fix(ci): exclude e2e directory from vitest to avoid playwright test mismatch

fix(ci): update package-lock.json for @vitest/coverage-v8
fix(ci): add @vitest/coverage-v8 for main branch coverage
2026-07-29 01:41:15 +08:00 · 2026-07-29 01:31:53 +08:00 · 2026-07-29 01:19:55 +08:00 · 2026-07-29 00:40:32 +08:00 · 2026-07-29 00:39:46 +08:00 · 2026-07-29 00:37:02 +08:00
21 changed files with 1155 additions and 113 deletions
@@ -47,22 +47,33 @@ jobs:
        id: protected_images
        if: gitea.event_name != 'pull_request_target' && !gitea.event.inputs.pr_sha
        env:
-          STAGING_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
+          STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+          STAGING_SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
+          STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+          STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
        run: |
          set +e
          echo "获取staging服务器运行中镜像作为白名单..."
-          mkdir -p ~/.ssh
-          echo "$STAGING_SSH_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-
          staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
          staging_port="${STAGING_SSH_PORT:-22222}"
+          staging_user="${STAGING_SSH_USER:-root}"
+
+          key_path=~/.ssh/id_rsa
+          if [ -n "${STAGING_SSH_KEY:-}" ]; then
+            printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
+            chmod 600 "$key_path"
+            echo "Using key from STAGING_SSH_KEY secret"
+          else
+            echo "⚠️  STAGING_SSH_KEY not set, skipping whitelist"
+            echo "protected_tags=" >> $GITHUB_OUTPUT
+            exit 0
+          fi

          ssh-keyscan -p "$staging_port" -H "$staging_host" >> ~/.ssh/known_hosts 2>/dev/null

          # 获取所有运行容器的镜像，提取tag部分
-          IMAGES=$(ssh -p "$staging_port" -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no \
-            "root@$staging_host" "docker ps --format '{{.Image}}' 2>/dev/null" 2>/dev/null | grep -v "^$" | sort -u)
+          IMAGES=$(ssh -p "$staging_port" -i "$key_path" -o StrictHostKeyChecking=no \
+            "$staging_user@$staging_host" "docker ps --format '{{.Image}}' 2>/dev/null" 2>/dev/null | grep -v "^$" | sort -u)

          PROTECTED_TAGS=""
          if [ -n "$IMAGES" ]; then
@@ -80,7 +91,7 @@ jobs:
          fi

          echo "staging运行中镜像tag: ${PROTECTED_TAGS:-（无）}"
-          echo "protected_tags=$PROTECTED_TAGS" >> $GITEA_OUTPUT
+          echo "protected_tags=$PROTECTED_TAGS" >> $GITHUB_OUTPUT

      # ====== Docker登录 ======
      - name: Docker login to ACR
@@ -323,6 +323,73 @@ jobs:
        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true

+  code-review:
+    name: AI Code Review
+    runs-on: ci-l2
+    timeout-minutes: 8
+    if: github.event_name == 'pull_request' && !github.event.pull_request.draft
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        curl -sH "Authorization: token $GITHUB_TOKEN"           "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"           | bash
+    - name: Record job start time
+      shell: sh
+      run: bash scripts/ci/step_timer_start.sh
+    - name: Install dependencies
+      shell: sh
+      run: |
+        if ! python3 -m pip --version >/dev/null 2>&1; then
+          apt-get update -qq && apt-get install -y -qq python3-pip python3-venv >/dev/null 2>&1
+        fi
+        if ! python3 -m pip --version >/dev/null 2>&1; then
+          python3 -m ensurepip --upgrade 2>/dev/null || curl -sS https://bootstrap.pypa.io/get-pip.py | python3
+        fi
+        python3 -m pip install --quiet requests
+    - name: Run AI Code Review
+      shell: sh
+      env:
+        GITEA_API_URL: ${{ gitea.server_url }}
+        GITEA_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+        REPO_NAME: ${{ gitea.repository }}
+        PR_NUMBER: ${{ gitea.event.pull_request.number }}
+        PR_HEAD_SHA: ${{ gitea.event.pull_request.head.sha }}
+        LLM_PROVIDER: "coze"
+        LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
+        LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+        COZE_BOT_ID: ${{ secrets.COZE_BOT_ID }}
+        LLM_MODEL: ${{ secrets.LLM_MODEL }}
+        MAX_DIFF_CHARS: "30000"
+        LLM_TIMEOUT: "120"
+      run: |
+        python3 scripts/ci_code_review.py
+    - name: Job duration summary
+      if: always()
+      shell: sh
+      run: bash scripts/ci/step_timer_end.sh
+    - name: Notify on failure
+      continue-on-error: true
+      if: failure()
+      shell: sh
+      env:
+        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+      run: |
+        set +e
+        NOTIFY_MODE=failure JOB_NAME="AI Code Review" python3 scripts/ci_notify.py
+    - name: Report CI trace
+      if: always()
+      shell: sh
+      env:
+        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+      run: |
+        STATUS="ok"
+        [ ${{ job.status }} = "success" ] || STATUS="error"
+        START_TIME=""
+        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+
  unit-tests:
    needs: check-frontend-only
    if: always() && needs.check-frontend-only.outputs.skip_backend != 'true'
@@ -458,6 +525,8 @@ jobs:
    name: Frontend Lint
    runs-on: ci-l2
    timeout-minutes: 10
+    needs: check-frontend-only
+    if: always() && needs.check-frontend-only.outputs.skip_frontend != 'true'
    steps:
    - name: Checkout code
      shell: sh
@@ -572,11 +641,12 @@ jobs:
        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true


-  build-pr:
-    name: PR Build ${{ matrix.service_display }} Image
+  build-pr-backend:
+    name: PR Build ${{ matrix.service_display }} Image (Backend)
    runs-on: runtime-builder
    timeout-minutes: ${{ matrix.timeout }}
-    if: github.event_name == 'pull_request'
+    needs: check-frontend-only
+    if: always() && github.event_name == 'pull_request' && needs.check-frontend-only.outputs.skip_backend != 'true'
    strategy:
      fail-fast: false
      matrix:
@@ -593,6 +663,174 @@ jobs:
          image_name: xiaoxia-saas-worker
          cache_name: worker-cache
          timeout: 40
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        curl -sH "Authorization: token $GITHUB_TOKEN"           "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"           | bash
+    - name: Record job start time
+      shell: sh
+      run: bash scripts/ci/step_timer_start.sh
+    - name: Docker login to Registry (for cache read)
+      shell: sh
+      env:
+        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        GITEA_REGISTRY_USER: xiaoxia
+        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+      run: |
+        set -eu
+        for i in 1 2 3; do
+          echo "Docker login attempt $i/3"
+          if printf '%s' "${ACR_PASSWORD}" | docker login xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com -u "${ACR_USERNAME}" --password-stdin              && docker login git.xiaoxiajianji.com -u "${GITEA_REGISTRY_USER}" -p "${GITEA_REGISTRY_TOKEN}"; then
+            echo "Docker login successful"
+            break
+          fi
+          echo "Docker login failed ($i/3), retrying in 5s..."
+          sleep 5
+        done
+    - name: Pre-build worker base images (fallback if not exist)
+      if: matrix.service == 'worker'
+      id: prebuild
+      shell: sh
+      run: |
+        set -eu
+        REGISTRY="git.xiaoxiajianji.com/xiaoxia-saas"
+        BASE_BUILDER="${REGISTRY}/worker-base-builder:latest"
+        BASE_RUNTIME="${REGISTRY}/worker-base-runtime:latest"
+        
+        # 尝试拉取基础镜像
+        echo "检查基础镜像..."
+        if docker pull "$BASE_BUILDER" 2>/dev/null && docker pull "$BASE_RUNTIME" 2>/dev/null; then
+          echo "基础镜像已存在，使用远程镜像"
+          echo "fallback=false" >> $GITHUB_OUTPUT
+        else
+          echo "基础镜像不存在，本地构建（fallback模式）..."
+          
+          # 尝试用buildx构建，失败则回退到普通docker build（DooD模式下buildx builder偶发崩溃）
+          BUILDER_NAME="ci-pr-builder-${GITHUB_RUN_ID:-local}"
+          BUILDX_AVAILABLE=true
+          if ! docker buildx create --use --name "$BUILDER_NAME" --driver docker-container > /dev/null 2>&1; then
+            BUILDX_AVAILABLE=false
+          fi
+          if [ "$BUILDX_AVAILABLE" = true ] && ! docker buildx inspect --bootstrap > /dev/null 2>&1; then
+            BUILDX_AVAILABLE=false
+            docker buildx rm "$BUILDER_NAME" > /dev/null 2>&1 || true
+          fi
+          
+          build_base() {
+            local df="$1"
+            local tag="$2"
+            local name="$3"
+            if [ "$BUILDX_AVAILABLE" = true ]; then
+              echo "构建 $name（buildx）..."
+              if docker buildx build --load -f "$df" -t "$tag" . > /dev/null 2>&1; then
+                echo "$name 构建成功"
+                return 0
+              fi
+              echo "buildx失败，回退到普通docker build"
+              BUILDX_AVAILABLE=false
+              docker buildx rm "$BUILDER_NAME" > /dev/null 2>&1 || true
+            fi
+            echo "构建 $name（docker build）..."
+            docker build -f "$df" -t "$tag" .
+          }
+          
+          build_base infra/docker/worker-base-builder.Dockerfile "$BASE_BUILDER" "worker-base-builder"
+          build_base infra/docker/worker-base-runtime.Dockerfile "$BASE_RUNTIME" "worker-base-runtime"
+          
+          echo "fallback=true" >> $GITHUB_OUTPUT
+          echo "基础镜像本地构建完成"
+        fi
+
+    - name: Build PR image (verify only, no push)
+      shell: sh
+      run: |
+        set -eu
+        REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
+        IMAGE_TAG="${REGISTRY}/${{ matrix.image_name }}:pr-${GITHUB_SHA}"
+        CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:develop"
+
+        EXTRA_BUILD_ARGS="APP_VERSION=\"${GITHUB_SHA}\""
+        if [ "${{ matrix.service }}" = "web" ]; then
+          EXTRA_BUILD_ARGS="$EXTRA_BUILD_ARGS NGINX_CONF=infra/docker/nginx-staging.conf"
+        fi
+
+        # Worker fallback模式：基础镜像本地已构建，用普通docker build绕过buildx
+        if [ "${{ matrix.service }}" = "worker" ] && [ "${{ steps.prebuild.outputs.fallback }}" = "true" ]; then
+          echo "Fallback模式：用普通docker build（基础镜像本地已构建）"
+          BUILD_ARG_STR=""
+          for arg in $EXTRA_BUILD_ARGS; do
+            BUILD_ARG_STR="$BUILD_ARG_STR --build-arg $arg"
+          done
+          docker build -f ${{ matrix.dockerfile }} -t "${IMAGE_TAG}" $BUILD_ARG_STR .
+          echo "Fallback PR Build successful"
+          exit 0
+        fi
+
+        NO_CACHE_FLAG=""
+        for i in 1 2 3; do
+          echo "PR Build attempt $i/3"
+          if bash scripts/ci/docker_build_only.sh $NO_CACHE_FLAG ${{ matrix.dockerfile }} "${IMAGE_TAG}" "${CACHE_REF}" $EXTRA_BUILD_ARGS; then
+            echo "PR Build successful"
+            break
+          fi
+          echo "PR Build failed (attempt $i/3)"
+          [ $i -eq 3 ] && exit 1
+          sleep 10
+          if [ $i -eq 2 ]; then
+            NO_CACHE_FLAG="--no-cache"
+            echo "Next retry with --no-cache"
+          fi
+        done
+        echo
+        echo "${{ matrix.service_display }} PR build verified: ${IMAGE_TAG}"
+    - name: Cleanup buildx builder
+      if: always()
+      shell: sh
+      run: |
+        BUILDER_NAME="ci-pr-builder-${GITHUB_RUN_ID:-local}"
+        docker buildx rm "$BUILDER_NAME" 2>/dev/null || true
+        docker buildx prune -f 2>/dev/null || true
+        echo "Builder cleanup done"
+    - name: Job duration summary
+      if: always()
+      shell: sh
+      run: bash scripts/ci/step_timer_end.sh
+    - name: Notify on failure
+      continue-on-error: true
+      if: failure()
+      shell: sh
+      env:
+        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+      run: |
+        set +e
+        NOTIFY_MODE=failure JOB_NAME="PR Build ${{ matrix.service_display }} Image" python3 scripts/ci_notify.py
+    - name: Report CI trace
+      if: always()
+      shell: sh
+      env:
+        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+      run: |
+        STATUS="ok"
+        [ ${{ job.status }} = "success" ] || STATUS="error"
+        START_TIME=""
+        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+
+
+  build-pr-web:
+    name: PR Build Web Image
+    runs-on: runtime-builder
+    timeout-minutes: ${{ matrix.timeout }}
+    needs: check-frontend-only
+    if: always() && github.event_name == 'pull_request' && needs.check-frontend-only.outputs.skip_frontend != 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
        - service: web
          service_display: Web
          dockerfile: infra/docker/web.Dockerfile
@@ -756,6 +994,7 @@ jobs:
        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true

+
  build-staging:
    name: Build Staging ${{ matrix.service_display }} Image
    runs-on: runtime-builder
@@ -1192,6 +1431,13 @@ jobs:
    runs-on: runtime-builder
    timeout-minutes: ${{ matrix.timeout }}
    needs:
+      - validate-code-quality
+      - validate-type-check
+      - validate-migration
+      - unit-tests
+      - integration-tests
+      - frontend-lint
+      - frontend-unit-test
    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'push' && github.ref_name == 'main')
    strategy:
      fail-fast: false
@@ -1265,7 +1511,7 @@ jobs:
        docker buildx inspect --bootstrap

