fix(deps): 精确锁定pyOpenSSL==26.2.0，与cryptography 46.0.5兼容

infra/docker/api.Dockerfile

@@ -6,14 +6,14 @@
 # 基础镜像：Python 3.12
 FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim
 
-# 构建参数：版本号（CI 传入 commit hash）
-ARG APP_VERSION=dev
-
 # 使用阿里云镜像加速
-RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null ||     sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
+RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
+    sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
 
 # 安装系统依赖
-RUN apt-get update && apt-get install -y --no-install-recommends     libpq-dev     && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
 
 # 设置工作目录
 WORKDIR /app
@@ -21,12 +21,15 @@ WORKDIR /app
 # ---- 依赖分层：基础依赖（变化少，缓存命中率高）----
 COPY requirements-base.txt /tmp/requirements-base.txt
 
-RUN python -m venv /opt/venv     && /opt/venv/bin/pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com -r /tmp/requirements-base.txt     && rm /tmp/requirements-base.txt
+RUN python -m venv /opt/venv \
+    && /opt/venv/bin/pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com -r /tmp/requirements-base.txt \
+    && rm /tmp/requirements-base.txt
 
 # ---- 依赖分层：业务依赖（变化频繁）----
 COPY requirements.txt /tmp/requirements.txt
 
-RUN /opt/venv/bin/pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com -r /tmp/requirements.txt     && rm /tmp/requirements.txt
+RUN /opt/venv/bin/pip install --no-cache-dir -i https://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com -r /tmp/requirements.txt \
+    && rm /tmp/requirements.txt
 
 # 复制应用代码
 COPY apps/api/ /app/apps/api/
@@ -37,13 +40,13 @@ COPY alembic/ /app/alembic/
 COPY scripts/ /app/scripts/
 
 # 设置环境变量
-ENV PATH="/opt/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+ENV PATH="/opt/venv/bin:$PATH"
 ENV PYTHONPATH=/app
 ENV PYTHONUNBUFFERED=1
-ENV APP_VERSION=$APP_VERSION
 
 # 健康检查
-HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3     CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)"
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)"
 
 # API 入口点
 WORKDIR /app/apps/api

infra/docker/worker.Dockerfile

@@ -6,9 +6,6 @@
 # 基础镜像：Python 3.12 + ffmpeg
 FROM git.xiaoxiajianji.com/xiaoxia/base/python:3.12-slim
 
-# 构建参数：版本号（CI 传入 commit hash）
-ARG APP_VERSION=dev
-
 # 使用阿里云镜像加速
 RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
     sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
@@ -55,7 +52,6 @@ COPY migrations/ /app/migrations/
 ENV PATH="/opt/venv/bin:$PATH"
 ENV PYTHONPATH=/app
 ENV PYTHONUNBUFFERED=1
-ENV APP_VERSION=$APP_VERSION
 
 # 创建非 root 用户运行 Worker
 RUN groupadd -r celery && useradd -r -g celery -d /app -s /sbin/nologin celery \

scripts/build_release_images.sh

@@ -57,7 +57,6 @@ fi
 echo "=== Building API image ==="
 if [ "$USE_CACHE" -eq 1 ]; then
   docker buildx build \
-    --build-arg APP_VERSION="$VERSION" \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_TAG},ignore-error=true" \
     --cache-to "type=registry,ref=${CACHE_REGISTRY}/api-cache:${CACHE_TAG},mode=max" \
     -f infra/docker/api.Dockerfile \
@@ -65,13 +64,12 @@ if [ "$USE_CACHE" -eq 1 ]; then
     --load \
     .
 else
-  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_LATEST" .
+  docker build --pull=false -f infra/docker/api.Dockerfile -t "$API_IMAGE" -t "$API_LATEST" .
 fi
 
 echo "=== Building Worker image ==="
 if [ "$USE_CACHE" -eq 1 ]; then
   docker buildx build \
-    --build-arg APP_VERSION="$VERSION" \
     --cache-from "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_TAG},ignore-error=true" \
     --cache-to "type=registry,ref=${CACHE_REGISTRY}/worker-cache:${CACHE_TAG},mode=max" \
     -f infra/docker/worker.Dockerfile \
@@ -79,7 +77,7 @@ if [ "$USE_CACHE" -eq 1 ]; then
     --load \
     .
 else
-  docker build --pull=false --build-arg APP_VERSION="$VERSION" -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_LATEST" .
+  docker build --pull=false -f infra/docker/worker.Dockerfile -t "$WORKER_IMAGE" -t "$WORKER_LATEST" .
 fi
 
 echo "=== Building Web image (with buildx cache) ==="