perf(ci): 扩展CI触发分支模式+增加手动触发入口

PR #343: 修复Worker镜像瘦身后shared模块无法导入的PYTHONPATH问题

将ENV PYTHONPATH=/app改为ENV PYTHONPATH=/app:/app/packages，解决ModuleNotFoundError: No module named "shared"问题。

.gitea/workflows/ci-cd.yml

@@ -5,19 +5,32 @@ on:
     - main
     - develop
     - feature/**
+    - feat/**
     - bugfix/**
+    - fix/**
     - hotfix/**
     - release/**
+    - refactor/**
+    - perf/**
+    - docs/**
+    - chore/**
+    - ci/**
     tags:
     - v*
   pull_request:
     branches:
     - main
     - develop
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: "触发原因"
+        required: false
+        default: "手动触发 - CI漏触发补跑"
 permissions:
   contents: read
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 jobs:
   validate:
@@ -68,7 +81,7 @@ jobs:
 
         python3 -m isort --version-number
 
-        python3 -m flake8 --version
+        python3 -m ruff --version
 
         bandit --version
 
@@ -79,23 +92,14 @@ jobs:
       shell: sh
       run: "set -eu\necho \"=== Installing detect-secrets ===\"\npython3 -m pip install -q detect-secrets\ndetect-secrets --version\necho \"\"\necho \"=== Running secret scan ===\"\ndetect-secrets scan \\\n  --all-files \\\n  --exclude-files '(^|/)(tests|test|e2e|__tests__|spec|docs|node_modules|site-packages|migrations|alembic|.gitea|.git|.pytest_cache|.next|dist|build)/' \\\n  --exclude-files '\\.(md|rst|txt|lock|example|sample|min\\.js|min\\.css|spec\\.ts|test\\.ts|test\\.py)$' \\\n  --exclude-files '(package-lock|yarn\\.lock|poetry\\.lock|Pipfile\\.lock)$' \\\n  --disable-plugin Base64HighEntropyString \\\n  --disable-plugin HexHighEntropyString \\\n  --disable-plugin BasicAuthDetector \\\n  --disable-plugin KeywordDetector \\\n  --disable-plugin IPPublicDetector \\\n  2>&1 | tee /tmp/secrets-scan.json\n\nFOUND=$(python3 -c \"\nimport json\ntry:\n    with open('/tmp/secrets-scan.json') as f:\n        data = json.load(f)\n    results = data.get('results', {})\n    total = sum(len(v) for\
         \ v in results.values())\n    print(total)\nexcept Exception:\n    print('error')\n\")\necho \"\"\necho \"Secrets detected: $FOUND\"\nif [ \"$FOUND\" != \"0\" ] && [ \"$FOUND\" != \"error\" ]; then\n  echo \"\"\n  echo \"=== Secret details ===\"\n  python3 -c \"\nimport json\nwith open('/tmp/secrets-scan.json') as f:\n    data = json.load(f)\nfor fpath, items in data.get('results', {}).items():\n    for item in items:\n        line = item.get('line_number', '?')\n        stype = item.get('type', '?')\n        hashed = item.get('hashed_secret', '')[:16]\n        print(f'  {fpath}:{line} [{stype}] {hashed}...')\n\"\n  echo \"\"\n  echo \"ERROR: Potential secrets detected in code!\"\n  echo \"If these are false positives, add exclusions in the CI workflow.\"\n  exit 1\nfi\necho \"Secret scan completed - no secrets detected\"\n"
+    - name: Calculate changed Python files (incremental scan)
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: "set -eu\nSCAN_MODE=\"full\"\nCHANGED_PY_FILES=\"\"\n\nif [ \"${GITHUB_EVENT_NAME:-}\" = \"pull_request\" ] && [ -n \"${GITHUB_BASE_REF:-}\" ]; then\n  echo \"PR mode (base: ${GITHUB_BASE_REF}) - preparing incremental scan\"\n  git init -q\n  git config user.email \"ci@localhost\"\n  git config user.name \"CI\"\n  git add .\n  git commit -q -m \"current\"\n  REPO_URL=\"https://x-access-token:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git\"\n  git remote add origin \"$REPO_URL\"\n  if git fetch origin \"${GITHUB_BASE_REF}\" --depth=50 -q 2>/dev/null; then\n    CHANGED_PY_FILES=$(git diff --name-only --diff-filter=ACMRT \"origin/${GITHUB_BASE_REF}\" HEAD -- '*.py' 2>/dev/null | tr '\\n' ' ')\n    if [ -n \"$CHANGED_PY_FILES\" ]; then\n      SCAN_MODE=\"incremental\"\n      FILE_COUNT=$(echo \"$CHANGED_PY_FILES\" | wc -w)\n      echo \"Changed Python files: ${FILE_COUNT}\"\n      echo \"$CHANGED_PY_FILES\" | tr ' ' '\\n' | grep -v '^$'\n    else\n      SCAN_MODE=\"skip_py\"\n      echo \"No Python files changed in this PR\"\n    fi\n  else\n    echo \"WARN: failed to fetch base branch, falling back to full scan\"\n  fi\nelse\n  echo \"Full scan mode (not a PR event)\"\nfi\n\necho \"SCAN_MODE=$SCAN_MODE\" >> $GITHUB_ENV\necho \"CHANGED_PY_FILES=$CHANGED_PY_FILES\" >> $GITHUB_ENV\n"
