From d3d2673e5cde5fcc3f6a546b668e3f2d2e95385d Mon Sep 17 00:00:00 2001
From: HenryDu8133 <813367384@qq.com>
Date: Sun, 13 Sep 2026 14:21:22 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E4=BF=AE=E5=A4=8D=20docker=20buildx?=
 =?UTF-8?q?=20=E8=B7=A8=20job=20=E6=97=A0=E6=B3=95=E5=A4=8D=E7=94=A8?=
 =?UTF-8?q?=E5=AE=9E=E4=BE=8B=E5=AF=BC=E8=87=B4=20instance=20multi=20?=
 =?UTF-8?q?=E6=89=BE=E4=B8=8D=E5=88=B0=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy.yml | 60 +++++++++++++++++++++++++++++++++++--
 1 file changed, 58 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 40c86ad..dda3a9f 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -509,6 +509,64 @@ jobs:
       image_full: ${{ needs.meta-warmup.outputs.image_full }}
       image_latest: ${{ needs.meta-warmup.outputs.image_latest }}
     steps:
+      - name: 检出代码
+        run: |
+          set -euxo pipefail
+          REPO_URL="https://${GITEA_HOST}/${GITHUB_REPOSITORY}.git"
+          BRANCH="${GITHUB_REF_NAME:-main}"
+          git clone --depth 1 -b "${BRANCH}" "${REPO_URL}" .
+
+      - name: 初始化 Docker Buildx builder (为本作业重新创建)
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || github.token }}
+        run: |
+          set -euxo pipefail
+          if [ -z "${REGISTRY_TOKEN}" ]; then
+            echo "ERROR: REGISTRY_TOKEN 为空。请在 Repository Secrets 中新建 REGISTRY_TOKEN"
+            exit 1
+          fi
+          REGISTRY_USER="${REGISTRY_USER,,}"
+          BUILDER_NAME="multi"
+          BUILDKIT_IMAGE="moby/buildkit:buildx-stable-1"
+          BKK_CFG="$(mktemp -t buildkitd_XXXXXX.toml)"
+          {
+            printf '[worker.oci]\n  max-parallelism = 2\n\n'
+            printf '[registry."docker.io"]\n  mirrors = ["docker.m.daocloud.io","dockerproxy.com","hub-mirror.c.163.com","docker.nju.edu.cn","docker.mirrors.ustc.edu.cn"]\n\n'
+            printf '[registry."ghcr.io"]\n  mirrors = ["ghcr.nju.edu.cn","ghcr.dockerproxy.com"]\n\n'
+            printf '[registry."k8s.gcr.io"]\n  mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n\n'
+            printf '[registry."%s"]\n  username = "%s"\n  password = "%s"\n' "${GITEA_HOST}" "${REGISTRY_USER}" "${REGISTRY_TOKEN}"
+          } > "${BKK_CFG}"
+          PULLED=0
+          for MIRROR in \
+            "docker.m.daocloud.io/${BUILDKIT_IMAGE}" \
+            "dockerproxy.com/${BUILDKIT_IMAGE}" \
+            "hub-mirror.c.163.com/${BUILDKIT_IMAGE}" \
+            "docker.nju.edu.cn/${BUILDKIT_IMAGE}" \
+            "docker.mirrors.ustc.edu.cn/${BUILDKIT_IMAGE}" \
+            "${BUILDKIT_IMAGE}"; do
+            if docker pull "${MIRROR}" 2>/dev/null; then
+              if [ "${MIRROR}" != "${BUILDKIT_IMAGE}" ]; then
+                docker tag "${MIRROR}" "${BUILDKIT_IMAGE}" 2>/dev/null || true
+              fi
+              PULLED=1
+              break
+            fi
+          done
+          [ "${PULLED}" = "1" ] || { echo "ERROR: 无法拉取 buildkitd 基础镜像"; exit 1; }
+          printf '%s' "${REGISTRY_TOKEN}" | docker login "${GITEA_HOST}" -u "${REGISTRY_USER}" --password-stdin
+          docker buildx rm "${BUILDER_NAME}" 2>/dev/null || true
+          docker buildx create \
+            --name "${BUILDER_NAME}" \
+            --driver docker-container \
+            --use \
+            --config "${BKK_CFG}" \
+            --buildkitd-flags '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host' \
+            --driver-opt network=host \
+            --driver-opt "image=${BUILDKIT_IMAGE}"
+          rm -f "${BKK_CFG}"
+          docker buildx inspect --bootstrap
+
       - name: 复用 meta-warmup 结果（与 Preflight 并发省 ~5min）
         run: |
           set -euo pipefail
@@ -522,8 +580,6 @@ jobs:
           echo "[meta-warmup] image_latest=${{ needs.meta-warmup.outputs.image_latest }}"
           echo "[meta-warmup] repo_owner=${{ needs.meta-warmup.outputs.repo_owner }}"
           echo "[meta-warmup] repo_name=${{ needs.meta-warmup.outputs.repo_name }}"
-          docker buildx use multi
-          docker buildx inspect
 
       - name: 构建并推送镜像
         env: