fix(ci): 重写PG/Redis Docker启动逻辑，端口映射+容器IP双fallback

- 用docker inspect替代docker port获取映射端口，更可靠
- 端口映射失败自动fallback到容器IP直连
- 每种模式都做TCP连通性验证，确保真的可用
- 失败时输出容器状态和日志便于诊断
- 修复容器IP模式下DATABASE_URL host错误的bug

scripts/ci/run_integration_tests.sh

@@ -22,80 +22,159 @@ bash scripts/ci/step_install_ffmpeg.sh
 # --- 启动 Redis ---
 echo ""
 echo "=== 启动 Redis ==="
-REDIS_CONTAINER="ci-redis-${GITHUB_RUN_ID:-$$}"
-docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
-docker run -d --name "$REDIS_CONTAINER" \
-  -P \
-  --health-cmd "redis-cli ping" \
-  --health-interval 2s \
-  --health-timeout 2s \
-  --health-retries 10 \
-  redis:7-alpine
-REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | cut -d: -f2)
-echo "Redis port: $REDIS_PORT"
-export REDIS_URL="redis://127.0.0.1:$REDIS_PORT/0"
-for i in $(seq 1 15); do
-  if docker inspect --format='{{.State.Health.Status}}' "$REDIS_CONTAINER" 2>/dev/null | grep -q healthy; then
-    echo "Redis is ready on port $REDIS_PORT"
-    break
-  fi
-  echo "Waiting for Redis... ($i/15)"
-  sleep 2
-done
-docker inspect --format='{{.State.Health.Status}}' "$REDIS_CONTAINER" | grep -q healthy
 
-# 额外验证：确保从宿主侧通过映射端口实际能连上 Redis
-for i in $(seq 1 20); do
-  if python3 -c "import socket; s=socket.socket(); s.settimeout(2); s.connect(('127.0.0.1', $REDIS_PORT)); s.close()" 2>/dev/null; then
-    echo "TCP connectivity to Redis confirmed on port $REDIS_PORT"
-    break
+start_redis() {
+  local name="ci-redis-${GITHUB_RUN_ID:-$$}"
+  
+  docker rm -f "$name" 2>/dev/null || true
+  docker run -d --name "$name" \
+    -p 0:6379 \
+    --health-cmd "redis-cli ping" \
+    --health-interval 2s \
+    --health-timeout 2s \
+    --health-retries 15 \
+    redis:7-alpine > /dev/null 2>&1
+  
+  # 等几秒让容器起来
+  sleep 3
+  
+  # 方式1: 端口映射
+  local port=""
+  port=$(docker inspect --format='{{if (index .NetworkSettings.Ports "6379/tcp")}}{{(index (index .NetworkSettings.Ports "6379/tcp") 0).HostPort}}{{end}}' "$name" 2>/dev/null || true)
+  
+  if [ -n "$port" ]; then
+    echo "  端口映射: 127.0.0.1:$port"
+    # 等健康
+    for i in $(seq 1 20); do
+      if docker inspect --format='{{.State.Health.Status}}' "$name" 2>/dev/null | grep -q healthy; then
+        break
+      fi
+      sleep 2
+    done
+    # TCP验证
+    for i in $(seq 1 15); do
+      if (echo > /dev/tcp/127.0.0.1/$port) 2>/dev/null; then
+        echo "✅ Redis端口映射模式可用"
+        export REDIS_URL="redis://127.0.0.1:$port/0"
+        return 0
+      fi
+      sleep 1
+    done
+    echo "  ⚠️  端口映射TCP不通，尝试容器IP"
+  else
+    echo "  ⚠️  无映射端口，尝试容器IP"
   fi
-  echo "Waiting for TCP connectivity to Redis on port $REDIS_PORT... ($i/20)"
-  sleep 2
-done
-python3 -c "import socket; s=socket.socket(); s.settimeout(2); s.connect(('127.0.0.1', $REDIS_PORT)); s.close()"
+  
+  # 方式2: 容器IP
+  local ip=""
+  ip=$(docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name" 2>/dev/null || true)
+  
+  if [ -n "$ip" ] && [ "$ip" != "null" ]; then
+    echo "  容器IP: $ip"
+    for i in $(seq 1 20); do
+      if docker inspect --format='{{.State.Health.Status}}' "$name" 2>/dev/null | grep -q healthy; then
+        break
+      fi
+      sleep 2
+    done
+    for i in $(seq 1 15); do
+      if (echo > /dev/tcp/$ip/6379) 2>/dev/null; then
+        echo "✅ Redis容器IP模式可用"
+        export REDIS_URL="redis://$ip:6379/0"
+        return 0
+      fi
+      sleep 1
+    done
+  fi
+  
+  echo "❌ Redis启动失败"
+  docker ps -a | head -5
+  docker logs --tail=10 "$name" 2>/dev/null || true
+  return 1
+}
+
+start_redis
 
 # --- 启动 PostgreSQL ---
 echo ""
 echo "=== 启动 PostgreSQL ==="
-PG_CONTAINER="ci-pg-${GITHUB_RUN_ID:-$$}"
-docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-docker run -d --name "$PG_CONTAINER" \
-  --shm-size=256m \
-  -e POSTGRES_USER=postgres \
-  -e POSTGRES_PASSWORD=postgres \
-  -e POSTGRES_DB=xiaoxia_saas \
-  -P \
-  --health-cmd "pg_isready -U postgres" \
-  --health-interval 5s \
-  --health-timeout 5s \
-  --health-retries 12 \
-  postgres:16
-PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | cut -d: -f2)
-echo "PostgreSQL port: $PG_PORT"
-export DATABASE_URL="postgresql+psycopg://postgres:postgres@127.0.0.1:$PG_PORT/xiaoxia_saas"
-for i in $(seq 1 30); do
-  if docker inspect --format='{{.State.Health.Status}}' "$PG_CONTAINER" 2>/dev/null | grep -q healthy; then
-    echo "PostgreSQL is ready on port $PG_PORT"
-    break
-  fi
-  echo "Waiting for PostgreSQL... ($i/30)"
-  sleep 2
-done
-docker inspect --format='{{.State.Health.Status}}' "$PG_CONTAINER" | grep -q healthy
 
