From 24011d20a099c6fc6949fe4b20f43fb628ec1e1f Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 01:01:43 +0800
Subject: [PATCH 01/10] ci: add worker base builder Dockerfile for layered
 caching

---
 infra/docker/worker-base-builder.Dockerfile | 43 +++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 infra/docker/worker-base-builder.Dockerfile

diff --git a/infra/docker/worker-base-builder.Dockerfile b/infra/docker/worker-base-builder.Dockerfile
new file mode 100644
index 000000000..4a1bdb1d3
--- /dev/null
+++ b/infra/docker/worker-base-builder.Dockerfile
@@ -0,0 +1,43 @@
+# ============================================================
+# Worker Builder 基础镜像
+# 预编译：编译工具 + 基础依赖 + Worker大包
+# 当 requirements-base.txt 或 requirements-worker.txt 变更时重新构建
+# 业务构建从此镜像开始，只需要安装业务依赖，节省15+分钟
+# ============================================================
+
+FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim
+
+# 使用阿里云镜像加速
+RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
+    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
+
+# 安装编译工具
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    g++ \
+    python3-dev \
+    binutils \
+    && rm -rf /var/lib/apt/lists/*
+
+# 创建 venv
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+WORKDIR /tmp
+
+# 基础依赖（变化极少）
+COPY requirements-base.txt /tmp/requirements-base.txt
+RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
+    pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
+    -r /tmp/requirements-base.txt \
+    && rm /tmp/requirements-base.txt
+
+# Worker 大包（变化少）
+COPY requirements-worker.txt /tmp/requirements-worker.txt
+RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
+    pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
+    -r /tmp/requirements-worker.txt \
+    && rm /tmp/requirements-worker.txt
+
+# 预先做一次 strip（基础层瘦身，业务层增量）
+RUN find /opt/venv -name "*.so" -type f -exec strip --strip-all {} \; 2>/dev/null || true
-- 
2.54.0


From f8ae2e8b1ef51b504239a00f9a9e244e567bf5c4 Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 01:01:43 +0800
Subject: [PATCH 02/10] ci: add worker base runtime Dockerfile for layered
 caching

---
 infra/docker/worker-base-runtime.Dockerfile | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 infra/docker/worker-base-runtime.Dockerfile

diff --git a/infra/docker/worker-base-runtime.Dockerfile b/infra/docker/worker-base-runtime.Dockerfile
new file mode 100644
index 000000000..4f83780ef
--- /dev/null
+++ b/infra/docker/worker-base-runtime.Dockerfile
@@ -0,0 +1,17 @@
+# ============================================================
+# Worker Runtime 基础镜像
+# 预安装：ffmpeg + 运行时依赖
+# 变化极少，业务构建从此镜像开始
+# ============================================================
+
+FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim
+
+# 使用阿里云镜像加速
+RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
+    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
+
+# 运行时依赖：ffmpeg + opencv需要的libglib
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ffmpeg \
+    libglib2.0-0 \
+    && rm -rf /var/lib/apt/lists/*
-- 
2.54.0


From f1c8e761d108861c2782a1234600e833d90639d0 Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 01:02:13 +0800
Subject: [PATCH 03/10] =?UTF-8?q?ci:=20worker=E9=95=9C=E5=83=8F=E5=88=86?=
 =?UTF-8?q?=E5=B1=82=E7=BC=93=E5=AD=98=E4=BC=98=E5=8C=96=EF=BC=8C=E4=BD=BF?=
 =?UTF-8?q?=E7=94=A8=E9=A2=84=E6=9E=84=E5=BB=BA=E5=9F=BA=E7=A1=80=E9=95=9C?=
 =?UTF-8?q?=E5=83=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infra/docker/worker.Dockerfile | 79 ++++++++--------------------------
 1 file changed, 17 insertions(+), 62 deletions(-)

