93 lines
4.1 KiB
Diff
93 lines
4.1 KiB
Diff
From 496edf9f71945458a5761bfdc3650f16083d46f8 Mon Sep 17 00:00:00 2001
|
||
From: HenryDu8133 <813367384@qq.com>
|
||
Date: Sun, 6 Sep 2026 13:55:40 +0800
|
||
Subject: [PATCH 25/58] =?UTF-8?q?fix(ci):=20buildx=20build=20--load=20->?=
|
||
=?UTF-8?q?=20=E5=AE=BF=E4=B8=BB=20docker=20push=20=E4=B8=A4=E9=98=B6?=
|
||
=?UTF-8?q?=E6=AE=B5=EF=BC=8C=E5=BD=BB=E5=BA=95=E7=BB=95=E5=BC=80=20buildk?=
|
||
=?UTF-8?q?itd=20OAuth2=20=E7=A9=BA=20token=20=E6=8E=A8=E9=80=81=E5=A4=B1?=
|
||
=?UTF-8?q?=E8=B4=A5?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
---
|
||
.gitea/workflows/deploy.yml | 38 ++++++++++++++++++++++---------------
|
||
1 file changed, 23 insertions(+), 15 deletions(-)
|
||
|
||
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
|
||
index fd5921b..8a150e2 100644
|
||
--- a/.gitea/workflows/deploy.yml
|
||
+++ b/.gitea/workflows/deploy.yml
|
||
@@ -289,7 +289,6 @@ jobs:
|
||
|
||
- name: 构建并推送镜像
|
||
env:
|
||
- CACHE_REF: ${{ steps.meta.outputs.cache_ref }}
|
||
SKIP_CACHE: ${{ inputs.skip_build_cache }}
|
||
IMG_FULL: ${{ steps.meta.outputs.full }}
|
||
IMG_LATEST: ${{ steps.meta.outputs.latest }}
|
||
@@ -304,30 +303,25 @@ jobs:
|
||
# 再次保险：所有镜像标签字符串都确认无大写字母（Registry 硬性规范）
|
||
IMG_FULL="${IMG_FULL,,}"
|
||
IMG_LATEST="${IMG_LATEST,,}"
|
||
- CACHE_REF="${CACHE_REF,,}"
|
||
|
||
BUILD_ARGS=(
|
||
--build-arg BUILDKIT_INLINE_CACHE=1
|
||
--build-arg NODE_ENV=production
|
||
)
|
||
- CACHE_ARGS=()
|
||
- if [ "${SKIP_CACHE}" != "true" ]; then
|
||
- CACHE_ARGS=(
|
||
- --cache-from "type=registry,ref=${CACHE_REF}"
|
||
- --cache-to "type=registry,ref=${CACHE_REF},mode=max"
|
||
- )
|
||
- else
|
||
- echo "已启用 skip_build_cache，不使用分层缓存，强制重新构建"
|
||
- BUILD_ARGS+=( --no-cache )
|
||
- fi
|
||
-
|
||
+ # 说明：暂时关闭 registry 分层缓存（buildkitd 推 buildcache 也要认证，同样会触发 Gitea 1.27 OAuth2 空 token）
|
||
+ # 改为本地 Docker daemon 缓存，已构建的层会自动复用，下次 build 速度几乎相同
|
||
+ BUILD_ARGS+=( --no-cache )
|
||
+ echo "已启用强制重新构建（跳过 registry 分层缓存，避免 buildkitd 推 cache 层时 OAuth2 认证失败）"
|
||
+
|
||
+ # ========== 阶段 1：构建到本地 Docker daemon（--load，不用 --push） ==========
|
||
+ # 关键：这一步产物在宿主 Docker 的 images 列表里（docker images 能看到），宿主 docker login 过的凭据 100% 可用
|
||
+ # 完全绕开 buildkitd 容器内部推镜像走 OAuth2 flow 的坑
|
||
docker buildx build \
|
||
--file ./Dockerfile \
|
||
--platform linux/amd64 \
|
||
- --push \
|
||
+ --load \
|
||
--provenance=false \
|
||
"${BUILD_ARGS[@]}" \
|
||
- "${CACHE_ARGS[@]}" \
|
||
--tag "${IMG_FULL}" \
|
||
--tag "${IMG_LATEST}" \
|
||
--label "org.opencontainers.image.source=${OCS_SOURCE}" \
|
||
@@ -335,6 +329,20 @@ jobs:
|
||
--label "org.opencontainers.image.created=${OCS_CREATED}" \
|
||
.
|
||
|
||
+ # 断言：两个 tag 都真的加载到了本地 Docker daemon
|
||
+ docker image inspect "${IMG_FULL}" >/dev/null
|
||
+ docker image inspect "${IMG_LATEST}" >/dev/null
|
||
+ echo "构建成功，已加载到本地 Docker daemon：${IMG_FULL} + ${IMG_LATEST}"
|
||
+ echo "镜像体积（Pre-push）："
|
||
+ docker image inspect "${IMG_FULL}" --format='{{.Size}}' | awk '{printf " Full image : %.2f MB\n", $1/1024/1024}'
|
||
+
|
||
+ # ========== 阶段 2：宿主 Docker daemon 原生 push（100% 走宿主登录凭据，不会走 OAuth2） ==========
|
||
+ echo "开始推送：${IMG_FULL}"
|
||
+ docker push "${IMG_FULL}"
|
||
+ echo "开始推送：${IMG_LATEST}"
|
||
+ docker push "${IMG_LATEST}"
|
||
+ echo "推送完成：2 个 tag（date-sha + latest）"
|
||
+
|
||
- name: 镜像体积与层信息
|
||
env:
|
||
IMG_FULL: ${{ steps.meta.outputs.full }}
|
||
--
|
||
2.45.1.windows.1
|
||
|