-# 额外验证：确保从宿主侧通过映射端口实际能连上 PG（端口映射可能有延迟）
-for i in $(seq 1 30); do
-  if python3 -c "import socket; s=socket.socket(); s.settimeout(2); s.connect(('127.0.0.1', $PG_PORT)); s.close()" 2>/dev/null; then
-    echo "TCP connectivity to PostgreSQL confirmed on port $PG_PORT"
-    break
+start_pg() {
+  local name="ci-pg-${GITHUB_RUN_ID:-$$}"
+  
+  docker rm -f "$name" 2>/dev/null || true
+  docker run -d --name "$name" \
+    -p 0:5432 \
+    --shm-size=256m \
+    -e POSTGRES_USER=postgres \
+    -e POSTGRES_PASSWORD=postgres \
+    -e POSTGRES_DB=xiaoxia_saas \
+    --health-cmd "pg_isready -U postgres" \
+    --health-interval 3s \
+    --health-timeout 3s \
+    --health-retries 20 \
+    postgres:16-alpine > /dev/null 2>&1
+  
+  sleep 3
+  
+  # 方式1: 端口映射
+  local port=""
+  port=$(docker inspect --format='{{if (index .NetworkSettings.Ports "5432/tcp")}}{{(index (index .NetworkSettings.Ports "5432/tcp") 0).HostPort}}{{end}}' "$name" 2>/dev/null || true)
+  
+  if [ -n "$port" ]; then
+    echo "  端口映射: 127.0.0.1:$port"
+    # 等健康
+    for i in $(seq 1 30); do
+      if docker inspect --format='{{.State.Health.Status}}' "$name" 2>/dev/null | grep -q healthy; then
+        break
+      fi
+      sleep 2
+    done
+    # TCP验证
+    for i in $(seq 1 20); do
+      if (echo > /dev/tcp/127.0.0.1/$port) 2>/dev/null; then
+        echo "✅ PG端口映射模式可用"
+        export DATABASE_URL="postgresql+psycopg://postgres:postgres@127.0.0.1:$port/xiaoxia_saas"
+        return 0
+      fi
+      sleep 1
+    done
+    echo "  ⚠️  端口映射TCP不通，尝试容器IP"
+  else
+    echo "  ⚠️  无映射端口，尝试容器IP"
   fi
-  echo "Waiting for TCP connectivity to PostgreSQL on port $PG_PORT... ($i/30)"
-  sleep 2
-done
-python3 -c "import socket; s=socket.socket(); s.settimeout(2); s.connect(('127.0.0.1', $PG_PORT)); s.close()"
+  
+  # 方式2: 容器IP
+  local ip=""
+  ip=$(docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name" 2>/dev/null || true)
+  
+  if [ -n "$ip" ] && [ "$ip" != "null" ]; then
+    echo "  容器IP: $ip"
+    for i in $(seq 1 30); do
+      if docker inspect --format='{{.State.Health.Status}}' "$name" 2>/dev/null | grep -q healthy; then
+        break
+      fi
+      sleep 2
+    done
+    for i in $(seq 1 20); do
+      if (echo > /dev/tcp/$ip/5432) 2>/dev/null; then
+        echo "✅ PG容器IP模式可用"
+        export DATABASE_URL="postgresql+psycopg://postgres:postgres@$ip:5432/xiaoxia_saas"
+        return 0
+      fi
+      sleep 1
+    done
+  fi
+  
+  echo "❌ PostgreSQL启动失败"
+  echo "  容器状态:"
+  docker inspect --format='状态:{{.State.Status}} 健康:{{.State.Health.Status}} 退出码:{{.State.ExitCode}}' "$name" 2>/dev/null || true
+  docker logs --tail=20 "$name" 2>/dev/null || true
+  return 1
+}
+
+start_pg
 
-# --- 执行迁移 ---
 echo ""
 echo "=== 执行 Alembic 迁移 ==="
 PYTHONPATH="$PWD/apps/api:$PWD" python3 -m alembic upgrade head
@@ -137,13 +216,6 @@ fi
 rm -f "$PERF_OUTPUT"
 set -e
 
-# --- 清理 ---
-echo ""
-echo "=== 清理容器 ==="
-docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
-echo "✅ 清理完成"
-
 # --- 覆盖率汇总 ---
 echo ""
 echo "=== 覆盖率汇总 ==="

scripts/ci/run_validate.sh

@@ -170,47 +170,138 @@ echo "✅ Release scripts syntax OK"
 
 # --- Alembic 迁移验证 ---
 echo ""
-echo "=== [8/8] Alembic migrations validation (with isolated PG) ==="
-PG_CONTAINER=ci-pg-validate-${GITHUB_RUN_ID:-$$}
-docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-docker run -d --name "$PG_CONTAINER" \
-  --shm-size=256m \
-  -e POSTGRES_USER=postgres \
-  -e POSTGRES_PASSWORD=postgres \
-  -e POSTGRES_DB=xiaoxia_saas \
-  -P \
-  --health-cmd "pg_isready -U postgres" \
-  --health-interval 3s \
-  --health-timeout 3s \
-  --health-retries 20 \
-  postgres:16-alpine
-PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | cut -d: -f2)
-echo "PostgreSQL port: $PG_PORT"
-export DATABASE_URL=postgresql+psycopg://postgres:postgres@127.0.0.1:$PG_PORT/xiaoxia_saas
-for i in $(seq 1 30); do
-  if docker inspect --format='{{.State.Health.Status}}' "$PG_CONTAINER" 2>/dev/null | grep -q healthy; then
-    echo "PostgreSQL is ready on port $PG_PORT"
-    break
-  fi
-  echo "Waiting for PostgreSQL... ($i/30)"
-  sleep 2
-done
-docker inspect --format='{{.State.Health.Status}}' "$PG_CONTAINER" | grep -q healthy
+echo "=== [8/8] Alembic migrations validation ==="
 
