ci: 优化构建速度与资源消耗

- docker-build: 停用 docker system prune --volumes (保住 build 层缓存), 改为 image prune -f - 新增 .dockerignore, node_modules/.git/src-tauri 等不再进 build context - 前端只构建一次: CI 构建 dist 供 OTA 与镜像复用 (PREBUILT_DIST 构建参数) - Dockerfile: npm install → npm ci + BuildKit cache mount - setup-node 开启 npm 缓存; master/android-* 加 concurrency 取消旧 run - android: 只构建 aarch64; tauri target 缓存 key 按 Cargo.lock hash - minisign 改为静态二进制下载, 去掉 apt-get
2026-10-25 00:48:50 +08:00
parent 20a5105c23
commit 51256335ba
5 changed files with 500 additions and 443 deletions
@@ -1,75 +1,81 @@
-name: OTA Frontend Build & Sign
-
-# 前端 OTA 升级包构建 + 签名 + 上传 artifact
-# 触发: 仅手动 (workflow_dispatch), 发版前用
-#   - 主分支 push 的自动 OTA 生成已并入 docker-build.yml (随镜像发布), 本 workflow 不再监听 push 避免重复构建
-# 输入: sequence / notes / min_binary (可覆盖默认)
-# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
-# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
-#       换密钥请手动改 conf 并 commit.
-
-on:
-  workflow_dispatch:
-    inputs:
-      sequence:
-        description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
-        required: false
-        type: string
-      notes:
-        description: '发布说明 (写入 latest.json.notes)'
-        required: false
-        type: string
-        default: ''
-      min_binary:
-        description: '最低 binary 版本 (默认 0.1.0 = 现有 APK 的原生版本, 与前端应用版本无关)'
-        required: false
-        type: string
-        default: '0.1.0'
-
-jobs:
-  build-ota:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
-
-      - name: Setup Node
-        uses: https://gitea.com/actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install deps
-        run: npm ci --no-audit --no-fund
-
-      - name: Build frontend
-        # 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
-        run: npm run build
-
-      - name: Install minisign
-        run: sudo apt-get update && sudo apt-get install -y minisign
-
-      - name: Build & sign OTA package
-        env:
-          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
-          OTA_NOTES: ${{ inputs.notes }}
-        run: |
-          set -euo pipefail
-          OUT="ota-package"
-          ARGS="--out ${OUT}"
-          # sequence 留空 → 脚本默认用时间戳; min_binary 默认 0.1.0 (与前端版本解耦)
-          if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
-          if [ -n "${OTA_NOTES}" ]; then ARGS="${ARGS} --notes ${OTA_NOTES}"; fi
-          if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
-          node scripts/build-ota.mjs ${ARGS}
-          echo "===== latest.json ====="
-          cat ${OUT}/latest.json
-          echo "===== bundle sha256 ====="
-          sha256sum ${OUT}/iboard-ota.tar.gz
-
-      - name: Upload OTA package as artifact
-        uses: https://gitea.com/actions/upload-artifact@v4
-        with:
-          name: iboard-ota-${{ inputs.sequence || github.run_number }}
-          path: ota-package/
-          retention-days: 30
-          if-no-files-found: error
+name: OTA Frontend Build & Sign
+
+# 前端 OTA 升级包构建 + 签名 + 上传 artifact
+# 触发: 仅手动 (workflow_dispatch), 发版前用
+#   - 主分支 push 的自动 OTA 生成已并入 docker-build.yml (随镜像发布), 本 workflow 不再监听 push 避免重复构建
+# 输入: sequence / notes / min_binary (可覆盖默认)
+# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
+# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
+#       换密钥请手动改 conf 并 commit.
+
+on:
+  workflow_dispatch:
+    inputs:
+      sequence:
+        description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
+        required: false
+        type: string
+      notes:
+        description: '发布说明 (写入 latest.json.notes)'
+        required: false
+        type: string
+        default: ''
+      min_binary:
+        description: '最低 binary 版本 (默认 0.1.0 = 现有 APK 的原生版本, 与前端应用版本无关)'
+        required: false
+        type: string
+        default: '0.1.0'
+
+jobs:
+  build-ota:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install deps
+        run: npm ci --no-audit --no-fund
+
+      - name: Build frontend
+        # 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
+        run: npm run build
+
+      - name: Install minisign
+        # 静态二进制直接下载, 免去每次 apt-get update + install
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/ms
+          curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
+          sudo install -m755 "$(find /tmp/ms -type f -name minisign | head -1)" /usr/local/bin/minisign
+          minisign -v
+
+      - name: Build & sign OTA package
+        env:
+          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
+          OTA_NOTES: ${{ inputs.notes }}
+        run: |
+          set -euo pipefail
+          OUT="ota-package"
+          ARGS="--out ${OUT}"
+          # sequence 留空 → 脚本默认用时间戳; min_binary 默认 0.1.0 (与前端版本解耦)
+          if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
+          if [ -n "${OTA_NOTES}" ]; then ARGS="${ARGS} --notes ${OTA_NOTES}"; fi
+          if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
+          node scripts/build-ota.mjs ${ARGS}
+          echo "===== latest.json ====="
+          cat ${OUT}/latest.json
+          echo "===== bundle sha256 ====="
+          sha256sum ${OUT}/iboard-ota.tar.gz
+
+      - name: Upload OTA package as artifact
+        uses: https://gitea.com/actions/upload-artifact@v4
+        with:
+          name: iboard-ota-${{ inputs.sequence || github.run_number }}
+          path: ota-package/
+          retention-days: 30
+          if-no-files-found: error