From 51256335ba62ece937195f1c4e84d7edac32987e Mon Sep 17 00:00:00 2001
From: "jif2.zhang" <jif2.zhang>
Date: Sun, 25 Oct 2026 00:48:50 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20=E4=BC=98=E5=8C=96=E6=9E=84=E5=BB=BA?=
 =?UTF-8?q?=E9=80=9F=E5=BA=A6=E4=B8=8E=E8=B5=84=E6=BA=90=E6=B6=88=E8=80=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- docker-build: 停用 docker system prune --volumes (保住 build 层缓存), 改为 image prune -f
- 新增 .dockerignore, node_modules/.git/src-tauri 等不再进 build context
- 前端只构建一次: CI 构建 dist 供 OTA 与镜像复用 (PREBUILT_DIST 构建参数)
- Dockerfile: npm install → npm ci + BuildKit cache mount
- setup-node 开启 npm 缓存; master/android-* 加 concurrency 取消旧 run
- android: 只构建 aarch64; tauri target 缓存 key 按 Cargo.lock hash
- minisign 改为静态二进制下载, 去掉 apt-get
---
 .dockerignore                      |  11 +
 .gitea/workflows/android-build.yml | 372 +++++++++++++++--------------
 .gitea/workflows/docker-build.yml  | 248 ++++++++++---------
 .gitea/workflows/ota-build.yml     | 156 ++++++------
 Dockerfile                         | 156 ++++++------
 5 files changed, 500 insertions(+), 443 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..fe773e5
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+# 大目录/与镜像无关的内容不进 build context
+# 注意: dist/ 和 ota-package/ 不能忽略 —— CI 预构建产物要通过 context 进入镜像
+.git
+.gitea
+.local
+.pnpm-store
+node_modules
+src-tauri
+docs
+*.log
+readme
diff --git a/.gitea/workflows/android-build.yml b/.gitea/workflows/android-build.yml
index 72cb31e..2571cc5 100644
--- a/.gitea/workflows/android-build.yml
+++ b/.gitea/workflows/android-build.yml
@@ -1,182 +1,190 @@
-name: Android Build & Publish
-
-# 仅在 android-* 分支 push 时触发 (如 android/release, android-1.0)
-# 构建 release APK (keystore 签名) 并上传到 Gitea Generic Package Registry
-on:
-  push:
-    branches:
-      - 'android-*'
-
-jobs:
-  build-android:
-    runs-on: ubuntu-latest
-    # 需要写权限: 上传 packages
-    permissions:
-      contents: read
-      packages: write
-
-    env:
-      # 固定工具链版本, 便于 actions/cache 命中
-      # Android 后端地址 (bake 进 APK); 与 scripts/wsl/build-apk.sh 保持一致
-      VITE_API_BASE: http://bh.vps.honor3.com:3001
-
-    steps:
-      - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
-
-      - name: Setup Node
-        uses: https://gitea.com/actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: 'npm'
-
-      # 版本号一致性: package.json / tauri.conf.json / Cargo.toml / Cargo.lock 必须完全相等。
-      # tauri.conf.json 的 version 就是 APK 的 versionName, 漏改会打出一个版本号错误的安装包。
-      - name: Check version consistency
-        run: node scripts/ci/check-version.mjs
-
-      - name: Setup JDK 17
-        uses: https://gitea.com/actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '17'
-
-      # ---------- 缓存: 命中后跳过下面的安装 ----------
-      - name: Cache Android SDK & NDK
-        id: cache-android
-        uses: https://gitea.com/actions/cache@v4
-        with:
-          path: ~/android-sdk
-          key: android-sdk-ndk-27.2-${{ runner.os }}
-
-      - name: Cache Rust toolchain
-        id: cache-rust
-        uses: https://gitea.com/actions/cache@v4
-        with:
-          path: |
-            ~/.cargo
-            ~/.rustup
-          # 工具链升级时 bump 版本号使缓存失效重装 (含 cargo-ndk)
-          key: rust-android-v1-${{ runner.os }}
-
-      - name: Cache Tauri cargo target
-        uses: https://gitea.com/actions/cache@v4
-        with:
-          path: src-tauri/target
-          key: tauri-target-android-${{ runner.os }}
-
-      # ---------- 安装工具链 (仅缓存未命中时) ----------
-      - name: Install Rust + Android targets
-        if: steps.cache-rust.outputs.cache-hit != 'true'
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-          . "$HOME/.cargo/env"
-          rustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-android i686-linux-android
-          cargo install cargo-ndk --locked
-
-      - name: Install Android SDK & NDK
-        if: steps.cache-android.outputs.cache-hit != 'true'
-        run: |
-          export ANDROID_HOME="$HOME/android-sdk"
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends unzip
-          mkdir -p "$ANDROID_HOME/cmdline-tools"
-          wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdline-tools.zip
-          unzip -q /tmp/cmdline-tools.zip -d /tmp/
-          mv /tmp/cmdline-tools "$ANDROID_HOME/cmdline-tools/latest"
-          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"
-          yes | sdkmanager --licenses >/dev/null || true
-          sdkmanager --install \
-            "platforms;android-36" \
-            "build-tools;36.0.0" \
-            "platform-tools" \