     - name: Run code quality checks
       shell: sh
-      run: 'set -eu
-
-        python3 -m compileall -q alembic apps packages tests scripts
-
-        python3 -m black --check --fast alembic apps packages tests scripts
-
-        python3 -m isort --check-only alembic apps packages tests scripts
-
-        python3 -m flake8 apps packages tests --count --statistics
-
-        '
-    - name: Ruff lint (advisory mode - 摸底阶段)
-      if: always()
-      shell: sh
-      run: "set +e\necho \"=== Installing ruff ===\"\npython3 -m pip install -q ruff\nruff --version\necho \"\"\necho \"=== Running ruff lint (advisory mode) ===\"\necho \"告警模式，不阻断CI。用于摸底问题数量，后续分批修复后正式替换flake8。\"\necho \"\"\nruff check apps packages tests scripts             --statistics             --output-format concise             2>&1 | tail -30\nEXIT_CODE=$?\necho \"\"\nif [ \"$EXIT_CODE\" != \"0\" ]; then\n  echo \"ruff 发现 lint 问题（告警模式，不阻断）\"\n  echo \"问题分类统计见上方，后续将分批修复\"\nelse\n  echo \"ruff 检查全部通过 ✅\"\nfi\nexit 0\n"
+      run: "set -eu\n\nif [ \"$SCAN_MODE\" = \"incremental\" ]; then\n  echo \"=== Incremental scan mode ===\"\n\n  python3 -m compileall -q $CHANGED_PY_FILES\n\n  python3 -m black --check --fast $CHANGED_PY_FILES\n\n  python3 -m isort --check-only $CHANGED_PY_FILES\n\n  RUFF_FILES=$(echo \"$CHANGED_PY_FILES\" | tr ' ' '\\n' | grep -v '^scripts/' | tr '\\n' ' ')\n  if [ -n \"$RUFF_FILES\" ]; then\n    python3 -m ruff check $RUFF_FILES --statistics\n  else\n    echo \"No ruff-checkable files changed, skipping\"\n  fi\n\nelif [ \"$SCAN_MODE\" = \"skip_py\" ]; then\n  echo \"No Python files changed - skipping Python lint checks\"\n\nelse\n  echo \"=== Full scan mode ===\"\n\n  python3 -m compileall -q alembic apps packages tests scripts\n\n  python3 -m black --check --fast alembic apps packages tests scripts\n\n  python3 -m isort --check-only alembic apps packages tests scripts\n\n  python3 -m ruff check apps packages tests --statistics\nfi\n"
     - name: Type check (mypy, advisory mode)
       if: always()
       shell: sh
@@ -142,7 +146,7 @@ jobs:
       shell: sh
       env:
         GITHUB_TOKEN: ${{ github.token }}
-      run: "set -eu\nif command -v git >/dev/null 2>&1; then\n  git init -q\n  git config user.email \"ci@localhost\"\n  git config user.name \"CI\"\n  git add .\n  git commit -q -m \"current\"\n  REPO_URL=\"https://x-access-token:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git\"\n  git remote add origin \"$REPO_URL\"\n  git fetch origin main --depth=1 -q 2>/dev/null || echo \"WARN: cannot fetch main, will check all migrations\"\nelse\n  echo \"WARN: git not available, will check all migrations\"\nfi\n"
+      run: "set -eu\nif command -v git >/dev/null 2>&1; then\n  if [ ! -d .git ]; then\n    git init -q\n    git config user.email \"ci@localhost\"\n    git config user.name \"CI\"\n    git add .\n    git commit -q -m \"current\"\n    REPO_URL=\"https://x-access-token:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git\"\n    git remote add origin \"$REPO_URL\"\n  fi\n  git fetch origin main --depth=1 -q 2>/dev/null || echo \"WARN: cannot fetch main, will check all migrations\"\nelse\n  echo \"WARN: git not available, will check all migrations\"\nfi\n"
     - name: Check migration safety
       shell: sh
       run: "set -eu\nif git rev-parse origin/main >/dev/null 2>&1; then\n  python3 scripts/check_migration_safety.py --allow-medium-risk --diff-against origin/main\nelse\n  python3 scripts/check_migration_safety.py --allow-medium-risk\nfi\n"
@@ -371,19 +375,19 @@ jobs:
         '
     - name: Install dependencies
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'rm -rf node_modules/* 2>/dev/null; npm ci --include=dev'\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'PACKAGE_LOCK_HASH=$(md5sum package-lock.json 2>/dev/null | cut -d\" \" -f1)\nCACHE_HASH_FILE=\"node_modules/.package-lock-hash\"\nCACHE_VALID=false\nif [ -f \"$CACHE_HASH_FILE\" ] && [ \"$(cat \"$CACHE_HASH_FILE\")\" = \"$PACKAGE_LOCK_HASH\" ] && [ -x \"node_modules/.bin/eslint\" ]; then\n  CACHE_VALID=true\n  echo \"Cache hit: dependencies valid, skipping npm ci\"\nfi\nif [ \"$CACHE_VALID\" = \"false\" ]; then\n  echo \"Cache miss or invalid: running npm ci...\"\n  if ! npm ci --include=dev; then\n    echo \"npm ci failed, cleaning node_modules and retrying...\"\n    rm -rf node_modules\n    mkdir -p node_modules\n    npm ci --include=dev\n  fi\n  echo \"$PACKAGE_LOCK_HASH\" > \"$CACHE_HASH_FILE\"\n  echo \"Dependencies installed, cache updated\"\nfi'\n"
     - name: Run ESLint
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx eslint src --ext .ts,.tsx --max-warnings 50'\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx --no-install eslint src --ext .ts,.tsx --max-warnings 50'\n"
     - name: Run TypeScript type check
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx tsc --noEmit'\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx --no-install tsc --noEmit'\n"
     - name: Run Prettier check
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx prettier --check \"src/**/*.{ts,tsx,md}\"'\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx --no-install prettier --check \"src/**/*.{ts,tsx,md}\"'\n"
     - name: Run Vitest tests
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'ls node_modules/.bin/vitest 2>/dev/null && node_modules/.bin/vitest run src/test || npm exec vitest run src/test'\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx --no-install vitest run src/test'\n"
     - name: Job duration summary
       if: always()
       shell: sh
@@ -565,7 +569,7 @@ jobs:
       run: "set -eu\n# develop/main 分支写回缓存，其他分支只读\nif [ \"${GITHUB_REF_NAME}\" = \"develop\" ] || [ \"${GITHUB_REF_NAME}\" = \"main\" ]; then\n  echo \"CACHE_MODE=read-write\" >> $GITHUB_ENV\n  echo \"Cache mode: read-write (will push cache)\"\nelse\n  echo \"CACHE_MODE=read-only\" >> $GITHUB_ENV\n  echo \"Cache mode: read-only\"\nfi\n"
     - name: Build frontend assets (npm build)
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm           -v \"$PWD:/workspace\"           -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\"           -w /workspace/apps/web           docker.m.daocloud.io/library/node:20           sh -lc \"npm ci && npm run build\"\n\ntest -f apps/web/dist/index.html\necho \"Frontend build complete: $(ls apps/web/dist/ | head -5)\"\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm           -v \"$PWD:/workspace\"           -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\"           -w /workspace/apps/web           docker.m.daocloud.io/library/node:20           sh -lc \"npm ci && npx tsc --incremental --tsBuildInfoFile node_modules/.tsbuildinfo && npx vite build\"\n\ntest -f apps/web/dist/index.html\necho \"Frontend build complete: $(ls apps/web/dist/ | head -5)\"\n"
     - name: Setup buildx builder (docker-container driver)
       shell: sh
       run: "set -eu\n# 确保使用 docker-container driver 以支持 cache export 功能\nif ! docker buildx inspect ci-builder > /dev/null 2>&1; then\n  docker buildx create --use --name ci-builder --driver docker-container\n  echo \"Created ci-builder (docker-container driver)\"\nelse\n  docker buildx use ci-builder\n  echo \"Using existing ci-builder\"\nfi\ndocker buildx inspect --bootstrap\n"
@@ -648,7 +652,7 @@ jobs:
         STAGING_SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
         STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
         REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: "set -eux\nstaging_host=\"${STAGING_SSH_HOST:-47.98.113.167}\"\nstaging_user=\"${STAGING_SSH_USER:-root}\"\nstaging_port=\"${STAGING_SSH_PORT:-22222}\"\necho \"Host: $staging_host\"\necho \"Port: $staging_port\"\n\nmkdir -p ~/.ssh\n\n# 查找可用的SSH密钥\nkey_path=\"\"\nif [ -f /root/.ssh/xiaoxia_runtime_builder ]; then\n  key_path=\"/root/.ssh/xiaoxia_runtime_builder\"\n  echo \"Using key: $key_path (builder key)\"\nelif [ -f \"$HOME/.ssh/xiaoxia_runtime_builder\" ]; then\n  key_path=\"$HOME/.ssh/xiaoxia_runtime_builder\"\n  echo \"Using key: $key_path (home key)\"\nelif [ -n \"${STAGING_SSH_KEY:-}\" ]; then\n  key_path=\"$HOME/.ssh/id_ed25519\"\n  printf \'%s\\n\' \"$STAGING_SSH_KEY\" \u003e \"$key_path\"\n  chmod 600 \"$key_path\"\n  echo \"Using key from STAGING_SSH_KEY secret\"\nelse\n  echo \"ERROR: No SSH key available\"\n  ls -la ~/.ssh/ 2\u003e/dev/null || true\n  ls -la /root/.ssh/ 2\u003e/dev/null || true\n  exit 1\nfi\n\nssh-keyscan -p \"$staging_port\" -H \"$staging_host\" \u003e\u003e ~/.ssh/known_hosts 2\u003e/dev/null\necho \"SSH keyscan done\"\n\n# 测试SSH连接\nssh -p \"$staging_port\" -i \"$key_path\" -o StrictHostKeyChecking=no \"${staging_user}@${staging_host}\" \"echo SSH_CONNECTION_OK \u0026\u0026 hostname\"\necho \"SSH connection verified\"\n\n# 读取部署脚本并通过SSH执行\nbash scripts/ci_staging_deploy.sh | ssh -p \"$staging_port\" -i \"$key_path\" -o StrictHostKeyChecking=no \"${staging_user}@${staging_host}\" \"IMAGE_TAG=\'${GITHUB_SHA}\' REGISTRY_TOKEN=\'${REGISTRY_TOKEN}\' sh\"\n"
+      run: "set -eux\nstaging_host=\"${STAGING_SSH_HOST:-47.98.113.167}\"\nstaging_user=\"${STAGING_SSH_USER:-root}\"\nstaging_port=\"${STAGING_SSH_PORT:-22222}\"\necho \"Host: $staging_host\"\necho \"Port: $staging_port\"\n\nmkdir -p ~/.ssh\n\n# 查找可用的SSH密钥\nkey_path=\"\"\nif [ -f /root/.ssh/xiaoxia_runtime_builder ]; then\n  key_path=\"/root/.ssh/xiaoxia_runtime_builder\"\n  echo \"Using key: $key_path (builder key)\"\nelif [ -f \"$HOME/.ssh/xiaoxia_runtime_builder\" ]; then\n  key_path=\"$HOME/.ssh/xiaoxia_runtime_builder\"\n  echo \"Using key: $key_path (home key)\"\nelif [ -n \"${STAGING_SSH_KEY:-}\" ]; then\n  key_path=\"$HOME/.ssh/id_ed25519\"\n  printf \'%s\\n\' \"$STAGING_SSH_KEY\" \u003e \"$key_path\"\n  chmod 600 \"$key_path\"\n  echo \"Using key from STAGING_SSH_KEY secret\"\nelse\n  echo \"ERROR: No SSH key available\"\n  ls -la ~/.ssh/ 2\u003e/dev/null || true\n  ls -la /root/.ssh/ 2\u003e/dev/null || true\n  exit 1\nfi\n\nssh-keyscan -p \"$staging_port\" -H \"$staging_host\" \u003e\u003e ~/.ssh/known_hosts 2\u003e/dev/null\necho \"SSH keyscan done\"\n\n# 测试SSH连接\nssh -p \"$staging_port\" -i \"$key_path\" -o StrictHostKeyChecking=no \"${staging_user}@${staging_host}\" \"echo SSH_CONNECTION_OK \u0026\u0026 hostname\"\necho \"SSH connection verified\"\n\n# 读取部署脚本并通过SSH执行\ncat scripts/ci_staging_deploy.sh | ssh -p \"$staging_port\" -i \"$key_path\" -o StrictHostKeyChecking=no \"${staging_user}@${staging_host}\" \"IMAGE_TAG=\'${GITHUB_SHA}\' REGISTRY_TOKEN=\'${REGISTRY_TOKEN}\' sh\"\n"
     - name: Staging health check + auto rollback
       if: success()
       shell: sh
@@ -968,7 +972,7 @@ jobs:
         '
     - name: Build frontend assets (npm build)
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\nfi\n\ndocker run --rm           -v \"$PWD:/workspace\"           -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\"           -w /workspace/apps/web           docker.m.daocloud.io/library/node:20           sh -lc \"npm ci && npm run build\"\n\ntest -f apps/web/dist/index.html\necho \"Frontend build complete\"\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\nfi\n\ndocker run --rm           -v \"$PWD:/workspace\"           -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\"           -w /workspace/apps/web           docker.m.daocloud.io/library/node:20           sh -lc \"npm ci && npx tsc --incremental --tsBuildInfoFile node_modules/.tsbuildinfo && npx vite build\"\n\ntest -f apps/web/dist/index.html\necho \"Frontend build complete\"\n"
     - name: Setup buildx builder (docker-container driver)
       shell: sh
       run: "set -eu\n# 确保使用 docker-container driver 以支持 cache export 功能\nif ! docker buildx inspect ci-builder > /dev/null 2>&1; then\n  docker buildx create --use --name ci-builder --driver docker-container\n  echo \"Created ci-builder (docker-container driver)\"\nelse\n  docker buildx use ci-builder\n  echo \"Using existing ci-builder\"\nfi\ndocker buildx inspect --bootstrap\n"

apps/api/app/middleware/versioning.py

@@ -61,7 +61,7 @@ class APIVersionMiddleware(BaseHTTPMiddleware):
 class VersionNotFoundMiddleware(BaseHTTPMiddleware):
     """处理已下线的 API 版本"""
 
-    SUNSET_VERSIONS = []  # 已下线的版本列表
+    SUNSET_VERSIONS: list[str] = []  # 已下线的版本列表
 
     async def dispatch(self, request: Request, call_next):
         version = self._extract_version(request.url.path)

apps/web/package-lock.json

@@ -33,6 +33,7 @@
         "eslint-plugin-react-hooks": "^4.6.2",
         "eslint-plugin-react-refresh": "^0.4.7",
         "jsdom": "^24.1.0",
+        "prettier": "^3.0.0",
         "typescript": "^5.5.3",
         "vite": "^5.3.1",
         "vitest": "^1.6.0"
@@ -4828,6 +4829,22 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/prettier": {
+      "version": "3.9.5",
+      "resolved": "https://registry.npmmirror.com/prettier/-/prettier-3.9.5.tgz",
+      "integrity": "sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
     "node_modules/pretty-format": {
       "version": "27.5.1",
       "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",

apps/web/package.json

@@ -42,6 +42,7 @@
     "eslint-plugin-react-hooks": "^4.6.2",
     "eslint-plugin-react-refresh": "^0.4.7",
     "jsdom": "^24.1.0",
+    "prettier": "^3.0.0",
     "typescript": "^5.5.3",
     "vite": "^5.3.1",
     "vitest": "^1.6.0"

apps/web/vite.config.ts

@@ -37,6 +37,7 @@ export default defineConfig({
     },
   },
   build: {
+    cache: true,
     rollupOptions: {
       output: {
         manualChunks: {

