Merge pull request 'release v0.1.136: 智能剪辑批量变体P0修复+AI数字人MOV支持+代码审查重构' (#1886 ) from release/v0.1.136 into main

release: 2026.09.14 智能剪辑批量变体P0修复+AI数字人MOV支持+代码审查重构 (#1885 )
Merge pull request 'fix(auth): 微信 unionid 账号打通逻辑修复（老账号自动关联 + 查找顺序优化 + 冲突保护）' (#1738 ) from fix/wechat-unionid-account-linking into main
2026-09-14 10:12:18 +08:00 · 2026-09-14 10:02:34 +08:00 · 2026-09-06 14:48:42 +08:00 · 2026-09-06 06:35:45 +00:00 · 2026-09-06 14:32:18 +08:00 · 2026-09-06 14:32:17 +08:00
6 changed files with 65 additions and 126 deletions
@@ -1022,22 +1022,12 @@ jobs:
        BRANCH_TAG="${IMAGE_FULL}:${GITHUB_REF_NAME}"
        CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:${GITHUB_REF_NAME}"

-        # develop 分支额外推送 :dev tag（Watchtower 监听的滚动更新 tag）
-        if [ "${GITHUB_REF_NAME}" = "develop" ]; then
-          DEV_TAG="${IMAGE_FULL}:dev"
-          EXTRA_TAGS="$BRANCH_TAG $DEV_TAG"
-          PUSHED_TAGS_SUMMARY="${BRANCH_TAG} + ${DEV_TAG}"
-        else
-          EXTRA_TAGS="$BRANCH_TAG"
-          PUSHED_TAGS_SUMMARY="${BRANCH_TAG}"
-        fi
-
        EXTRA_BUILD_ARGS="APP_VERSION=\"${GITHUB_SHA}\""

        NO_CACHE_FLAG=""
        for i in 1 2 3; do
          echo "=== Docker build 尝试 $i/3 (${{ matrix.service_display }}) ==="
-          if EXTRA_TAGS="$EXTRA_TAGS" bash scripts/ci/docker_build_push.sh $NO_CACHE_FLAG ${{ matrix.dockerfile }} "${IMAGE_TAG}" "${CACHE_REF}" $EXTRA_BUILD_ARGS; then
+          if EXTRA_TAGS="$BRANCH_TAG" bash scripts/ci/docker_build_push.sh $NO_CACHE_FLAG ${{ matrix.dockerfile }} "${IMAGE_TAG}" "${CACHE_REF}" $EXTRA_BUILD_ARGS; then
            echo "✅ Docker build 成功"
            break
          fi
@@ -1050,7 +1040,7 @@ jobs:
          fi
        done

-        echo "${{ matrix.service_display }} image pushed: ${IMAGE_TAG} (+ ${PUSHED_TAGS_SUMMARY})"
+        echo "${{ matrix.service_display }} image pushed: ${IMAGE_TAG} (+ ${BRANCH_TAG})"

    - name: Job duration summary
      if: always()
@@ -1254,11 +1244,9 @@ jobs:
        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
      run: |
        set -eux
-        # CI runner (act_runner) 部署在 116 staging 本机（116.62.226.203 公网 22 未开放），
-        # 默认走 127.0.0.1:22 本机 SSH，避免跨机网络依赖；可通过 secrets 覆盖。
-        staging_host="${STAGING_SSH_HOST:-127.0.0.1}"
+        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
        staging_user="${STAGING_SSH_USER:-root}"
-        staging_port="${STAGING_SSH_PORT:-22}"
+        staging_port="${STAGING_SSH_PORT:-22222}"
        echo "Host: $staging_host"
        echo "Port: $staging_port"

@@ -22,8 +22,8 @@ export interface ScriptSentence {
  endTime: number
 }

-/** 句子分隔符：中英文句号/问号/感叹号/分号/换行（按句断，不在逗号处切；保持与后端一致） */
-const SENTENCE_SPLIT_RE = /[。！？!?？！;；\n\r]+/
+/** 句子分隔符：中英文句号/问号/感叹号/分号/逗号/换行（覆盖中文短视频常用断句） */
+const SENTENCE_SPLIT_RE = /[。！？!?？！;；,，\n\r]+/