-            "ndk;27.2.12479018" \
-            "cmake;3.22.1"
-
-      - name: Install frontend deps
-        run: npm ci --no-audit --no-fund
-
-      # ---------- 全局 Android 环境 (对后续所有 step 生效, 无论缓存是否命中) ----------
-      - name: Set Android env
-        run: |
-          echo "ANDROID_HOME=$HOME/android-sdk" >> "$GITHUB_ENV"
-          echo "ANDROID_NDK_HOME=$HOME/android-sdk/ndk/27.2.12479018" >> "$GITHUB_ENV"
-          echo "$HOME/android-sdk/cmdline-tools/latest/bin" >> "$GITHUB_PATH"
-          echo "$HOME/android-sdk/platform-tools" >> "$GITHUB_PATH"
-
-      # ---------- 构建 ----------
-      - name: Init Android project
-        run: |
-          # tauri android init 需要 cargo (运行 cargo metadata)。
-          # Rust 工具链缓存命中时 "Install Rust" 步骤被跳过, 不会把 cargo 加进全局 PATH,
-          # 因此这里显式加载 cargo 环境 (与 Build release APK 步骤保持一致)。
-          . "$HOME/.cargo/env"
-          cd src-tauri
-          npx tauri android init --ci
-
-      - name: Inject release signing config
-        run: bash scripts/ci/android-signing.sh
-        env:
-          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
-          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
-          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
-
-      - name: Build release APK
-        run: |
-          export ANDROID_HOME="$HOME/android-sdk"
-          export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/27.2.12479018"
-          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH"
-          export CARGO_HOME="$HOME/.cargo"
-          . "$HOME/.cargo/env"
-          cd src-tauri
-          npx tauri android build --apk
-          # 断言签名配置仍在且 release 块实际引用了它 (防止 tauri 重新生成 gen/android 或正则未命中)
-          if ! grep -q 'create("release")' gen/android/app/build.gradle.kts || ! grep -q 'signingConfig = signingConfigs.getByName("release")' gen/android/app/build.gradle.kts; then
-            echo "ERROR: 构建后签名配置丢失/未生效, APK 未签名" >&2
-            exit 1
-          fi
-
-      - name: Locate APK
-        id: apk
-        run: |
-          # 优先 universal 已签名 APK, 找不到再回退到其他已签名 APK
-          APK=""
-          UNIVERSAL=$(find src-tauri/gen/android/app/build/outputs/apk/universal/release -name '*.apk' ! -name '*unsigned*' 2>/dev/null | head -1)
-          if [ -n "$UNIVERSAL" ]; then
-            APK="$UNIVERSAL"
-          else
-            APK=$(find src-tauri/gen/android/app/build/outputs/apk -name '*.apk' ! -name '*unsigned*' | head -1)
-          fi
-          if [ -z "$APK" ]; then
-            echo "ERROR: 未找到已签名 APK" >&2
-            exit 1
-          fi
-          echo "path=$APK" >> $GITHUB_OUTPUT
-          ls -lh "$APK"
-
-      # ---------- 上传到 Gitea Generic Package ----------
-      - name: Publish APK to Gitea packages
-        env:
-          # 注意: 不能用 GITEA_TOKEN (内置 job token, 无组织 packages 写权限, 且命名规则禁止 GITEA_ 前缀)
-          # 用一个自定义名 secret 存放有 packages 写权限的 user token
-          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
-          APK_PATH: ${{ steps.apk.outputs.path }}
-        run: |
-          set -euo pipefail
-          # 包版本: 用分支名去掉 android- 前缀 + 短 SHA, 保证每次 push 唯一
-          BRANCH="${GITHUB_REF_NAME#android-}"
-          PKG_VERSION="${BRANCH}-${GITHUB_SHA:0:8}"
-          FILE_NAME="iboard-$(basename "$APK_PATH")"
-          OWNER="${GITHUB_REPOSITORY_OWNER}"
-          PKG_NAME="iboard"
-          # Gitea Generic Package Registry 上传端点 (PUT)
-          # 注意: GITHUB_SERVER_URL 是仓库 web 根地址, 例如 http://git.honor3.com
-          URL="${GITHUB_SERVER_URL}/api/packages/${OWNER}/generic/${PKG_NAME}/${PKG_VERSION}/${FILE_NAME}"
-          echo "上传到: ${URL}"
-          curl -sS --fail-with-body \
-            -H "Authorization: token ${PACKAGE_TOKEN}" \
-            --upload-file "$APK_PATH" \
-            "${URL}"
-          echo ""
-          echo "已发布: ${URL}"
+name: Android Build & Publish
+
+# 仅在 android-* 分支 push 时触发 (如 android/release, android-1.0)
+# 构建 release APK (keystore 签名) 并上传到 Gitea Generic Package Registry
+on:
+  push:
+    branches:
+      - 'android-*'
+
+# 同分支连续 push 时取消旧的构建, 省资源也避免上传过时 APK
+concurrency:
+  group: android-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  build-android:
+    runs-on: ubuntu-latest
+    # 需要写权限: 上传 packages
+    permissions:
+      contents: read
+      packages: write
+
+    env:
+      # 固定工具链版本, 便于 actions/cache 命中
+      # Android 后端地址 (bake 进 APK); 与 scripts/wsl/build-apk.sh 保持一致
+      VITE_API_BASE: http://bh.vps.honor3.com:3001
+
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      # 版本号一致性: package.json / tauri.conf.json / Cargo.toml / Cargo.lock 必须完全相等。