diff --git a/infra/docker/worker.Dockerfile b/infra/docker/worker.Dockerfile
index 0639128cb..d00043021 100755
--- a/infra/docker/worker.Dockerfile
+++ b/infra/docker/worker.Dockerfile
@@ -1,88 +1,43 @@
 # ============================================================
-# Worker Dockerfile - 优化版（多阶段构建 + 镜像瘦身 + cache mount加速）
-# 优化项：
-#   1. 多阶段构建：builder 阶段安装编译依赖，runtime 阶段只保留运行时
-#   2. ffmpeg 通过 apt 安装（阿里云镜像加速，几秒完成，稳定可靠）
-#   3. Python 依赖瘦身：strip .so 调试符号 + 清理测试文件 + 清理缓存
-#   4. pip cache mount：加速依赖下载（跨构建共享pip wheel缓存）
+# Worker Dockerfile - 分层缓存优化版
+# 优化：基础依赖 + Worker大包预构建为基础镜像，业务构建仅叠加业务依赖
+# 基础镜像：worker-base-builder / worker-base-runtime
+# 预计节省：依赖不变时构建时间从23min降至5min以内
 # ============================================================
 
 # ==================== Builder 阶段 ====================
-FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim AS builder
+# 从预构建的builder基础镜像开始，已经包含：
+#   - 编译工具 (gcc/g++/python3-dev/binutils)
+#   - requirements-base.txt 全部依赖
+#   - requirements-worker.txt 全部依赖 (numpy/scipy/opencv)
+#   - 预strip的.so文件
+FROM git.xiaoxiajianji.com/xiaoxia-saas/worker-base-builder:latest AS builder
 
-# 使用阿里云镜像加速
-RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
-    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
-
-# 安装编译工具（仅 builder 需要）
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    gcc \
-    g++ \
-    python3-dev \
-    binutils \
-    && rm -rf /var/lib/apt/lists/*
-
-
-# ---- 安装 Python 依赖 ----
-WORKDIR /tmp
-
-# 创建 venv
-RUN python -m venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
 
-# 基础依赖
-COPY requirements-base.txt /tmp/requirements-base.txt
-RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
-    pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
-    -r /tmp/requirements-base.txt \
-    && rm /tmp/requirements-base.txt
+WORKDIR /tmp
 
-# Worker 专属大包
-COPY requirements-worker.txt /tmp/requirements-worker.txt
-RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
-    pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
-    -r /tmp/requirements-worker.txt \
-    && rm /tmp/requirements-worker.txt
-
-# 业务依赖
+# ---- 安装业务依赖（变化频繁，单独一层）----
 COPY requirements.txt /tmp/requirements.txt
 RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
     pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com \
     -r /tmp/requirements.txt \
     && rm /tmp/requirements.txt
 
-# ---- Python 依赖瘦身 ----
-# 1. strip .so 文件的调试符号（节省约 80-100MB）
+# ---- 增量瘦身（只处理新增的业务依赖）----
 RUN find /opt/venv -name "*.so" -type f -exec strip --strip-all {} \; 2>/dev/null || true
-
-# 2. 清理测试文件（节省约 20MB）
-RUN find /opt/venv -type d -name "tests" -exec rm -rf {} + 2>/dev/null; \
-    find /opt/venv -type d -name "test" -exec rm -rf {} + 2>/dev/null; \
-    find /opt/venv -name "test_*.py" -delete 2>/dev/null || true
-
-# 3. 清理 .pyc 缓存和 __pycache__（节省约 10MB，运行时按需生成）
 RUN find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null; \
     find /opt/venv -name "*.pyc" -delete 2>/dev/null || true
 
-# 4. 清理 dist-info 中的文档
-RUN find /opt/venv -name "*.dist-info" -type d -exec sh -c 'rm -f "$1"/DESCRIPTION.rst "$1"/INSTALLER "$1"/LICENSE* "$1"/WHEEL "$1"/entry_points.txt' _ {} \; 2>/dev/null || true
-
 # ==================== Runtime 阶段 ====================
-FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim AS runtime
+# 从预构建的runtime基础镜像开始，已经包含：
+#   - ffmpeg
+#   - libglib2.0-0
+FROM git.xiaoxiajianji.com/xiaoxia-saas/worker-base-runtime:latest AS runtime
 
