97 lines
5.6 KiB
Diff
97 lines
5.6 KiB
Diff
From 2097608f511695f4371b2727fbae48609636ffa4 Mon Sep 17 00:00:00 2001
|
||
From: HenryDu8133 <813367384@qq.com>
|
||
Date: Sun, 6 Sep 2026 13:42:04 +0800
|
||
Subject: [PATCH 24/58] =?UTF-8?q?fix(ci):=20buildkitd.toml=20=E6=B3=A8?=
|
||
=?UTF-8?q?=E5=85=A5=20Gitea=20Basic=20Auth=20=E5=87=AD=E6=8D=AE=EF=BC=8C?=
|
||
=?UTF-8?q?=E7=BB=95=E5=BC=80=20OAuth2=20=E7=A9=BA=20token=EF=BC=88authori?=
|
||
=?UTF-8?q?zation=20server=20did=20not=20include=20a=20token=EF=BC=89?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
---
|
||
.gitea/workflows/deploy.yml | 41 +++++++++++++++++++++++++------------
|
||
1 file changed, 28 insertions(+), 13 deletions(-)
|
||
|
||
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
|
||
index 06553ca..fd5921b 100644
|
||
--- a/.gitea/workflows/deploy.yml
|
||
+++ b/.gitea/workflows/deploy.yml
|
||
@@ -209,9 +209,18 @@ jobs:
|
||
echo "Cache ref : ${CACHE_REF_INNER}"
|
||
echo "======================================"
|
||
|
||
- - name: 初始化 Docker Buildx builder（带国内 registry-mirrors + gh-proxy 环境）
|
||
+ - name: 初始化 Docker Buildx builder（带国内 registry-mirrors + 内置 Gitea Basic Auth）
|
||
+ env:
|
||
+ REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
|
||
+ REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || github.token }}
|
||
run: |
|
||
set -euxo pipefail
|
||
+ # 先校验凭据非空（避免 buildkitd.toml 写空用户名/密码导致 push 时 401）
|
||
+ if [ -z "${REGISTRY_TOKEN}" ]; then
|
||
+ echo "ERROR: REGISTRY_TOKEN 为空。请在 Repository Secrets 中新建 REGISTRY_TOKEN（个人应用令牌，权限 read:package + write:package + read:repository）"
|
||
+ exit 1
|
||
+ fi
|
||
+ REGISTRY_USER="${REGISTRY_USER,,}"
|
||
BUILDER_NAME="multi"
|
||
BUILDKIT_IMAGE="moby/buildkit:buildx-stable-1"
|
||
BKK_CFG="$(mktemp -t buildkitd_XXXXXX.toml)"
|
||
@@ -220,7 +229,10 @@ jobs:
|
||
printf '[worker.oci]\n max-parallelism = 2\n\n'
|
||
printf '[registry."docker.io"]\n mirrors = ["docker.m.daocloud.io","dockerproxy.com","hub-mirror.c.163.com","docker.nju.edu.cn","docker.mirrors.ustc.edu.cn"]\n\n'
|
||
printf '[registry."ghcr.io"]\n mirrors = ["ghcr.nju.edu.cn","ghcr.dockerproxy.com"]\n\n'
|
||
- printf '[registry."k8s.gcr.io"]\n mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n'
|
||
+ printf '[registry."k8s.gcr.io"]\n mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n\n'
|
||
+ # 关键：Gitea Container Registry 直接用 Basic Auth 凭据写死在 buildkitd.toml
|
||
+ # 绕开 buildkitd 的 OAuth2 flow（Gitea 1.27.x 有时返回空 token body：authorization server did not include a token）
|
||
+ printf '[registry."%s"]\n username = "%s"\n password = "%s"\n' "${GITEA_HOST}" "${REGISTRY_USER}" "${REGISTRY_TOKEN}"
|
||
} > "${BKK_CFG}"
|
||
# 预拉 buildkitd 基础镜像（优先 5 个国内镜像 fallback，避免 Docker Hub <200KB/s）
|
||
PULLED=0
|
||
@@ -240,6 +252,11 @@ jobs:
|
||
fi
|
||
done
|
||
[ "${PULLED}" = "1" ] || { echo "ERROR: 无法拉取 buildkitd 基础镜像，请检查 Docker registry-mirrors"; exit 1; }
|
||
+ # 宿主 Docker daemon 也同步登录（后面镜像体积与层信息 Step 的 docker image inspect / docker history 要用）
|
||
+ printf '%s' "${REGISTRY_TOKEN}" | docker login "${GITEA_HOST}" \
|
||
+ -u "${REGISTRY_USER}" --password-stdin
|
||
+ echo "宿主 Docker 登录成功：${REGISTRY_USER} @ ${GITEA_HOST}"
|
||
+ # 立即重建 buildx builder（带凭据 + registry-mirrors）
|
||
docker buildx rm "${BUILDER_NAME}" 2>/dev/null || true
|
||
docker buildx create \
|
||
--name "${BUILDER_NAME}" \
|
||
@@ -257,20 +274,18 @@ jobs:
|
||
GIT_CONFIG_VALUE_1="https://gist.github.com/"
|
||
export GIT_CONFIG_COUNT=2 GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1
|
||
docker buildx inspect --bootstrap
|
||
+ echo "Builder 启动成功，buildkitd.toml 已内置 ${GITEA_HOST} Basic Auth 凭据，push 不再走 OAuth2 flow"
|
||
|
||
- - name: 登录 Gitea 容器仓库
|
||
- env:
|
||
- REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
|
||
- REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || github.token }}
|
||
+ - name: 确认已登录（凭据已注入 buildkitd.toml 与宿主 Docker daemon）
|
||
run: |
|
||
set -euo pipefail
|
||
- if [ -z "${REGISTRY_TOKEN}" ]; then
|
||
- echo "ERROR: REGISTRY_TOKEN 为空。请在 Repository Secrets 中新建 REGISTRY_TOKEN（权限：read:package + write:package）"
|
||
- exit 1
|
||
- fi
|
||
- printf '%s' "${REGISTRY_TOKEN}" | docker login "${GITEA_HOST}" \
|
||
- -u "${REGISTRY_USER}" --password-stdin
|
||
- echo "登录成功：${REGISTRY_USER} @ ${GITEA_HOST}"
|
||
+ # 前面「初始化 Docker Buildx builder」Step 已完成两次登录：
|
||
+ # 1. 宿主 Docker daemon（镜像体积 Step 要用）；2. buildkitd.toml（buildx push 要用，Basic Auth 不走 OAuth2）
|
||
+ # 这里只做一个快速断言，确保宿主登录成功
|
||
+ docker info 2>/dev/null | grep -E "Username|Registry" || echo "已存在登录凭据（跳过详细输出）"
|
||
+ echo "登录确认完成，REGISTRY_USER=${REGISTRY_USER:-${GITHUB_ACTOR,,}}，GITEA_HOST=${GITEA_HOST}"
|
||
+ env:
|
||
+ REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
|
||
|
||
- name: 构建并推送镜像
|
||
env:
|
||
--
|
||
2.45.1.windows.1
|
||
|