+      # tauri.conf.json 的 version 就是 APK 的 versionName, 漏改会打出一个版本号错误的安装包。
+      - name: Check version consistency
+        run: node scripts/ci/check-version.mjs
+
+      - name: Setup JDK 17
+        uses: https://gitea.com/actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      # ---------- 缓存: 命中后跳过下面的安装 ----------
+      - name: Cache Android SDK & NDK
+        id: cache-android
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/android-sdk
+          key: android-sdk-ndk-27.2-${{ runner.os }}
+
+      - name: Cache Rust toolchain
+        id: cache-rust
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: |
+            ~/.cargo
+            ~/.rustup/toolchains
+          # 工具链升级时 bump 版本号使缓存失效重装 (含 cargo-ndk)
+          key: rust-android-v1-${{ runner.os }}
+
+      - name: Cache Tauri cargo target
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: src-tauri/target
+          # 依赖变化 → 新 key; 命不中时回退最近一次的 target 目录做增量编译
+          key: tauri-target-android-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: tauri-target-android-
+
+      # ---------- 安装工具链 (仅缓存未命中时) ----------
+      - name: Install Rust + Android targets
+        if: steps.cache-rust.outputs.cache-hit != 'true'
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+          . "$HOME/.cargo/env"
+          # 只构建 aarch64 (现代 Android 手机); 需要模拟器/x86 设备时再加回其他 target
+          rustup target add aarch64-linux-android
+          cargo install cargo-ndk --locked
+
+      - name: Install Android SDK & NDK
+        if: steps.cache-android.outputs.cache-hit != 'true'
+        run: |
+          export ANDROID_HOME="$HOME/android-sdk"
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends unzip
+          mkdir -p "$ANDROID_HOME/cmdline-tools"
+          wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdline-tools.zip
+          unzip -q /tmp/cmdline-tools.zip -d /tmp/
+          mv /tmp/cmdline-tools "$ANDROID_HOME/cmdline-tools/latest"
+          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"
+          yes | sdkmanager --licenses >/dev/null || true
+          sdkmanager --install \
+            "platforms;android-36" \
+            "build-tools;36.0.0" \
+            "platform-tools" \
+            "ndk;27.2.12479018" \
+            "cmake;3.22.1"
+
+      - name: Install frontend deps
+        run: npm ci --no-audit --no-fund
+
+      # ---------- 全局 Android 环境 (对后续所有 step 生效, 无论缓存是否命中) ----------
+      - name: Set Android env
+        run: |
+          echo "ANDROID_HOME=$HOME/android-sdk" >> "$GITHUB_ENV"
+          echo "ANDROID_NDK_HOME=$HOME/android-sdk/ndk/27.2.12479018" >> "$GITHUB_ENV"
+          echo "$HOME/android-sdk/cmdline-tools/latest/bin" >> "$GITHUB_PATH"
+          echo "$HOME/android-sdk/platform-tools" >> "$GITHUB_PATH"
+
+      # ---------- 构建 ----------
+      - name: Init Android project
+        run: |
+          # tauri android init 需要 cargo (运行 cargo metadata)。
+          # Rust 工具链缓存命中时 "Install Rust" 步骤被跳过, 不会把 cargo 加进全局 PATH,
+          # 因此这里显式加载 cargo 环境 (与 Build release APK 步骤保持一致)。
+          . "$HOME/.cargo/env"
+          cd src-tauri
+          npx tauri android init --ci
+
+      - name: Inject release signing config
+        run: bash scripts/ci/android-signing.sh
+        env:
+          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+
+      - name: Build release APK
+        run: |
+          export ANDROID_HOME="$HOME/android-sdk"
+          export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/27.2.12479018"
+          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH"
+          export CARGO_HOME="$HOME/.cargo"
+          . "$HOME/.cargo/env"
+          cd src-tauri
+          npx tauri android build --apk --target aarch64
+          # 断言签名配置仍在且 release 块实际引用了它 (防止 tauri 重新生成 gen/android 或正则未命中)
+          if ! grep -q 'create("release")' gen/android/app/build.gradle.kts || ! grep -q 'signingConfig = signingConfigs.getByName("release")' gen/android/app/build.gradle.kts; then
+            echo "ERROR: 构建后签名配置丢失/未生效, APK 未签名" >&2
+            exit 1
+          fi
+
+      - name: Locate APK
+        id: apk
+        run: |
+          # 优先 universal 已签名 APK, 找不到再回退到其他已签名 APK
+          APK=""
+          UNIVERSAL=$(find src-tauri/gen/android/app/build/outputs/apk/universal/release -name '*.apk' ! -name '*unsigned*' 2>/dev/null | head -1)
+          if [ -n "$UNIVERSAL" ]; then
+            APK="$UNIVERSAL"
+          else
+            APK=$(find src-tauri/gen/android/app/build/outputs/apk -name '*.apk' ! -name '*unsigned*' | head -1)
