feat(ci): M-2 local cache为主 + registry cache兜底 - 解决缓存导入慢247s问题

Merge PR #357: fix(ci): 修复registry不稳定导致构建失败 - 构建与缓存推送解耦

.gitea/workflows/ci-cd.yml

@@ -96,7 +96,7 @@ jobs:
       shell: sh
       env:
         GITHUB_TOKEN: ${{ github.token }}
-      run: "set -eu\nSCAN_MODE=\"full\"\nCHANGED_PY_FILES=\"\"\n\nif [ \"${GITHUB_EVENT_NAME:-}\" = \"pull_request\" ] && [ -n \"${GITHUB_BASE_REF:-}\" ]; then\n  echo \"PR mode (base: ${GITHUB_BASE_REF}) - preparing incremental scan\"\n  git init -q\n  git config user.email \"ci@localhost\"\n  git config user.name \"CI\"\n  git add .\n  git commit -q -m \"current\"\n  REPO_URL=\"https://x-access-token:${GITHUB_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git\"\n  git remote add origin \"$REPO_URL\"\n  if git fetch origin \"${GITHUB_BASE_REF}\" --depth=50 -q 2>/dev/null; then\n    CHANGED_PY_FILES=$(git diff --name-only --diff-filter=ACMRT \"origin/${GITHUB_BASE_REF}\" HEAD -- '*.py' 2>/dev/null | tr '\\n' ' ')\n    if [ -n \"$CHANGED_PY_FILES\" ]; then\n      SCAN_MODE=\"incremental\"\n      FILE_COUNT=$(echo \"$CHANGED_PY_FILES\" | wc -w)\n      echo \"Changed Python files: ${FILE_COUNT}\"\n      echo \"$CHANGED_PY_FILES\" | tr ' ' '\\n' | grep -v '^$'\n    else\n      SCAN_MODE=\"skip_py\"\n      echo \"No Python files changed in this PR\"\n    fi\n  else\n    echo \"WARN: failed to fetch base branch, falling back to full scan\"\n  fi\nelse\n  echo \"Full scan mode (not a PR event)\"\nfi\n\necho \"SCAN_MODE=$SCAN_MODE\" >> $GITHUB_ENV\necho \"CHANGED_PY_FILES=$CHANGED_PY_FILES\" >> $GITHUB_ENV\n"
+      run: "set -eu\nSCAN_MODE=\"full\"\nCHANGED_PY_FILES=\"\"\n\nif [ \"${GITHUB_EVENT_NAME:-}\" = \"pull_request\" ] && [ -n \"${GITHUB_REF_NAME:-}\" ]; then\n  echo \"PR mode (#${GITHUB_REF_NAME}) - fetching changed files from API\"\n\n  PR_NUMBER=$(echo \"$GITHUB_REF\" | sed 's|refs/pull/||; s|/.*||')\n  API_URL=\"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files?limit=100\"\n\n  set +e\n  RESPONSE=$(curl -s -w \"\\n%{http_code}\" -H \"Authorization: token ${GITHUB_TOKEN}\" \"${API_URL}\")\n  HTTP_CODE=$(echo \"$RESPONSE\" | tail -n1)\n  BODY=$(echo \"$RESPONSE\" | sed '$d')\n  set -e\n\n  if [ \"$HTTP_CODE\" = \"200\" ]; then\n    CHANGED_PY_FILES=$(echo \"$BODY\" | python3 -c \"\nimport json, sys\ntry:\n    files = json.load(sys.stdin)\n    py_files = [f['filename'] for f in files\n                if f['filename'].endswith('.py') and f['status'] != 'removed']\n    print(' '.join(py_files))\nexcept Exception:\n    print('')\n\")\n    if [ -n \"$CHANGED_PY_FILES\" ]; then\n      SCAN_MODE=\"incremental\"\n      FILE_COUNT=$(echo \"$CHANGED_PY_FILES\" | wc -w)\n      echo \"Changed Python files: ${FILE_COUNT}\"\n      echo \"$CHANGED_PY_FILES\" | tr ' ' '\\n' | grep -v '^$'\n    else\n      SCAN_MODE=\"skip_py\"\n      echo \"No Python files changed in this PR\"\n    fi\n  else\n    echo \"WARN: API returned HTTP $HTTP_CODE, falling back to full scan\"\n  fi\nelse\n  echo \"Full scan mode (not a PR event)\"\nfi\n\necho \"SCAN_MODE=$SCAN_MODE\" >> $GITHUB_ENV\necho \"CHANGED_PY_FILES=$CHANGED_PY_FILES\" >> $GITHUB_ENV\n"
     - name: Run code quality checks
       shell: sh
       run: "set -eu\n\nif [ \"$SCAN_MODE\" = \"incremental\" ]; then\n  echo \"=== Incremental scan mode ===\"\n\n  python3 -m compileall -q $CHANGED_PY_FILES\n\n  python3 -m black --check --fast $CHANGED_PY_FILES\n\n  python3 -m isort --check-only $CHANGED_PY_FILES\n\n  RUFF_FILES=$(echo \"$CHANGED_PY_FILES\" | tr ' ' '\\n' | grep -v '^scripts/' | tr '\\n' ' ')\n  if [ -n \"$RUFF_FILES\" ]; then\n    python3 -m ruff check $RUFF_FILES --statistics\n  else\n    echo \"No ruff-checkable files changed, skipping\"\n  fi\n\nelif [ \"$SCAN_MODE\" = \"skip_py\" ]; then\n  echo \"No Python files changed - skipping Python lint checks\"\n\nelse\n  echo \"=== Full scan mode ===\"\n\n  python3 -m compileall -q alembic apps packages tests scripts\n\n  python3 -m black --check --fast alembic apps packages tests scripts\n\n  python3 -m isort --check-only alembic apps packages tests scripts\n\n  python3 -m ruff check apps packages tests --statistics\nfi\n"