    - name: Build and push production ${{ matrix.service_display }} image (with retry)
-      shell: sh
+      shell: bash
      run: |
        set -eu
        REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
@@ -1481,18 +1727,26 @@ jobs:
      shell: sh
      run: bash scripts/ci/step_timer_start.sh
    - name: Run production browser E2E
-      shell: sh
+      shell: bash
      run: |
        set -eu
-        docker run --rm --ipc=host \
+        # DooD模式下不能用-v挂载（宿主机路径与CI容器路径不一致）
+        # 改用 docker create + docker cp 方式把代码拷进容器
+        CONTAINER_NAME="production-e2e-$$"
+        docker create --name "$CONTAINER_NAME" --ipc=host \
          -e E2E_BASE_URL=https://saas.xiaoxiajianji.com \
          -e E2E_API_BASE=https://api.xiaoxiajianji.com/api/v1 \
          -e E2E_BROWSER_CHANNEL=chromium \
          -e PLAYWRIGHT_HEADLESS=1 \
-          -v "$PWD:/workspace" \
          -w /workspace/apps/web \
          git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
-          sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts'
+          sh -lc "npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts"
+        docker cp apps "$CONTAINER_NAME:/workspace/"
+        docker cp package-lock.json "$CONTAINER_NAME:/workspace/" 2>/dev/null || true
+        docker start -a "$CONTAINER_NAME"
+        EXIT_CODE=$(docker wait "$CONTAINER_NAME")
+        docker rm "$CONTAINER_NAME" 2>/dev/null || true
+        exit $EXIT_CODE

    - name: Job duration summary
      if: always()
@@ -1672,11 +1926,13 @@ jobs:
      - validate-code-quality
      - validate-type-check
      - validate-migration
+      - code-review
      - unit-tests
      - integration-tests
      - frontend-lint
      - frontend-unit-test
-      - build-pr
+      - build-pr-backend
+      - build-pr-web
    timeout-minutes: 3
    steps:
      - name: Checkout code
@@ -1699,11 +1955,13 @@ jobs:
          RESULT_CODE_QUALITY: ${{ needs.validate-code-quality.result }}
          RESULT_TYPE_CHECK: ${{ needs.validate-type-check.result }}
          RESULT_MIGRATION: ${{ needs.validate-migration.result }}
+          RESULT_CODE_REVIEW: ${{ needs.code-review.result }}
          RESULT_UNIT_TESTS: ${{ needs.unit-tests.result }}
          RESULT_INTEGRATION: ${{ needs.integration-tests.result }}
          RESULT_FRONTEND_LINT: ${{ needs.frontend-lint.result }}
          RESULT_FRONTEND_UNIT: ${{ needs.frontend-unit-test.result }}
-          RESULT_BUILD_PR: ${{ needs.build-pr.result }}
+          RESULT_BUILD_PR_BACKEND: ${{ needs.build-pr-backend.result }}
+          RESULT_BUILD_PR_WEB: ${{ needs.build-pr-web.result }}
        run: |
          set -eu
          echo "=== CI Gate 评估 ==="
@@ -1713,11 +1971,13 @@ jobs:
          echo "  validate-code-quality: $RESULT_CODE_QUALITY"
          echo "  validate-type-check: $RESULT_TYPE_CHECK"
          echo "  validate-migration: $RESULT_MIGRATION"
+          echo "  code-review: $RESULT_CODE_REVIEW"
          echo "  unit-tests: $RESULT_UNIT_TESTS"
          echo "  integration-tests: $RESULT_INTEGRATION"
          echo "  frontend-lint: $RESULT_FRONTEND_LINT"
          echo "  frontend-unit-test: $RESULT_FRONTEND_UNIT"
-          echo "  build-pr: $RESULT_BUILD_PR"
+          echo "  build-pr-backend: $RESULT_BUILD_PR_BACKEND"
+          echo "  build-pr-web: $RESULT_BUILD_PR_WEB"
          echo ""

          # 判断PR类型
@@ -1731,18 +1991,20 @@ jobs:
            "validate-code-quality:$RESULT_CODE_QUALITY"
            "validate-type-check:$RESULT_TYPE_CHECK"
            "validate-migration:$RESULT_MIGRATION"
-            "frontend-lint:$RESULT_FRONTEND_LINT"
-            "build-pr:$RESULT_BUILD_PR"
+            "code-review:$RESULT_CODE_REVIEW"
          )

          # 后端检查
          REQUIRED_BACKEND=(
            "unit-tests:$RESULT_UNIT_TESTS"
+            "build-pr-backend:$RESULT_BUILD_PR_BACKEND"
          )

          # 前端检查
          REQUIRED_FRONTEND=(
+            "frontend-lint:$RESULT_FRONTEND_LINT"
            "frontend-unit-test:$RESULT_FRONTEND_UNIT"
+            "build-pr-web:$RESULT_BUILD_PR_WEB"
          )

          ALL_PASSED=true
@@ -1805,7 +2067,7 @@ jobs:
            echo "❌ CI Gate: FAILED"
            echo "失败项: ${FAILED_ITEMS[*]}"
            echo "gate_result=failure" >> $GITHUB_OUTPUT
-            exit 0
+            exit 1
          fi

      - name: Report CI trace
@@ -87,7 +87,7 @@ jobs:
    runs-on: ci-l2
    timeout-minutes: 10
    outputs:
-      report: ${{ steps.smoke.outputs.report }}
+      report: ${{ steps.report.outputs.report }}

    steps:
      - name: Checkout code
@@ -207,7 +207,7 @@ jobs:
    runs-on: ci-l2
    timeout-minutes: 15
    outputs:
-      report: ${{ steps.smoke.outputs.report }}
+      report: ${{ steps.e2e.outputs.report }}

    steps:
      - name: Checkout code
@@ -8,6 +8,10 @@ on:
 permissions:
  contents: read

+concurrency:
+  group: pr-automation-${{ gitea.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
  auto-approve:
    name: Auto Approve on CI Green
@@ -56,7 +60,7 @@ jobs:
    name: Auto Merge on CI Green + Approved
    runs-on: ci-check
    if: github.event_name == 'pull_request' && !github.event.pull_request.draft && github.event.pull_request.base.ref == 'develop'
-    timeout-minutes: 45  # 长等待模式：等CI全绿后自动合并，不遗漏任何PR
+    timeout-minutes: 3  # 短作业模式：检查一次，不满足就退出，由pr-auto-scan每5分钟定时兜底
    steps:
      - name: Checkout code
        shell: sh
@@ -120,8 +120,8 @@ jobs:
        PREVIEW_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
      run: |
        set -eux
-        preview_host="${PREVIEW_SSH_HOST:-172.30.18.197}"
-        preview_user="${PREVIEW_SSH_USER:-deploy}"
+        preview_host="${PREVIEW_SSH_HOST:-47.98.113.167}"
+        preview_user="${PREVIEW_SSH_USER:-root}"
        preview_port="${PREVIEW_SSH_PORT:-22222}"
        preview_dir="/var/www/preview/pr-${PR_NUMBER}"

