      # 错误率超过 5% 自动回滚
    - type: Latency
      threshold: 2000ms    # p99 延迟超过 2s 自动回滚

# 演练场景 1：数据库连接耗尽
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: simulate-db-connection-exhaustion
spec:
  action: delay
  mode: one
  selector:
    namespaces:
      - production
    labelSelectors:
      app: order-service
  delay:
    latency: "5000ms"
  target:
    mode: one
    selector:
      namespaces:
        - production
      labelSelectors:
        db: mysql

---
# 演练场景 2：Redis 不可用
apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata:
  name: redis-node-failure
spec:
  action: pod-kill
  mode: one
  selector:
    namespaces:
      - production
    labelSelectors:
      app: redis