init project+ci/cd

.gitea/README.md

@@ -0,0 +1,57 @@
+# Gitea Actions 配置说明
+
+本目录为本项目的 Gitea CI/CD 工作流。运行环境为 **self-hosted Linux runner**，且 runner 必须能在目标主机上以 root 身份执行 eBPF/bcc。
+
+## 工作流
+
+- [`workflows/ci.yml`](workflows/ci.yml) — push / PR 到 `main` 触发。语法检查 + 干净 venv 安装依赖。**不**需要 root。
+- [`workflows/cd.yml`](workflows/cd.yml) — 推送 `v*` tag 或手动触发。流程：
+  1. `stop.sh` 停掉旧实例（若存在）
+  2. `rsync` 当前 checkout 到固定目录 `/opt/syscall_monitor`
+  3. `setup.sh` 装 venv 依赖
+  4. `run.sh` 启动
+  5. 校验 `.pid` 进程存活
+  6. 重试 10 次 `curl http://127.0.0.1:5000` 做健康检查
+  7. tail 启动日志
+
+  **需要 root**。部署目录和健康检查 URL 在 workflow 顶部 `env:` 块里改。
+
+## Runner 准备
+
+1. 在目标 Linux 主机上注册 act_runner，labels 至少包含 `self-hosted`。
+2. 安装系统依赖：
+
+   ```
+   sudo apt install -y python3-venv python3-bpfcc bpfcc-tools rsync curl linux-headers-$(uname -r)
+   ```
+
+3. 创建固定部署目录并把所有权给 root（脚本以 root 运行）：
+
+   ```
+   sudo mkdir -p /opt/syscall_monitor
+   ```
+
+4. 给 runner 用户配置免密 sudo。CD 用到的 root 命令有 4 个：rsync、setup.sh、run.sh、stop.sh，外加 tail 读 root 拥有的日志。写 `/etc/sudoers.d/syscall-monitor`：
+
+   ```
+   <runner-user> ALL=(root) NOPASSWD: /usr/bin/rsync, /opt/syscall_monitor/setup.sh, /opt/syscall_monitor/run.sh, /opt/syscall_monitor/stop.sh, /usr/bin/tail
+   ```
+
+   只授权这些，不要 `ALL` 通配。`rsync` 路径以 `which rsync` 为准。
+
+## 触发方式
+
+- 日常 push / PR → 自动跑 CI。
+- 发版部署 → 打 tag：
+
+  ```
+  git tag v0.1.0 && git push origin v0.1.0
+  ```
+
+  也可在 Gitea Actions 页面用 `workflow_dispatch` 手动触发。
+
+## 注意
+
+- 部署目录固定为 `/opt/syscall_monitor`。每次 CD 用 `rsync --delete` 全量同步代码（保留 `.venv` / `logs` / `.pid`），所以 venv 不会每次重建，依赖增量装。
+- 健康检查用 `HEALTH_URL` 默认 `http://127.0.0.1:5000`，重试 10 次每次间隔 2 秒。如果你的 Flask 路由没有根路径，把 `env.HEALTH_URL` 改成 `http://127.0.0.1:5000/具体路径`。
+- `run.sh` 是 `nohup` 后台启动，runner 当前 workspace 跟部署目录是分开的——`.pid` 落在 `/opt/syscall_monitor/.pid`，CD 校验的就是这个。

.gitea/workflows/cd.yml

@@ -0,0 +1,85 @@
+name: CD
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  DEPLOY_DIR: /opt/syscall_monitor
+  HEALTH_URL: http://127.0.0.1:5000
+
+jobs:
+  deploy:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Show target host info
+        run: |
+          echo "deploying on: $(hostname)"
+          echo "user: $(id -un) ($(id -u))"
+          echo "ref: ${{ gitea.ref }}"
+          echo "deploy dir: $DEPLOY_DIR"
+
+      - name: Stop running instance (if any)
+        run: |
+          if [ -x "$DEPLOY_DIR/stop.sh" ]; then
+            sudo -n "$DEPLOY_DIR/stop.sh" || true
+          else
+            echo "no prior install at $DEPLOY_DIR, skipping stop"
+          fi
+
+      - name: Sync code to deploy dir
+        run: |
+          sudo -n /usr/bin/rsync -a --delete \
+            --exclude='.git' \
+            --exclude='.venv' \
+            --exclude='.venv-ci' \
+            --exclude='logs' \
+            --exclude='.pid' \
+            ./ "$DEPLOY_DIR/"
+          sudo -n chmod +x "$DEPLOY_DIR/setup.sh" "$DEPLOY_DIR/run.sh" "$DEPLOY_DIR/stop.sh"
+
+      - name: Setup venv and dependencies
+        run: sudo -n "$DEPLOY_DIR/setup.sh"
+
+      - name: Start service
+        run: sudo -n "$DEPLOY_DIR/run.sh"
+
+      - name: Verify pid is alive
+        run: |
+          sleep 2
+          PID_FILE="$DEPLOY_DIR/.pid"
+          if [ ! -f "$PID_FILE" ]; then
+            echo "no .pid file at $PID_FILE" >&2
+            sudo -n tail -n 50 "$DEPLOY_DIR/logs/app.log" >&2 || true
+            exit 1
+          fi
+          PID=$(cat "$PID_FILE")
+          if ! kill -0 "$PID" 2>/dev/null; then
+            echo "pid $PID not alive" >&2
+            sudo -n tail -n 50 "$DEPLOY_DIR/logs/app.log" >&2 || true
+            exit 1
+          fi
+          echo "service running, pid=$PID"
+
+      - name: HTTP health check
+        run: |
+          for i in 1 2 3 4 5 6 7 8 9 10; do
+            if curl -fsS -o /dev/null "$HEALTH_URL"; then
+              echo "health check passed on attempt $i"
+              exit 0
+            fi
+            echo "attempt $i failed, retrying..."
+            sleep 2
+          done
+          echo "health check failed: $HEALTH_URL unreachable" >&2
+          sudo -n tail -n 80 "$DEPLOY_DIR/logs/app.log" >&2 || true
+          exit 1
+
+      - name: Tail startup log
+        if: always()
+        run: sudo -n tail -n 30 "$DEPLOY_DIR/logs/app.log" || true

.gitea/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint-and-build:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Python syntax check
+        run: |
+          python3 -m compileall -q collector web main.py
+
+      - name: Optional ruff lint
+        run: |
+          if command -v ruff >/dev/null 2>&1; then
+            ruff check collector web main.py || true
+          else
+            echo "ruff not installed, skipping"
+          fi
+
+      - name: Build venv (dry-run install)
+        run: |
+          python3 -m venv --system-site-packages .venv-ci
+          .venv-ci/bin/pip install --upgrade pip
+          .venv-ci/bin/pip install -r requirements.txt
+          .venv-ci/bin/python -c "import flask; print('flask', flask.__version__)"
+
+      - name: Cleanup
+        if: always()
+        run: rm -rf .venv-ci