@@ -111,15 +111,15 @@ jobs:
            CACHE_VALID=false
            if [ -f "$CACHE_HASH_FILE" ] && [ "$(cat "$CACHE_HASH_FILE")" = "$PACKAGE_LOCK_HASH" ] && [ -x "node_modules/.bin/vite" ] && [ -x "node_modules/.bin/tsc" ]; then
              CACHE_VALID=true
-              echo "Cache hit: dependencies valid, skipping npm ci"
+              echo "Cache hit: dependencies valid, skipping npm install"
            fi
            if [ "$CACHE_VALID" = "false" ]; then
-              echo "Cache miss or invalid: running npm ci..."
-              if ! npm ci --include=dev; then
-                echo "npm ci failed, cleaning node_modules and retrying..."
+              echo "Cache miss or invalid: running npm install..."
+              if ! npm install --include=dev; then
+                echo "npm install failed, cleaning node_modules and retrying..."
                rm -rf node_modules
                mkdir -p node_modules
-                npm ci --include=dev
+                npm install --include=dev
              fi
              echo "$PACKAGE_LOCK_HASH" > "$CACHE_HASH_FILE"
              echo "Dependencies installed, cache updated"
@@ -10,7 +10,7 @@ from __future__ import annotations
 from app.auth import AuthenticatedUser
 from app.auth import get_current_user as get_authenticated_user
 from app.dependencies import get_user_repository
-from fastapi import Depends
+from fastapi import Depends, HTTPException
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

 from packages.domain.entities import User
@@ -28,6 +28,7 @@
        "@typescript-eslint/eslint-plugin": "^7.13.1",
        "@typescript-eslint/parser": "^7.13.1",
        "@vitejs/plugin-react": "^4.3.1",
+        "@vitest/coverage-v8": "^1.6.0",
        "@vitest/ui": "^1.6.0",
        "eslint": "^8.57.0",
        "eslint-plugin-react-hooks": "^4.6.2",
@@ -46,6 +47,20 @@
      "dev": true,
      "license": "MIT"
    },
+    "node_modules/@ampproject/remapping": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
+      "integrity": "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
    "node_modules/@ant-design/colors": {
      "version": "7.2.1",
      "resolved": "https://registry.npmjs.org/@ant-design/colors/-/colors-7.2.1.tgz",
@@ -475,6 +490,13 @@
        "node": ">=6.9.0"
      }
    },
+    "node_modules/@bcoe/v8-coverage": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
+      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/@csstools/color-helpers": {
      "version": "5.1.0",
      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
@@ -1142,6 +1164,16 @@
      "dev": true,
      "license": "BSD-3-Clause"
    },
+    "node_modules/@istanbuljs/schema": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz",
+      "integrity": "sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
    "node_modules/@jest/schemas": {
      "version": "29.6.3",
      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz",
@@ -2221,6 +2253,34 @@
        "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
      }
    },
+    "node_modules/@vitest/coverage-v8": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-1.6.1.tgz",
+      "integrity": "sha512-6YeRZwuO4oTGKxD3bijok756oktHSIm3eczVVzNe3scqzuhLwltIF3S9ZL/vwOVIpURmU6SnZhziXXAfw8/Qlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@ampproject/remapping": "^2.2.1",
+        "@bcoe/v8-coverage": "^0.2.3",
+        "debug": "^4.3.4",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-lib-source-maps": "^5.0.4",
+        "istanbul-reports": "^3.1.6",
+        "magic-string": "^0.30.5",
+        "magicast": "^0.3.3",
+        "picocolors": "^1.0.0",
+        "std-env": "^3.5.0",
+        "strip-literal": "^2.0.0",
+        "test-exclude": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "vitest": "1.6.1"
+      }
+    },
    "node_modules/@vitest/expect": {
      "version": "1.6.1",
      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-1.6.1.tgz",
@@ -3877,6 +3937,13 @@
        "node": ">=18"
      }
    },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/http-proxy-agent": {
      "version": "7.0.2",
      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
@@ -4085,6 +4152,60 @@
      "dev": true,
      "license": "ISC"
    },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-lib-source-maps": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-5.0.6.tgz",
+      "integrity": "sha512-yg2d+Em4KizZC5niWhQaIomgf5WlL4vOOjZ5xGCmF8SnPE/mDWWXgvRExdcpCgh9lLRRa1/fSYp2ymmbJ1pI+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.23",
+        "debug": "^4.1.1",
+        "istanbul-lib-coverage": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
    "node_modules/js-tokens": {
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
@@ -4352,6 +4473,34 @@
        "@jridgewell/sourcemap-codec": "^1.5.5"
      }
    },
+    "node_modules/magicast": {
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.3.5.tgz",
+      "integrity": "sha512-L0WhttDl+2BOsybvEOLK7fW3UA0OQ0IQ2d6Zl2x/a6vVRs3bAY0ECOSHHeL5jD+SbOpOCUEi0y1DgHEn9Qn1AQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.25.4",
+        "@babel/types": "^7.25.4",
+        "source-map-js": "^1.2.0"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
    "node_modules/math-intrinsics": {
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -6010,6 +6159,45 @@
      "dev": true,
      "license": "MIT"
    },
+    "node_modules/test-exclude": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
+      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@istanbuljs/schema": "^0.1.2",
+        "glob": "^7.1.4",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/test-exclude/node_modules/brace-expansion": {
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/test-exclude/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
    "node_modules/text-table": {
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
@@ -37,14 +37,15 @@
    "@typescript-eslint/eslint-plugin": "^7.13.1",
    "@typescript-eslint/parser": "^7.13.1",
    "@vitejs/plugin-react": "^4.3.1",
+    "@vitest/coverage-v8": "^1.6.0",
    "@vitest/ui": "^1.6.0",
    "eslint": "^8.57.0",
    "eslint-plugin-react-hooks": "^4.6.2",
    "eslint-plugin-react-refresh": "^0.4.7",
    "jsdom": "^24.1.0",
+    "prettier": "^3.9.5",
    "typescript": "^5.5.3",
    "vite": "^5.3.1",
-    "vitest": "^1.6.0",
-    "prettier": "^3.9.5"
+    "vitest": "^1.6.0"
  }
 }
@@ -11,6 +11,12 @@ export default defineConfig({
    globals: true,
    environment: "jsdom",
    setupFiles: "./src/test/setup.ts",
+    exclude: [
+      "node_modules",
+      "e2e",
+      "dist",
+      "build",
+    ],
    coverage: {
      provider: "v8",
      reporter: ["text", "json", "html"],
@@ -4,7 +4,7 @@
 # ============================================================

 # 基础镜像：Python 3.12
-FROM python:3.12-slim-bookworm
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/python:3.12-slim-bookworm

 # 使用阿里云镜像加速
 RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/python:3.12-slim

 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=0 \
@@ -1,4 +1,4 @@
-FROM docker.m.daocloud.io/library/nginx:alpine AS runner
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/nginx:alpine AS runner
 ARG NGINX_CONF=infra/docker/nginx.conf
 WORKDIR /usr/share/nginx/html
 COPY apps/web/dist ./
@@ -1,5 +1,5 @@
 # Build stage
-FROM docker.m.daocloud.io/library/node:20 AS builder
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/node:20 AS builder
 WORKDIR /app
 ARG VITE_API_URL=https://saas-api.xiaoxiajianji.com
 ENV VITE_API_URL=$VITE_API_URL
@@ -11,7 +11,7 @@ COPY apps/web/ ./
 RUN npm run build

 # Production stage with nginx
-FROM docker.m.daocloud.io/library/nginx:alpine AS runner
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/nginx:alpine AS runner
 ARG NGINX_CONF=infra/docker/nginx.conf
 WORKDIR /usr/share/nginx/html
 COPY --from=builder /app/apps/web/dist ./
@@ -4,7 +4,7 @@
 # ============================================================

 # 基础镜像：Python 3.12 + ffmpeg
-FROM python:3.12-slim-bookworm
+FROM xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/base/python:3.12-slim-bookworm

