fix(ci): staging deploy SSH host to internal IP for Docker runner (#1891)

Co-authored-by: xiaoxia <dev@xiaoxiajianji.com>
Co-committed-by: xiaoxia <dev@xiaoxiajianji.com>

.gitea/workflows/ci-pipeline.yml

@@ -1022,12 +1022,22 @@ jobs:
         BRANCH_TAG="${IMAGE_FULL}:${GITHUB_REF_NAME}"
         CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:${GITHUB_REF_NAME}"
 
+        # develop 分支额外推送 :dev tag（Watchtower 监听的滚动更新 tag）
+        if [ "${GITHUB_REF_NAME}" = "develop" ]; then
+          DEV_TAG="${IMAGE_FULL}:dev"
+          EXTRA_TAGS="$BRANCH_TAG $DEV_TAG"
+          PUSHED_TAGS_SUMMARY="${BRANCH_TAG} + ${DEV_TAG}"
+        else
+          EXTRA_TAGS="$BRANCH_TAG"
+          PUSHED_TAGS_SUMMARY="${BRANCH_TAG}"
+        fi
+
         EXTRA_BUILD_ARGS="APP_VERSION=\"${GITHUB_SHA}\""
 
         NO_CACHE_FLAG=""
         for i in 1 2 3; do
           echo "=== Docker build 尝试 $i/3 (${{ matrix.service_display }}) ==="
-          if EXTRA_TAGS="$BRANCH_TAG" bash scripts/ci/docker_build_push.sh $NO_CACHE_FLAG ${{ matrix.dockerfile }} "${IMAGE_TAG}" "${CACHE_REF}" $EXTRA_BUILD_ARGS; then
+          if EXTRA_TAGS="$EXTRA_TAGS" bash scripts/ci/docker_build_push.sh $NO_CACHE_FLAG ${{ matrix.dockerfile }} "${IMAGE_TAG}" "${CACHE_REF}" $EXTRA_BUILD_ARGS; then
             echo "✅ Docker build 成功"
             break
           fi
@@ -1040,7 +1050,7 @@ jobs:
           fi
         done
 
-        echo "${{ matrix.service_display }} image pushed: ${IMAGE_TAG} (+ ${BRANCH_TAG})"
+        echo "${{ matrix.service_display }} image pushed: ${IMAGE_TAG} (+ ${PUSHED_TAGS_SUMMARY})"
 
     - name: Job duration summary
       if: always()
@@ -1244,9 +1254,11 @@ jobs:
         ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
       run: |
         set -eux
-        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
+        # CI runner (act_runner) 部署在 116 staging 本机（116.62.226.203 公网 22 未开放），
+        # 默认走 127.0.0.1:22 本机 SSH，避免跨机网络依赖；可通过 secrets 覆盖。
+        staging_host="${STAGING_SSH_HOST:-127.0.0.1}"
         staging_user="${STAGING_SSH_USER:-root}"
-        staging_port="${STAGING_SSH_PORT:-22222}"
+        staging_port="${STAGING_SSH_PORT:-22}"
         echo "Host: $staging_host"
         echo "Port: $staging_port"
 
@@ -1470,7 +1482,6 @@ jobs:
       - validate-security
       - validate-python
       - unit-tests
-      - frontend-lint
       - frontend-unit-test
     if: github.event_name == 'push' && github.ref_name == 'main' && !failure() && !cancelled()
     strategy:
@@ -2124,3 +2135,4 @@ jobs:
           START_TIME=""
           [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
           curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+# CI retry trigger

EMPTY_COMMIT.txt

@@ -0,0 +1 @@
+retrigger3

README.md

@@ -263,3 +263,4 @@ pytest --cov=packages --cov-report=html
 ---
 
 **License**: MIT
+<!-- CI trigger: 1788229339 -->

scripts/build_release_images.sh

@@ -36,14 +36,20 @@ CACHE_TAG_PRIMARY="${CACHE_TAG:-develop}"
 API_IMAGE="xiaoxia-saas-api:$VERSION"
 WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
 WEB_IMAGE="xiaoxia-saas-web:$VERSION"
-API_LATEST="xiaoxia-saas-api:dev"
-WORKER_LATEST="xiaoxia-saas-worker:dev"
+API_DEV="xiaoxia-saas-api:dev"
+WORKER_DEV="xiaoxia-saas-worker:dev"
+WEB_DEV="xiaoxia-saas-web:dev"
 