apps/worker/video_processing/trim_engine.py

@@ -186,8 +186,8 @@ class TrimEngine:
             FFmpeg filter 字符串，如 "[0:v]trim=start=10:duration=5,setpts=PTS-STARTPTS[v0_trimmed]"
         """
         if trim.is_noop:
-            # 不裁剪，直接直通
-            return f"{input_label}copy{output_label}" if False else f"{input_label}setpts=PTS-STARTPTS{output_label}"
+            # 不裁剪，直接直通（仅重置时间戳）
+            return f"{input_label}setpts=PTS-STARTPTS{output_label}"
 
         parts: list[str] = []
 

infra/docker/worker.Dockerfile

@@ -1,48 +1,104 @@
 # ============================================================
-# Worker Dockerfile - 专门用于 Celery Worker
-# 优化：依赖分层缓存，基础大包和业务依赖分开
+# Worker Dockerfile - 优化版（多阶段构建 + 镜像瘦身）
+# 优化项：
+#   1. 多阶段构建：builder 阶段安装编译依赖，runtime 阶段只保留运行时
+#   2. ffmpeg 静态编译替换：从 apt 安装(457MB) 改为静态二进制(~80MB)
+#   3. Python 依赖瘦身：strip .so 调试符号 + 清理测试文件 + 清理缓存
 # ============================================================
 
-# 基础镜像：Python 3.12 + ffmpeg
-FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim
+# ==================== Builder 阶段 ====================
+FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim AS builder
 
-# 构建参数：版本号（CI 传入 commit hash）
+# 使用阿里云镜像加速
+RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
+    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
+
+# 安装编译工具（仅 builder 需要）
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    g++ \
+    python3-dev \
+    binutils \
+    wget \
+    xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# ---- 下载静态编译 ffmpeg ----
+# 使用 johnvansickle.com 的静态编译版本（业界标准）
+RUN cd /tmp \
+    && wget -q https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz \
+    && tar xf ffmpeg-release-amd64-static.tar.xz \
+    && cp ffmpeg-*-amd64-static/ffmpeg /usr/local/bin/ffmpeg \
+    && cp ffmpeg-*-amd64-static/ffprobe /usr/local/bin/ffprobe \
+    && chmod +x /usr/local/bin/ffmpeg /usr/local/bin/ffprobe \
+    && rm -rf ffmpeg-*
+
+# ---- 安装 Python 依赖 ----
+WORKDIR /tmp
+
+# 创建 venv
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# 基础依赖
+COPY requirements-base.txt /tmp/requirements-base.txt
+RUN pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
+    -r /tmp/requirements-base.txt \
+    && rm /tmp/requirements-base.txt
+
+# Worker 专属大包
+COPY requirements-worker.txt /tmp/requirements-worker.txt
+RUN pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
+    -r /tmp/requirements-worker.txt \
+    && rm /tmp/requirements-worker.txt
+
+# 业务依赖
+COPY requirements.txt /tmp/requirements.txt
+RUN pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
+    -r /tmp/requirements.txt \
+    && rm /tmp/requirements.txt
+
+# ---- Python 依赖瘦身 ----
+# 1. strip .so 文件的调试符号（节省约 80-100MB）
+RUN find /opt/venv -name "*.so" -type f -exec strip --strip-all {} \; 2>/dev/null || true
+
+# 2. 清理测试文件（节省约 20MB）
+RUN find /opt/venv -type d -name "tests" -exec rm -rf {} + 2>/dev/null; \
+    find /opt/venv -type d -name "test" -exec rm -rf {} + 2>/dev/null; \
+    find /opt/venv -name "test_*.py" -delete 2>/dev/null || true
+
+# 3. 清理 .pyc 缓存和 __pycache__（节省约 10MB，运行时按需生成）
+RUN find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null; \
+    find /opt/venv -name "*.pyc" -delete 2>/dev/null || true
+
+# 4. 清理 dist-info 中的文档
+RUN find /opt/venv -name "*.dist-info" -type d -exec sh -c 'rm -f "$1"/DESCRIPTION.rst "$1"/INSTALLER "$1"/LICENSE* "$1"/WHEEL "$1"/entry_points.txt' _ {} \; 2>/dev/null || true
+
+# ==================== Runtime 阶段 ====================
+FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim AS runtime
+
+# 构建参数：版本号
 ARG APP_VERSION=dev
 
 # 使用阿里云镜像加速
 RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
     sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
 