+          fi
+          if [ -z "$APK" ]; then
+            echo "ERROR: 未找到已签名 APK" >&2
+            exit 1
+          fi
+          echo "path=$APK" >> $GITHUB_OUTPUT
+          ls -lh "$APK"
+
+      # ---------- 上传到 Gitea Generic Package ----------
+      - name: Publish APK to Gitea packages
+        env:
+          # 注意: 不能用 GITEA_TOKEN (内置 job token, 无组织 packages 写权限, 且命名规则禁止 GITEA_ 前缀)
+          # 用一个自定义名 secret 存放有 packages 写权限的 user token
+          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+          APK_PATH: ${{ steps.apk.outputs.path }}
+        run: |
+          set -euo pipefail
+          # 包版本: 用分支名去掉 android- 前缀 + 短 SHA, 保证每次 push 唯一
+          BRANCH="${GITHUB_REF_NAME#android-}"
+          PKG_VERSION="${BRANCH}-${GITHUB_SHA:0:8}"
+          FILE_NAME="iboard-$(basename "$APK_PATH")"
+          OWNER="${GITHUB_REPOSITORY_OWNER}"
+          PKG_NAME="iboard"
+          # Gitea Generic Package Registry 上传端点 (PUT)
+          # 注意: GITHUB_SERVER_URL 是仓库 web 根地址, 例如 http://git.honor3.com
+          URL="${GITHUB_SERVER_URL}/api/packages/${OWNER}/generic/${PKG_NAME}/${PKG_VERSION}/${FILE_NAME}"
+          echo "上传到: ${URL}"
+          curl -sS --fail-with-body \
+            -H "Authorization: token ${PACKAGE_TOKEN}" \
+            --upload-file "$APK_PATH" \
+            "${URL}"
+          echo ""
+          echo "已发布: ${URL}"
diff --git a/.gitea/workflows/docker-build.yml b/.gitea/workflows/docker-build.yml
index c40afb3..b5f3245 100644
--- a/.gitea/workflows/docker-build.yml
+++ b/.gitea/workflows/docker-build.yml
@@ -1,114 +1,134 @@
-name: Docker Build and Push
-
-# 仅主分支 (master) push 触发部署; 其他分支一律不触发 (见 readme「分支规则」)
-# 每次提交: 构建前端 + 生成 OTA 升级包 (签名) → 打进 Docker 镜像 → 自动升级数据库 → 部署
-# OTA 随镜像发布: 容器内 OTA_PACKAGE_DIR=/app/ota-package 指向打包的 ota-package/
-#
-# 分支策略 (2026-10 调整):
-#   - master  = 主分支, 唯一部署出口, push 即发布生产 (容器 iboard, 宿主 3001)
-#   - dev-*   = 开发集成分支, 只做 CI 校验 (构建/版本一致性), **不再自动部署**;
-#               要上线必须先合并到 master 再推 master
-#   - tmp-*   = 单个问题的临时分支, 合到 dev-* 后删除
-#   - android-*= 只用于触发 APK 外壳构建, 不部署; 改动前须与 master 同步
-#
-# 历史: 之前 dev-* 与 master 共用同一套生产环境 (推送即发布), 容易把半成品带上线,
-#       现已取消 dev-* 的 push 触发。
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  build-image:
-    runs-on: ubuntu-latest
-    env:
-      # 关键: 显式固定 Android/OTA 后端地址, 覆盖 runner 环境里可能存在的
-      # 其他 VITE_API_BASE 值。否则 OTA 包里的前端可能连错后端, 导致
-      # "OTA 更新后登录失败/进不去内部"。与 android-build.yml 保持一致。
-      VITE_API_BASE: http://bh.vps.honor3.com:3001
-      # OTA bundle 要求的最低原生二进制版本。
-      # 与 package.json 的应用版本是**两个概念**: 前端 OTA 不碰原生层,
-      # 现有 APK 仍是 0.1.0, 所以这里固定 0.1.0 (否则旧 APK 会被判定为不兼容而收不到更新)。
-      # 重打 APK 并确认原生层无破坏后, 再提升此值。
-      OTA_MIN_BINARY: '0.1.0'
-    steps:
-      - uses: https://gitea.com/actions/checkout@v4
-
-      - name: Setup Node
-        uses: https://gitea.com/actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Check version consistency & branch
-        # 1) package.json / tauri.conf.json / Cargo.toml / Cargo.lock 四处版本必须完全相等且不带 -ota
-        #    （tauri.conf.json 的 version 就是 APK 的 versionName）
-        # 2) 防止 OTA 版本号与分支错位: OTA 包的 version 直接取自 package.json,
-        #    dev-0.2 分支上必须是 0.2.x, 否则线上 OTA 会报成上一个版本的号
-        #    (master 分支跳过分支前缀校验, 但四处一致性照样强制)
-        env:
-          GITHUB_REF_NAME: ${{ github.ref_name }}
-        run: node scripts/ci/check-version.mjs
-
-      - name: Install deps
-        run: npm ci --no-audit --no-fund
-
-      - name: Build frontend
-        # dist/ 供 OTA 打包用 (Dockerfile 内也会构建一份)
-        run: npm run build
-
-      - name: Install minisign
-        run: sudo apt-get update && sudo apt-get install -y minisign
-
-      - name: Build & sign OTA package
-        # 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
-        # 产物 ota-package/ (tar.gz + latest.json + .minisig) 进入 docker build context, 由 Dockerfile COPY 进镜像
-        env:
-          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
-          OTA_NOTES: ${{ github.sha }}
-        run: |
-          set -euo pipefail
-          node scripts/build-ota.mjs --out ota-package --notes ${OTA_NOTES} --min-binary ${OTA_MIN_BINARY}
-          echo "===== latest.json ====="
-          cat ota-package/latest.json
-          echo "===== bundle sha256 ====="
-          sha256sum ota-package/iboard-ota.tar.gz
-
-      - name: Build Docker image
-        # DATABASE_URL 仅在 prisma generate 阶段需要, 可用任何合法占位串
-        run: docker build -t iboard:latest --build-arg DATABASE_URL=mysql://build:build@127.0.0.1:3306/build .