 # 构建参数：版本号
 ARG APP_VERSION=dev
 
-# 使用阿里云镜像加速
-RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
-    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
-
-# 安装最小运行时依赖（opencv-python-headless 需要 libglib2.0-0）
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ffmpeg \
-    libglib2.0-0 \
-    && rm -rf /var/lib/apt/lists/*
-
 # 从 builder 复制 Python 虚拟环境
 COPY --from=builder /opt/venv /opt/venv
 
-- 
2.54.0


From c9ca2b060e86052783b27c202b922add58ca26ea Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 01:04:04 +0800
Subject: [PATCH 04/10] ci: add worker base image auto-build workflow

---
 .gitea/workflows/worker-base-image.yml | 102 +++++++++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 .gitea/workflows/worker-base-image.yml

diff --git a/.gitea/workflows/worker-base-image.yml b/.gitea/workflows/worker-base-image.yml
new file mode 100644
index 000000000..510d0fc69
--- /dev/null
+++ b/.gitea/workflows/worker-base-image.yml
@@ -0,0 +1,102 @@
+name: Worker Base Image Build
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - 'requirements-base.txt'
+      - 'requirements-worker.txt'
+      - 'infra/docker/worker-base-builder.Dockerfile'
+      - 'infra/docker/worker-base-runtime.Dockerfile'
+  workflow_dispatch:  # 支持手动触发
+
+jobs:
+  build-worker-base:
+    name: Build Worker Base Images
+    runs-on: runtime-builder
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - name: builder
+          dockerfile: infra/docker/worker-base-builder.Dockerfile
+          image_name: worker-base-builder
+          cache_name: worker-base-builder-cache
+        - name: runtime
+          dockerfile: infra/docker/worker-base-runtime.Dockerfile
+          image_name: worker-base-runtime
+          cache_name: worker-base-runtime-cache
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        curl -sH "Authorization: token $GITHUB_TOKEN"           "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"           | bash
+
+    - name: Docker login to Registry
+      shell: sh
+      env:
+        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        GITEA_REGISTRY_USER: xiaoxia
+        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+      run: |
+        set -eu
+        for i in 1 2 3; do
+          echo "=== Docker login 尝试 $i/3 ==="
+          if printf '%s' "${ACR_PASSWORD}" | docker login xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com -u "${ACR_USERNAME}" --password-stdin              && docker login git.xiaoxiajianji.com -u "${GITEA_REGISTRY_USER}" -p "${GITEA_REGISTRY_TOKEN}"; then
+            echo "✅ Docker login successful"
+            break
+          fi
+          echo "❌ Docker login 失败（尝试 $i/3），5s 后重试..."
+          sleep 5
+        done
+
+    - name: Setup buildx builder
+      shell: sh
+      run: |
+        set -eu
+        BUILDER_NAME="ci-builder-${GITHUB_RUN_ID}-${{ matrix.name }}"
+        if ! docker buildx inspect "$BUILDER_NAME" > /dev/null 2>&1; then
+          docker buildx create --use --name "$BUILDER_NAME" --driver docker-container
+          echo "Created $BUILDER_NAME"
+        else
+          docker buildx use "$BUILDER_NAME"
+          echo "Using existing $BUILDER_NAME"
+        fi
+        docker buildx inspect --bootstrap
+
+    - name: Build and push base image
+      shell: sh
+      run: |
+        set -eu
+        REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
+        IMAGE_TAG="${REGISTRY}/${{ matrix.image_name }}:latest"
+        CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:${GITHUB_REF_NAME}"
+        
+        echo "=== Building ${{ matrix.name }} base image ==="
+        echo "Image: ${IMAGE_TAG}"
+        echo "Cache: ${CACHE_REF}"
+        
+        # 用通用构建脚本
+        bash scripts/ci/docker_build_push.sh           ${{ matrix.dockerfile }}           "${IMAGE_TAG}"           "${CACHE_REF}"
+        
+        # 同时推送到 Gitea Packages 作为备份（可选）
+        GITEA_IMAGE="git.xiaoxiajianji.com/xiaoxia-saas/${{ matrix.image_name }}:latest"
+        docker tag "${IMAGE_TAG}" "${GITEA_IMAGE}"
+        docker push "${GITEA_IMAGE}" || echo "Gitea Packages push failed (non-fatal)"
+        
+        echo ""
+        echo "✅ ${{ matrix.name }} base image built and pushed"
+
+    - name: Cleanup buildx builder
+      if: always()
+      shell: sh
+      run: |
+        docker buildx rm "ci-builder-${GITHUB_RUN_ID}-${{ matrix.name }}" 2>/dev/null || true
+        docker buildx prune -f 2>/dev/null || true
+        echo "Builder cleanup done"
-- 
2.54.0