-# Registry 上的完整镜像名
+# Registry 上的完整镜像名（SHA/版本 tag）
 REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:$VERSION"
 REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:$VERSION"
 REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:$VERSION"
 
+# Registry 上的 dev floating tag（仅 staging/develop 构建时推送，供 Watchtower 监听自动更新）
+REGISTRY_API_DEV="${REGISTRY}/xiaoxia-saas-api:dev"
+REGISTRY_WORKER_DEV="${REGISTRY}/xiaoxia-saas-worker:dev"
+REGISTRY_WEB_DEV="${REGISTRY}/xiaoxia-saas-web:dev"
+
 USE_CACHE=0
 USE_PUSH=0
 CACHE_WRITE=0
@@ -56,23 +62,34 @@ if docker buildx version >/dev/null 2>&1; then
   docker buildx use default 2>/dev/null || true
 fi
 
+# ---- 是否需要推送 dev tag ----
+# staging 构建 或 develop 分支构建时才推送 :dev tag，供 Watchtower 自动更新；
+# production / release tag 构建不推送 dev tag，避免污染生产 tag 指向。
+PUSH_DEV_TAG=0
+BRANCH_NAME="${GITHUB_REF_NAME:-${CI_COMMIT_BRANCH:-unknown}}"
+if [ "$BUILD_ENV" = "staging" ] || [ "$BRANCH_NAME" = "develop" ]; then
+  PUSH_DEV_TAG=1
+  echo "Dev tag push: ENABLED (BUILD_ENV=$BUILD_ENV, BRANCH=$BRANCH_NAME) — Watchtower will pick up new :dev"
+else
+  echo "Dev tag push: disabled (BUILD_ENV=$BUILD_ENV, BRANCH=$BRANCH_NAME)"
+fi
+
 # ---- 缓存读写策略（按分支隔离）----
 # 默认只读不写，防止 feature 分支污染主缓存
 # 只有 develop/main 分支才写回缓存
-BRANCH_NAME="${GITHUB_REF_NAME:-${CI_COMMIT_BRANCH:-unknown}}"
 # 清理本地旧镜像
-docker rmi -f "$API_IMAGE" "$API_LATEST" 2>/dev/null || true
+docker rmi -f "$API_IMAGE" "$API_DEV" 2>/dev/null || true
 
 if [ "$USE_CACHE" -eq 1 ]; then
   docker buildx build \
     --build-arg APP_VERSION="$VERSION" \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
     -f infra/docker/api.Dockerfile \
-    -t "$API_IMAGE" -t "$API_LATEST" \
+    -t "$API_IMAGE" -t "$API_DEV" \
     --load \
     .
 else
-  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_LATEST" .
+  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_DEV" .
 fi
 
 build_with_cache() {
@@ -122,22 +139,22 @@ build_with_cache() {
 echo "=== Building API image ==="
 build_with_cache "api" "infra/docker/api.Dockerfile" \
   "--build-arg APP_VERSION=$VERSION"
-docker tag "$API_IMAGE" "$API_LATEST"
+docker tag "$API_IMAGE" "$API_DEV"
 
 echo "=== Building Worker image ==="
 # 清理本地旧镜像
-docker rmi -f "$WORKER_IMAGE" "$WORKER_LATEST" 2>/dev/null || true
+docker rmi -f "$WORKER_IMAGE" "$WORKER_DEV" 2>/dev/null || true
 
 if [ "$USE_CACHE" -eq 1 ]; then
   docker buildx build \
     --build-arg APP_VERSION="$VERSION" \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
     -f infra/docker/worker.Dockerfile \
-    -t "$WORKER_IMAGE" -t "$WORKER_LATEST" \
+    -t "$WORKER_IMAGE" -t "$WORKER_DEV" \
     --load \
     .
 else
-  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_LATEST" .
+  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_DEV" .
 fi
 
 echo "=== Building Web image (with buildx cache) ==="
@@ -158,37 +175,52 @@ docker run --rm \
 test -f apps/web/dist/index.html
 
 # 清理本地旧镜像
-docker rmi -f "$WEB_IMAGE" 2>/dev/null || true
+docker rmi -f "$WEB_IMAGE" "$WEB_DEV" 2>/dev/null || true
 
 if [ "$USE_CACHE" -eq 1 ]; then
   docker buildx build \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/web-cache:${CACHE_TAG_PRIMARY},ignore-error=true" \
     -f infra/docker/web-artifact.Dockerfile \
     --build-arg "NGINX_CONF=$NGINX_CONF_FILE" \
-    -t "$WEB_IMAGE" \
+    -t "$WEB_IMAGE" -t "$WEB_DEV" \
     --load \
     .
 else
   docker build --pull=false \
     -f infra/docker/web-artifact.Dockerfile \
     --build-arg "NGINX_CONF=$NGINX_CONF_FILE" \
-    -t "$WEB_IMAGE" \
+    -t "$WEB_IMAGE" -t "$WEB_DEV" \
     .
 fi
 
 # Push 到 Registry
 if [ "$USE_PUSH" -eq 1 ]; then
-  echo "=== Pushing images to Registry ==="
+  echo "=== Pushing SHA/version-tagged images to Registry ==="
   docker tag "$API_IMAGE" "$REGISTRY_API"
   docker tag "$WORKER_IMAGE" "$REGISTRY_WORKER"
   docker tag "$WEB_IMAGE" "$REGISTRY_WEB"
   docker push "$REGISTRY_API"
   docker push "$REGISTRY_WORKER"
   docker push "$REGISTRY_WEB"
-  echo "All images pushed to $REGISTRY"
+  echo "SHA-tagged images pushed to $REGISTRY"
+
+  # ---- 额外推送 :dev floating tag（仅 staging/develop）----
+  # :dev tag 指向最新一次 develop/staging 构建，供 Watchtower 通过 WATCHTOWER_ROLLING_RESTART 等方式
+  # 监听镜像更新并自动 pull + restart；部署脚本 (ci_staging_deploy.sh) 仍使用 SHA tag 做确定性部署，
+  # dev tag 仅作为"最新 develop 成功构建"的可滚动标识，避免并发构建互相覆盖导致的不可重现问题。
+  if [ "$PUSH_DEV_TAG" -eq 1 ]; then
+    echo "=== Pushing :dev floating tags to Registry (for Watchtower auto-update) ==="
+    docker tag "$API_IMAGE" "$REGISTRY_API_DEV"
+    docker tag "$WORKER_IMAGE" "$REGISTRY_WORKER_DEV"
+    docker tag "$WEB_IMAGE" "$REGISTRY_WEB_DEV"
+    docker push "$REGISTRY_API_DEV"
+    docker push "$REGISTRY_WORKER_DEV"
+    docker push "$REGISTRY_WEB_DEV"
+    echo ":dev tags pushed to $REGISTRY"
+  fi
 else
   echo "Registry push skipped (no auth token available)"
 fi
 
 echo "=== Build complete ==="
-docker images | grep "xiaoxia-saas" | grep "$VERSION" || true
+docker images | grep "xiaoxia-saas" | grep -E "($VERSION|dev)" || true

