diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index dca9c415b..0e3a48ca3 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -81,12 +81,6 @@ jobs:
       skip_backend: ${{ steps.check.outputs.skip_backend }}
       skip_frontend: ${{ steps.check.outputs.skip_frontend }}
     steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Check changed files
       id: check
       shell: bash
@@ -125,7 +119,7 @@ jobs:
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+        curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
 
   validate-code-quality:
     needs: dedupe-check
@@ -495,9 +489,6 @@ jobs:
     needs:
       - check-frontend-only
       - dedupe-check
-      - validate-code-quality
-      - validate-type-check
-      - validate-migration
     env:
       DATABASE_URL: postgresql+psycopg://postgres:postgres@host.docker.internal:5432/xiaoxia_saas
       USE_IN_MEMORY_DB: 'false'
@@ -858,12 +849,6 @@ jobs:
       skip_backend: ${{ steps.check.outputs.skip_backend }}
       skip_frontend: ${{ steps.check.outputs.skip_frontend }}
     steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Check changed paths
       id: check
       shell: bash
@@ -881,7 +866,7 @@ jobs:
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+        curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
 
   build-staging:
     name: Build Staging ${{ matrix.service_display }} Image
@@ -1896,14 +1881,6 @@ jobs:
       - build-pr
     timeout-minutes: 3
     steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
-
       - name: Evaluate CI Gate
         id: gate
         shell: bash
@@ -2065,4 +2042,4 @@ jobs:
           [ "${{ steps.gate.outputs.gate_result }}" = "success" ] || STATUS="error"
           START_TIME=""
           [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
+          curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
diff --git a/scripts/ci/step_checkout.sh b/scripts/ci/step_checkout.sh
index cfe0de57f..6d1ac877d 100755
--- a/scripts/ci/step_checkout.sh
+++ b/scripts/ci/step_checkout.sh
@@ -1,18 +1,39 @@
 #!/bin/sh
-# CI 公共步骤：Checkout 代码（带重试）
+# CI 公共步骤：Checkout 代码（流式下载+解压，带重试）
 # 用法：直接 source 或调用，需要 GITHUB_TOKEN 环境变量
 set -eu
 
 python3 - <<'PY'
-import io, os, tarfile, time, urllib.request, urllib.error
+import io, os, sys, tarfile, time, urllib.request, urllib.error
+
 url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
 request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
 last_err = None
+
 for attempt in range(5):
     try:
         with urllib.request.urlopen(request, timeout=120) as response:
-            archive = response.read()
-        break
+            # 流式读取：先读少量数据确认连接成功，再大块读取
+            first_chunk = response.read(8192)
+            buf = io.BytesIO()
+            buf.write(first_chunk)
+            while True:
+                chunk = response.read(65536)
+                if not chunk:
+                    break
+                buf.write(chunk)
+            buf.seek(0)
+            with tarfile.open(fileobj=buf, mode='r:gz') as tar:
+                root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+                for member in tar.getmembers():
+                    name = member.name
+                    if name == root_prefix[:-1]:
+                        continue
+                    if name.startswith(root_prefix):
+                        member.name = name[len(root_prefix):]
+                    if member.name:
+                        tar.extract(member, '.')
+            break
     except urllib.error.HTTPError as e:
         last_err = e
         if e.code >= 500 and attempt < 4:
@@ -31,14 +52,5 @@ for attempt in range(5):
         raise
 else:
     raise last_err
-with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-    root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-    for member in tar.getmembers():
-        name = member.name
-        if name == root_prefix[:-1]:
-            continue
-        if name.startswith(root_prefix):
-            member.name = name[len(root_prefix):]
-        if member.name:
-            tar.extract(member, '.')
 PY
+# CI pipeline speedup batch 1