 # 使用阿里云镜像加速
 RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
@@ -5,3 +5,45 @@ target-version = ["py312"]
 [tool.isort]
 profile = "black"
 line_length = 120
+
+[tool.ruff]
+target-version = "py311"
+line-length = 120
+exclude = [
+  ".git",
+  "__pycache__",
+  ".venv",
+  "venv",
+  "node_modules",
+  "alembic",
+  ".gitea",
+  ".next",
+  "dist",
+  "build",
+  "hostexecutor",
+]
+
+[tool.ruff.lint]
+select = [
+  "E",   # pycodestyle errors（同 flake8 默认）
+  "F",   # pyflakes（同 flake8 默认）
+]
+ignore = [
+  "E203",
+  "E501",  # line-too-long（black管）
+  "E302",
+  "E402",  # module-import-not-at-top（循环导入多）
+  "E722",  # bare-except
+  "W291",
+  "W293",
+  "F401",
+  "F403",
+  "F405",
+  "F841",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401", "F403", "F405"]
+"tests/**" = ["E402", "F401", "F821", "F841"]
+"packages/ports/*" = ["E301"]
+"apps/api/app/api/routes/auth.py" = ["ALL"]
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # 自动合并：CI全绿+已审批后自动squash merge PR到develop
+# 短作业模式：只检查一次，不满足条件就退出，由pr-auto-scan定时兜底
 # 环境变量：GITHUB_TOKEN, MERGE_TOKEN, PR_NUMBER, PR_HEAD_SHA, BASE_REF, GITHUB_API_URL, GITHUB_REPOSITORY
 set -eu

@@ -7,6 +8,8 @@ set -eu

 echo "PR #${PR_NUMBER} - 检查CI状态+审批并自动合并到${BASE_REF}"
 echo
+echo "模式: 短作业（只检查一次，不满足则退出，由pr-auto-scan定时兜底）"
+echo

 # 只合develop分支
 if [ "$BASE_REF" != "develop" ]; then
@@ -30,21 +33,20 @@ CONTEXTS=(
 echo "检查CI Gate统一门禁"
 echo

-# 初始等待30秒，给CI启动写status的时间
-echo "等待30秒让CI启动..."
-sleep 30
+# 等待60秒，给CI启动写status的时间
+echo "等待60秒让CI启动..."
+sleep 60

-# 405连续计数器
+# 405计数器（单次运行内重试）
 MERGE_405_COUNT=0
-MAX_405_RETRIES=10
+MAX_405_RETRIES=3

-# 轮询等待，最多30分钟（180次x10秒）
-for attempt in $(seq 1 90); do  # 最多等45分钟(90次x30秒)，确保等得到Worker构建完成
+check_and_merge() {
  ALL_SUCCESS=true
  ANY_FAILED=false
  ANY_PENDING=false

-  echo "--- 第${attempt}次检查 ($(date '+%H:%M:%S')) ---"
+  echo "--- 检查CI状态 ($(date '+%H:%M:%S')) ---"

  # 检查CI状态
  for ctx in "${CONTEXTS[@]}"; do
@@ -61,77 +63,82 @@ for attempt in $(seq 1 90); do  # 最多等45分钟(90次x30秒)，确保等得
    fi
  done

-
-  # CI全绿 → 合并
-  if [ "$ALL_SUCCESS" = "true" ]; then
-    echo
-    echo "CI全绿，执行自动合并"
-    echo "等待60秒冷却，给Gitea内部状态同步时间..."
-    sleep 60
-
-    # 幂等检查：PR是否还是open
-    PR_STATE=$(curl -s -H "Authorization: token ${MERGE_TOKEN}" \
-      "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" \
-      | python3 -c "import sys,json; print(json.load(sys.stdin).get('state',''))")
-
-    if [ "$PR_STATE" != "open" ]; then
-      echo "PR状态为 ${PR_STATE}，无需合并"
-      exit 0
-    fi
-
-    # 执行squash merge
-    HTTP_CODE=$(curl -s -o /tmp/merge_resp.json -w "%{http_code}" \
-      -X POST \
-      -H "Authorization: token ${MERGE_TOKEN}" \
-      -H "Content-Type: application/json" \
-      -d '{"do":"squash","merge_title_field":"","merge_message_field":"","delete_branch_after_merge":true,"force_merge":false}' \
-      "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/merge")
-
-    echo "合并API HTTP状态: $HTTP_CODE"
-
-    if [ "$HTTP_CODE" = "200" ]; then
-      echo "自动合并成功"
-      exit 0
-    elif [ "$HTTP_CODE" = "405" ]; then
-      MERGE_405_COUNT=$((MERGE_405_COUNT + 1))
-      echo "⚠️  合并返回405（第${MERGE_405_COUNT}次），可能CI状态尚未同步或有未解决的门禁，继续等待重试..."
-      cat /tmp/merge_resp.json 2>/dev/null || true
-      echo
-      if [ "$MERGE_405_COUNT" -ge "$MAX_405_RETRIES" ]; then
-        echo "⚠️  连续${MAX_405_RETRIES}次合并返回405，放弃自动合并（需人工确认，非代码问题）"
-        curl -s -X POST \
-          -H "Authorization: token ${MERGE_TOKEN}" \
-          -H "Content-Type: application/json" \
-          -d '{"body": "Auto merge skipped after multiple 405 errors: PR may have conflicts or unresolved checks. Please review manually. This is not a CI failure."}' \
-          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" > /dev/null 2>&1 || true
-        exit 0
-      fi
-      sleep 30
-      continue
-    else
-      echo "自动合并失败 (HTTP $HTTP_CODE)"
-      cat /tmp/merge_resp.json 2>/dev/null || true
-      curl -s -X POST \
-        -H "Authorization: token ${MERGE_TOKEN}" \
-        -H "Content-Type: application/json" \
-        -d "{\"body\": \"Auto merge failed (HTTP ${HTTP_CODE}), please check manually.\"}" \
-        "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" > /dev/null 2>&1 || true
-      exit 1
-    fi
-  else
-    # 本轮不满足合并条件，重置405计数器
-    MERGE_405_COUNT=0
-  fi
-
+  # CI有失败 → 不合并，直接退出
  if [ "$ANY_FAILED" = "true" ]; then
    echo
-    echo "CI有失败项，不自动合并"
+    echo "❌ CI有失败项，不自动合并"
    exit 0
  fi

