CI：Gitea Actions 工作流（零第三方 action，国内网络自包含）

- push/PR 触发：后端 gofmt/vet/test/build + health 冒烟，
  前端 npm ci/类型检查/构建 + 站内文档嵌入校验
- main/tag v* 触发 Release：先跑测试门禁，
  再 buildx 多架构(amd64/arm64)构建推送阿里云 ACR（provenance/sbom 关闭，
  规避 ACR 不识别 OCI empty manifest 的问题）
- 检出用 GITHUB_TOKEN 自克隆，不依赖 github.com 的外部 action

.gitea/workflows/release-image.yml

@@ -0,0 +1,102 @@
+name: Release 镜像
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch:
+
+env:
+  REGISTRY: registry.cn-hangzhou.aliyuncs.com
+  IMAGE: registry.cn-hangzhou.aliyuncs.com/skymirror/fileshare
+
+jobs:
+  test:
+    name: 测试（推送前置门禁）
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.27.1-alpine
+    timeout-minutes: 30
+    steps:
+      - name: 安装工具并检出
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
+          apk add --no-cache git curl bash >/dev/null
+          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
+            "https://oauth2:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+
+      - name: go vet + go test
+        working-directory: server
+        env:
+          GOCACHE: /tmp/.gocache
+          GOMODCACHE: /tmp/.gomodcache
+          CGO_ENABLED: "0"
+        run: |
+          go vet ./...
+          go test ./... -count=1
+
+  build-push:
+    name: 多架构构建并推送 ACR
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: 安装工具并检出
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
+          apk add --no-cache git curl bash >/dev/null
+          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
+            "https://oauth2:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+          # 嵌入产物同步（保证二进制内前端与仓库一致）
+          if [ -f web-embed/index.html ]; then :; fi
+
+      - name: 安装 Docker CLI（挂宿主 daemon）
+        run: apk add --no-cache docker-cli buildx >/dev/null
+
+      - name: 计算 tag 与平台
+        id: meta
+        env:
+          REF: ${{ gitea.ref }}
+        run: |
+          case "$REF" in
+            refs/tags/v*)
+              VER="${REF#refs/tags/v}"
+              echo "tags=${IMAGE}:${VER} ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+              echo "发布 tag: ${VER} + latest" ;;
+            *)
+              echo "tags=${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+              echo "main 构建: latest" ;;
+          esac
+
+      - name: 登录阿里云 ACR
+        env:
+          ACR_USER: ${{ secrets.ACR_USERNAME }}
+          ACR_PASS: ${{ secrets.ACR_PASSWORD }}
+        run: |
+          PASS_LEN=${#ACR_PASS}
+          echo "ACR 用户: $ACR_USER (密码 ${PASS_LEN} 位)"
+          printf '%s' "$ACR_PASS" | docker login "$REGISTRY" -u "$ACR_USER" --password-stdin
+
+      - name: 多架构构建并推送
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+        # provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation），
+        # 否则报 "denied: unknown manifest class for application/vnd.oci.empty.v1+json"
+        run: |
+          ARGS=""
+          for t in $TAGS; do ARGS="$ARGS -t $t"; done
+          docker buildx build \
+            --builder default \
+            --platform linux/amd64,linux/arm64 \
+            --provenance=false --sbom=false \
+            --push \
+            -f deploy/Dockerfile \
+            $ARGS \
+            .
+
+      - name: 校验远程 manifest（双架构）
+        run: docker buildx imagetools inspect "${IMAGE}:latest" | grep -E "linux/amd64|linux/arm64"