Add Gitea Docker package workflow

.gitea/workflows/docker.yml

@@ -3,89 +3,154 @@ name: Build Docker Package
 on:
   push:
     branches:
-      - master
+      - main
     tags:
       - "v*"
   workflow_dispatch:
 
 jobs:
   docker-package:
-    runs-on: ubuntu-latest
+    runs-on: gitea_act
+    # 使用 Docker CLI 镜像，因为 runner 默认任务镜像不一定包含 docker、
+    # bash 或基于 Node 的 action 依赖。
+    container:
+      image: docker:28-cli
     env:
       REGISTRY: git.hanhan.ltd
+      GITEA_SERVER_URL: https://git.hanhan.ltd
       NODE_IMAGE: m.daocloud.io/docker.io/library/node:22
       NPM_REGISTRY: https://registry.npmmirror.com
     steps:
+      - name: Install job tools
+        shell: sh
+        run: |
+          apk add --no-cache git
+          docker --version
+          git --version
+
       - name: Checkout
-        uses: actions/checkout@v4
+        env:
+          GITEA_ACTOR: ${{ gitea.actor }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        shell: sh
+        run: |
+          command -v git
+
+          repository="${GITHUB_REPOSITORY:-${{ gitea.repository }}}"
+          # GITHUB_SERVER_URL 可能指向任务容器无法解析的内部容器主机名，
+          # 因此这里固定使用公网 Gitea 地址。
+          server_url="${GITEA_SERVER_URL}"
+          sha="${GITHUB_SHA:-${{ gitea.sha }}}"
+
+          git init .
+          git remote add origin "${server_url}/${repository}.git"
+
+          if [ -n "${GITEA_TOKEN}" ]; then
+            auth="$(printf '%s:%s' "${GITEA_ACTOR}" "${GITEA_TOKEN}" | base64 | tr -d '\n')"
+            git -c "http.extraHeader=Authorization: Basic ${auth}" fetch --depth=1 origin "${sha}"
+          else
+            git fetch --depth=1 origin "${sha}"
+          fi
+
+          git checkout --force FETCH_HEAD
+          git config --global --add safe.directory "$PWD"
 
       - name: Prepare image metadata
-        id: meta
+        shell: sh
-        shell: bash
         run: |
           repository="${GITHUB_REPOSITORY:-${{ gitea.repository }}}"
-          repository="$(printf '%s' "$repository" | tr '[:upper:]' '[:lower:]')"
+          image_repository="$(printf '%s' "$repository" | tr '[:upper:]' '[:lower:]')"
-          image="${REGISTRY}/${repository}"
+          image="${REGISTRY}/${image_repository}"
 
           sha="${GITHUB_SHA:-${{ gitea.sha }}}"
-          short_sha="${sha:0:12}"
           ref="${GITHUB_REF:-${{ gitea.ref }}}"
+          source_url="${GITEA_SERVER_URL}/${repository}"
+
+          : > .image-tags
+
+          # 分支构建发布滚动的 latest 标签；版本标签如 v1.2.3
+          # 只发布不可变的 1.2.3 镜像标签。
+          case "${ref}" in
+            refs/tags/v*)
+              tag="${ref#refs/tags/}"
+              version="${tag#v}"
+              echo "${image}:${version}" >> .image-tags
+              ;;
+            *)
+              echo "${image}:latest" >> .image-tags
+              ;;
+          esac
 
           {
-            echo "image=${image}"
+            # OCI 标签可以帮助 Gitea 和其他镜像仓库展示来源仓库；
-            echo "tags<<EOF"
+            # 即使包仍需手动关联仓库，也能保留来源元数据。
-            echo "${image}:sha-${short_sha}"
+            echo "org.opencontainers.image.source=${source_url}"
+            echo "org.opencontainers.image.url=${source_url}"
+            echo "org.opencontainers.image.revision=${sha}"
+            echo "org.opencontainers.image.title=${repository}"
+          } > .image-labels
 
-            if [[ "${ref}" == "refs/heads/master" ]]; then
+          cat .image-tags
-              echo "${image}:latest"
-            fi
-
-            if [[ "${ref}" == refs/tags/* ]]; then
-              tag="${ref#refs/tags/}"
-              echo "${image}:${tag}"
-            fi
-
-            echo "EOF"
-          } >> "${GITHUB_OUTPUT}"
 
