perf(ci): buildx builder 预拉 moby/buildkit 走国内 registry-mirrors，提速启动 5-10 倍

.gitea/workflows/deploy.yml

@@ -205,6 +205,7 @@ jobs:
         run: |
           set -euxo pipefail
           BUILDER_NAME="multi"
+          BUILDKIT_IMAGE="moby/buildkit:buildx-stable-1"
           BKK_CFG="$(mktemp -t buildkitd_XXXXXX.toml)"
           # 用 printf 逐行写 buildkitd 配置，避免 YAML parser 把 heredoc 内部的 [...] 误判为 YAML key
           {
@@ -213,6 +214,24 @@ jobs:
             printf '[registry."ghcr.io"]\n  mirrors = ["ghcr.nju.edu.cn","ghcr.dockerproxy.com"]\n\n'
             printf '[registry."k8s.gcr.io"]\n  mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n'
           } > "${BKK_CFG}"
+          # 预拉 buildkitd 基础镜像（优先 5 个国内镜像 fallback，避免 Docker Hub <200KB/s）
+          PULLED=0
+          for MIRROR in \
+            "docker.m.daocloud.io/${BUILDKIT_IMAGE}" \
+            "dockerproxy.com/${BUILDKIT_IMAGE}" \
+            "hub-mirror.c.163.com/${BUILDKIT_IMAGE}" \
+            "docker.nju.edu.cn/${BUILDKIT_IMAGE}" \
+            "docker.mirrors.ustc.edu.cn/${BUILDKIT_IMAGE}" \
+            "${BUILDKIT_IMAGE}"; do
+            if docker pull "${MIRROR}" 2>/dev/null; then
+              if [ "${MIRROR}" != "${BUILDKIT_IMAGE}" ]; then
+                docker tag "${MIRROR}" "${BUILDKIT_IMAGE}" 2>/dev/null || true
+              fi
+              PULLED=1
+              break
+            fi
+          done
+          [ "${PULLED}" = "1" ] || { echo "ERROR: 无法拉取 buildkitd 基础镜像，请检查 Docker registry-mirrors"; exit 1; }
           docker buildx rm "${BUILDER_NAME}" 2>/dev/null || true
           docker buildx create \
             --name "${BUILDER_NAME}" \
@@ -220,13 +239,15 @@ jobs:
             --use \
             --config "${BKK_CFG}" \
             --buildkitd-flags '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host' \
-            --driver-opt network=host
+            --driver-opt network=host \
+            --driver-opt "image=${BUILDKIT_IMAGE}"
           rm -f "${BKK_CFG}"
-          export GIT_CONFIG_COUNT=2
-          export GIT_CONFIG_KEY_0="url.${GH_PROXY_PREFIX}https://github.com/.insteadOf"
-          export GIT_CONFIG_VALUE_0="https://github.com/"
-          export GIT_CONFIG_KEY_1="url.${GH_PROXY_PREFIX}https://gist.github.com/.insteadOf"
-          export GIT_CONFIG_VALUE_1="https://gist.github.com/"
+          # gh-proxy 环境（全变量显式赋值，避免 bash tracing 边界反引号歧义）
+          GIT_CONFIG_KEY_0="url.${GH_PROXY_PREFIX}https://github.com/.insteadOf"
+          GIT_CONFIG_VALUE_0="https://github.com/"
+          GIT_CONFIG_KEY_1="url.${GH_PROXY_PREFIX}https://gist.github.com/.insteadOf"
+          GIT_CONFIG_VALUE_1="https://gist.github.com/"
+          export GIT_CONFIG_COUNT=2 GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1
           docker buildx inspect --bootstrap
 
       - name: 登录 Gitea 容器仓库