-
-      - name: List images
-        run: docker images
-
-      - name: Apply DB migrations
-        # 数据库自动升级: 按 prisma/migrations/ 下的迁移顺序应用 (生产库由 master 部署时统一升级)
-        # migrate deploy 幂等, 无新迁移时为 no-op
-        # 位置关键: 在 "Remove old container" 之前 —— 建表/改表成功后才切换流量,
-        # 迁移失败则整个 workflow 中断, 不会用新镜像顶掉仍在运行的旧容器
-        env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-        run: |
-          set -euo pipefail
-          npx prisma migrate status || true
-          npx prisma migrate deploy
-
-      - name: Remove old container
-        run: docker rm -vf iboard || true
-
-      - name: Recycle container
-        run: docker system prune --volumes -f
-
-      - name: Run container
-        # DATABASE_URL 通过 gitea Actions secret 注入, 不进镜像层
-        # OTA_PACKAGE_DIR 已在 Dockerfile 设为 /app/ota-package
-        # 米家凭证 (auth.txt) 不进 git: 运维放宿主机 /app/iboard/cache, bind-mount 进容器 (MIHOME_CACHE_DIR=/app/cache)
-        run: |
-          docker run -d --name iboard -p 3001:3001 \
-            -e DATABASE_URL="${{ secrets.DATABASE_URL }}" \
-            -e JWT_SECRET="${{ secrets.JWT_SECRET }}" \
-            -e MIHOME_CACHE_DIR=/app/cache \
-            -v /app/iboard/cache:/app/cache \
-            iboard:latest
-        env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          JWT_SECRET: ${{ secrets.JWT_SECRET }}
+name: Docker Build and Push
+
+# 仅主分支 (master) push 触发部署; 其他分支一律不触发 (见 readme「分支规则」)
+# 每次提交: 构建前端 + 生成 OTA 升级包 (签名) → 打进 Docker 镜像 → 自动升级数据库 → 部署
+# OTA 随镜像发布: 容器内 OTA_PACKAGE_DIR=/app/ota-package 指向打包的 ota-package/
+#
+# 分支策略 (2026-10 调整):
+#   - master  = 主分支, 唯一部署出口, push 即发布生产 (容器 iboard, 宿主 3001)
+#   - dev-*   = 开发集成分支, 只做 CI 校验 (构建/版本一致性), **不再自动部署**;
+#               要上线必须先合并到 master 再推 master
+#   - tmp-*   = 单个问题的临时分支, 合到 dev-* 后删除
+#   - android-*= 只用于触发 APK 外壳构建, 不部署; 改动前须与 master 同步
+#
+# 历史: 之前 dev-* 与 master 共用同一套生产环境 (推送即发布), 容易把半成品带上线,
+#       现已取消 dev-* 的 push 触发。
+on:
+  push:
+    branches:
+      - master
+
+# 连续 push master 时取消还在跑的旧部署, 避免排队执行过时版本的完整部署
+concurrency:
+  group: deploy-master
+  cancel-in-progress: true
+
+jobs:
+  build-image:
+    runs-on: ubuntu-latest
+    env:
+      # 关键: 显式固定 Android/OTA 后端地址, 覆盖 runner 环境里可能存在的
+      # 其他 VITE_API_BASE 值。否则 OTA 包里的前端可能连错后端, 导致
+      # "OTA 更新后登录失败/进不去内部"。与 android-build.yml 保持一致。
+      VITE_API_BASE: http://bh.vps.honor3.com:3001
+      # OTA bundle 要求的最低原生二进制版本。
+      # 与 package.json 的应用版本是**两个概念**: 前端 OTA 不碰原生层,
+      # 现有 APK 仍是 0.1.0, 所以这里固定 0.1.0 (否则旧 APK 会被判定为不兼容而收不到更新)。
+      # 重打 APK 并确认原生层无破坏后, 再提升此值。
+      OTA_MIN_BINARY: '0.1.0'
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Check version consistency & branch
+        # 1) package.json / tauri.conf.json / Cargo.toml / Cargo.lock 四处版本必须完全相等且不带 -ota
+        #    （tauri.conf.json 的 version 就是 APK 的 versionName）
+        # 2) 防止 OTA 版本号与分支错位: OTA 包的 version 直接取自 package.json,
+        #    dev-0.2 分支上必须是 0.2.x, 否则线上 OTA 会报成上一个版本的号
+        #    (master 分支跳过分支前缀校验, 但四处一致性照样强制)
+        env:
+          GITHUB_REF_NAME: ${{ github.ref_name }}
+        run: node scripts/ci/check-version.mjs
+
+      - name: Install deps
+        run: npm ci --no-audit --no-fund
+
+      - name: Build frontend
+        # 全流程唯一一次前端构建: dist/ 既供 OTA 打包, 也通过 build context 进入镜像
+        # (docker build 传 PREBUILT_DIST=true 跳过镜像内的重复构建)
+        run: npm run build
+
+      - name: Install minisign
+        # 静态二进制直接下载, 免去每次 apt-get update + install
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/ms
+          curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
+          sudo install -m755 "$(find /tmp/ms -type f -name minisign | head -1)" /usr/local/bin/minisign
+          minisign -v
+
+      - name: Build & sign OTA package
+        # 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
+        # 产物 ota-package/ (tar.gz + latest.json + .minisig) 进入 docker build context, 由 Dockerfile COPY 进镜像
+        env:
+          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
+          OTA_NOTES: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          node scripts/build-ota.mjs --out ota-package --notes ${OTA_NOTES} --min-binary ${OTA_MIN_BINARY}
+          echo "===== latest.json ====="
+          cat ota-package/latest.json
+          echo "===== bundle sha256 ====="
+          sha256sum ota-package/iboard-ota.tar.gz
+
+      - name: Build Docker image
+        # DATABASE_URL 仅在 prisma generate 阶段需要, 可用任何合法占位串
+        # PREBUILT_DIST=true: 复用上一步构建好的 dist/, 镜像内跳过前端构建
+        # DOCKER_BUILDKIT=1: Dockerfile 用了 cache mount 语法
+        run: docker build -t iboard:latest --build-arg DATABASE_URL=mysql://build:build@127.0.0.1:3306/build --build-arg PREBUILT_DIST=true .
+        env:
+          DOCKER_BUILDKIT: '1'
+
+      - name: List images
+        run: docker images
+
+      - name: Apply DB migrations
+        # 数据库自动升级: 按 prisma/migrations/ 下的迁移顺序应用 (生产库由 master 部署时统一升级)
+        # migrate deploy 幂等, 无新迁移时为 no-op
+        # 位置关键: 在 "Remove old container" 之前 —— 建表/改表成功后才切换流量,
+        # 迁移失败则整个 workflow 中断, 不会用新镜像顶掉仍在运行的旧容器
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+        run: |
+          set -euo pipefail
+          npx prisma migrate status || true
+          npx prisma migrate deploy
+
+      - name: Remove old container
+        run: docker rm -vf iboard || true
+
+      - name: Prune dangling images
+        # 只清理本项目的悬空镜像 (旧 iboard:latest 被同名新镜像顶掉后变 dangling),
+        # 不再用 `docker system prune --volumes` —— 那会清光宿主机 build cache,
+        # 导致每次部署都全量重装 npm 依赖、重跑构建
+        run: docker image prune -f
+
+      - name: Run container
+        # DATABASE_URL 通过 gitea Actions secret 注入, 不进镜像层
+        # OTA_PACKAGE_DIR 已在 Dockerfile 设为 /app/ota-package
+        # 米家凭证 (auth.txt) 不进 git: 运维放宿主机 /app/iboard/cache, bind-mount 进容器 (MIHOME_CACHE_DIR=/app/cache)
+        run: |
+          docker run -d --name iboard -p 3001:3001 \
+            -e DATABASE_URL="${{ secrets.DATABASE_URL }}" \
+            -e JWT_SECRET="${{ secrets.JWT_SECRET }}" \
+            -e MIHOME_CACHE_DIR=/app/cache \
+            -v /app/iboard/cache:/app/cache \
+            iboard:latest
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          JWT_SECRET: ${{ secrets.JWT_SECRET }}
diff --git a/.gitea/workflows/ota-build.yml b/.gitea/workflows/ota-build.yml
index 40538a0..9b1185d 100644
--- a/.gitea/workflows/ota-build.yml
+++ b/.gitea/workflows/ota-build.yml
@@ -1,75 +1,81 @@
-name: OTA Frontend Build & Sign
-
-# 前端 OTA 升级包构建 + 签名 + 上传 artifact
-# 触发: 仅手动 (workflow_dispatch), 发版前用
-#   - 主分支 push 的自动 OTA 生成已并入 docker-build.yml (随镜像发布), 本 workflow 不再监听 push 避免重复构建
-# 输入: sequence / notes / min_binary (可覆盖默认)
-# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
-# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
-#       换密钥请手动改 conf 并 commit.