+  # CI未全绿（pending中）→ 退出，等下次触发
+  if [ "$ALL_SUCCESS" != "true" ]; then
+    echo
+    echo "⏳ CI尚未全绿（仍有pending），退出等待下次触发"
+    echo "   （pr-auto-scan每5分钟扫描一次，CI通过后会自动合并）"
+    exit 0
+  fi
+
+  # CI全绿 → 合并
+  echo
+  echo "✅ CI全绿，执行自动合并"
+  echo "等待30秒冷却，给Gitea内部状态同步时间..."
  sleep 30
+
+  # 幂等检查：PR是否还是open
+  PR_STATE=$(curl -s -H "Authorization: token ${MERGE_TOKEN}" \
+    "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" \
+    | python3 -c "import sys,json; print(json.load(sys.stdin).get('state',''))")
+
+  if [ "$PR_STATE" != "open" ]; then
+    echo "PR状态为 ${PR_STATE}，无需合并"
+    exit 0
+  fi
+
+  # 执行squash merge
+  HTTP_CODE=$(curl -s -o /tmp/merge_resp.json -w "%{http_code}" \
+    -X POST \
+    -H "Authorization: token ${MERGE_TOKEN}" \
+    -H "Content-Type: application/json" \
+    -d '{"do":"squash","merge_title_field":"","merge_message_field":"","delete_branch_after_merge":true,"force_merge":false}' \
+    "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/merge")
+
+  echo "合并API HTTP状态: $HTTP_CODE"
+
+  if [ "$HTTP_CODE" = "200" ]; then
+    echo "✅ 自动合并成功"
+    exit 0
+  elif [ "$HTTP_CODE" = "405" ]; then
+    MERGE_405_COUNT=$((MERGE_405_COUNT + 1))
+    echo "⚠️  合并返回405（第${MERGE_405_COUNT}次），可能CI状态尚未同步或有未解决的门禁"
+    cat /tmp/merge_resp.json 2>/dev/null || true
+    echo
+    if [ "$MERGE_405_COUNT" -ge "$MAX_405_RETRIES" ]; then
+      echo "⚠️  连续${MAX_405_RETRIES}次合并返回405，放弃本次自动合并"
+      echo "   （pr-auto-scan会继续尝试，需人工确认是否有冲突或门禁问题）"
+      exit 0
+    fi
+    echo "30秒后重试..."
+    sleep 30
+    return 1  # 重试
+  else
+    echo "❌ 自动合并失败 (HTTP $HTTP_CODE)"
+    cat /tmp/merge_resp.json 2>/dev/null || true
+    curl -s -X POST \
+      -H "Authorization: token ${MERGE_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -d "{\"body\": \"Auto merge failed (HTTP ${HTTP_CODE}), please check manually.\"}" \
+      "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" > /dev/null 2>&1 || true
+    exit 1
+  fi
+}
+
+# 最多重试3次（用于405重试，非CI轮询）
+for i in 1 2 3; do
+  if check_and_merge; then
+    exit 0
+  fi
 done