scripts/ci/sync_base_images.sh

@@ -0,0 +1,103 @@
+#!/bin/bash
+# ============================================
+# 基础镜像同步脚本 - 从公共镜像源同步到私有ACR
+# 用法:
+#   ACR_USERNAME=xxx ACR_PASSWORD=yyy bash scripts/ci/sync_base_images.sh
+# ============================================
+
+set -euo pipefail
+
+ACR_REGISTRY="${ACR_REGISTRY:-xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji}"
+ACR_USERNAME="${ACR_USERNAME:-}"
+ACR_PASSWORD="${ACR_PASSWORD:-}"
+SOURCE_PREFIX="${SOURCE_PREFIX:-docker.m.daocloud.io/library}"
+
+# 需要同步的镜像列表 (源镜像名:tag => ACR目标名:tag)
+IMAGES=(
+    "python:3.12-slim-bookworm"
+    "python:3.12-slim"
+    "node:20"
+    "nginx:alpine"
+)
+
+echo "============================================"
+echo "  基础镜像同步到 ACR"
+echo "  ACR: $ACR_REGISTRY"
+echo "  源: $SOURCE_PREFIX"
+echo "============================================"
+echo ""
+
+# 登录 ACR
+if [ -n "$ACR_PASSWORD" ] && [ -n "$ACR_USERNAME" ]; then
+    echo "登录 ACR..."
+    ACR_HOST=$(echo "$ACR_REGISTRY" | cut -d/ -f1)
+    printf '%s' "$ACR_PASSWORD" | docker login "$ACR_HOST" -u "$ACR_USERNAME" --password-stdin
+    echo "ACR 登录成功"
+    echo ""
+fi
+
+success=0
+failed=0
+
+for image in "${IMAGES[@]}"; do
+    source_image="${SOURCE_PREFIX}/${image}"
+    target_image="${ACR_REGISTRY}/base/${image}"
+
+    echo "--- 同步: $image ---"
+    echo "  源: $source_image"
+    echo "  目标: $target_image"
+
+    # Pull 源镜像（带重试）
+    pulled=0
+    for attempt in 1 2 3; do
+        echo "  Pull 尝试 $attempt/3..."
+        if docker pull "$source_image"; then
+            pulled=1
+            break
+        fi
+        echo "  Pull 失败，5s 后重试..."
+        sleep 5
+    done
+
+    if [ "$pulled" -eq 0 ]; then
+        echo "  ❌ Pull 失败: $image"
+        failed=$((failed + 1))
+        continue
+    fi
+
+    # Tag
+    docker tag "$source_image" "$target_image"
+    echo "  Tag 完成"
+
+    # Push 到 ACR
+    pushed=0
+    for attempt in 1 2 3; do
+        echo "  Push 尝试 $attempt/3..."
+        if docker push "$target_image"; then
+            pushed=1
+            break
+        fi
+        echo "  Push 失败，5s 后重试..."
+        sleep 5
+    done
+
+    if [ "$pushed" -eq 1 ]; then
+        echo "  ✅ 同步成功: $image"
+        success=$((success + 1))
+    else
+        echo "  ❌ Push 失败: $image"
+        failed=$((failed + 1))
+    fi
+
+    echo ""
+done
+
+echo "============================================"
+echo "  同步完成"
+echo "  成功: $success"
+echo "  失败: $failed"
+echo "============================================"
+
+if [ "$failed" -gt 0 ]; then
+    exit 1
+fi

scripts/ci/validate_code_quality.sh

@@ -0,0 +1,157 @@
+#!/bin/bash
+# CI Validate: 代码质量与安全扫描（并行Job 1/3）
+# 包含：密钥扫描、格式检查、安全扫描、依赖漏洞、死代码检测、脚本语法校验
+set -eu
+
+echo "=== CI Validate: 代码质量与安全扫描 ==="
+
+# --- 密钥检测 ---
+echo ""
+echo "=== [1/6] Secret detection (detect-secrets) ==="
+python3 -m pip install -q detect-secrets
+detect-secrets --version
+
+detect-secrets scan \
+  --all-files \
+  --exclude-files '(^|/)(tests|test|e2e|__tests__|spec|docs|node_modules|site-packages|migrations|alembic|.gitea|.git|.pytest_cache|.next|dist|build)/' \
+  --exclude-files '\.(md|rst|txt|lock|example|sample|min\.js|min\.css|spec\.ts|test\.ts|test\.py)$' \
+  --exclude-files '(package-lock|yarn\.lock|poetry\.lock|Pipfile\.lock)$' \
+  --disable-plugin Base64HighEntropyString \
+  --disable-plugin HexHighEntropyString \
+  --disable-plugin BasicAuthDetector \
+  --disable-plugin KeywordDetector \
+  --disable-plugin IPPublicDetector \
+  > /tmp/secrets-scan.json 2>&1
+
+FOUND=$(python3 -c "
+import json
+try:
+    with open('/tmp/secrets-scan.json') as f:
+        data = json.load(f)
+    results = data.get('results', {})
+    total = sum(len(v) for v in results.values())
+    print(total)
+except Exception:
+    print('error')
+")
+
+echo "Secrets detected: $FOUND"
+if [ "$FOUND" != "0" ] && [ "$FOUND" != "error" ]; then
+  echo ""
+  echo "=== Secret details ==="
+  python3 -c "
+import json
+with open('/tmp/secrets-scan.json') as f:
+    data = json.load(f)
+for fpath, items in data.get('results', {}).items():
+    for item in items:
+        line = item.get('line_number', '?')
+        stype = item.get('type', '?')
+        hashed = item.get('hashed_secret', '')[:16]
+        print(f'  {fpath}:{line} [{stype}] {hashed}...')
+"
+  echo ""
+  echo "ERROR: Potential secrets detected in code!"
+  exit 1
+fi
+echo "✅ Secret scan passed"
+
+# --- 代码质量检查（全量，PR 和 push 统一标准）---
+# 历史：PR 侧用增量检查以加速，但会导致 push 侧全量检查失败时 PR 侧感知不到
+# 现在统一全量检查，确保 CI 真正保护主分支（black/isort/ruff 全量仅多几十秒）
+echo ""
+echo "=== [2/6] Code quality checks (full scan) ==="
+SCAN_MODE="full"
+echo "Full scan mode"
+python3 -m compileall -q alembic apps packages tests scripts
+python3 -m black --check --fast alembic apps packages tests scripts
+python3 -m isort --check-only alembic apps packages tests scripts
+python3 -m ruff check apps packages tests --statistics
+
+echo "✅ Code quality checks passed"
+
+# --- Bandit 安全扫描（仅告警） ---
+echo ""
+echo "=== [3/6] Security scan (bandit, advisory only) ==="
+set +e
+bandit -r apps packages -q -ll
+BANDIT_EXIT=$?
+set -e
+if [ "$BANDIT_EXIT" -ne 0 ]; then
+  echo "⚠️  Bandit found security issues (advisory mode - not blocking CI)"
+else
+  echo "✅ Bandit security scan passed"
+fi
+
+# --- Pip-audit 依赖漏洞扫描（仅告警） ---
+echo ""
+echo "=== [4/6] Python dependency vulnerability scan (pip-audit, advisory only) ==="
+python3 -m pip install -q pip-audit
+pip-audit --version
+EXIT_CODE=0
+for req_file in requirements.txt requirements-base.txt requirements-dev.txt; do
+  if [ -f "$req_file" ]; then
+    echo "--- Scanning $req_file ---"
+    pip-audit -r "$req_file" --desc on 2>&1 | head -40 || EXIT_CODE=$?
+    echo ""
+  fi
+done
+echo "pip-audit scan completed (advisory mode - warnings only, not blocking CI)"
+
+# --- Vulture 死代码检测（仅告警） ---
+echo ""
+echo "=== [5/6] Dead code detection (vulture, advisory only) ==="
+set +e
+python3 -m pip install -q vulture
+vulture --version
+echo "告警模式，不阻断CI。置信度>=90%建议尽快确认。"
+echo ""
+vulture apps packages scripts \
+  --exclude "tests,test,migrations,.gitea,docs,node_modules,site-packages,*/test_*.py,*/conftest.py" \
+  --min-confidence 70 \
+  2>&1 | sort -t'(' -k2 -rn | head -80
+echo ""
+echo "=== vulture scan summary ==="
+echo "发现潜在死代码（可能包含框架装饰器注册的函数，为误报）"
+echo "建议：定期人工审查高置信度（>=90%）条目"
+set -e
+
+# --- CI脚本语法校验 ---
+echo ""
+echo "=== [6/6] CI & shell scripts syntax validation ==="
+SYNTAX_ERROR=0
+# 检查所有 CI shell 脚本
+for script in scripts/ci/*.sh; do
+  if [ -f "$script" ]; then
+    if ! bash -n "$script" 2>&1; then
+      echo "❌ 语法错误: $script"
+      SYNTAX_ERROR=1
+    fi
+  fi
+done
+# 检查所有 CI Python 脚本语法
+for script in scripts/ci/*.py; do
+  if [ -f "$script" ]; then
+    if ! python3 -m py_compile "$script" 2>&1; then
+      echo "❌ Python语法错误: $script"
+      SYNTAX_ERROR=1
+    fi
+  fi
+done
+# 检查 .gitea/workflows 下的脚本（如果有）
+for script in .gitea/workflows/*.sh; do
+  if [ -f "$script" ]; then
+    if ! bash -n "$script" 2>&1; then
+      echo "❌ 语法错误: $script"
+      SYNTAX_ERROR=1
+    fi
+  fi
+done
+if [ "$SYNTAX_ERROR" -ne 0 ]; then
+  echo "❌ CI脚本语法校验失败，见上方错误"
+  exit 1
+fi
+echo "✅ All CI scripts syntax OK"
+
+echo ""
+echo "=== CI Validate: 代码质量与安全扫描 全部通过 ✅ ==="

