ci: 建立生产镜像与 Tag 发布流水线

新增独立仓库级 Gitea Runner，main 和 PR 执行完整质量门禁与不可变 SHA 镜像构建；只有来自 main 历史的语义版本 Tag 才调用受限生产发布助手。专属 Buildx builder 将缓存限制为 2 GB。\n\n验证：流水线结构测试、ShellCheck、Go vet/test、govulncheck、前端 lint/test/build、Compose 渲染及高危依赖审计通过。
2026-07-17 12:39:07 +08:00
parent af13a0444e
commit 745811cc6d
6 changed files with 418 additions and 0 deletions
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$root"
+
+tag=${IMAGE_TAG:-}
+registry=${AI_GATEWAY_IMAGE_REGISTRY:-registry.cn-shanghai.aliyuncs.com/easyaigc}
+builder=${AI_GATEWAY_BUILDX_BUILDER:-easyai-gateway-ci}
+cache_limit=${AI_GATEWAY_BUILDX_CACHE_LIMIT:-2gb}
+platform=${AI_GATEWAY_PLATFORM:-linux/amd64}
+
+if [[ ! $tag =~ ^[0-9a-f]{40}$ ]]; then
+  echo 'IMAGE_TAG must be a full lowercase Git SHA' >&2
+  exit 1
+fi
+if [[ ! $registry =~ ^[A-Za-z0-9.-]+(:[0-9]+)?(/[A-Za-z0-9._/-]+)+$ ]]; then
+  echo 'AI_GATEWAY_IMAGE_REGISTRY has an invalid format' >&2
+  exit 1
+fi
+
+if ! docker buildx inspect "$builder" >/dev/null 2>&1; then
+  docker buildx create --name "$builder" --driver docker-container --use >/dev/null
+fi
+docker buildx inspect "$builder" --bootstrap >/dev/null
+
+cleanup_cache() {
+  docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit" >/dev/null || true
+}
+trap cleanup_cache EXIT HUP INT TERM
+
+api_image="$registry/ai-gateway:$tag"
+web_image="$registry/ai-gateway-web:$tag"
+common_args=(
+  --builder "$builder"
+  --platform "$platform"
+  --file Dockerfile
+  --pull
+  --load
+)
+
+docker buildx build --builder "$builder" \
+  "${common_args[@]:2}" \
+  --target api \
+  --build-arg "GO_BUILD_IMAGE=${AI_GATEWAY_GO_BUILD_IMAGE:-docker.m.daocloud.io/library/golang:1.26.5-alpine}" \
+  --build-arg "API_RUNTIME_IMAGE=${AI_GATEWAY_API_RUNTIME_IMAGE:-docker.m.daocloud.io/library/alpine:3.22}" \
+  --tag "$api_image" .
+
+docker buildx build --builder "$builder" \
+  "${common_args[@]:2}" \
+  --target web \
+  --build-arg "NODE_BUILD_IMAGE=${AI_GATEWAY_NODE_BUILD_IMAGE:-docker.m.daocloud.io/library/node:24-alpine}" \
+  --build-arg "WEB_RUNTIME_IMAGE=${AI_GATEWAY_WEB_RUNTIME_IMAGE:-docker.m.daocloud.io/library/nginx:1.27-alpine}" \
+  --tag "$web_image" .
+
+for image in "$api_image" "$web_image"; do
+  trivy image --scanners vuln,secret --severity HIGH,CRITICAL --ignore-unfixed \
+    --exit-code 1 --timeout 15m "$image"
+done
+
+printf 'gateway_images=PASS git_sha=%s api=%s web=%s\n' "$tag" "$api_image" "$web_image"