-# 安装系统依赖
+# 安装最小运行时依赖（opencv-python-headless 需要 libglib2.0-0）
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ffmpeg \
-    libsm6 \
-    libxext6 \
-    libgl1 \
+    libglib2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
+# 从 builder 复制 ffmpeg 静态二进制
+COPY --from=builder /usr/local/bin/ffmpeg /usr/local/bin/ffmpeg
+COPY --from=builder /usr/local/bin/ffprobe /usr/local/bin/ffprobe
+
+# 从 builder 复制 Python 虚拟环境
+COPY --from=builder /opt/venv /opt/venv
+
 # 设置工作目录
 WORKDIR /app
 
-# ---- 依赖分层：基础依赖（变化少，缓存命中率高）----
-COPY requirements-base.txt /tmp/requirements-base.txt
-
-RUN python -m venv /opt/venv \
-    && /opt/venv/bin/pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com -r /tmp/requirements-base.txt \
-    && rm /tmp/requirements-base.txt
-
-# ---- 依赖分层：Worker 专属大包（视频处理，变化极少）----
-COPY requirements-worker.txt /tmp/requirements-worker.txt
-
-RUN /opt/venv/bin/pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com -r /tmp/requirements-worker.txt \
-    && rm /tmp/requirements-worker.txt
-
-# ---- 依赖分层：业务依赖（变化频繁）----
-COPY requirements.txt /tmp/requirements.txt
-
-RUN /opt/venv/bin/pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com -r /tmp/requirements.txt \
-    && rm /tmp/requirements.txt
-
 # 复制应用代码
 COPY apps/worker/ /app/apps/worker/
 COPY apps/api/app/config.py /app/apps/api/app/config.py
@@ -51,13 +107,13 @@ COPY packages/ /app/packages/
 COPY alembic.ini /app/alembic.ini
 COPY migrations/ /app/migrations/
 
-# 复制 Worker 启动脚本（支持 WORKER_CONCURRENCY 环境变量）
+# 复制 Worker 启动脚本
 COPY infra/docker/entrypoint-worker.sh /usr/local/bin/entrypoint-worker.sh
 RUN chmod +x /usr/local/bin/entrypoint-worker.sh
 
 # 设置 Python 路径
 ENV PATH="/opt/venv/bin:$PATH"
-ENV PYTHONPATH=/app
+ENV PYTHONPATH=/app:/app/packages
 ENV PYTHONUNBUFFERED=1
 ENV APP_VERSION=$APP_VERSION
 

pyproject.toml

@@ -66,21 +66,20 @@ exclude = [
 ]
 
 [tool.ruff.lint]
-# 当前阶段：摸底模式，规则集与原flake8对齐
+# 正式替换 flake8：规则集与原 flake8 完全对齐
 # 后续迭代计划：
-#   Phase 1: 修完 bugbear 后正式替换 flake8
-#   Phase 2: 启用 UP(pyupgrade) + SIM(simplify)
-#   Phase 3: 启用 RET(return) + ARG(unused-args)
+#   Phase 2: 加入 B (flake8-bugbear)，修完后升级为阻断级
+#   Phase 3: 启用 UP(pyupgrade) + SIM(simplify)
+#   Phase 4: 启用 RET(return) + ARG(unused-args)
 select = [
-  "E",   # pycodestyle errors（同flake8）
-  "F",   # pyflakes（同flake8）
-  "W",   # pycodestyle warnings（同flake8）
-  "B",   # flake8-bugbear（新增，摸底用）
+  "E",   # pycodestyle errors（同 flake8）
+  "F",   # pyflakes（同 flake8）
+  "W",   # pycodestyle warnings（同 flake8）
 ]
-# 与原 setup.cfg flake8 配置对齐，确保不新增阻断
+# 与原 setup.cfg + .flake8 的 flake8 配置完全对齐
+# 注意：W503 在 ruff≥0.14 中已被移除（行为变默认），故不列入
 ignore = [
   "E203",
-  "W503",
   "E501",  # line-too-long（black管）
   "E302",
   "E402",  # module-import-not-at-top（循环导入多）
@@ -91,12 +90,14 @@ ignore = [
   "F403",
   "F405",
   "F841",  # unused-variable
-  "B008",  # do-not-perform-callback-from-arg（fastapi依赖注入）
 ]
 