 /**
 * 分句并计算每句的起止时间。
@@ -36,20 +36,14 @@ CACHE_TAG_PRIMARY="${CACHE_TAG:-develop}"
 API_IMAGE="xiaoxia-saas-api:$VERSION"
 WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
 WEB_IMAGE="xiaoxia-saas-web:$VERSION"
-API_DEV="xiaoxia-saas-api:dev"
-WORKER_DEV="xiaoxia-saas-worker:dev"
-WEB_DEV="xiaoxia-saas-web:dev"
+API_LATEST="xiaoxia-saas-api:dev"
+WORKER_LATEST="xiaoxia-saas-worker:dev"

-# Registry 上的完整镜像名（SHA/版本 tag）
+# Registry 上的完整镜像名
 REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:$VERSION"
 REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:$VERSION"
 REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:$VERSION"

-# Registry 上的 dev floating tag（仅 staging/develop 构建时推送，供 Watchtower 监听自动更新）
-REGISTRY_API_DEV="${REGISTRY}/xiaoxia-saas-api:dev"
-REGISTRY_WORKER_DEV="${REGISTRY}/xiaoxia-saas-worker:dev"
-REGISTRY_WEB_DEV="${REGISTRY}/xiaoxia-saas-web:dev"
-
 USE_CACHE=0
 USE_PUSH=0
 CACHE_WRITE=0
@@ -62,34 +56,23 @@ if docker buildx version >/dev/null 2>&1; then
  docker buildx use default 2>/dev/null || true
 fi

-# ---- 是否需要推送 dev tag ----
-# staging 构建 或 develop 分支构建时才推送 :dev tag，供 Watchtower 自动更新；
-# production / release tag 构建不推送 dev tag，避免污染生产 tag 指向。
-PUSH_DEV_TAG=0
-BRANCH_NAME="${GITHUB_REF_NAME:-${CI_COMMIT_BRANCH:-unknown}}"
-if [ "$BUILD_ENV" = "staging" ] || [ "$BRANCH_NAME" = "develop" ]; then
-  PUSH_DEV_TAG=1
-  echo "Dev tag push: ENABLED (BUILD_ENV=$BUILD_ENV, BRANCH=$BRANCH_NAME) — Watchtower will pick up new :dev"
-else
-  echo "Dev tag push: disabled (BUILD_ENV=$BUILD_ENV, BRANCH=$BRANCH_NAME)"
-fi
-
 # ---- 缓存读写策略（按分支隔离）----
 # 默认只读不写，防止 feature 分支污染主缓存
 # 只有 develop/main 分支才写回缓存
+BRANCH_NAME="${GITHUB_REF_NAME:-${CI_COMMIT_BRANCH:-unknown}}"
 # 清理本地旧镜像
-docker rmi -f "$API_IMAGE" "$API_DEV" 2>/dev/null || true
+docker rmi -f "$API_IMAGE" "$API_LATEST" 2>/dev/null || true

 if [ "$USE_CACHE" -eq 1 ]; then
  docker buildx build \
    --build-arg APP_VERSION="$VERSION" \
    --cache-from "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
    -f infra/docker/api.Dockerfile \
-    -t "$API_IMAGE" -t "$API_DEV" \
+    -t "$API_IMAGE" -t "$API_LATEST" \
    --load \
    .
 else
-  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_DEV" .
+  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_LATEST" .
 fi

 build_with_cache() {
@@ -139,22 +122,22 @@ build_with_cache() {
 echo "=== Building API image ==="
 build_with_cache "api" "infra/docker/api.Dockerfile" \
  "--build-arg APP_VERSION=$VERSION"
-docker tag "$API_IMAGE" "$API_DEV"
+docker tag "$API_IMAGE" "$API_LATEST"

 echo "=== Building Worker image ==="
 # 清理本地旧镜像
-docker rmi -f "$WORKER_IMAGE" "$WORKER_DEV" 2>/dev/null || true
+docker rmi -f "$WORKER_IMAGE" "$WORKER_LATEST" 2>/dev/null || true

 if [ "$USE_CACHE" -eq 1 ]; then
  docker buildx build \
    --build-arg APP_VERSION="$VERSION" \
    --cache-from "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
    -f infra/docker/worker.Dockerfile \
-    -t "$WORKER_IMAGE" -t "$WORKER_DEV" \
+    -t "$WORKER_IMAGE" -t "$WORKER_LATEST" \
    --load \
    .
 else
-  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_DEV" .
+  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_LATEST" .
 fi

 echo "=== Building Web image (with buildx cache) ==="
@@ -175,52 +158,37 @@ docker run --rm \
 test -f apps/web/dist/index.html

