fix(ci): 解决Python版本不兼容导致单测失败

1. CI主机Python 3.10，但代码使用 datetime.UTC(Python 3.11+)，导入packages/domain直接ImportError
2. ci_env.sh新增_ensure_python311函数，检测并切换到python3.12
3. run_unit_tests/mypy_check/validate_code_quality/run_validate/validate_migration/run_integration_tests
   均走ci_env.sh统一Python版本保障；run_unit_tests的REQ_HASH_FILE按Python版本区分，避免跨版本复用
4. staging机已通过uv安装Python 3.12.15到/opt/python3.12/bin，并在act-runner-docker@.service的systemd override中PATH前置
5. 预装pytest/coverage/diff-cover/mypy到3.12环境，缩短首次CI耗时

alembic/versions/107_add_language_to_viral_video_jobs.py

@@ -6,12 +6,13 @@ Create Date: 2026-10-09
 
 """
 
-from alembic import op
 import sqlalchemy as sa
 
+from alembic import op
+
 # revision identifiers, used by Alembic.
 revision = "107"
-down_revision = "106"
+down_revision = "106_system_settings"
 branch_labels = None
 depends_on = None
 

scripts/ci/ci_env.sh

@@ -12,3 +12,22 @@ export CI_LOCAL_PG_PORT="${CI_LOCAL_PG_PORT:-5432}"
 
 # === 默认数据库名 ===
 export CI_DEFAULT_DB="${CI_DEFAULT_DB:-xiaoxia_saas}"
+
+# === Python 版本保障：本项目依赖 datetime.UTC，需要 Python >= 3.11 ===
+_ensure_python311() {
+  if python3 -c "import sys; assert sys.version_info >= (3, 11)" 2>/dev/null; then
+    return 0
+  fi
+  for cand in python3.12 python3.11 /opt/python3.12/bin/python3; do
+    if command -v "$cand" >/dev/null 2>&1 && "$cand" -c "import sys; assert sys.version_info >= (3, 11)" 2>/dev/null; then
+      _d="$(dirname "$(command -v "$cand")")"
+      export PATH="$_d:$PATH"
+      hash -r
+      echo "✅ ci_env: 切换到 $cand ($("$cand" -c 'import sys; print(sys.version.split()[0])'))"
+      return 0
+    fi
+  done
+  echo "❌ ci_env: 未找到 Python >= 3.11（datetime.UTC 需要），请安装 Python 3.11/3.12" >&2
+  return 1
+}
+_ensure_python311

scripts/ci/mypy_check.sh

@@ -4,6 +4,11 @@
 
 set -e
 
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+# shellcheck source=ci_env.sh
+source "${SCRIPT_DIR}/ci_env.sh"
+
+
 echo "=== Installing mypy ==="
 python3 -m pip install -q mypy
 mypy --version

scripts/ci/run_unit_tests.sh

@@ -7,9 +7,29 @@ JOB_NAME="${1:-Unit Tests}"
 
 echo "=== CI Unit Tests 开始 ==="
 
-# --- 依赖缓存检查 ---
+# --- Python 版本选择（必须 >= 3.11，代码使用 datetime.UTC）---
+if ! python3 -c "import sys; assert sys.version_info >= (3, 11)" 2>/dev/null; then
+  for cand in python3.12 python3.11 /opt/python3.12/bin/python3; do
+    if command -v "$cand" >/dev/null 2>&1 && "$cand" -c "import sys; assert sys.version_info >= (3, 11)" 2>/dev/null; then
+      PY3_DIR="$(dirname "$(command -v "$cand")")"
+      export PATH="$PY3_DIR:$PATH"
+      hash -r
+      echo "✅ python3 版本过低，改用 $cand ($("$cand" -c "import sys; print(sys.version.split()[0])"))"
+      break
+    fi
+  done
+  if ! python3 -c "import sys; assert sys.version_info >= (3, 11)" 2>/dev/null; then
+    echo "❌ 未找到 Python >= 3.11，本项目要求 Python 3.11+（使用 datetime.UTC）" >&2
+    exit 1
+  fi
+fi
+
+PYVER=$(python3 -c "import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")")
+echo "使用 Python 版本: $(python3 --version)"
+
+# --- 依赖缓存检查（按 Python 版本区分缓存文件，避免跨版本复用）---
 # 如果 requirements 文件未变化且依赖已安装，跳过 pip install（持久 runner 优化）
-REQ_HASH_FILE="/tmp/.ci_unit_tests_req_hash"
+REQ_HASH_FILE="/tmp/.ci_unit_tests_req_hash_py${PYVER}"
 CURRENT_REQ_HASH=""
 if [ -f requirements-base.txt ] && [ -f requirements.txt ] && [ -f requirements-dev.txt ]; then
   CURRENT_REQ_HASH=$(cat requirements-base.txt requirements.txt requirements-dev.txt | md5sum | cut -d' ' -f1)

scripts/ci/validate_code_quality.sh

@@ -77,6 +77,11 @@ set +e
 bandit -r apps packages -q -ll
 BANDIT_EXIT=$?
 set -e
+
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+# shellcheck source=ci_env.sh
+source "${SCRIPT_DIR}/ci_env.sh"
+
 if [ "$BANDIT_EXIT" -ne 0 ]; then
   echo "⚠️  Bandit found security issues (advisory mode - not blocking CI)"
 else