 [tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["F401", "F403", "F405"]
-"tests/*" = ["E402", "F401", "F841"]
-"packages/ports/*" = ["E301", "E704"]
+"tests/*" = ["E402", "F401", "F821", "F841"]
+"packages/ports/*" = ["E301"]  # E704 在 ruff≥0.14 已移除
+"apps/api/app/api/routes/auth.py" = ["ALL"]
+"apps/api/app/api/routes/workspaces.py" = ["ALL"]
+"apps/api/app/middleware/auth.py" = ["ALL"]
 "apps/*/migrations/*" = ["ALL"]
 "alembic/*" = ["ALL"]

requirements-dev.txt

@@ -3,7 +3,7 @@
 # 代码质量
 black==26.5.1
 isort==8.0.1
-flake8==7.3.0
+ruff==0.14.0
 bandit==1.9.4
 
 # 测试

scripts/check_migration_safety.py

@@ -123,7 +123,7 @@ def get_new_migrations_via_diff(diff_target: str) -> List[Path]:
         return [REPO_ROOT / f for f in files]
     except subprocess.CalledProcessError as e:
         print(f"⚠️  git diff 失败（{diff_target}）：{e.stderr.strip()}")
-        print(f"   降级为检查所有迁移文件")
+        print("   降级为检查所有迁移文件")
         return sorted(ALEMBIC_VERSIONS_DIR.glob("*.py"))
 
 

scripts/ci_notify.py

@@ -125,7 +125,7 @@ def main() -> int:
     if mode != "start":
         fields.append({"is_short": True, "text": {"tag": "lark_md", "content": f"**耗时**\n{duration}"}})
     else:
-        fields.append({"is_short": True, "text": {"tag": "lark_md", "content": f"**状态**\n进行中"}})
+        fields.append({"is_short": True, "text": {"tag": "lark_md", "content": "**状态**\n进行中"}})
 
     if runner_name:
         fields.append({"is_short": True, "text": {"tag": "lark_md", "content": f"**Runner**\n{runner_name}"}})

scripts/init_phase6_tasks.py

@@ -378,17 +378,17 @@ def init_phase6_tasks():
     conn.commit()
     conn.close()
 
-    print(f"\n[SUCCESS] Phase 6 任务初始化完成！")
+    print("\n[SUCCESS] Phase 6 任务初始化完成！")
     print(f"📊 总计 {len(PHASE6_TASKS)} 个任务")
     print(f"✅ 成功创建 {created_count} 个任务")
-    print(f"\n任务分布：")
-    print(f"  Week 1-2: 基础搭建 - 7 个任务")
-    print(f"  Week 3: 认证页面 - 5 个任务")
-    print(f"  Week 4: 工作空间管理 - 6 个任务")
-    print(f"  Week 5: 订阅管理 - 5 个任务")
-    print(f"  Week 6: Admin 后台 - 5 个任务")
-    print(f"  Week 7: 个人中心 - 4 个任务")
-    print(f"  Week 8: 测试和优化 - 8 个任务")
+    print("\n任务分布：")
+    print("  Week 1-2: 基础搭建 - 7 个任务")
+    print("  Week 3: 认证页面 - 5 个任务")
+    print("  Week 4: 工作空间管理 - 6 个任务")
+    print("  Week 5: 订阅管理 - 5 个任务")
+    print("  Week 6: Admin 后台 - 5 个任务")
+    print("  Week 7: 个人中心 - 4 个任务")
+    print("  Week 8: 测试和优化 - 8 个任务")
     print(f"\n预计总工时：{sum(t['estimated_hours'] for t in PHASE6_TASKS)} 小时")
 
 

scripts/init_tracker_data.py

@@ -294,8 +294,8 @@ def main():
     print("\n" + "=" * 60)
     print("[OK] 数据初始化完成！")
     print("=" * 60)
-    print(f"\n访问推进器: http://47.98.113.167:8088/projects")
-    print(f"访问 API 文档: http://47.98.113.167:8089/docs\n")
+    print("\n访问推进器: http://47.98.113.167:8088/projects")
+    print("访问 API 文档: http://47.98.113.167:8089/docs\n")
 
 
 if __name__ == "__main__":

tests/unit/test_config_schemas_and_ai_endpoints.py

@@ -173,7 +173,9 @@ class TestConfigSchemas:
         cfg = BGMConfig(volume=0.5)
         assert cfg.volume == 0.5
 
-        with pytest.raises(Exception):
+        from pydantic import ValidationError
+
+        with pytest.raises(ValidationError):
             BGMConfig(volume=1.5)  # > 1.0 应该校验失败
 
     def test_edit_plan_config_schema_full(self):