fix(ci): Preflight npm ci 防超时 + Deploy job 误触发保护\n\n- deploy.yml preflight/安装依赖 Step：新增「双 registry 切换 + 3 轮重试 + npm fetch-retries=5 + fetch-timeout=5min + prefer-offline」\n - 主站 https://registry.npmmirror.com 备用 https://mirrors.cloud.tencent.com/npm/（两套独立 CDN 节点），奇偶次交替\n - npm 内部 read ETIMEDOUT（exit 146）自动走 fetch-retries 重试；整轮失败 bash 层 15s 后再跑下一轮\n - 失败 3 轮才真正 exit 1，并在日志中明确提示可覆盖 NPM_REGISTRY_PRIMARY/FALLBACK\n- deploy.yml deploy job：if 条件从 \x27!cancelled() && !failure()\x27 改为 \x27always() && needs.build-image.result == \x27\x27success\x27\x27\x27\n - 之前 build-image 被 skip（preflight 先失败）时，!failure() 为真导致 deploy 被触发但 IMAGE_NEW 空 → exit 9 误报为 deploy 本身错\n - 现在仅当 build-image 真的 success 时才会执行 deploy，build-image 被跳过/失败时 deploy 自动显示为 skipped（符合语义）

.gitea/workflows/deploy.yml

@@ -178,13 +178,47 @@ jobs:
           git clone --depth 1 -b "${BRANCH}" "${REPO_URL}" .
           git rev-parse --short HEAD
 
-      - name: 安装依赖（npm ci）
+      - name: 安装依赖（npm ci，含网络超时兜底：双 registry 切换 + 3 次重试 + fetch-retires 5 次 + 5 分钟 fetch-timeout）
         run: |
-          set -euxo pipefail
+          set -euo pipefail
-          npm config set registry https://registry.npmmirror.com || true
+          # npmmirror 双域名容错（主站 registry.npmmirror.com + 腾讯云镜像 mirrors.cloud.tencent.com/npm/，两套独立 CDN 节点）
+          NPM_REGISTRY_PRIMARY="${NPM_REGISTRY_PRIMARY:-https://registry.npmmirror.com}"
+          NPM_REGISTRY_FALLBACK="${NPM_REGISTRY_FALLBACK:-https://mirrors.cloud.tencent.com/npm/}"
+          MAX_RETRY=3
+          DELAY_SEC=15
+          CI_OK=0
+          for ATTEMPT in $(seq 1 $MAX_RETRY); do
+            # 奇数次用主站、偶数次切备用域名（npmmirror 主站 429/超时/断流时兜底，避免一直卡一个节点）
+            if [ $(( ATTEMPT % 2 )) -eq 1 ]; then
+              CUR_REGISTRY="${NPM_REGISTRY_PRIMARY}"
+            else
+              CUR_REGISTRY="${NPM_REGISTRY_FALLBACK}"
+            fi
+            echo "--- [npm ci attempt $ATTEMPT/$MAX_RETRY] registry=${CUR_REGISTRY} ---"
+            npm config set registry "${CUR_REGISTRY}" || true
             npm config set fund false
             npm config set audit false
-          npm ci --legacy-peer-deps
+            npm config set prefer-offline true 2>/dev/null || true
+            npm config set cache-min 3600 2>/dev/null || true
+            # fetch-retries: npm 内部单次请求失败重试（read ETIMEDOUT / ECONNRESET 等网络抖动）
+            npm config set fetch-retries 5 2>/dev/null || true
+            # fetch-timeout=300000ms（5 分钟）：esbuild/@swc 等大型原生 prebuilt 包慢链路时避免 30s 读超时
+            npm config set fetch-retry-maxtimeout 300000 2>/dev/null || true
+            npm config set fetch-timeout 300000 2>/dev/null || true
+            npm config set fetch-retry-mintimeout 20000 2>/dev/null || true
+            if npm ci --legacy-peer-deps; then
+              CI_OK=1
+              echo "[npm ci] attempt ${ATTEMPT} SUCCESS"
+              break
+            fi
+            echo "[npm ci] attempt ${ATTEMPT} FAILED（exit=$?），${DELAY_SEC}s 后重试下一轮（若还有）..."
+            sleep $DELAY_SEC
+          done
+          if [ "${CI_OK}" != "1" ]; then
+            echo "ERROR: npm ci 经过 ${MAX_RETRY} 轮（主站/备用域名交替）仍失败，请检查 Runner 网络是否能访问 ${NPM_REGISTRY_PRIMARY} / ${NPM_REGISTRY_FALLBACK}" >&2
+            echo "  可在 Variables 中覆盖 NPM_REGISTRY_PRIMARY / NPM_REGISTRY_FALLBACK，或在 Runner 宿主机手动配 npm 代理" >&2
+            exit 1
+          fi
 
       - name: 检查 package.json 无 pnpm 残留
         run: |
@@ -497,7 +531,7 @@ jobs:
   deploy:
     name: 部署到生产服务器
     needs: build-image
-    if: ${{ !cancelled() && !failure() && (github.event_name == 'push' || inputs.deploy_target == true) }}
+    if: always() && needs.build-image.result == 'success' && (github.event_name == 'push' || inputs.deploy_target == true)
     runs-on: ubuntu-latest
     timeout-minutes: 25
     environment: