fix(ci): 修复 Preflight/构建 Job 源死循环（ca-certificates 与 HTTPS 镜像源鸡生蛋问题）
- env 新增 HTTP/HTTPS 双套镜像源变量（Debian bookworm + Ubuntu 22.04） - Preflight（Debian slim 容器）：Step 0 先用 HTTP 清华源 apt-get 装 ca-certificates + update-ca-certificates；Step 1 有证书后再切 HTTPS 清华源装 git/curl - build-image（Ubuntu 宿主 Runner）：apt-get 用默认 HTTP archive.ubuntu.com 先装 ca-certificates；之后再 sed 换 HTTPS 清华源，避免同样的证书死循环 - 本地 yaml.safe_load 验证通过（YAML_OK）；grep uses: 0 行；grep GH_PROXY_PREFIX 7 处 全部走用户指定的 https://v4.gh-proxy.org/ 前缀
This commit is contained in:
+48
-18
@@ -28,6 +28,12 @@ env:
|
||||
GH_PROXY_PREFIX: https://v4.gh-proxy.org/
|
||||
APT_MIRROR_DEBIAN: https://mirrors.tuna.tsinghua.edu.cn/debian
|
||||
APT_MIRROR_DEBIAN_SECURITY: https://mirrors.tuna.tsinghua.edu.cn/debian-security
|
||||
APT_MIRROR_DEBIAN_HTTP: http://mirrors.tuna.tsinghua.edu.cn/debian
|
||||
APT_MIRROR_DEBIAN_SECURITY_HTTP: http://mirrors.tuna.tsinghua.edu.cn/debian-security
|
||||
APT_MIRROR_UBUNTU: https://mirrors.tuna.tsinghua.edu.cn/ubuntu
|
||||
APT_MIRROR_UBUNTU_SECURITY: https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security
|
||||
APT_MIRROR_UBUNTU_HTTP: http://mirrors.tuna.tsinghua.edu.cn/ubuntu
|
||||
APT_MIRROR_UBUNTU_SECURITY_HTTP: http://mirrors.tuna.tsinghua.edu.cn/ubuntu-security
|
||||
HTTP_PROXY_EXAMPLE: ""
|
||||
HTTPS_PROXY_EXAMPLE: ""
|
||||
|
||||
@@ -42,27 +48,39 @@ jobs:
|
||||
- name: 安装基础运行依赖（git/ca-certificates，已换清华 TUNA 源）
|
||||
run: |
|
||||
set -euxo pipefail
|
||||
# Debian 12 (bookworm) 换清华 TUNA 国内镜像（避免 deb.debian.org 国外源速度 <200KB/s）
|
||||
# ========== Step 0：先用 HTTP 清华源装 ca-certificates（解鸡生蛋：HTTPS 需要证书，证书得先用 HTTP 装） ==========
|
||||
SOURCES_FILE="/etc/apt/sources.list.d/debian.sources"
|
||||
if [ -f "${SOURCES_FILE}" ]; then
|
||||
sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|http://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|https://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|http://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|https://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" "${SOURCES_FILE}"
|
||||
else
|
||||
# 兜底旧格式 /etc/apt/sources.list
|
||||
if [ -f /etc/apt/sources.list ]; then
|
||||
sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
|
||||
sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
|
||||
sed -i "s|http://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
|
||||
sed -i "s|https://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
|
||||
sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" /etc/apt/sources.list
|
||||
sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" /etc/apt/sources.list
|
||||
sed -i "s|http://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" /etc/apt/sources.list
|
||||
sed -i "s|https://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" /etc/apt/sources.list
|
||||
fi
|
||||
fi
|
||||
apt-get update -qq
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends \
|
||||
git ca-certificates curl
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends ca-certificates
|
||||
update-ca-certificates 2>/dev/null || true
|
||||
|
||||
# ========== Step 1：现在有了证书，换成 HTTPS 清华源（更安全）+ 装 git/curl ==========
|
||||
if [ -f "${SOURCES_FILE}" ]; then
|
||||
sed -i "s|${APT_MIRROR_DEBIAN_HTTP}|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
|
||||
sed -i "s|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
|
||||
else
|
||||
if [ -f /etc/apt/sources.list ]; then
|
||||
sed -i "s|${APT_MIRROR_DEBIAN_HTTP}|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
|
||||
sed -i "s|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
|
||||
fi
|
||||
fi
|
||||
apt-get update -qq
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends git curl
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
# 全局 git 代理：任何 git clone/fetch/pull https://github.com/... 自动走 gh-proxy.com 前缀
|
||||
# 全局 git 代理：任何 git clone/fetch/pull https://github.com/... 自动走 gh-proxy 前缀
|
||||
git config --system url."${GH_PROXY_PREFIX}https://github.com/".insteadOf "https://github.com/" || true
|
||||
git --version
|
||||
node -v
|
||||
@@ -116,19 +134,31 @@ jobs:
|
||||
- name: 系统环境准备（Ubuntu 22.04 默认镜像源换清华 + 全局 GitHub gh-proxy）
|
||||
run: |
|
||||
set -euxo pipefail
|
||||
# ========== Step 0：先装 ca-certificates（默认 HTTP archive.ubuntu.com 不需要证书，解鸡生蛋） ==========
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
sudo apt-get update -qq 2>/dev/null || apt-get update -qq 2>/dev/null || true
|
||||
sudo DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends ca-certificates 2>/dev/null || \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends ca-certificates 2>/dev/null || true
|
||||
sudo update-ca-certificates 2>/dev/null || update-ca-certificates 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# ========== Step 1：有了证书后换 HTTPS 清华源 ==========
|
||||
# Ubuntu 22.04 默认是 http://archive.ubuntu.com/ubuntu 和 http://security.ubuntu.com/ubuntu
|
||||
if command -v apt-get >/dev/null 2>&1 && [ -f /etc/apt/sources.list ]; then
|
||||
sudo sed -i \
|
||||
-e 's|http://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
|
||||
-e 's|http://security.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security|g' \
|
||||
-e 's|https://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
|
||||
-e 's|http://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
|
||||
-e 's|http://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
|
||||
-e 's|https://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
|
||||
-e 's|https://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
|
||||
/etc/apt/sources.list
|
||||
fi
|
||||
if command -v apt-get >/dev/null 2>&1 && ls /etc/apt/sources.list.d/*.sources 1>/dev/null 2>&1; then
|
||||
for f in /etc/apt/sources.list.d/*.sources; do
|
||||
sudo sed -i \
|
||||
-e 's|http://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
|
||||
-e 's|http://security.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security|g' \
|
||||
-e 's|http://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
|
||||
-e 's|http://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
|
||||
-e 's|https://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
|
||||
-e 's|https://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
|
||||
"${f}" 2>/dev/null || true
|
||||
done
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user