 # 清理本地旧镜像
-docker rmi -f "$WEB_IMAGE" "$WEB_DEV" 2>/dev/null || true
+docker rmi -f "$WEB_IMAGE" 2>/dev/null || true

 if [ "$USE_CACHE" -eq 1 ]; then
  docker buildx build \
    --cache-from "type=registry,ref=${CACHE_REGISTRY}/web-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
    -f infra/docker/web-artifact.Dockerfile \
    --build-arg "NGINX_CONF=$NGINX_CONF_FILE" \
-    -t "$WEB_IMAGE" -t "$WEB_DEV" \
+    -t "$WEB_IMAGE" \
    --load \
    .
 else
  docker build --pull=false \
    -f infra/docker/web-artifact.Dockerfile \
    --build-arg "NGINX_CONF=$NGINX_CONF_FILE" \
-    -t "$WEB_IMAGE" -t "$WEB_DEV" \
+    -t "$WEB_IMAGE" \
    .
 fi

 # Push 到 Registry
 if [ "$USE_PUSH" -eq 1 ]; then
-  echo "=== Pushing SHA/version-tagged images to Registry ==="
+  echo "=== Pushing images to Registry ==="
  docker tag "$API_IMAGE" "$REGISTRY_API"
  docker tag "$WORKER_IMAGE" "$REGISTRY_WORKER"
  docker tag "$WEB_IMAGE" "$REGISTRY_WEB"
  docker push "$REGISTRY_API"
  docker push "$REGISTRY_WORKER"
  docker push "$REGISTRY_WEB"
-  echo "SHA-tagged images pushed to $REGISTRY"
-
-  # ---- 额外推送 :dev floating tag（仅 staging/develop）----
-  # :dev tag 指向最新一次 develop/staging 构建，供 Watchtower 通过 WATCHTOWER_ROLLING_RESTART 等方式
-  # 监听镜像更新并自动 pull + restart；部署脚本 (ci_staging_deploy.sh) 仍使用 SHA tag 做确定性部署，
-  # dev tag 仅作为"最新 develop 成功构建"的可滚动标识，避免并发构建互相覆盖导致的不可重现问题。
-  if [ "$PUSH_DEV_TAG" -eq 1 ]; then
-    echo "=== Pushing :dev floating tags to Registry (for Watchtower auto-update) ==="
-    docker tag "$API_IMAGE" "$REGISTRY_API_DEV"
-    docker tag "$WORKER_IMAGE" "$REGISTRY_WORKER_DEV"
-    docker tag "$WEB_IMAGE" "$REGISTRY_WEB_DEV"
-    docker push "$REGISTRY_API_DEV"
-    docker push "$REGISTRY_WORKER_DEV"
-    docker push "$REGISTRY_WEB_DEV"
-    echo ":dev tags pushed to $REGISTRY"
-  fi
+  echo "All images pushed to $REGISTRY"
 else
  echo "Registry push skipped (no auth token available)"
 fi