       - name: Login to Gitea container registry
         env:
           PACKAGE_USERNAME: ${{ secrets.PACKAGE_USERNAME }}
           PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
           GITEA_ACTOR: ${{ gitea.actor }}
-        shell: bash
+        shell: sh
         run: |
+          if [ -z "${PACKAGE_TOKEN}" ]; then
+            echo "PACKAGE_TOKEN secret is required to publish container packages." >&2
+            echo "Create a Gitea personal access token with package write permission for PACKAGE_USERNAME." >&2
+            exit 1
+          fi
           username="${PACKAGE_USERNAME:-${GITEA_ACTOR}}"
 
-          if [[ -z "${PACKAGE_TOKEN}" ]]; then
+          # PACKAGE_USERNAME 为了方便可以不填；但当 token 所属用户和
-            echo "PACKAGE_TOKEN secret is required to publish container packages." >&2
+          # 触发流水线的用户不一致时，显式设置它可以避免 unauthorized。
-            echo "Create a Gitea personal access token with package write permission and save it as PACKAGE_TOKEN." >&2
+          if [ -z "${username}" ]; then
+            echo "PACKAGE_USERNAME secret is required because Gitea actor is empty." >&2
+            echo "Set it to the Gitea username that owns PACKAGE_TOKEN." >&2
+            exit 1
+          fi
+
+          if [ -z "${PACKAGE_USERNAME}" ]; then
+            echo "PACKAGE_USERNAME is not set; using Gitea actor '${username}' for docker login."
+            echo "If login fails with unauthorized, set PACKAGE_USERNAME to the token owner."
+          fi
+
+          if ! docker version; then
+            echo "Docker daemon is not reachable from the Gitea runner." >&2
+            echo "Mount /var/run/docker.sock into the runner or use a dind runner image." >&2
             exit 1
           fi
 
           echo "${PACKAGE_TOKEN}" | docker login "${REGISTRY}" -u "${username}" --password-stdin
 
       - name: Build image
-        shell: bash
+        shell: sh
         run: |
-          mapfile -t tags <<< "${{ steps.meta.outputs.tags }}"
+          tag_args=""
+          while IFS= read -r tag; do
+            tag_args="${tag_args} --tag ${tag}"
+          done < .image-tags
 
-          args=()
+          label_args=""
-          for tag in "${tags[@]}"; do
+          while IFS= read -r label; do
-            args+=(--tag "$tag")
+            label_args="${label_args} --label ${label}"
-          done
+          done < .image-labels
 
-          docker build \
+          # tag/label 参数都由上面的脚本生成，值里不包含空格；
+          # 这里保留拆词是为了把它们展开成 docker build 参数。
+          # shellcheck disable=SC2086
+          docker build $tag_args $label_args \
             --build-arg "NODE_IMAGE=${NODE_IMAGE}" \
             --build-arg "NPM_REGISTRY=${NPM_REGISTRY}" \
-            "${args[@]}" \
             .
 
       - name: Push image
-        shell: bash
+        shell: sh
         run: |
-          mapfile -t tags <<< "${{ steps.meta.outputs.tags }}"
+          while IFS= read -r tag; do
-
-          for tag in "${tags[@]}"; do
             docker push "$tag"
-          done
+          done < .image-tags

Dockerfile

@@ -3,11 +3,16 @@ ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 FROM ${NODE_IMAGE} AS deps
 WORKDIR /app
+# FROM 之前声明的 ARG 不会自动进入每个构建阶段；
+# 只要 RUN 命令里要使用 registry，就需要在当前阶段重新声明。
+ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+# 仓库中提交的 lockfile 是本次构建的可信输入；
+# 这里避免 pnpm 11 在 Docker 构建期间重新用 registry 元数据校验供应链策略。
 RUN corepack enable \
   && pnpm config set registry ${NPM_REGISTRY} \
-  && pnpm install --frozen-lockfile
+  && pnpm install --frozen-lockfile --config.trust-lockfile=true
 
 FROM ${NODE_IMAGE} AS builder
 WORKDIR /app
@@ -15,8 +20,10 @@ ENV NEXT_TELEMETRY_DISABLED=1
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
+# 每个 Docker 阶段都有独立 PATH，因此使用 pnpm 前需要重新启用 corepack。
+RUN corepack enable
 RUN mkdir -p public/audio
-RUN npm run build
+RUN pnpm build
 
 FROM ${NODE_IMAGE} AS runner
 WORKDIR /app
@@ -29,9 +36,10 @@ ENV PORT=3000
 ENV AUDIO_DIRECTORY=/app/public/audio
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+# 运行时镜像只安装生产依赖。
 RUN corepack enable \
   && pnpm config set registry ${NPM_REGISTRY} \
-  && pnpm install --prod --frozen-lockfile \
+  && pnpm install --prod --frozen-lockfile --config.trust-lockfile=true \
   && pnpm store prune
 
 COPY --from=builder /app/.next ./.next