chore(merge): 整合最新 main 与统一认证变更

合并远端生产 CI、依赖与 API 文档改动，保留统一认证和 SSF 能力。由于远端生产基线已占用 0062，将尚未发布的身份迁移整理为 0063 至 0068 的最终增量 Schema，移除仅用于开发期草稿升级的破坏性迁移步骤。验证：go test ./...。其余生产门禁在合并提交后继续执行。
2026-07-17 19:06:37 +08:00
parent 5b8178b703 6cc24fa978
commit 4426eeccf7
100 changed files with 9673 additions and 1799 deletions
@@ -0,0 +1,36 @@
+log:
+  level: info
+
+runner:
+  file: /data/.runner
+  capacity: 1
+  envs:
+    GOPROXY: "https://goproxy.cn,direct"
+    GOSUMDB: "sum.golang.google.cn"
+    PATH: "/opt/easyai-gateway-ci/bin:/opt/easyai-gateway-ci/toolchains/go/bin:/opt/easyai-gateway-ci/toolchains/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+  timeout: 3h
+  shutdown_timeout: 5m
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels:
+    - "easyai-gateway-ci-unprivileged-v2:docker://docker.io/library/node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7"
+
+cache:
+  enabled: false
+
+container:
+  docker_host: "-"
+  privileged: false
+  force_pull: false
+  force_rebuild: false
+  require_docker: true
+  docker_timeout: 1m
+  bind_workdir: false
+  workdir_parent: workspace
+  options: "--volume /opt/easyai-gateway-ci:/opt/easyai-gateway-ci:ro"
+  valid_volumes:
+    - "/opt/easyai-gateway-ci"
+
+host:
+  workdir_parent: /data/host-work
@@ -0,0 +1,44 @@
+[Unit]
+Description=EasyAI AI Gateway rootless DinD Gitea Actions runner v2
+Requires=docker.service
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+Environment=RUNNER_SECURITY_OPTIONS=
+Environment=RUNNER_IMAGE_REF=
+EnvironmentFile=-/etc/easyai-gateway-ci-v2/runner.env
+ExecStartPre=-/usr/bin/docker rm --force easyai-gateway-ci-v2-runner
+ExecStart=/usr/bin/docker run --rm --pull=never --name easyai-gateway-ci-v2-runner --privileged --cpus 2 --memory 2g --memory-swap 3g --pids-limit 1024 $RUNNER_SECURITY_OPTIONS --volume easyai-gateway-ci-v2-data:/data --volume /etc/easyai-gateway-ci-v2/config.yaml:/config.yaml:ro --volume /etc/easyai-gateway-ci-v2/daemon.json:/home/rootless/.config/docker/daemon.json:ro --volume /opt/easyai-gateway-ci:/opt/easyai-gateway-ci:ro --env CONFIG_FILE=/config.yaml --env DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns --env DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520 --env DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--pidns $RUNNER_IMAGE_REF
+ExecStop=-/usr/bin/docker stop --time 360 easyai-gateway-ci-v2-runner
+Restart=always
+RestartSec=5s
+TimeoutStartSec=60s
+TimeoutStopSec=390s
+
+# systemd only launches the host Docker client. Pull-request jobs run inside the
+# nested rootless daemon and never receive the host or nested Docker socket.
+NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1 @@
+2d6c16fec0bec9c0288e5cb142b458af982fff8f