 echo "=== Build complete ==="
-docker images | grep "xiaoxia-saas" | grep -E "($VERSION|dev)" || true
+docker images | grep "xiaoxia-saas" | grep "$VERSION" || true
@@ -170,17 +170,16 @@ rollback() {
      --name xiaoxia-api-production \
      --env-file "$ENV_FILE" \
      --network xiaoxia-net-production \
-      --network-alias xiaoxia-api \
      -p 127.0.0.1:8001:8000 \
      -e APP_ENV=production \
      -e APP_VERSION="$(echo $PREV_API_IMAGE | grep -oE '[^:]+$')" \
      -e GENERATED_FILES_DIR=/app/generated \
-      -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
-      -e PUBLIC_API_BASE_URL=https://saas-api.xiaoxiajianji.com \
+      -e GENERATED_FILES_URL_PREFIX=/generated-files \
+      -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
      -v "$GENERATED_DIR:/app/generated" \
      --restart unless-stopped \
-      --cpus 2 \
-      --memory 2g \
+  --cpus 2 \
+  --memory 2g \
      --health-cmd "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\"" \
      --health-interval 30s \
      --health-timeout 10s \
@@ -197,29 +196,26 @@ rollback() {
    echo "Rolling back Worker to: $PREV_WORKER_IMAGE"
    docker run -d \
      --name xiaoxia-worker-production \
-      --network xiaoxia-net-production \
-      --network-alias xiaoxia-worker \
-      --network-alias xiaoxia-api \
      --env-file "$ENV_FILE" \
+      --network xiaoxia-net-production \
      -e APP_ENV=production \
      -e APP_VERSION="$(echo $PREV_WORKER_IMAGE | grep -oE '[^:]+$')" \
+      -e WORKER_CONCURRENCY=1 \
+      -e WORKER_MAX_TASKS_PER_CHILD=100 \
      -e GENERATED_FILES_DIR=/app/generated \
-      -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
-      -e PYTHONPATH=/app:/app/apps/api:/app/packages \
+      -e GENERATED_FILES_URL_PREFIX=/generated-files \
+      -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
      -v "$GENERATED_DIR:/app/generated" \
-      -v "$LEGACY_ASSETS_DIR:/app/legacy-assets" \
-      -w /app/apps/worker \
      --restart unless-stopped \
-      --cpus 2 \
-      --memory 3g \
-      --health-cmd "sh -c 'PYTHONPATH=/app:/app/apps/api:/app/packages celery -A worker_app.celery_app inspect ping -t 5 2>&1 | grep -q pong'" \
+  --cpus 2 \
+  --memory 2g \
+      --health-cmd "sh -c \"for pid in /proc/[0-9]*/cmdline; do if grep -ql celery \"$pid\" 2>/dev/null; then exit 0; fi; done; exit 1\"" \
      --health-interval 30s \
-      --health-timeout 15s \
+      --health-timeout 10s \
      --health-retries 3 \
-      --health-start-period 60s \
-      --log-driver json-file --log-opt max-size=200m --log-opt max-file=5 \
-      "$PREV_WORKER_IMAGE" \
-      /usr/local/bin/entrypoint-worker.sh
+      --health-start-period 30s \
+      $LOG_OPTS \
+      "$PREV_WORKER_IMAGE"
  else
    echo "No previous Worker image to roll back to"
  fi
@@ -234,15 +230,12 @@ rollback() {
    docker run -d \
      --name xiaoxia-web-production \
      --network xiaoxia-net-production \
-      --network-alias xiaoxia-web \
      -p 127.0.0.1:3002:80 \
-      -e APP_ENV=production \
-      -e API_BASE_URL=https://saas-api.xiaoxiajianji.com \
-      -v "$NGINX_CONF_FILE:/etc/nginx/conf.d/default.conf:ro" \
-      $LEGACY_VOLUME \
      --restart unless-stopped \
-      --cpus 1 \
-      --memory 512m \
+  --cpus 0.5 \
+  --memory 512m \
+      $LEGACY_VOLUME \
+      -v "$NGINX_CONF_FILE:/etc/nginx/conf.d/default.conf:ro" \
      --health-cmd "wget --spider -q http://127.0.0.1:80" \
      --health-interval 30s \
      --health-timeout 5s \
@@ -380,13 +373,12 @@ docker run -d \
  --name xiaoxia-api-production \
  --env-file "$ENV_FILE" \
  --network xiaoxia-net-production \
-  --network-alias xiaoxia-api \
  -p 127.0.0.1:8001:8000 \
  -e APP_ENV=production \
  -e APP_VERSION="$IMAGE_TAG" \
  -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
-  -e PUBLIC_API_BASE_URL=https://saas-api.xiaoxiajianji.com \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
  -v "$GENERATED_DIR:/app/generated" \
  --restart unless-stopped \
  --cpus 2 \
@@ -403,29 +395,26 @@ docker run -d \
 echo "Starting Worker container..."
 docker run -d \
  --name xiaoxia-worker-production \
-  --network xiaoxia-net-production \
-  --network-alias xiaoxia-worker \
-  --network-alias xiaoxia-api \
  --env-file "$ENV_FILE" \
+  --network xiaoxia-net-production \
  -e APP_ENV=production \
  -e APP_VERSION="$IMAGE_TAG" \
+  -e WORKER_CONCURRENCY=1 \
+  -e WORKER_MAX_TASKS_PER_CHILD=100 \
  -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
-  -e PYTHONPATH=/app:/app/apps/api:/app/packages \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
  -v "$GENERATED_DIR:/app/generated" \
-  -v "$LEGACY_ASSETS_DIR:/app/legacy-assets" \
-  -w /app/apps/worker \
  --restart unless-stopped \
  --cpus 2 \
-  --memory 3g \
-  --health-cmd "sh -c 'PYTHONPATH=/app:/app/apps/api:/app/packages celery -A worker_app.celery_app inspect ping -t 5 2>&1 | grep -q pong'" \
+  --memory 2g \
+  --health-cmd "sh -c \"for pid in /proc/[0-9]*/cmdline; do if grep -ql celery \"$pid\" 2>/dev/null; then exit 0; fi; done; exit 1\"" \
  --health-interval 30s \
-  --health-timeout 15s \
+  --health-timeout 10s \
  --health-retries 3 \
-  --health-start-period 60s \
-  --log-driver json-file --log-opt max-size=200m --log-opt max-file=5 \
-  "$REGISTRY_WORKER" \
-  /usr/local/bin/entrypoint-worker.sh || rollback
+  --health-start-period 30s \
+  $LOG_OPTS \
+  "$REGISTRY_WORKER" || rollback