 echo
-echo "快速检查超时（3分钟），CI尚未全绿或无审批，退出等待下次触发"
+echo "本次检查未满足合并条件，退出。pr-auto-scan每5分钟会继续扫描。"
 exit 0
@@ -0,0 +1,103 @@
+#!/bin/bash
+# ============================================
+# 基础镜像同步脚本 - 从公共镜像源同步到私有ACR
+# 用法:
+#   ACR_USERNAME=xxx ACR_PASSWORD=yyy bash scripts/ci/sync_base_images.sh
+# ============================================
+
+set -euo pipefail
+
+ACR_REGISTRY="${ACR_REGISTRY:-xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji}"
+ACR_USERNAME="${ACR_USERNAME:-}"
+ACR_PASSWORD="${ACR_PASSWORD:-}"
+SOURCE_PREFIX="${SOURCE_PREFIX:-docker.m.daocloud.io/library}"
+
+# 需要同步的镜像列表 (源镜像名:tag => ACR目标名:tag)
+IMAGES=(
+    "python:3.12-slim-bookworm"
+    "python:3.12-slim"
+    "node:20"
+    "nginx:alpine"
+)
+
+echo "============================================"
+echo "  基础镜像同步到 ACR"
+echo "  ACR: $ACR_REGISTRY"
+echo "  源: $SOURCE_PREFIX"
+echo "============================================"
+echo ""
+
+# 登录 ACR
+if [ -n "$ACR_PASSWORD" ] && [ -n "$ACR_USERNAME" ]; then
+    echo "登录 ACR..."
+    ACR_HOST=$(echo "$ACR_REGISTRY" | cut -d/ -f1)
+    printf '%s' "$ACR_PASSWORD" | docker login "$ACR_HOST" -u "$ACR_USERNAME" --password-stdin
+    echo "ACR 登录成功"
+    echo ""
+fi
+
+success=0
+failed=0
+
+for image in "${IMAGES[@]}"; do
+    source_image="${SOURCE_PREFIX}/${image}"
+    target_image="${ACR_REGISTRY}/base/${image}"
+
+    echo "--- 同步: $image ---"
+    echo "  源: $source_image"
+    echo "  目标: $target_image"
+
+    # Pull 源镜像（带重试）
+    pulled=0
+    for attempt in 1 2 3; do
+        echo "  Pull 尝试 $attempt/3..."
+        if docker pull "$source_image"; then
+            pulled=1
+            break
+        fi
+        echo "  Pull 失败，5s 后重试..."
+        sleep 5
+    done
+
+    if [ "$pulled" -eq 0 ]; then
+        echo "  ❌ Pull 失败: $image"
+        failed=$((failed + 1))
+        continue
+    fi
+
+    # Tag
+    docker tag "$source_image" "$target_image"
+    echo "  Tag 完成"
+
+    # Push 到 ACR
+    pushed=0
+    for attempt in 1 2 3; do
+        echo "  Push 尝试 $attempt/3..."
+        if docker push "$target_image"; then
+            pushed=1
+            break
+        fi
+        echo "  Push 失败，5s 后重试..."
+        sleep 5
+    done
+
+    if [ "$pushed" -eq 1 ]; then
+        echo "  ✅ 同步成功: $image"
+        success=$((success + 1))
+    else
+        echo "  ❌ Push 失败: $image"
+        failed=$((failed + 1))
+    fi
+
+    echo ""
+done
+
+echo "============================================"
+echo "  同步完成"
+echo "  成功: $success"
+echo "  失败: $failed"
+echo "============================================"
+
+if [ "$failed" -gt 0 ]; then
+    exit 1
+fi
@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""
+CI 通知脚本 - 发送飞书消息通知
+用法:
+  NOTIFY_MODE=start JOB_NAME="Build API" python3 scripts/ci_notify.py
+  NOTIFY_MODE=success JOB_NAME="Deploy Staging" python3 scripts/ci_notify.py
+  NOTIFY_MODE=failure JOB_NAME="Unit Tests" python3 scripts/ci_notify.py
+
+环境变量:
+  NOTIFY_MODE     - 通知类型: start/success/failure
+  JOB_NAME        - Job名称
+  CI_NOTIFY_WEBHOOK - 飞书Webhook地址
+  GITHUB_SHA      - Commit SHA (可选)
+  GITHUB_REF_NAME - 分支名 (可选)
+  GITHUB_RUN_ID   - Run ID (可选)
+  GITHUB_REPOSITORY - 仓库名 (可选)
+  GITHUB_SERVER_URL - Gitea地址 (可选)
+
+设计原则:
+  通知失败永远不阻断主流程（永远返回0）
+"""
+
+import json
+import os
+import sys
+import urllib.request
+from datetime import datetime
+
+
+def get_env(name, default=""):
+    return os.environ.get(name, default)
+
+
+def send_feishu_notify(webhook_url, title, content, color="blue"):
+    """发送飞书通知（简单卡片格式）"""
+    if not webhook_url:
+        print("[INFO] 未配置 CI_NOTIFY_WEBHOOK，跳过通知")
+        return True
+
+    # 状态颜色映射
+    color_map = {
+        "green": "green",
+        "red": "red",
+        "blue": "blue",
+        "yellow": "yellow",
+    }
+    header_color = color_map.get(color, "blue")
+
+    # 构造卡片
+    card = {
+        "config": {"wide_screen_mode": True},
+        "header": {
+            "title": {"tag": "plain_text", "content": title},
+            "template": header_color,
+        },
+        "elements": [
+            {"tag": "div", "text": {"tag": "lark_md", "content": content}},
+        ],
+    }
+
+    payload = {"msg_type": "interactive", "card": card}
+    data = json.dumps(payload).encode("utf-8")
+
+    req = urllib.request.Request(
+        webhook_url,
+        data=data,
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            resp_body = resp.read().decode("utf-8")
+        result = json.loads(resp_body)
+        if result.get("code", 0) != 0:
+            print(f"[WARN] 飞书通知返回错误: {result.get('msg', resp_body)}", file=sys.stderr)
+            return False
+        print("[INFO] 飞书通知发送成功")
+        return True
+    except Exception as e:
+        print(f"[WARN] 飞书通知发送失败: {e}", file=sys.stderr)
+        return False
+
+
+def build_message():
+    """根据环境变量构造通知消息"""
+    notify_mode = get_env("NOTIFY_MODE", "info").lower()
+    job_name = get_env("JOB_NAME", "未知Job")
+    branch = get_env("GITHUB_REF_NAME", "未知分支")
+    sha = get_env("GITHUB_SHA", "")[:8]
+    run_id = get_env("GITHUB_RUN_ID", "")
+    repo = get_env("GITHUB_REPOSITORY", "")
+    server_url = get_env("GITHUB_SERVER_URL", "https://git.xiaoxiajianji.com")
+
+    # 状态映射
+    status_map = {
+        "start": ("🔔 CI 任务开始", "blue", "开始执行"),
+        "success": ("✅ CI 任务成功", "green", "执行成功"),
+        "failure": ("❌ CI 任务失败", "red", "执行失败"),
+        "info": ("ℹ️ CI 通知", "blue", "通知"),
+    }
+    title, color, status_text = status_map.get(notify_mode, status_map["info"])
+
+    # 构造内容
+    content_lines = [
+        f"**任务**: {job_name}",
+        f"**状态**: {status_text}",
+        f"**分支**: {branch}",
+    ]
+    if sha:
+        content_lines.append(f"**Commit**: `{sha}`")
+    if run_id and repo and server_url:
+        run_url = f"{server_url}/{repo}/actions/runs/{run_id}"
+        content_lines.append(f"**详情**: [点击查看]({run_url})")
+
+    content_lines.append(f"**时间**: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
+
+    content = "\n".join(content_lines)
+    return title, content, color
+
+
+def main():
+    webhook = get_env("CI_NOTIFY_WEBHOOK", "")
+    title, content, color = build_message()
+
+    print(f"[CI Notify] 模式: {get_env('NOTIFY_MODE')}")
+    print(f"[CI Notify] 任务: {get_env('JOB_NAME')}")
+
+    send_feishu_notify(webhook, title, content, color)
+
+    # 永远返回0，不阻断主流程
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,173 @@
+#!/bin/sh
+# ============================================
+# CI Staging 部署脚本 - 通过 SSH 在 Staging 服务器执行
+# 用法：IMAGE_TAG=<sha> ACR_USERNAME=<user> ACR_PASSWORD=<pass> sh ci_staging_deploy.sh
+# ============================================
+
+set -eu
+
+IMAGE_TAG="${IMAGE_TAG:-}"
+ACR_REGISTRY="${ACR_REGISTRY:-xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji}"
+ACR_USERNAME="${ACR_USERNAME:-}"
+ACR_PASSWORD="${ACR_PASSWORD:-}"
+
+ENV_FILE="${ENV_FILE:-/var/lib/xiaoxia-saas-staging/.env}"
+GENERATED_DIR="${GENERATED_DIR:-/var/lib/xiaoxia-saas-staging/generated}"
+STAGING_NETWORK="${STAGING_NETWORK:-xiaoxia-net-staging}"
+
+if [ -z "$IMAGE_TAG" ]; then
+  echo "ERROR: IMAGE_TAG is required"
+  exit 1
+fi
+
+echo "============================================"
+echo "  Staging 部署 - CI触发"
+echo "  Version: $IMAGE_TAG"
