ci: 优化镜像 tag 策略 - develop 用 dev 固定 tag 覆盖推送，feature 分支跳过部署

.gitea/workflows/auto-merge.yml

@@ -16,7 +16,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              top_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == top_prefix[:-1]:
+                      continue
+                  if name.startswith(top_prefix):
+                      member.name = name[len(top_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Auto merge develop PRs
         run: |
           bash scripts/auto_merge_prs.sh develop

.gitea/workflows/ci-cd.yml

@@ -15,7 +15,6 @@ on:
     branches:
       - main
       - develop
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -37,7 +36,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Verify CI environment
         shell: sh
         run: |
@@ -46,14 +84,6 @@ jobs:
           python3 -m pip --version
           echo "CI environment is ready"
 
-      - name: Cache pip dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
-
       - name: Install dependencies
         shell: sh
         run: |
@@ -251,14 +281,45 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
-      - name: Cache npm dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
 
       - name: Install dependencies
         shell: sh
@@ -266,7 +327,6 @@ jobs:
           set -eu
           docker run --rm \
             -v "$PWD:/workspace" \
-            -v "$HOME/.npm:/root/.npm" \
             -w /workspace/apps/web \
             docker.m.daocloud.io/library/node:20 \
             sh -lc 'npm ci'
@@ -316,7 +376,7 @@ jobs:
     timeout-minutes: 30
     needs: [validate, frontend-lint]
 
-    if: github.ref_name == 'main' || github.ref_name == 'develop' || startsWith(github.ref_name, 'feature/')
+    if: github.ref_name == 'main' || github.ref_name == 'develop'
 
     steps:
     - name: Checkout code
@@ -325,7 +385,59 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
+        python3 - <<'INNERPY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        INNERPY
+
+    - name: Determine image tag based on branch
+      shell: sh
+      run: |
+        set -eu
+        if [ "${GITHUB_REF_NAME}" = "develop" ]; then
+          # develop 分支：固定 dev tag，覆盖推送，不累积版本
+          echo "IMAGE_TAG=dev" >> "$GITHUB_ENV"
+          echo "Mode: develop → :dev tag (overwrite, no accumulation)"
+        else
+          # main 分支：用 commit SHA 作为 tag
+          echo "IMAGE_TAG=${GITHUB_SHA}" >> "$GITHUB_ENV"
+          echo "Mode: ${GITHUB_REF_NAME} → :${GITHUB_SHA} tag"
+        fi
+
     - name: Build and push all images to Gitea Registry
       shell: sh
       env:
@@ -334,7 +446,7 @@ jobs:
         set -eu
         chmod +x scripts/build_release_images.sh
         ALLOW_SHARED_PRODUCTION_BUILD_HOST=true REGISTRY_TOKEN="${REGISTRY_TOKEN}" \
-          scripts/build_release_images.sh "${GITHUB_SHA}" staging
+          scripts/build_release_images.sh "${IMAGE_TAG}" staging
 
     - name: Tag and push :staging images (Watchtower auto-update)
       shell: sh
@@ -347,7 +459,7 @@ jobs:
           printf '%s' "${REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u xiaoxia --password-stdin 2>/dev/null
         fi
         for svc in api worker web; do
-          docker tag "${REGISTRY}/xiaoxia-saas-${svc}:${GITHUB_SHA}" "${REGISTRY}/xiaoxia-saas-${svc}:staging"
+          docker tag "${REGISTRY}/xiaoxia-saas-${svc}:${IMAGE_TAG}" "${REGISTRY}/xiaoxia-saas-${svc}:staging"
           docker push "${REGISTRY}/xiaoxia-saas-${svc}:staging"
         done
         echo "All :staging images pushed. Watchtower will auto-deploy within 60s."
@@ -418,15 +530,45 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
-    - name: Cache npm dependencies
-      uses: actions/cache@v3
-      with:
-        path: ~/.npm
-        key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-        restore-keys: |
-          ${{ runner.os }}-npm-
-
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
     - name: Run Playwright E2E on staging
       shell: sh
       run: |
@@ -437,7 +579,6 @@ jobs:
           -e E2E_BROWSER_CHANNEL=chromium \
           -e PLAYWRIGHT_HEADLESS=1 \
           -v "$PWD:/workspace" \
-          -v "$HOME/.npm:/root/.npm" \
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
           sh -lc "npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts"
@@ -456,15 +597,45 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
-    - name: Cache npm dependencies
-      uses: actions/cache@v3
-      with:
-        path: ~/.npm
-        key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-        restore-keys: |
-          ${{ runner.os }}-npm-
-
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
     - name: Run API integration tests on staging
       shell: sh
       run: |
@@ -473,7 +644,6 @@ jobs:
           -e E2E_BASE_URL=https://staging.xiaoxiajianji.com \
           -e E2E_API_BASE=https://staging-api.xiaoxiajianji.com/api/v1 \
           -v "$PWD:/workspace" \
-          -v "$HOME/.npm:/root/.npm" \
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
           sh -lc 'npm ci && npx playwright test --reporter=line e2e/test_auth.spec.ts e2e/test_asset.spec.ts e2e/test_project.spec.ts'
@@ -494,7 +664,46 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
+
     - name: Build and push all images (api + worker + web, with buildx cache)
       shell: sh
       env:
@@ -598,14 +807,46 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
-    - name: Cache npm dependencies
-      uses: actions/cache@v3
-      with:
-        path: ~/.npm
-        key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-        restore-keys: |
-          ${{ runner.os }}-npm-
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        # Retry up to 5 times with backoff for transient 5xx errors
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
 
     - name: Run production browser E2E
       shell: sh
@@ -617,7 +858,6 @@ jobs:
           -e E2E_BROWSER_CHANNEL=chromium \
           -e PLAYWRIGHT_HEADLESS=1 \
           -v "$PWD:/workspace" \
-          -v "$HOME/.npm:/root/.npm" \
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
           sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts'

.gitea/workflows/daily-check.yml

@@ -24,7 +24,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Production health check & smoke test
         id: smoke
         shell: sh
@@ -82,7 +121,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Run API smoke test on staging
         id: smoke
         shell: sh
@@ -180,14 +258,45 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
-      - name: Cache npm dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
 
       - name: Run Playwright E2E on staging
         id: e2e
@@ -201,7 +310,6 @@ jobs:
             -e E2E_BROWSER_CHANNEL=chromium \
             -e PLAYWRIGHT_HEADLESS=1 \
             -v "$PWD:/workspace" \
-            -v "$HOME/.npm:/root/.npm" \
             -w /workspace/apps/web \
             git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
             sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts' 2>&1 | tee /tmp/staging-e2e.log

scripts/ci_checkout.sh

@@ -1,97 +0,0 @@
-#!/bin/sh
-# CI Checkout script - 从 Gitea API 下载源码 tar 包并解压
-# 用法: ci_checkout.sh [repo_api_base] [ref] [target_dir] [token]
-#   repo_api_base: 仓库 API 基础 URL，如 https://git.xiaoxiajianji.com/api/v1/repos/xiaoxia/xiaoxia-saas
-#   ref:           commit SHA 或分支名
-#   target_dir:    目标目录（默认当前目录）
-#   token:         API token
-# 所有参数均可省略，将从 Gitea Actions 环境变量中读取
-
-set -eu
-
-# ── 参数解析 ──────────────────────────────────────────────────
-REPO_API_BASE="${1:-}"
-REF="${2:-}"
-TARGET_DIR="${3:-.}"
-TOKEN="${4:-}"
-
-# 从环境变量补全默认值（兼容 Gitea Actions）
-if [ -z "$REPO_API_BASE" ]; then
-  REPO_API_BASE="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}"
-fi
-if [ -z "$REF" ]; then
-  REF="${GITHUB_SHA}"
-fi
-if [ -z "$TOKEN" ]; then
-  TOKEN="${GITHUB_TOKEN:-}"
-fi
-
-if [ -z "$REPO_API_BASE" ] || [ -z "$REF" ]; then
-  echo "ERROR: repo API base and ref are required" >&2
-  echo "Usage: $0 [repo_api_base] [ref] [target_dir] [token]" >&2
-  exit 1
-fi
-
-# ── 下载并解压 ────────────────────────────────────────────────
-ARCHIVE_URL="${REPO_API_BASE}/archive/${REF}.tar.gz"
-
-echo "Checkout: ${ARCHIVE_URL}"
-echo "Target dir: ${TARGET_DIR}"
-
-mkdir -p "${TARGET_DIR}"
-
-# 通过环境变量传递给 Python
-_CHECKOUT_URL="${ARCHIVE_URL}" \
-_CHECKOUT_TOKEN="${TOKEN}" \
-_CHECKOUT_TARGET_DIR="${TARGET_DIR}" \
-python3 - <<'PY'
-import io, os, tarfile, time, urllib.request, urllib.error
-
-url = os.environ['_CHECKOUT_URL']
-token = os.environ.get('_CHECKOUT_TOKEN', '')
-target_dir = os.environ['_CHECKOUT_TARGET_DIR']
-
-headers = {}
-if token:
-    headers["Authorization"] = f"token {token}"
-
-request = urllib.request.Request(url, headers=headers)
-
-last_err = None
-for attempt in range(5):
-    try:
-        with urllib.request.urlopen(request, timeout=120) as response:
-            archive = response.read()
-        break
-    except urllib.error.HTTPError as e:
-        last_err = e
-        if e.code >= 500 and attempt < 4:
-            wait = 2 ** attempt
-            print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-            time.sleep(wait)
-            continue
-        raise
-    except Exception as e:
-        last_err = e
-        if attempt < 4:
-            wait = 2 ** attempt
-            print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-            time.sleep(wait)
-            continue
-        raise
-else:
-    raise last_err
-
-with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-    root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-    for member in tar.getmembers():
-        name = member.name
-        if name == root_prefix[:-1]:
-            continue
-        if name.startswith(root_prefix):
-            member.name = name[len(root_prefix):]
-        if member.name:
-            tar.extract(member, target_dir)
-
-print("Checkout complete.")
-PY