-# 额外验证：确保从宿主侧通过映射端口实际能连上（端口映射可能有延迟）
-for i in $(seq 1 30); do
-  if python3 -c "import socket; s=socket.socket(); s.settimeout(2); s.connect(('127.0.0.1', $PG_PORT)); s.close()" 2>/dev/null; then
-    echo "TCP connectivity to PostgreSQL confirmed on port $PG_PORT"
-    break
+install_pg_local() {
+  if command -v pg_isready > /dev/null 2>&1; then
+    return 0
   fi
-  echo "Waiting for TCP connectivity to PostgreSQL on port $PG_PORT... ($i/30)"
-  sleep 2
-done
-python3 -c "import socket; s=socket.socket(); s.settimeout(2); s.connect(('127.0.0.1', $PG_PORT)); s.close()"
+  if command -v apk > /dev/null 2>&1; then
+    apk add --no-cache postgresql postgresql-client > /dev/null 2>&1
+    mkdir -p /var/lib/postgresql/data
+    chown postgres:postgres /var/lib/postgresql/data
+    su - postgres -c "initdb -D /var/lib/postgresql/data" > /dev/null 2>&1
+    su - postgres -c "pg_ctl -D /var/lib/postgresql/data -l /tmp/pg.log start" > /dev/null 2>&1
+    sleep 2
+    su - postgres -c "psql -c "CREATE USER postgres WITH SUPERUSER PASSWORD 'postgres';"" > /dev/null 2>&1
+    su - postgres -c "psql -c "CREATE DATABASE xiaoxia_saas OWNER postgres;"" > /dev/null 2>&1
+  elif command -v apt-get > /dev/null 2>&1; then
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update -qq > /dev/null 2>&1
+    apt-get install -y -qq postgresql postgresql-client > /dev/null 2>&1
+    PG_VERSION=$(pg_lsclusters -h | head -1 | awk '{print $1}')
+    PG_CLUSTER=$(pg_lsclusters -h | head -1 | awk '{print $2}')
+    PG_HBA="/etc/postgresql/$PG_VERSION/$PG_CLUSTER/pg_hba.conf"
+    sed -i "s/local.*all.*all.*peer/local   all             all             trust/" "$PG_HBA" 2>/dev/null || true
+    sed -i "s/host.*all.*all.*127.0.0.1.*scram-sha-256/host    all             all             127.0.0.1/32            trust/" "$PG_HBA" 2>/dev/null || true
+    pg_ctlcluster "$PG_VERSION" "$PG_CLUSTER" start 2>/dev/null || true
+    sleep 2
+    su - postgres -c "psql -c "CREATE USER postgres WITH SUPERUSER PASSWORD 'postgres';"" 2>/dev/null || true
+    su - postgres -c "psql -c "CREATE DATABASE xiaoxia_saas OWNER postgres;"" 2>/dev/null || true
+  else
+    return 1
+  fi
+}
+
+# 优先本地安装，失败则fallback到Docker
+PG_LOCAL_OK=0
+if install_pg_local; then
+  for i in $(seq 1 20); do
+    if pg_isready -U postgres -h 127.0.0.1 -p 5432 2>/dev/null | grep -q "accepting connections"; then
+      echo "PostgreSQL is ready on 127.0.0.1:5432 (local install)"
+      PG_LOCAL_OK=1
+      break
+    fi
+    sleep 2
+  done
+fi
+
+if [ "$PG_LOCAL_OK" != "1" ]; then
+  echo "Local PG not available, falling back to Docker..."
+  PG_CONTAINER="ci-pg-validate-${GITHUB_RUN_ID:-$$}"
+  
+  docker rm -f "$PG_CONTAINER" 2>/dev/null || true
