From b3f3f391731b76228647be4491791587647c5e12 Mon Sep 17 00:00:00 2001
From: CI Bot <ci-bot@xiaoxiajianji.com>
Date: Sun, 19 Jul 2026 21:18:08 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20ACR=20cleanup=E6=94=B9=E5=88=B0Deplo?=
 =?UTF-8?q?y=E4=B9=8B=E5=90=8E=E8=BF=90=E8=A1=8C=EF=BC=8C=E4=BF=9D?=
 =?UTF-8?q?=E6=8A=A4=E5=BD=93=E5=89=8D=E6=9E=84=E5=BB=BAtag=E4=B8=8D?=
 =?UTF-8?q?=E8=A2=AB=E8=AF=AF=E5=88=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

问题：ACR cleanup和Deploy Staging并行运行，缓存构建的镜像manifest
created时间是旧的，被ACR cleanup当成老镜像删掉了，导致Deploy拉取
时报not found。

修复：
1. ACR cleanup的needs从build-staging改为deploy-staging，确保部署
   成功后再清理旧镜像
2. 添加PROTECTED_TAG保护机制，当前commit对应的tag不被删除（双保险）
---
 .gitea/workflows/ci-pipeline.yml | 3 ++-
 scripts/ci/acr_cleanup.py        | 9 +++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 6d20a27c7..556f74911 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -908,7 +908,7 @@ jobs:
     runs-on: runtime-builder
     timeout-minutes: 10
     needs:
-    - build-staging
+    - deploy-staging
     if: github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')
     env:
       ACR_REGISTRY: xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com
@@ -928,6 +928,7 @@ jobs:
       env:
         ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
         ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        PROTECTED_TAG: ${{ github.sha }}
       run: |
         set -eu
         python3 scripts/ci/acr_cleanup.py \
diff --git a/scripts/ci/acr_cleanup.py b/scripts/ci/acr_cleanup.py
index 3986e2d61..a705f618e 100644
--- a/scripts/ci/acr_cleanup.py
+++ b/scripts/ci/acr_cleanup.py
@@ -278,6 +278,15 @@ def cleanup_repo(repo, keep_count, pr_days, dry_run):
         valid_kept = [t for t in kept if t["created"]]
         if valid_kept:
             print("  最早保留:", valid_kept[-1]["tag"][:12], "(" + valid_kept[-1]["created"][:10] + ")")
+        # 保护当前构建的tag（通过PROTECTED_TAG环境变量传入，如GITHUB_SHA）
+        protected_tag = os.environ.get("PROTECTED_TAG", "").strip()
+        if protected_tag:
+            before = len(to_delete)
+            to_delete = [t for t in to_delete if not t["tag"].startswith(protected_tag)]
+            removed = before - len(to_delete)
+            if removed > 0:
+                print(f"  保护当前构建tag: {protected_tag[:12]} (跳过{removed}个)")
+
         to_del_valid = [t for t in to_delete if t["digest"]]
         print("  可删除(有digest):", len(to_del_valid), "个")
     else:
-- 
2.54.0