fix(ci): 使用隔离服务运行 PostgreSQL 集成库

将 PostgreSQL 16 改为固定 digest 的 Actions service container，并通过专用 Job 网络向 Go migrator 和集成测试提供数据库。

移除 PR Job 对 Docker CLI 的依赖，继续禁止宿主及内层 Docker API 暴露；同步发布工作流、契约测试和镜像代理恢复说明。

.gitea/workflows/ci.yml

@@ -9,8 +9,22 @@ on:
 jobs:
   verify:
     runs-on: easyai-gateway-ci-unprivileged-v2
+    services:
+      postgres:
+        image: docker.io/library/postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+        env:
+          POSTGRES_USER: easyai_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+          POSTGRES_DB: easyai_gateway_test
+        options: >-
+          --health-cmd "pg_isready -U easyai_test -d easyai_gateway_test"
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
     env:
       TRIVY_DB_REPOSITORY: ghcr.m.daocloud.io/aquasecurity/trivy-db:2
+      AI_GATEWAY_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
+      AI_GATEWAY_TEST_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
     steps:
       - name: Checkout without external Actions
         env:
@@ -47,7 +61,6 @@ jobs:
           go version
           node --version
           pnpm --version
-          docker --version
           docker-compose version
           shellcheck --version
           trivy --version
@@ -80,37 +93,9 @@ jobs:
             printf 'Go files require gofmt:\n%s\n' "$unformatted" >&2
             exit 1
           }
-      - name: Start PostgreSQL 16 integration database
-        env:
-          CI_RUN_ID: ${{ github.run_id }}
-          CI_RUN_NUMBER: ${{ github.run_number }}
-        run: |
-          set -eu
-          container="easyai-gateway-test-pg-${CI_RUN_ID}-${CI_RUN_NUMBER}"
-          docker run -d --rm --name "$container" \
-            -e POSTGRES_USER=easyai_test \
-            -e POSTGRES_PASSWORD=easyai_test_only \
-            -e POSTGRES_DB=easyai_gateway_test \
-            postgres:16-alpine
-          for attempt in $(seq 1 60); do
-            if docker exec "$container" pg_isready -U easyai_test -d easyai_gateway_test >/dev/null 2>&1; then
-              break
-            fi
-            test "$attempt" -lt 60
-            sleep 1
-          done
-          database_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$container")
-          test -n "$database_ip"
-          printf 'AI_GATEWAY_TEST_DATABASE_URL=postgresql://easyai_test:easyai_test_only@%s:5432/easyai_gateway_test?sslmode=disable\n' "$database_ip" >> "$GITHUB_ENV"
-          printf 'AI_GATEWAY_TEST_POSTGRES_CONTAINER=%s\n' "$container" >> "$GITHUB_ENV"
-          docker exec "$container" psql -v ON_ERROR_STOP=1 -U easyai_test -d easyai_gateway_test \
-            -c 'CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())'
-          for migration in apps/api/migrations/*.sql; do
-            docker exec -i "$container" psql -v ON_ERROR_STOP=1 -U easyai_test -d easyai_gateway_test < "$migration"
-            version=$(basename "$migration" .sql)
-            docker exec "$container" psql -v ON_ERROR_STOP=1 -U easyai_test -d easyai_gateway_test \
-              -c "INSERT INTO schema_migrations(version) VALUES ('$version') ON CONFLICT (version) DO NOTHING"
-          done
+      - name: Migrate PostgreSQL 16 integration database
+        working-directory: apps/api
+        run: go run ./cmd/migrate
       - name: Verify Go code
         working-directory: apps/api
         env:
@@ -142,9 +127,3 @@ jobs:
           trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL \
             --ignore-unfixed --exit-code 1 --timeout 15m --skip-dirs .git \
             --skip-dirs node_modules .
-      - name: Stop PostgreSQL integration database
-        if: always()
-        run: |
-          if test -n "${AI_GATEWAY_TEST_POSTGRES_CONTAINER:-}"; then
-            docker rm -f "$AI_GATEWAY_TEST_POSTGRES_CONTAINER" >/dev/null 2>&1 || true
-          fi