scripts/ci_production_deploy.sh

@@ -170,16 +170,17 @@ rollback() {
       --name xiaoxia-api-production \
       --env-file "$ENV_FILE" \
       --network xiaoxia-net-production \
+      --network-alias xiaoxia-api \
       -p 127.0.0.1:8001:8000 \
       -e APP_ENV=production \
       -e APP_VERSION="$(echo $PREV_API_IMAGE | grep -oE '[^:]+$')" \
       -e GENERATED_FILES_DIR=/app/generated \
-      -e GENERATED_FILES_URL_PREFIX=/generated-files \
-      -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
+      -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
+      -e PUBLIC_API_BASE_URL=https://saas-api.xiaoxiajianji.com \
       -v "$GENERATED_DIR:/app/generated" \
       --restart unless-stopped \
-  --cpus 2 \
-  --memory 2g \
+      --cpus 2 \
+      --memory 2g \
       --health-cmd "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\"" \
       --health-interval 30s \
       --health-timeout 10s \
@@ -196,26 +197,29 @@ rollback() {
     echo "Rolling back Worker to: $PREV_WORKER_IMAGE"
     docker run -d \
       --name xiaoxia-worker-production \
-      --env-file "$ENV_FILE" \
       --network xiaoxia-net-production \
+      --network-alias xiaoxia-worker \
+      --network-alias xiaoxia-api \
+      --env-file "$ENV_FILE" \
       -e APP_ENV=production \
       -e APP_VERSION="$(echo $PREV_WORKER_IMAGE | grep -oE '[^:]+$')" \
-      -e WORKER_CONCURRENCY=1 \
-      -e WORKER_MAX_TASKS_PER_CHILD=100 \
       -e GENERATED_FILES_DIR=/app/generated \
-      -e GENERATED_FILES_URL_PREFIX=/generated-files \
-      -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
+      -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
+      -e PYTHONPATH=/app:/app/apps/api:/app/packages \
       -v "$GENERATED_DIR:/app/generated" \
+      -v "$LEGACY_ASSETS_DIR:/app/legacy-assets" \
+      -w /app/apps/worker \
       --restart unless-stopped \
-  --cpus 2 \
-  --memory 2g \
-      --health-cmd "sh -c \"for pid in /proc/[0-9]*/cmdline; do if grep -ql celery \"$pid\" 2>/dev/null; then exit 0; fi; done; exit 1\"" \
+      --cpus 2 \
+      --memory 3g \
+      --health-cmd "sh -c 'PYTHONPATH=/app:/app/apps/api:/app/packages celery -A worker_app.celery_app inspect ping -t 5 2>&1 | grep -q pong'" \
       --health-interval 30s \
-      --health-timeout 10s \
+      --health-timeout 15s \
       --health-retries 3 \
-      --health-start-period 30s \
-      $LOG_OPTS \
-      "$PREV_WORKER_IMAGE"
+      --health-start-period 60s \
+      --log-driver json-file --log-opt max-size=200m --log-opt max-file=5 \
+      "$PREV_WORKER_IMAGE" \
+      /usr/local/bin/entrypoint-worker.sh
   else
     echo "No previous Worker image to roll back to"
   fi
@@ -230,12 +234,15 @@ rollback() {
     docker run -d \
