From b5f06d09b3d5c345a26485ef8c64e7f9804869f7 Mon Sep 17 00:00:00 2001
From: l3126596029 <skymirror@skymirror.top>
Date: Sat, 5 Sep 2026 06:07:46 +0800
Subject: [PATCH] =?UTF-8?q?CI=EF=BC=9AGitea=20Actions=20=E5=B7=A5=E4=BD=9C?=
 =?UTF-8?q?=E6=B5=81=EF=BC=88=E9=9B=B6=E7=AC=AC=E4=B8=89=E6=96=B9=20action?=
 =?UTF-8?q?=EF=BC=8C=E5=9B=BD=E5=86=85=E7=BD=91=E7=BB=9C=E8=87=AA=E5=8C=85?=
 =?UTF-8?q?=E5=90=AB=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- push/PR 触发：后端 gofmt/vet/test/build + health 冒烟，
  前端 npm ci/类型检查/构建 + 站内文档嵌入校验
- main/tag v* 触发 Release：先跑测试门禁，
  再 buildx 多架构(amd64/arm64)构建推送阿里云 ACR（provenance/sbom 关闭，
  规避 ACR 不识别 OCI empty manifest 的问题）
- 检出用 GITHUB_TOKEN 自克隆，不依赖 github.com 的外部 action
---
 .gitea/workflows/release-image.yml | 102 +++++++++++++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 .gitea/workflows/release-image.yml

diff --git a/.gitea/workflows/release-image.yml b/.gitea/workflows/release-image.yml
new file mode 100644
index 0000000..29ee8a8
--- /dev/null
+++ b/.gitea/workflows/release-image.yml
@@ -0,0 +1,102 @@
+name: Release 镜像
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch:
+
+env:
+  REGISTRY: registry.cn-hangzhou.aliyuncs.com
+  IMAGE: registry.cn-hangzhou.aliyuncs.com/skymirror/fileshare
+
+jobs:
+  test:
+    name: 测试（推送前置门禁）
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.27.1-alpine
+    timeout-minutes: 30
+    steps:
+      - name: 安装工具并检出
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
+          apk add --no-cache git curl bash >/dev/null
+          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
+            "https://oauth2:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+
+      - name: go vet + go test
+        working-directory: server
+        env:
+          GOCACHE: /tmp/.gocache
+          GOMODCACHE: /tmp/.gomodcache
+          CGO_ENABLED: "0"
+        run: |
+          go vet ./...
+          go test ./... -count=1
+
+  build-push:
+    name: 多架构构建并推送 ACR
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: 安装工具并检出
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
+          apk add --no-cache git curl bash >/dev/null
+          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
+            "https://oauth2:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+          # 嵌入产物同步（保证二进制内前端与仓库一致）
+          if [ -f web-embed/index.html ]; then :; fi
+
+      - name: 安装 Docker CLI（挂宿主 daemon）
+        run: apk add --no-cache docker-cli buildx >/dev/null
+
+      - name: 计算 tag 与平台
+        id: meta
+        env:
+          REF: ${{ gitea.ref }}
+        run: |
+          case "$REF" in
+            refs/tags/v*)
+              VER="${REF#refs/tags/v}"
+              echo "tags=${IMAGE}:${VER} ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+              echo "发布 tag: ${VER} + latest" ;;
+            *)
+              echo "tags=${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+              echo "main 构建: latest" ;;
+          esac
+
+      - name: 登录阿里云 ACR
+        env:
+          ACR_USER: ${{ secrets.ACR_USERNAME }}
+          ACR_PASS: ${{ secrets.ACR_PASSWORD }}
+        run: |
+          PASS_LEN=${#ACR_PASS}
+          echo "ACR 用户: $ACR_USER (密码 ${PASS_LEN} 位)"
+          printf '%s' "$ACR_PASS" | docker login "$REGISTRY" -u "$ACR_USER" --password-stdin
+
+      - name: 多架构构建并推送
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+        # provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation），
+        # 否则报 "denied: unknown manifest class for application/vnd.oci.empty.v1+json"
+        run: |
+          ARGS=""
+          for t in $TAGS; do ARGS="$ARGS -t $t"; done
+          docker buildx build \
+            --builder default \
+            --platform linux/amd64,linux/arm64 \
+            --provenance=false --sbom=false \
+            --push \
+            -f deploy/Dockerfile \
+            $ARGS \
+            .
+
+      - name: 校验远程 manifest（双架构）
+        run: docker buildx imagetools inspect "${IMAGE}:latest" | grep -E "linux/amd64|linux/arm64"