From 3c4af082273b9b9d20c5c33c980c95f5b64ac635 Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 08:07:57 +0800
Subject: [PATCH 05/10] =?UTF-8?q?fix:=20cache=20tag=E6=96=9C=E6=9D=A0?=
 =?UTF-8?q?=E6=9B=BF=E6=8D=A2=E4=B8=BA=E7=9F=AD=E6=A8=AA=E7=BA=BF=EF=BC=8C?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8Dinvalid=20reference=20format?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/worker-base-image.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/worker-base-image.yml b/.gitea/workflows/worker-base-image.yml
index 510d0fc69..c07286aa8 100644
--- a/.gitea/workflows/worker-base-image.yml
+++ b/.gitea/workflows/worker-base-image.yml
@@ -76,7 +76,8 @@ jobs:
         set -eu
         REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
         IMAGE_TAG="${REGISTRY}/${{ matrix.image_name }}:latest"
-        CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:${GITHUB_REF_NAME}"
+        SAFE_REF_NAME=$(echo "${GITHUB_REF_NAME}" | tr '/' '-')
+        CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:${SAFE_REF_NAME}"
         
         echo "=== Building ${{ matrix.name }} base image ==="
         echo "Image: ${IMAGE_TAG}"
-- 
2.54.0


From 0f2b1be1217240fa7eb31ac9a8781754b615f801 Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 08:17:48 +0800
Subject: [PATCH 06/10] =?UTF-8?q?fix:=20PR=20Build=20Worker=E5=A2=9E?=
 =?UTF-8?q?=E5=8A=A0=E5=9F=BA=E7=A1=80=E9=95=9C=E5=83=8Ffallback=EF=BC=8C?=
 =?UTF-8?q?=E5=86=B7=E5=90=AF=E5=8A=A8=E6=97=B6=E6=9C=AC=E5=9C=B0=E9=A2=84?=
 =?UTF-8?q?=E6=9E=84=E5=BB=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/ci-pipeline.yml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 64c9551ea..d9de8c07e 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -472,6 +472,35 @@ jobs:
           echo "Docker login failed ($i/3), retrying in 5s..."
           sleep 5
         done
+    - name: Pre-build worker base images (fallback if not exist)
+      if: matrix.service == 'worker'
+      shell: sh
+      run: |
+        set -eu
+        REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
+        BASE_BUILDER="${REGISTRY}/worker-base-builder:latest"
+        BASE_RUNTIME="${REGISTRY}/worker-base-runtime:latest"
+        
+        # 检查基础镜像是否可拉取
+        echo "检查基础镜像是否存在..."
+        BASE_EXIST=true
+        docker pull "$BASE_BUILDER" 2>/dev/null || BASE_EXIST=false
+        if [ "$BASE_EXIST" = "false" ]; then
+          echo "基础镜像不存在，先本地构建..."
+          
+          # 构建builder基础镜像
+          echo "构建 worker-base-builder..."
+          docker build -f infra/docker/worker-base-builder.Dockerfile             -t "$BASE_BUILDER" .
+          
+          # 构建runtime基础镜像
+          echo "构建 worker-base-runtime..."
+          docker build -f infra/docker/worker-base-runtime.Dockerfile             -t "$BASE_RUNTIME" .
+          
+          echo "基础镜像本地构建完成"
+        else
+          echo "基础镜像已存在，跳过预构建"
+        fi
+
     - name: Build PR image (verify only, no push)
       shell: sh
       run: |
-- 
2.54.0


From aefd944a3d8ba213a83daa8688d3d24d1d559f22 Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 08:39:08 +0800
Subject: [PATCH 07/10] =?UTF-8?q?fix:=20fallback=E5=9F=BA=E7=A1=80?=
 =?UTF-8?q?=E9=95=9C=E5=83=8F=E6=94=B9=E7=94=A8Gitea=20Packages=E5=9C=B0?=
 =?UTF-8?q?=E5=9D=80=E5=B9=B6push=EF=BC=8C=E8=A7=A3=E5=86=B3buildx?=
 =?UTF-8?q?=E6=8B=89=E4=B8=8D=E5=88=B0=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/ci-pipeline.yml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index d9de8c07e..bc2c341c6 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -475,9 +475,12 @@ jobs:
     - name: Pre-build worker base images (fallback if not exist)
       if: matrix.service == 'worker'
       shell: sh
+      env:
+        GITEA_REGISTRY_USER: xiaoxia
+        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
       run: |
         set -eu
-        REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
+        REGISTRY="git.xiaoxiajianji.com/xiaoxia-saas"
         BASE_BUILDER="${REGISTRY}/worker-base-builder:latest"
         BASE_RUNTIME="${REGISTRY}/worker-base-runtime:latest"
         
@@ -486,17 +489,22 @@ jobs:
         BASE_EXIST=true
         docker pull "$BASE_BUILDER" 2>/dev/null || BASE_EXIST=false
         if [ "$BASE_EXIST" = "false" ]; then
-          echo "基础镜像不存在，先本地构建..."
+          echo "基础镜像不存在，本地构建并推送..."
           
           # 构建builder基础镜像
           echo "构建 worker-base-builder..."
-          docker build -f infra/docker/worker-base-builder.Dockerfile             -t "$BASE_BUILDER" .
+          docker build -f infra/docker/worker-base-builder.Dockerfile -t "$BASE_BUILDER" .
           
           # 构建runtime基础镜像
           echo "构建 worker-base-runtime..."
-          docker build -f infra/docker/worker-base-runtime.Dockerfile             -t "$BASE_RUNTIME" .
+          docker build -f infra/docker/worker-base-runtime.Dockerfile -t "$BASE_RUNTIME" .
           
-          echo "基础镜像本地构建完成"
+          # 推送到Gitea Packages，供后续buildx拉取
+          echo "推送基础镜像到Gitea Packages..."
+          docker push "$BASE_BUILDER"
+          docker push "$BASE_RUNTIME"
+          
+          echo "基础镜像构建并推送完成"
         else
           echo "基础镜像已存在，跳过预构建"
         fi
-- 
2.54.0


From 841b3b3695fd851a6c83b75cd5fdd7a04c3de67d Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 08:48:19 +0800
Subject: [PATCH 08/10] =?UTF-8?q?fix:=20fallback=E5=9F=BA=E7=A1=80?=
 =?UTF-8?q?=E9=95=9C=E5=83=8F=E6=94=B9=E6=9C=AC=E5=9C=B0=E6=9E=84=E5=BB=BA?=
 =?UTF-8?q?+=E6=99=AE=E9=80=9Adocker=20build=E6=A8=A1=E5=BC=8F=EF=BC=8C?=
 =?UTF-8?q?=E7=BB=95=E8=BF=87registry=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/ci-pipeline.yml | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index bc2c341c6..5c2599b0f 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -474,22 +474,21 @@ jobs:
         done
     - name: Pre-build worker base images (fallback if not exist)
       if: matrix.service == 'worker'
+      id: prebuild
       shell: sh
-      env:
-        GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
       run: |
         set -eu
         REGISTRY="git.xiaoxiajianji.com/xiaoxia-saas"
         BASE_BUILDER="${REGISTRY}/worker-base-builder:latest"
         BASE_RUNTIME="${REGISTRY}/worker-base-runtime:latest"
         