+echo "============================================"
+echo ""
+
+# ---- 登录 ACR ----
+if [ -n "$ACR_PASSWORD" ] && [ -n "$ACR_USERNAME" ]; then
+  echo "登录 ACR..."
+  printf '%s' "$ACR_PASSWORD" | docker login "$(echo "$ACR_REGISTRY" | cut -d/ -f1)" -u "$ACR_USERNAME" --password-stdin 2>/dev/null || {
+    echo "WARN: docker login failed, will try to pull anyway"
+  }
+fi
+
+# ---- Pull 3个镜像 ----
+API_IMAGE="${ACR_REGISTRY}/xiaoxia-saas-api:${IMAGE_TAG}"
+WORKER_IMAGE="${ACR_REGISTRY}/xiaoxia-saas-worker:${IMAGE_TAG}"
+WEB_IMAGE="${ACR_REGISTRY}/xiaoxia-saas-web:${IMAGE_TAG}"
+
+echo ""
+echo "拉取 API 镜像..."
+docker pull "$API_IMAGE"
+echo "拉取 Worker 镜像..."
+docker pull "$WORKER_IMAGE"
+echo "拉取 Web 镜像..."
+docker pull "$WEB_IMAGE"
+echo ""
+echo "所有镜像拉取完成"
+
+# ---- 确保基础设施在运行 ----
+echo ""
+echo "检查基础设施容器..."
+for c in xiaoxia-postgres-staging xiaoxia-redis-staging; do
+  if ! docker inspect "$c" >/dev/null 2>&1; then
+    echo "ERROR: 基础设施容器不存在: $c"
+    exit 1
+  fi
+  state=$(docker inspect -f '{{.State.Status}}' "$c")
+  if [ "$state" != "running" ]; then
+    echo "ERROR: 基础设施容器未运行: $c ($state)"
+    exit 1
+  fi
+done
+echo "基础设施正常"
+
+# ---- 确保 staging 网络存在 ----
+docker network create "$STAGING_NETWORK" 2>/dev/null || true
+
+mkdir -p "$GENERATED_DIR"
+
+# ---- 数据库 Migration ----
+echo ""
+echo "执行数据库迁移..."
+docker run --rm --env-file "$ENV_FILE" --network "$STAGING_NETWORK" "$API_IMAGE" sh -c "cd /app && /opt/venv/bin/alembic upgrade head"
+echo "数据库迁移完成"
+
+# ---- 停止旧容器 ----
+echo ""
+echo "停止旧容器..."
+docker rm -f xiaoxia-api-staging 2>/dev/null || true
+docker rm -f xiaoxia-worker-staging 2>/dev/null || true
+docker rm -f xiaoxia-web-staging 2>/dev/null || true
+
+# ---- 启动 API ----
+echo "启动 API 容器..."
+docker run -d \
+  --name xiaoxia-api-staging \
+  --env-file "$ENV_FILE" \
+  --network "$STAGING_NETWORK" \
+  -p 127.0.0.1:8000:8000 \
+  -e APP_ENV=staging \
+  -e APP_VERSION="$IMAGE_TAG" \
+  -e GENERATED_FILES_DIR=/app/generated \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -v "$GENERATED_DIR:/app/generated" \
+  --restart unless-stopped \
+  --health-cmd "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\"" \
+  --health-interval 30s \
+  --health-timeout 10s \
+  --health-retries 3 \
+  --health-start-period 40s \
+  "$API_IMAGE"
+
+# ---- 启动 Worker ----
+echo "启动 Worker 容器..."
+docker run -d \
+  --name xiaoxia-worker-staging \
+  --env-file "$ENV_FILE" \
+  --network "$STAGING_NETWORK" \
+  -e APP_ENV=staging \
+  -e APP_VERSION="$IMAGE_TAG" \
+  -e WORKER_CONCURRENCY=1 \
+  -e WORKER_MAX_TASKS_PER_CHILD=100 \
+  -e GENERATED_FILES_DIR=/app/generated \
+  -e GENERATED_FILES_URL_PREFIX=/generated-files \
+  -v "$GENERATED_DIR:/app/generated" \
+  --restart unless-stopped \
+  --health-cmd "sh -c \"grep -q celery /proc/1/cmdline || exit 1\"" \
+  --health-interval 30s \
+  --health-timeout 10s \
+  --health-retries 3 \
+  --health-start-period 30s \
+  "$WORKER_IMAGE"
+
+# ---- 启动 Web ----
+echo "启动 Web 容器..."
+docker run -d \
+  --name xiaoxia-web-staging \
+  --network "$STAGING_NETWORK" \
+  -p 127.0.0.1:3001:80 \
+  --restart unless-stopped \
+  --health-cmd "wget --spider -q http://127.0.0.1:80" \
+  --health-interval 30s \
+  --health-timeout 5s \
+  --health-retries 3 \
+  "$WEB_IMAGE"
+
+# ---- 等待 API 健康 ----
+echo ""
+echo "等待 API 健康检查..."
+i=0
+while [ "$i" -lt 30 ]; do
+  if curl -sf --max-time 5 http://127.0.0.1:8000/health >/dev/null 2>&1; then
+    echo "API 健康检查通过"
+    break
+  fi
+  i=$((i + 1))
+  echo "  等待中... ($i/30)"
+  sleep 2
+done
+
+if [ "$i" -ge 30 ]; then
+  echo "ERROR: API 在 60s 内未通过健康检查"
+  echo ""
+  echo "=== API 最近日志 ==="
+  docker logs --tail 50 xiaoxia-api-staging
+  exit 1
+fi
+
+# ---- 清理旧镜像 ----
+docker image prune -af --filter "until=72h" 2>/dev/null || true
+
+echo ""
+echo "============================================"
+echo "  ✅ Staging 部署完成"
+echo "============================================"
+echo "API:      http://127.0.0.1:8000"
+echo "Web:      http://127.0.0.1:3001"
+echo "Version:  $IMAGE_TAG"
+echo ""
+docker ps --format "table {{.Names}}\t{{.Status}}" | grep staging
@@ -0,0 +1,110 @@
+#!/bin/bash
+# ============================================
+# CI Staging 健康检查脚本 - 在 CI Runner 上执行
+# 通过 SSH 连接 Staging 服务器，检查 API/Worker/Web 健康状态
+# ============================================
+
+set -eu
+
+STAGING_SSH_HOST="${STAGING_SSH_HOST:-47.98.113.167}"
+STAGING_SSH_USER="${STAGING_SSH_USER:-root}"
+STAGING_SSH_PORT="${STAGING_SSH_PORT:-22222}"
+STAGING_SSH_KEY="${STAGING_SSH_KEY:-}"
+
+HEALTH_TIMEOUT="${HEALTH_TIMEOUT:-120}"
+HEALTH_INTERVAL="${HEALTH_INTERVAL:-5}"
+
+echo "============================================"
+echo "  Staging 健康检查"
+echo "  Host: $STAGING_SSH_HOST:$STAGING_SSH_PORT"
+echo "============================================"
+echo ""
+
+# ---- 准备 SSH key ----
+mkdir -p ~/.ssh
+key_path=""
+if [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
+  key_path="/root/.ssh/xiaoxia_runtime_builder"
+elif [ -f "$HOME/.ssh/xiaoxia_runtime_builder" ]; then
+  key_path="$HOME/.ssh/xiaoxia_runtime_builder"
+elif [ -n "${STAGING_SSH_KEY:-}" ]; then
+  key_path="$HOME/.ssh/staging_deploy_key"
+  printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
+  chmod 600 "$key_path"
+else
+  echo "ERROR: 没有可用的 SSH key"
+  exit 1
+fi
+
+ssh-keyscan -p "$STAGING_SSH_PORT" -H "$STAGING_SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
+
+SSH_CMD="ssh -p $STAGING_SSH_PORT -i $key_path -o StrictHostKeyChecking=no ${STAGING_SSH_USER}@${STAGING_SSH_HOST}"
+
+# ---- 检查函数 ----
+check_api() {
+  $SSH_CMD "curl -sf --max-time 5 http://127.0.0.1:8000/health" 2>/dev/null >/dev/null
+}
+
+check_web() {
+  $SSH_CMD "curl -sf --max-time 5 -o /dev/null -w '%{http_code}' http://127.0.0.1:3001/" 2>/dev/null | grep -q "200"
+}
+
+check_worker() {
+  $SSH_CMD "docker inspect --format='{{.State.Status}}' xiaoxia-worker-staging 2>/dev/null | grep -q running" 2>/dev/null
+}
+
+# ---- 循环等待健康 ----
+echo "等待 Staging 环境健康 (超时: ${HEALTH_TIMEOUT}s)..."
+elapsed=0
+api_ok=0
+web_ok=0
+worker_ok=0
+
+while [ "$elapsed" -lt "$HEALTH_TIMEOUT" ]; do
+  # 检查 API
+  if [ "$api_ok" -eq 0 ] && check_api; then
+    echo "  ✅ API 健康"
+    api_ok=1
+  fi
+
+  # 检查 Web
+  if [ "$web_ok" -eq 0 ] && check_web; then
+    echo "  ✅ Web 健康"
+    web_ok=1
+  fi
+
+  # 检查 Worker
+  if [ "$worker_ok" -eq 0 ] && check_worker; then
+    echo "  ✅ Worker 运行中"
+    worker_ok=1
+  fi
+
+  # 全部通过
+  if [ "$api_ok" -eq 1 ] && [ "$web_ok" -eq 1 ] && [ "$worker_ok" -eq 1 ]; then
+    echo ""
+    echo "============================================"
+    echo "  ✅ 全部健康检查通过"
+    echo "============================================"
+    exit 0
+  fi
+
+  sleep "$HEALTH_INTERVAL"
+  elapsed=$((elapsed + HEALTH_INTERVAL))
+  echo "  等待中... (${elapsed}s/${HEALTH_TIMEOUT}s)"
+done
+
+echo ""
+echo "============================================"
+echo "  ❌ 健康检查超时"
+echo "============================================"
+echo ""
+echo "未通过的检查项:"
+[ "$api_ok" -eq 0 ] && echo "  - API (http://127.0.0.1:8000/health)"
+[ "$web_ok" -eq 0 ] && echo "  - Web (http://127.0.0.1:3001/)"
+[ "$worker_ok" -eq 0 ] && echo "  - Worker 容器"
+
+echo ""
+echo "=== API 最近日志 ==="
+$SSH_CMD "docker logs --tail 30 xiaoxia-api-staging" 2>/dev/null || echo "无法获取日志"
+
+exit 1