 # ---- 启动 Web ----
 LEGACY_VOLUME=""
@@ -440,15 +429,12 @@ echo "Starting Web container..."
 docker run -d \
  --name xiaoxia-web-production \
  --network xiaoxia-net-production \
-  --network-alias xiaoxia-web \
  -p 127.0.0.1:3002:80 \
-  -e APP_ENV=production \
-  -e API_BASE_URL=https://saas-api.xiaoxiajianji.com \
+  --restart unless-stopped \
+  --cpus 0.5 \
+  --memory 512m \
  -v "$NGINX_CONF_FILE:/etc/nginx/conf.d/default.conf:ro" \
  $LEGACY_VOLUME \
-  --restart unless-stopped \
-  --cpus 1 \
-  --memory 512m \
  --health-cmd "wget --spider -q http://127.0.0.1:80" \
  --health-interval 30s \
  --health-timeout 5s \
@@ -501,7 +487,7 @@ docker builder prune -af --filter "until=168h" 2>/dev/null || true

 echo ""
 echo "=== Production deployment complete ==="
-echo "API:      http://127.0.0.1:8001"
-echo "Web:      http://127.0.0.1:3002"
+echo "API:      http://127.0.0.1:8000"
+echo "Web:      http://127.0.0.1:3001"
 echo "Version:  $IMAGE_TAG"
 docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep production
@@ -264,9 +264,6 @@ if [ -n "$REGISTRY_TOKEN" ]; then
 fi

 # ---- 并行 Pull 三个镜像 ----
-# 注意：这里必须使用 IMAGE_TAG（commit SHA）做确定性部署，不要改成 :dev。
-# :dev 是 floating tag，可能被并发构建覆盖，导致部署版本不可重现、回滚混乱。
-# Watchtower 可监听 :dev 做非关键路径的自动同步；正式部署/回滚一律锚定 SHA。
 REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:${IMAGE_TAG}"
 REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:${IMAGE_TAG}"
 REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:${IMAGE_TAG}"
@@ -17,9 +17,9 @@
 #   SKIP_NOTIFY           - 跳过通知 (true/false, 默认 false)
 #   CI_NOTIFY_WEBHOOK     - 通知 Webhook URL
 #
-#   STAGING_SSH_HOST      - Staging 服务器 SSH 地址 (默认 127.0.0.1，CI runner 在 staging 本机)
+#   STAGING_SSH_HOST      - Staging 服务器 SSH 地址 (默认 47.98.113.167)
 #   STAGING_SSH_USER      - SSH 用户名 (默认 root)
-#   STAGING_SSH_PORT      - SSH 端口 (默认 22)
+#   STAGING_SSH_PORT      - SSH 端口 (默认 22222)
 #   STAGING_SSH_KEY       - SSH 私钥内容
 #   REGISTRY_TOKEN        - Registry Token（回滚时拉取旧镜像需要）
 #
@@ -40,9 +40,9 @@ HEALTH_CHECK_TIMEOUT="${HEALTH_CHECK_TIMEOUT:-120}"
 SKIP_ROLLBACK="${SKIP_ROLLBACK:-false}"
 SKIP_NOTIFY="${SKIP_NOTIFY:-false}"

-STAGING_SSH_HOST="${STAGING_SSH_HOST:-127.0.0.1}"
+STAGING_SSH_HOST="${STAGING_SSH_HOST:-47.98.113.167}"
 STAGING_SSH_USER="${STAGING_SSH_USER:-root}"
-STAGING_SSH_PORT="${STAGING_SSH_PORT:-22}"
+STAGING_SSH_PORT="${STAGING_SSH_PORT:-22222}"

 REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
 REGISTRY_USER="${REGISTRY_USER:-xiaoxia}"