       --name xiaoxia-web-production \
       --network xiaoxia-net-production \
+      --network-alias xiaoxia-web \
       -p 127.0.0.1:3002:80 \
-      --restart unless-stopped \
-  --cpus 0.5 \
-  --memory 512m \
-      $LEGACY_VOLUME \
+      -e APP_ENV=production \
+      -e API_BASE_URL=https://saas-api.xiaoxiajianji.com \
       -v "$NGINX_CONF_FILE:/etc/nginx/conf.d/default.conf:ro" \
+      $LEGACY_VOLUME \
+      --restart unless-stopped \
+      --cpus 1 \
+      --memory 512m \
       --health-cmd "wget --spider -q http://127.0.0.1:80" \
       --health-interval 30s \
       --health-timeout 5s \
@@ -373,12 +380,13 @@ docker run -d \
   --name xiaoxia-api-production \
   --env-file "$ENV_FILE" \
   --network xiaoxia-net-production \
+  --network-alias xiaoxia-api \
   -p 127.0.0.1:8001:8000 \
   -e APP_ENV=production \
   -e APP_VERSION="$IMAGE_TAG" \
   -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=/generated-files \
-  -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
+  -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
+  -e PUBLIC_API_BASE_URL=https://saas-api.xiaoxiajianji.com \
   -v "$GENERATED_DIR:/app/generated" \
   --restart unless-stopped \
   --cpus 2 \
@@ -395,26 +403,29 @@ docker run -d \
 echo "Starting Worker container..."
 docker run -d \
   --name xiaoxia-worker-production \
-  --env-file "$ENV_FILE" \
   --network xiaoxia-net-production \
+  --network-alias xiaoxia-worker \
+  --network-alias xiaoxia-api \
+  --env-file "$ENV_FILE" \
   -e APP_ENV=production \
   -e APP_VERSION="$IMAGE_TAG" \
-  -e WORKER_CONCURRENCY=1 \
-  -e WORKER_MAX_TASKS_PER_CHILD=100 \
   -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=/generated-files \
-  -e PUBLIC_API_BASE_URL=https://production-api.xiaoxiajianji.com \
+  -e GENERATED_FILES_URL_PREFIX=https://saas-api.xiaoxiajianji.com/generated-files \
+  -e PYTHONPATH=/app:/app/apps/api:/app/packages \
   -v "$GENERATED_DIR:/app/generated" \
+  -v "$LEGACY_ASSETS_DIR:/app/legacy-assets" \
+  -w /app/apps/worker \
   --restart unless-stopped \
   --cpus 2 \
-  --memory 2g \
-  --health-cmd "sh -c \"for pid in /proc/[0-9]*/cmdline; do if grep -ql celery \"$pid\" 2>/dev/null; then exit 0; fi; done; exit 1\"" \
+  --memory 3g \
+  --health-cmd "sh -c 'PYTHONPATH=/app:/app/apps/api:/app/packages celery -A worker_app.celery_app inspect ping -t 5 2>&1 | grep -q pong'" \
   --health-interval 30s \
-  --health-timeout 10s \
+  --health-timeout 15s \
   --health-retries 3 \
-  --health-start-period 30s \
-  $LOG_OPTS \
-  "$REGISTRY_WORKER" || rollback
+  --health-start-period 60s \
+  --log-driver json-file --log-opt max-size=200m --log-opt max-file=5 \
+  "$REGISTRY_WORKER" \
+  /usr/local/bin/entrypoint-worker.sh || rollback
 