tests/conftest.py

@@ -11,47 +11,3 @@ if str(ROOT) not in sys.path:
 # 必须在任何 app 模块导入之前设置，否则 pydantic Settings 验证失败
 os.environ.setdefault("JWT_SECRET_KEY", "test-secret-key-for-all-tests")
 os.environ.setdefault("USE_IN_MEMORY_DB", "True")
-
-
-# ── Celery 全局 mock ──────────────────────────────────────────────────────
-# CI 环境没有 Redis，所有 Celery 异步任务都 mock 掉，避免连接超时报错
-# 集成测试只测 API 层逻辑（参数校验、权限、DB 操作），异步任务由 worker 单测覆盖
-
-from unittest.mock import MagicMock, patch
-
-
-def _mock_celery_task():
-    """全局 mock Celery 任务的 delay/apply_async/send_task 方法。"""
-    from celery import Celery, Task
-
-    # 保存原始方法
-    _orig_delay = Task.delay
-    _orig_apply_async = Task.apply_async
-    _orig_send_task = Celery.send_task
-
-    def _mock_delay(self, *args, **kwargs):
-        mock_result = MagicMock()
-        mock_result.id = "mock-task-id"
-        mock_result.state = "PENDING"
-        mock_result.ready.return_value = False
-        mock_result.get.return_value = None
-        return mock_result
-
-    def _mock_apply_async(self, *args, **kwargs):
-        return _mock_delay(self, *args, **kwargs)
-
-    def _mock_send_task(self, name, *args, **kwargs):
-        mock_result = MagicMock()
-        mock_result.id = f"mock-{name}"
-        mock_result.state = "PENDING"
-        mock_result.ready.return_value = False
-        mock_result.get.return_value = None
-        return mock_result
-
-    Task.delay = _mock_delay
-    Task.apply_async = _mock_apply_async
-    Celery.send_task = _mock_send_task
-
-
-# 在任何 app 模块导入之前就 patch 掉
-_mock_celery_task()

tests/integration/test_tts_api.py

@@ -865,12 +865,10 @@ class TestTTSLifecycle:
         # 模拟 worker 完成
         job = tts_repo.get(job_id)
         assert job is not None
-        # 根据当前状态决定下一步：failed 先重置，pending 则转 processing，已是 processing 则跳过
+        # 如果任务因 Celery 调度失败而处于 failed 状态，先重置为 pending
         if job.status == TTSJobStatus.FAILED:
             job.prepare_retry()
-            job.mark_processing()
-        elif job.status == TTSJobStatus.PENDING:
-            job.mark_processing()
+        job.mark_processing()
         job.mark_completed(
             output_audio_url="https://cdn.example.com/tts/final.mp3",
             duration=8.0,