scripts/ci/docker_build_push.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
-# 通用Docker镜像构建+推送脚本（构建与缓存解耦）
+# 通用Docker镜像构建+推送脚本（local cache为主 + registry cache兜底）
+# M-2优化：解决registry缓存导入慢(247s)和推送不稳定问题
 # 用法: docker_build_push.sh <Dockerfile> <image_tag> <cache_ref> [build_arg...]
 set -eu
 
@@ -21,40 +22,59 @@ else
 fi
 docker buildx inspect --bootstrap
 
-CACHE_FROM="type=registry,ref=${CACHE_REF},ignore-error=true"
+# 从cache_ref中提取缓存名称（如 api-cache:develop -> api-cache-develop）
+CACHE_NAME=$(echo "$CACHE_REF" | tr '/' '_' | tr ':' '-')
+LOCAL_CACHE_DIR="/tmp/buildx-cache/${CACHE_NAME}"
+
+mkdir -p "$LOCAL_CACHE_DIR"
+
+# 缓存源：local优先，registry兜底
+CACHE_FROM_LOCAL="type=local,src=${LOCAL_CACHE_DIR}"
+CACHE_FROM_REGISTRY="type=registry,ref=${CACHE_REF},ignore-error=true"
+
+# 本地缓存目标（必选，mode=max最大化命中率）
+CACHE_TO_LOCAL="type=local,dest=${LOCAL_CACHE_DIR},mode=max"
+
+echo "=== Step 1: Build & push image (local cache read-write + registry read) ==="
+echo "Local cache: ${LOCAL_CACHE_DIR}"
+echo "Registry cache: ${CACHE_REF}"
+echo ""
 
-echo "=== Step 1: Build & push image (read-only cache) ==="
 docker buildx build \
   $BUILD_ARGS \
-  --cache-from "${CACHE_FROM}" \
+  --cache-from "${CACHE_FROM_LOCAL}" \
+  --cache-from "${CACHE_FROM_REGISTRY}" \
+  --cache-to "${CACHE_TO_LOCAL}" \
   -f "${DOCKERFILE}" \
   -t "${IMAGE_TAG}" \
   --push \
   .
 
+echo ""
 echo "Image pushed: ${IMAGE_TAG}"
+echo "Local cache updated"
 
 echo ""
-echo "=== Step 2: Push cache (best effort, retries 3x) ==="
-CACHE_TO="type=registry,ref=${CACHE_REF},mode=max,compression=zstd"
+echo "=== Step 2: Sync registry cache (best effort, retries 3x) ==="
+CACHE_TO_REGISTRY="type=registry,ref=${CACHE_REF},mode=max,compression=zstd"
 
 MAX_RETRIES=3
 SUCCESS=0
 for attempt in $(seq 1 $MAX_RETRIES); do
-  echo "Cache push attempt $attempt/$MAX_RETRIES"
+  echo "Registry cache sync attempt $attempt/$MAX_RETRIES"
   if docker buildx build \
     $BUILD_ARGS \
-    --cache-from "${CACHE_FROM}" \
-    --cache-to "${CACHE_TO}" \
+    --cache-from "${CACHE_FROM_LOCAL}" \
+    --cache-to "${CACHE_TO_REGISTRY}" \
     -f "${DOCKERFILE}" \
     -t "${IMAGE_TAG}" \
     --push \
     .; then
-    echo "Cache pushed (attempt $attempt)"
+    echo "Registry cache synced (attempt $attempt)"
     SUCCESS=1
     break
   else
-    echo "Cache push failed (attempt $attempt)"
+    echo "Registry cache sync failed (attempt $attempt)"
     if [ $attempt -lt $MAX_RETRIES ]; then
       WAIT=$((attempt * 5))
       echo "Retrying in ${WAIT}s..."
@@ -64,7 +84,7 @@ for attempt in $(seq 1 $MAX_RETRIES); do
 done
 
 if [ $SUCCESS -eq 0 ]; then
-  echo "WARNING: Cache push failed after $MAX_RETRIES attempts (non-fatal)"
+  echo "WARNING: Registry cache sync failed after $MAX_RETRIES attempts (non-fatal, local cache still works)"
 fi
 
 echo ""