-
-on:
-  workflow_dispatch:
-    inputs:
-      sequence:
-        description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
-        required: false
-        type: string
-      notes:
-        description: '发布说明 (写入 latest.json.notes)'
-        required: false
-        type: string
-        default: ''
-      min_binary:
-        description: '最低 binary 版本 (默认 0.1.0 = 现有 APK 的原生版本, 与前端应用版本无关)'
-        required: false
-        type: string
-        default: '0.1.0'
-
-jobs:
-  build-ota:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
-
-      - name: Setup Node
-        uses: https://gitea.com/actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install deps
-        run: npm ci --no-audit --no-fund
-
-      - name: Build frontend
-        # 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
-        run: npm run build
-
-      - name: Install minisign
-        run: sudo apt-get update && sudo apt-get install -y minisign
-
-      - name: Build & sign OTA package
-        env:
-          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
-          OTA_NOTES: ${{ inputs.notes }}
-        run: |
-          set -euo pipefail
-          OUT="ota-package"
-          ARGS="--out ${OUT}"
-          # sequence 留空 → 脚本默认用时间戳; min_binary 默认 0.1.0 (与前端版本解耦)
-          if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
-          if [ -n "${OTA_NOTES}" ]; then ARGS="${ARGS} --notes ${OTA_NOTES}"; fi
-          if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
-          node scripts/build-ota.mjs ${ARGS}
-          echo "===== latest.json ====="
-          cat ${OUT}/latest.json
-          echo "===== bundle sha256 ====="
-          sha256sum ${OUT}/iboard-ota.tar.gz
-
-      - name: Upload OTA package as artifact
-        uses: https://gitea.com/actions/upload-artifact@v4
-        with:
-          name: iboard-ota-${{ inputs.sequence || github.run_number }}
-          path: ota-package/
-          retention-days: 30
-          if-no-files-found: error
+name: OTA Frontend Build & Sign
+
+# 前端 OTA 升级包构建 + 签名 + 上传 artifact
+# 触发: 仅手动 (workflow_dispatch), 发版前用
+#   - 主分支 push 的自动 OTA 生成已并入 docker-build.yml (随镜像发布), 本 workflow 不再监听 push 避免重复构建
+# 输入: sequence / notes / min_binary (可覆盖默认)
+# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
+# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
+#       换密钥请手动改 conf 并 commit.
+
+on:
+  workflow_dispatch:
+    inputs:
+      sequence:
+        description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
+        required: false
+        type: string
+      notes:
+        description: '发布说明 (写入 latest.json.notes)'
+        required: false
+        type: string
+        default: ''
+      min_binary:
+        description: '最低 binary 版本 (默认 0.1.0 = 现有 APK 的原生版本, 与前端应用版本无关)'
+        required: false
+        type: string
+        default: '0.1.0'
+
+jobs:
+  build-ota:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install deps
+        run: npm ci --no-audit --no-fund
+
+      - name: Build frontend
+        # 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
+        run: npm run build
+
+      - name: Install minisign
+        # 静态二进制直接下载, 免去每次 apt-get update + install
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/ms
+          curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
+          sudo install -m755 "$(find /tmp/ms -type f -name minisign | head -1)" /usr/local/bin/minisign
+          minisign -v
+
+      - name: Build & sign OTA package
+        env:
+          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
+          OTA_NOTES: ${{ inputs.notes }}
+        run: |
+          set -euo pipefail
+          OUT="ota-package"
+          ARGS="--out ${OUT}"
+          # sequence 留空 → 脚本默认用时间戳; min_binary 默认 0.1.0 (与前端版本解耦)
+          if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
+          if [ -n "${OTA_NOTES}" ]; then ARGS="${ARGS} --notes ${OTA_NOTES}"; fi
+          if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
+          node scripts/build-ota.mjs ${ARGS}
+          echo "===== latest.json ====="
+          cat ${OUT}/latest.json
+          echo "===== bundle sha256 ====="
+          sha256sum ${OUT}/iboard-ota.tar.gz
+
+      - name: Upload OTA package as artifact
+        uses: https://gitea.com/actions/upload-artifact@v4
+        with:
+          name: iboard-ota-${{ inputs.sequence || github.run_number }}
+          path: ota-package/
+          retention-days: 30
+          if-no-files-found: error
diff --git a/Dockerfile b/Dockerfile
index 7b4405c..ffec25c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,73 +1,85 @@
-# ===============================================================
-# iBoard 一体化镜像: 静态前端 (dist/) + Express API (server/) 同进程
-# 构建: docker build --build-arg DATABASE_URL=... -t iboard:latest .
-#       可选 --build-arg VITE_API_BASE=https://api.example.com 让前端走绝对地址
-# 运行: docker run -d --name iboard -p 3001:3001 -e DATABASE_URL=... iboard:latest
-# ===============================================================
-FROM node:22-alpine AS builder
-
-WORKDIR /app
-
-# 国内构建时可换源
-RUN npm config set registry https://registry.npmmirror.com
-
-# 先拷贝 package 文件, 利用 Docker 缓存
-COPY package*.json ./
-COPY prisma ./prisma/
-COPY prisma.config.ts ./
-COPY generated ./generated/
-
-# 装全量依赖 (dev 也装, 后面 build 要用)
-RUN npm install
-
-# 拷贝源码
-COPY . .
-
-# 构建前端 (输出到 dist/) 与 Prisma 客户端
-RUN npx prisma generate
-# build 时把 VITE_API_BASE 写进 bundle, 默认空 = 走相对路径 /api (同源 Express)
-ARG VITE_API_BASE=
-ENV VITE_API_BASE=$VITE_API_BASE
-RUN npm run build
-
-# 运行时阶段
-FROM node:22-alpine
-
-WORKDIR /app
-
-# 阿里源加速
-RUN npm config set registry https://registry.npmmirror.com
-
-# 只装运行时依赖
-COPY package*.json ./
-RUN npm install --omit=dev
-
-# 拷贝构建产物
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/server ./server
-COPY --from=builder /app/generated ./generated
-COPY --from=builder /app/prisma ./prisma
-COPY --from=builder /app/prisma.config.ts ./prisma.config.ts
-COPY --from=builder /app/scripts ./scripts
-COPY --from=builder /app/content ./content
-COPY --from=builder /app/public ./public
-
-# OTA 升级包: CI (docker-build.yml) 生成的 ota-package/, 随镜像发布
-# 本地构建时只有占位文件 (ota-package/README.md), server 找不到 latest.json 则 OTA 返回"无更新"
-COPY ota-package ./ota-package
-ENV OTA_PACKAGE_DIR=/app/ota-package
-# OTA bundle 下载用的绝对 base (manifest.url 必须是绝对 URL, 插件不拼 base, 相对路径会导致下载 0% 失败)
-# 生产为 http 明文 (无 https), 客户端 tauri.conf.json 的 hotswap.require_https 已设为 false 放行 http
-ENV OTA_PUBLIC_BASE=http://bh.vps.honor3.com:3001
-
-# 健康检查
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD wget -qO- http://127.0.0.1:3001/api/health || exit 1
-
-EXPOSE 3001
-
-ENV NODE_ENV=production
-ENV PORT=3001
-
-# Node 22 默认未开 strip-types, 显式开启以便加载 generated/prisma/*.ts
+# syntax=docker/dockerfile:1
+# ===============================================================
+# iBoard 一体化镜像: 静态前端 (dist/) + Express API (server/) 同进程
+# 构建: docker build --build-arg DATABASE_URL=... -t iboard:latest .
+#       可选 --build-arg VITE_API_BASE=https://api.example.com 让前端走绝对地址
+#       CI 传入 --build-arg PREBUILT_DIST=true 复用 CI 已构建的 dist/ (跳过镜像内前端构建)
+# 运行: docker run -d --name iboard -p 3001:3001 -e DATABASE_URL=... iboard:latest
+# 需要 BuildKit (cache mount 语法; Docker 23+ 默认开启)
+# ===============================================================
+FROM node:22-alpine AS builder
+
+WORKDIR /app
+
+# 国内构建时可换源
+RUN npm config set registry https://registry.npmmirror.com
+
+# 先拷贝 package 文件, 利用 Docker 缓存
+COPY package*.json ./
+COPY prisma ./prisma/
+COPY prisma.config.ts ./
+COPY generated ./generated/
+
+# 装全量依赖 (dev 也装, 后面 prisma generate / 本地构建前端要用)
+# cache mount 复用 npm 下载缓存, 不进镜像层
+RUN --mount=type=cache,target=/root/.npm npm ci
+
+# 拷贝源码
+COPY . .
+
+# 构建 Prisma 客户端
+RUN --mount=type=cache,target=/root/.npm npx prisma generate
+
+# 构建前端 (输出到 dist/)
+# PREBUILT_DIST=true: CI 已在镜像外构建过 dist/ (供 OTA 打包), 直接复用, 跳过镜像内构建
+ARG PREBUILT_DIST=false
+# build 时把 VITE_API_BASE 写进 bundle, 默认空 = 走相对路径 /api (同源 Express)
+ARG VITE_API_BASE=
+ENV VITE_API_BASE=$VITE_API_BASE
+RUN if [ "$PREBUILT_DIST" = "true" ]; then \
+      test -f dist/index.html || { echo "PREBUILT_DIST=true 但 dist/ 缺失"; exit 1; }; \
+    else \
+      npm run build; \
+    fi
+
+# 运行时阶段
+FROM node:22-alpine
+
+WORKDIR /app
+
+# 阿里源加速
+RUN npm config set registry https://registry.npmmirror.com
+
+# 只装运行时依赖
+COPY package*.json ./
+RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev
+
+# 拷贝构建产物
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/server ./server
+COPY --from=builder /app/generated ./generated
+COPY --from=builder /app/prisma ./prisma
+COPY --from=builder /app/prisma.config.ts ./prisma.config.ts
+COPY --from=builder /app/scripts ./scripts
+COPY --from=builder /app/content ./content
+COPY --from=builder /app/public ./public
+
+# OTA 升级包: CI (docker-build.yml) 生成的 ota-package/, 随镜像发布
+# 本地构建时只有占位文件 (ota-package/README.md), server 找不到 latest.json 则 OTA 返回"无更新"
+COPY ota-package ./ota-package
+ENV OTA_PACKAGE_DIR=/app/ota-package
+# OTA bundle 下载用的绝对 base (manifest.url 必须是绝对 URL, 插件不拼 base, 相对路径会导致下载 0% 失败)
+# 生产为 http 明文 (无 https), 客户端 tauri.conf.json 的 hotswap.require_https 已设为 false 放行 http
+ENV OTA_PUBLIC_BASE=http://bh.vps.honor3.com:3001
+
+# 健康检查
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget -qO- http://127.0.0.1:3001/api/health || exit 1
+
+EXPOSE 3001
+
+ENV NODE_ENV=production
+ENV PORT=3001
+
+# Node 22 默认未开 strip-types, 显式开启以便加载 generated/prisma/*.ts
 CMD ["node", "--experimental-strip-types", "--no-warnings", "server/index.js"]
\ No newline at end of file