 # ---- 启动 Web ----
 LEGACY_VOLUME=""
@@ -429,12 +440,15 @@ echo "Starting Web container..."
 docker run -d \
   --name xiaoxia-web-production \
   --network xiaoxia-net-production \
+  --network-alias xiaoxia-web \
   -p 127.0.0.1:3002:80 \
-  --restart unless-stopped \
-  --cpus 0.5 \
-  --memory 512m \
+  -e APP_ENV=production \
+  -e API_BASE_URL=https://saas-api.xiaoxiajianji.com \
   -v "$NGINX_CONF_FILE:/etc/nginx/conf.d/default.conf:ro" \
   $LEGACY_VOLUME \
+  --restart unless-stopped \
+  --cpus 1 \
+  --memory 512m \
   --health-cmd "wget --spider -q http://127.0.0.1:80" \
   --health-interval 30s \
   --health-timeout 5s \
@@ -487,7 +501,7 @@ docker builder prune -af --filter "until=168h" 2>/dev/null || true
 
 echo ""
 echo "=== Production deployment complete ==="
-echo "API:      http://127.0.0.1:8000"
-echo "Web:      http://127.0.0.1:3001"
+echo "API:      http://127.0.0.1:8001"
+echo "Web:      http://127.0.0.1:3002"
 echo "Version:  $IMAGE_TAG"
 docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep production

scripts/ci_staging_deploy.sh

@@ -264,6 +264,9 @@ if [ -n "$REGISTRY_TOKEN" ]; then
 fi
 
 # ---- 并行 Pull 三个镜像 ----
+# 注意：这里必须使用 IMAGE_TAG（commit SHA）做确定性部署，不要改成 :dev。
+# :dev 是 floating tag，可能被并发构建覆盖，导致部署版本不可重现、回滚混乱。
+# Watchtower 可监听 :dev 做非关键路径的自动同步；正式部署/回滚一律锚定 SHA。
 REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:${IMAGE_TAG}"
 REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:${IMAGE_TAG}"
 REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:${IMAGE_TAG}"

scripts/ci_staging_healthcheck.sh

@@ -17,9 +17,9 @@
 #   SKIP_NOTIFY           - 跳过通知 (true/false, 默认 false)
 #   CI_NOTIFY_WEBHOOK     - 通知 Webhook URL
 #
-#   STAGING_SSH_HOST      - Staging 服务器 SSH 地址 (默认 47.98.113.167)
+#   STAGING_SSH_HOST      - Staging 服务器 SSH 地址 (默认 127.0.0.1，CI runner 在 staging 本机)
 #   STAGING_SSH_USER      - SSH 用户名 (默认 root)
-#   STAGING_SSH_PORT      - SSH 端口 (默认 22222)
+#   STAGING_SSH_PORT      - SSH 端口 (默认 22)
 #   STAGING_SSH_KEY       - SSH 私钥内容
 #   REGISTRY_TOKEN        - Registry Token（回滚时拉取旧镜像需要）
 #
@@ -40,9 +40,9 @@ HEALTH_CHECK_TIMEOUT="${HEALTH_CHECK_TIMEOUT:-120}"
 SKIP_ROLLBACK="${SKIP_ROLLBACK:-false}"
 SKIP_NOTIFY="${SKIP_NOTIFY:-false}"
 
-STAGING_SSH_HOST="${STAGING_SSH_HOST:-47.98.113.167}"
+STAGING_SSH_HOST="${STAGING_SSH_HOST:-127.0.0.1}"
 STAGING_SSH_USER="${STAGING_SSH_USER:-root}"
-STAGING_SSH_PORT="${STAGING_SSH_PORT:-22222}"
+STAGING_SSH_PORT="${STAGING_SSH_PORT:-22}"
 
 REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
 REGISTRY_USER="${REGISTRY_USER:-xiaoxia}"