.gitea/workflows/release-ci.yml

@@ -7,8 +7,22 @@ on:
 jobs:
   verify-tag:
     runs-on: easyai-gateway-ci-unprivileged-v2
+    services:
+      postgres:
+        image: docker.io/library/postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+        env:
+          POSTGRES_USER: easyai_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+          POSTGRES_DB: easyai_gateway_test
+        options: >-
+          --health-cmd "pg_isready -U easyai_test -d easyai_gateway_test"
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
     env:
       TRIVY_DB_REPOSITORY: ghcr.m.daocloud.io/aquasecurity/trivy-db:2
+      AI_GATEWAY_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
+      AI_GATEWAY_TEST_DATABASE_URL: postgresql://easyai_test@postgres:5432/easyai_gateway_test?sslmode=disable
     steps:
       - name: Checkout without external Actions
         env:
@@ -31,7 +45,6 @@ jobs:
           go version
           node --version
           pnpm --version
-          docker --version
           docker-compose version
           shellcheck --version
           trivy --version
@@ -65,37 +78,9 @@ jobs:
             printf 'Go files require gofmt:\n%s\n' "$unformatted" >&2
             exit 1
           }
-      - name: Start PostgreSQL 16 integration database
-        env:
-          CI_RUN_ID: ${{ github.run_id }}
-          CI_RUN_NUMBER: ${{ github.run_number }}
-        run: |
-          set -eu
-          container="easyai-gateway-test-pg-${CI_RUN_ID}-${CI_RUN_NUMBER}"
-          docker run -d --rm --name "$container" \
-            -e POSTGRES_USER=easyai_test \
-            -e POSTGRES_PASSWORD=easyai_test_only \
-            -e POSTGRES_DB=easyai_gateway_test \
-            postgres:16-alpine
-          for attempt in $(seq 1 60); do
-            if docker exec "$container" pg_isready -U easyai_test -d easyai_gateway_test >/dev/null 2>&1; then
-              break
-            fi
-            test "$attempt" -lt 60
-            sleep 1
-          done
-          database_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$container")
-          test -n "$database_ip"
-          printf 'AI_GATEWAY_TEST_DATABASE_URL=postgresql://easyai_test:easyai_test_only@%s:5432/easyai_gateway_test?sslmode=disable\n' "$database_ip" >> "$GITHUB_ENV"
-          printf 'AI_GATEWAY_TEST_POSTGRES_CONTAINER=%s\n' "$container" >> "$GITHUB_ENV"
-          docker exec "$container" psql -v ON_ERROR_STOP=1 -U easyai_test -d easyai_gateway_test \
-            -c 'CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())'
-          for migration in apps/api/migrations/*.sql; do
-            docker exec -i "$container" psql -v ON_ERROR_STOP=1 -U easyai_test -d easyai_gateway_test < "$migration"
-            version=$(basename "$migration" .sql)
-            docker exec "$container" psql -v ON_ERROR_STOP=1 -U easyai_test -d easyai_gateway_test \
-              -c "INSERT INTO schema_migrations(version) VALUES ('$version') ON CONFLICT (version) DO NOTHING"
-          done
+      - name: Migrate PostgreSQL 16 integration database
+        working-directory: apps/api
+        run: go run ./cmd/migrate
       - name: Verify Go code
         working-directory: apps/api
         env:
@@ -127,9 +112,3 @@ jobs:
           trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL \
             --ignore-unfixed --exit-code 1 --timeout 15m --skip-dirs .git \
             --skip-dirs node_modules .
-      - name: Stop PostgreSQL integration database
-        if: always()
-        run: |
-          if test -n "${AI_GATEWAY_TEST_POSTGRES_CONTAINER:-}"; then
-            docker rm -f "$AI_GATEWAY_TEST_POSTGRES_CONTAINER" >/dev/null 2>&1 || true
-          fi