ci: 优化生产镜像部署 - 改用Registry push/pull替代tar+scp\n\n- build_release_images.sh: 增加web镜像buildx缓存构建 + push到Gitea Registry\n- deploy-production.sh: 改用docker pull从Registry拉取镜像，替代docker load\n- ci-cd.yml: 简化build-production和deploy-production job\n - 移除docker save + scp传镜像tar的流程\n - 仅保留源码tar.gz scp（compose/migration脚本需要）\n - web镜像构建合并到build_release_images.sh统一管理

scripts/build_release_images.sh

@@ -9,42 +9,44 @@ if [ -z "$VERSION" ]; then
 fi
 
 ROOT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
-OUTPUT_DIR="${OUTPUT_DIR:-$ROOT_DIR/dist/release-images}"
-mkdir -p "$OUTPUT_DIR"
-
-API_IMAGE="xiaoxia-saas-api:$VERSION"
-WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
-API_LATEST="xiaoxia-saas-api:dev"
-WORKER_LATEST="xiaoxia-saas-worker:dev"
-TAR_PATH="$OUTPUT_DIR/xiaoxia-runtime-images-$VERSION.tar"
-
 cd "$ROOT_DIR"
 
-if docker ps --format '{{.Names}}' | grep -Eq '^(xiaoxia-(api|web|worker|postgres|redis)-production|gitea)$'; then
+if docker ps --format "{{.Names}}" | grep -Eq "^(xiaoxia-(api|web|worker|postgres|redis)-production|gitea)$"; then
   if [ "${ALLOW_SHARED_PRODUCTION_BUILD_HOST:-false}" != "true" ]; then
     echo "Refusing to build runtime images on a host that is running production services."
-    echo "Use a dedicated build host/CI runner, or set ALLOW_SHARED_PRODUCTION_BUILD_HOST=true only for an explicitly approved emergency."
     exit 1
   fi
 fi
 
-# ---- BuildKit 缓存优化 ----
+# ---- Registry 配置 ----
+REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
 CACHE_REGISTRY="${CACHE_REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
 CACHE_TAG="${CACHE_TAG:-release}"
-USE_CACHE=0
 
-# 检查 buildx 和 Gitea Registry 认证是否可用
+API_IMAGE="xiaoxia-saas-api:$VERSION"
+WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
+WEB_IMAGE="xiaoxia-saas-web:$VERSION"
+API_LATEST="xiaoxia-saas-api:dev"
+WORKER_LATEST="xiaoxia-saas-worker:dev"
+
+# Registry 上的完整镜像名
+REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:$VERSION"
+REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:$VERSION"
+REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:$VERSION"
+
+USE_CACHE=0
+USE_PUSH=0
+
+# 检查 buildx 和 Registry 认证
 if docker buildx version >/dev/null 2>&1; then
-  # 尝试登录缓存 Registry（有 token 才启用缓存）
   if [ -n "${REGISTRY_TOKEN:-}" ]; then
-    printf '%s' "${REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u xiaoxia --password-stdin 2>/dev/null && USE_CACHE=1
+    printf "%s" "${REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u xiaoxia --password-stdin 2>/dev/null && USE_CACHE=1 && USE_PUSH=1
   fi
-  # 确保使用 docker driver（共享 daemon 凭证）
   docker buildx use default 2>/dev/null || true
 fi
 
+echo "=== Building API image ==="
 if [ "$USE_CACHE" -eq 1 ]; then
-  echo "Using buildx with distributed cache (${CACHE_REGISTRY})"
   docker buildx build \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_TAG},ignore-error=true" \
     --cache-to "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_TAG},mode=max" \
@@ -52,6 +54,12 @@ if [ "$USE_CACHE" -eq 1 ]; then
     -t "$API_IMAGE" -t "$API_LATEST" \
     --load \
     .
+else
+  docker build --pull=false -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_LATEST" .
+fi
+
+echo "=== Building Worker image ==="
+if [ "$USE_CACHE" -eq 1 ]; then
   docker buildx build \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_TAG},ignore-error=true" \
     --cache-to "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_TAG},mode=max" \
@@ -60,11 +68,49 @@ if [ "$USE_CACHE" -eq 1 ]; then
     --load \
     .
 else
-  echo "Buildx cache not available, using plain docker build"
-  docker build --pull=false -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_LATEST" .
   docker build --pull=false -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_LATEST" .
 fi
 
-docker save "$API_IMAGE" "$API_LATEST" "$WORKER_IMAGE" "$WORKER_LATEST" -o "$TAR_PATH"
+echo "=== Building Web image (with buildx cache) ==="
+# 先构建前端产物
+docker run --rm \
+  -v "$PWD:/workspace" \
+  -w /workspace/apps/web \
+  docker.m.daocloud.io/library/node:20 \
+  sh -lc "npm ci && npm run build"
 
-printf '%s\n' "$TAR_PATH"
+test -f apps/web/dist/index.html
+
+if [ "$USE_CACHE" -eq 1 ]; then
+  docker buildx build \
+    --cache-from "type=registry,ref=${CACHE_REGISTRY}/web-cache:${CACHE_TAG},ignore-error=true" \
+    --cache-to "type=registry,ref=${CACHE_REGISTRY}/web-cache:${CACHE_TAG},mode=max" \
+    -f infra/docker/web-artifact.Dockerfile \
+    --build-arg NGINX_CONF=infra/docker/nginx-production.conf \
+    -t "$WEB_IMAGE" \
+    --load \
+    .
+else
+  docker build --pull=false \
+    -f infra/docker/web-artifact.Dockerfile \
+    --build-arg NGINX_CONF=infra/docker/nginx-production.conf \
+    -t "$WEB_IMAGE" \
+    .
+fi
+
+# Push 到 Registry
+if [ "$USE_PUSH" -eq 1 ]; then
+  echo "=== Pushing images to Registry ==="
+  docker tag "$API_IMAGE" "$REGISTRY_API"
+  docker tag "$WORKER_IMAGE" "$REGISTRY_WORKER"
+  docker tag "$WEB_IMAGE" "$REGISTRY_WEB"
+  docker push "$REGISTRY_API"
+  docker push "$REGISTRY_WORKER"
+  docker push "$REGISTRY_WEB"
+  echo "All images pushed to $REGISTRY"
+else
+  echo "Registry push skipped (no auth token available)"
+fi
+
+echo "=== Build complete ==="
+docker images | grep "xiaoxia-saas.*:$VERSION"