+  docker run -d --name "$PG_CONTAINER" \
+    -p 0:5432 \
+    --shm-size=256m \
+    -e POSTGRES_USER=postgres \
+    -e POSTGRES_PASSWORD=postgres \
+    -e POSTGRES_DB=xiaoxia_saas \
+    --health-cmd "pg_isready -U postgres" \
+    --health-interval 3s \
+    --health-timeout 3s \
+    --health-retries 20 \
+    postgres:16-alpine > /dev/null 2>&1
+  
+  sleep 3
+  
+  # 方式1: 端口映射
+  PG_PORT=$(docker inspect --format='{{if (index .NetworkSettings.Ports "5432/tcp")}}{{(index (index .NetworkSettings.Ports "5432/tcp") 0).HostPort}}{{end}}' "$PG_CONTAINER" 2>/dev/null || true)
+  
+  PG_HOST="127.0.0.1"
+  PG_OK=0
+  if [ -n "$PG_PORT" ]; then
+    echo "  PG端口映射: 127.0.0.1:$PG_PORT"
+    for i in $(seq 1 30); do
+      if docker inspect --format='{{.State.Health.Status}}' "$PG_CONTAINER" 2>/dev/null | grep -q healthy; then
+        break
+      fi
+      sleep 2
+    done
+    for i in $(seq 1 20); do
+      if (echo > /dev/tcp/127.0.0.1/$PG_PORT) 2>/dev/null; then
+        echo "✅ PG端口映射模式可用"
+        PG_OK=1
+        break
+      fi
+      sleep 1
+    done
+    if [ "$PG_OK" != "1" ]; then
+      echo "  ⚠️  端口映射TCP不通，尝试容器IP"
+    fi
+  else
+    echo "  ⚠️  无映射端口，尝试容器IP"
+  fi
+  
+  # 方式2: 容器IP直连
+  if [ "$PG_OK" != "1" ]; then
+    PG_IP=$(docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG_CONTAINER" 2>/dev/null || true)
+    if [ -n "$PG_IP" ] && [ "$PG_IP" != "null" ]; then
+      echo "  PG容器IP: $PG_IP"
+      for i in $(seq 1 30); do
+        if docker inspect --format='{{.State.Health.Status}}' "$PG_CONTAINER" 2>/dev/null | grep -q healthy; then
+          break
+        fi
+        sleep 2
+      done
+      for i in $(seq 1 20); do
+        if (echo > /dev/tcp/$PG_IP/5432) 2>/dev/null; then
+          echo "✅ PG容器IP模式可用"
+          PG_HOST="$PG_IP"
+          PG_PORT=5432
+          PG_OK=1
+          break
+        fi
+        sleep 1
+      done
+    fi
+  fi
+  
+  if [ "$PG_OK" != "1" ]; then
+    echo "❌ PG启动失败，打印诊断信息:"
+    docker inspect --format='状态:{{.State.Status}} 健康:{{.State.Health.Status}} 退出码:{{.State.ExitCode}}' "$PG_CONTAINER" 2>/dev/null || true
+    docker logs --tail=20 "$PG_CONTAINER" 2>/dev/null || true
+    exit 1
+  fi
+  
+  echo "PostgreSQL (Docker) ready on $PG_HOST:$PG_PORT"
+  export DATABASE_URL="postgresql+psycopg://postgres:postgres@$PG_HOST:$PG_PORT/xiaoxia_saas"
+else
+  export DATABASE_URL="postgresql+psycopg://postgres:postgres@127.0.0.1:5432/xiaoxia_saas"
+fi
 
 PYTHONPATH="$PWD/apps/api:$PWD" python3 -m alembic upgrade head
 echo "✅ Alembic migrations applied successfully"
-docker rm -f "$PG_CONTAINER" 2>/dev/null || true
 
 echo ""
 echo "=== CI Validate: 所有检查通过 ✅ ==="