feat(ci): optimize web image build with multi-stage Dockerfile + buildx cache

.gitea/workflows/auto-merge.yml

@@ -13,13 +13,9 @@ jobs:
         uses: actions/checkout@v3
       
       - name: Auto merge develop PRs
-        env:
-          GITEA_API_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
         run: |
           bash scripts/auto_merge_prs.sh develop
       
       - name: Auto merge main PRs (release only)
-        env:
-          GITEA_API_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
         run: |
           bash scripts/auto_merge_prs.sh main

.gitea/workflows/ci-cd.yml

@@ -128,27 +128,6 @@ jobs:
           grep -q "Running upgrade" /tmp/alembic-upgrade.sql
           python3 scripts/check_schema_metadata.py
 
-      - name: Start Redis for unit tests
-        shell: sh
-        run: |
-          set -eu
-          docker rm -f ci-redis-validate 2>/dev/null || true
-          docker run -d --name ci-redis-validate \
-            -p 6379:6379 \
-            --health-cmd "redis-cli ping" \
-            --health-interval 2s \
-            --health-timeout 2s \
-            --health-retries 15 \
-            redis:7-alpine
-          for i in $(seq 1 20); do
-            if docker inspect --format='{{.State.Health.Status}}' ci-redis-validate 2>/dev/null | grep -q healthy; then
-              echo "Redis is ready"
-              break
-            fi
-            echo "Waiting for Redis... ($i/20)"
-            sleep 1
-          done
-          docker inspect --format='{{.State.Health.Status}}' ci-redis-validate | grep -q healthy
       - name: Run unit tests
         shell: sh
         env:
@@ -213,6 +192,7 @@ jobs:
   frontend-lint:
     name: Frontend Lint
     runs-on: ubuntu-22.04
+    timeout-minutes: 20
 
     steps:
       - name: Checkout code
@@ -238,7 +218,17 @@ jobs:
           tar -xzf /tmp/repo.tar.gz --strip-components=1 -C .
           rm -f /tmp/repo.tar.gz
 
+      - name: Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: apps/web/node_modules
+          key: ${{ runner.os }}-node-web-${{ hashFiles('apps/web/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-web-
+
       - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
         shell: sh
         run: |
           set -eu

.gitea/workflows/tests.yml

@@ -11,11 +11,9 @@ jobs:
     steps:
     - name: Checkout code
       shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        python3 - <<'PY'
+        python - <<'PY'
         import io
         import os
         import tarfile
@@ -95,11 +93,9 @@ jobs:
     steps:
     - name: Checkout code
       shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        python3 - <<'PY'
+        python - <<'PY'
         import io
         import os
         import tarfile

infra/docker/web.Dockerfile

@@ -5,7 +5,9 @@ ARG VITE_API_URL=https://saas-api.xiaoxiajianji.com
 ENV VITE_API_URL=$VITE_API_URL
 COPY apps/web/package.json apps/web/package-lock.json ./apps/web/
 WORKDIR /app/apps/web
-RUN npm config set registry https://registry.npmmirror.com \
+RUN \
+    --mount=type=cache,target=/root/.npm \
+    npm config set registry https://registry.npmmirror.com \
     && npm ci
 COPY apps/web/ ./
 RUN npm run build

scripts/build_release_images.sh

@@ -72,28 +72,25 @@ else
 fi
 
 echo "=== Building Web image (with buildx cache) ==="
-# 先构建前端产物
-docker run --rm \
-  -v "$PWD:/workspace" \
-  -w /workspace/apps/web \
-  docker.m.daocloud.io/library/node:20 \
-  sh -lc "npm ci && npm run build"
-
-test -f apps/web/dist/index.html
+# 使用多阶段 Dockerfile 构建，配合 buildx cache 缓存 npm 安装和构建产物
+WEB_NGINX_CONF="${WEB_NGINX_CONF:-infra/docker/nginx-production.conf}"
+WEB_API_URL="${VITE_API_URL:-https://saas-api.xiaoxiajianji.com}"
 
 if [ "$USE_CACHE" -eq 1 ]; then
   docker buildx build \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/web-cache:${CACHE_TAG},ignore-error=true" \
     --cache-to "type=registry,ref=${CACHE_REGISTRY}/web-cache:${CACHE_TAG},mode=max" \
-    -f infra/docker/web-artifact.Dockerfile \
-    --build-arg NGINX_CONF=infra/docker/nginx-production.conf \
+    -f infra/docker/web.Dockerfile \
+    --build-arg NGINX_CONF="${WEB_NGINX_CONF}" \
+    --build-arg VITE_API_URL="${WEB_API_URL}" \
     -t "$WEB_IMAGE" \
     --load \
     .
 else
   docker build --pull=false \
-    -f infra/docker/web-artifact.Dockerfile \
-    --build-arg NGINX_CONF=infra/docker/nginx-production.conf \
+    -f infra/docker/web.Dockerfile \
+    --build-arg NGINX_CONF="${WEB_NGINX_CONF}" \
+    --build-arg VITE_API_URL="${WEB_API_URL}" \
     -t "$WEB_IMAGE" \
     .
 fi