-        # 检查基础镜像是否可拉取
-        echo "检查基础镜像是否存在..."
-        BASE_EXIST=true
-        docker pull "$BASE_BUILDER" 2>/dev/null || BASE_EXIST=false
-        if [ "$BASE_EXIST" = "false" ]; then
-          echo "基础镜像不存在，本地构建并推送..."
+        # 尝试拉取基础镜像
+        echo "检查基础镜像..."
+        if docker pull "$BASE_BUILDER" 2>/dev/null && docker pull "$BASE_RUNTIME" 2>/dev/null; then
+          echo "基础镜像已存在，使用远程镜像"
+          echo "fallback=false" >> $GITHUB_OUTPUT
+        else
+          echo "基础镜像不存在，本地构建（fallback模式）..."
           
           # 构建builder基础镜像
           echo "构建 worker-base-builder..."
@@ -499,14 +498,8 @@ jobs:
           echo "构建 worker-base-runtime..."
           docker build -f infra/docker/worker-base-runtime.Dockerfile -t "$BASE_RUNTIME" .
           
-          # 推送到Gitea Packages，供后续buildx拉取
-          echo "推送基础镜像到Gitea Packages..."
-          docker push "$BASE_BUILDER"
-          docker push "$BASE_RUNTIME"
-          
-          echo "基础镜像构建并推送完成"
-        else
-          echo "基础镜像已存在，跳过预构建"
+          echo "fallback=true" >> $GITHUB_OUTPUT
+          echo "基础镜像本地构建完成"
         fi
 
     - name: Build PR image (verify only, no push)
-- 
2.54.0


From 435787e14e615886222734cce15a86c6890b1d4c Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 08:49:12 +0800
Subject: [PATCH 09/10] =?UTF-8?q?fix:=20Worker=20fallback=E6=A8=A1?=
 =?UTF-8?q?=E5=BC=8F=E7=94=A8=E6=99=AE=E9=80=9Adocker=20build=E7=BB=95?=
 =?UTF-8?q?=E8=BF=87buildx=E5=9F=BA=E7=A1=80=E9=95=9C=E5=83=8F=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

-- 
2.54.0


From 4e162791ab2c85b3bbbaaa6853043e9a52b8602f Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 08:49:45 +0800
Subject: [PATCH 10/10] =?UTF-8?q?fix:=20Worker=20fallback=E6=A8=A1?=
 =?UTF-8?q?=E5=BC=8F=E7=94=A8=E6=99=AE=E9=80=9Adocker=20build=E7=BB=95?=
 =?UTF-8?q?=E8=BF=87buildx=E5=9F=BA=E7=A1=80=E9=95=9C=E5=83=8F=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/ci-pipeline.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 5c2599b0f..936543ca9 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -515,6 +515,18 @@ jobs:
           EXTRA_BUILD_ARGS="$EXTRA_BUILD_ARGS NGINX_CONF=infra/docker/nginx-staging.conf"
         fi
 
+        # Worker fallback模式：基础镜像本地已构建，用普通docker build绕过buildx
+        if [ "${{ matrix.service }}" = "worker" ] && [ "${{ steps.prebuild.outputs.fallback }}" = "true" ]; then
+          echo "Fallback模式：用普通docker build（基础镜像本地已构建）"
+          BUILD_ARG_STR=""
+          for arg in $EXTRA_BUILD_ARGS; do
+            BUILD_ARG_STR="$BUILD_ARG_STR --build-arg $arg"
+          done
+          docker build -f ${{ matrix.dockerfile }} -t "${IMAGE_TAG}" $BUILD_ARG_STR .
+          echo "Fallback PR Build successful"
+          exit 0
+        fi
+
         NO_CACHE_FLAG=""
         for i in 1 2 3; do
           echo "PR Build attempt $i/3"
-- 
2.54.0