增强 Gitea CI 网络稳定性

为所有 npm ci 增加整命令级有界重试。

补齐 AI 游戏创作 npm 与 Cargo 依赖缓存闭合验证。

更新可信 CI 镜像、缓存漂移告警和 Runner 运维文档。

记录 Actions Gateway CONNECT 断连崩溃的处理与验证边界。

deploy/container/README.md

@@ -67,13 +67,13 @@ Linux Docker Engine 若要从宿主机 CLI 连到容器内服务，直接用 `ht
 ```bash
 bash scripts/gitea-ci-job-image.sh build
 bash scripts/gitea-ci-job-image.sh verify
-bash scripts/gitea-ci-job-image.sh export /仓库外受控路径/genarrative-gitea-project-ci-20260723.1.tar.zst
+bash scripts/gitea-ci-job-image.sh export /仓库外受控路径/genarrative-gitea-project-ci-20260807.1.tar.zst
 bash scripts/gitea-ci-job-image.sh load-runner
 ```
 
-默认构建 tag 为 `genarrative/gitea-project-ci:20260723.1`。脚本通过 NUL 分隔白名单 tar 流只发送 Dockerfile、checkout 脚本、npm manifests/lock 和 Cargo manifests/lock；当前构建 context 约 `1.638 MB`，不会把业务源码、素材或本地私密文件发送给 Docker daemon。镜像除固定工具链外，还按当前根 `package-lock.json`、`server-rs/Cargo.lock` 和桌面壳 `Cargo.lock` 预热 npm / Cargo 下载缓存；两个 `cargo fetch --locked` 最多执行 5 次整命令级有界重试，再以断网 `cargo fetch --locked` 验证缓存闭合，不包含 `node_modules` 或 Cargo `target`。`build` 完成后会自动运行环境校验，`load-runner` 还会比对宿主和 runner 内层的完整 Image ID，并在内层执行 bwrap 与 Chrome headless canary。当前验证镜像约 `1.788 GB`，完整 Image ID 为 `sha256:c04b114b1f145072c9df7842c4c974e1bb2eaaf391d95d84c9212a460546b7d5`。执行这些命令不要求必须使用 root，但执行账号必须有权访问宿主 Docker API 并管理 runner 容器；没有该权限时交给 runner 运维人员执行。
+默认构建 tag 为 `genarrative/gitea-project-ci:20260807.1`。脚本通过 NUL 分隔白名单 tar 流只发送 Dockerfile、checkout 脚本、根与 AI 游戏创作壳的 npm manifests/lock，以及 server-rs、桌面壳和 AI 游戏创作壳的 Cargo manifests/lock；当前构建 context 约 `2.13 MB`，不会把业务源码、素材或本地私密文件发送给 Docker daemon。镜像除固定工具链外，还按上述五份 lock 预热 npm / Cargo 下载缓存；三个 `cargo fetch --locked` 最多执行 5 次整命令级有界重试，再分别以断网 `cargo fetch --locked` 验证缓存闭合，不包含 `node_modules` 或 Cargo `target`。`build` 完成后会自动运行环境校验，`load-runner` 还会比对宿主和 runner 内层的完整 Image ID，并在内层执行 bwrap 与 Chrome headless canary。当前验证镜像约 `1.85 GB`，完整 Image ID 为 `sha256:8b4b30f5a096522942947927b06cf47bdb1a1016dde9a3573f9780e79d8e40cf`。执行这些命令不要求必须使用 root，但执行账号必须有权访问宿主 Docker API 并管理 runner 容器；没有该权限时交给 runner 运维人员执行。
 
-runner 配置保留原 `ubuntu-latest` 映射，另外增加 `genarrative-ci:docker://sha256:c04b114b1f145072c9df7842c4c974e1bb2eaaf391d95d84c9212a460546b7d5`。内层 Docker 数据必须持久化，`force_pull` 保持 `false`；该精确 Image ID 在内层不存在时 job 应直接失败，不回退到浮动 tag 或现场拉取。四个 job 使用镜像内 `genarrative-gitea-checkout` 直接从当前 Gitea 拉取事件 commit，带 5 次有界重试，不再运行时下载 GitHub checkout action；随后以 `GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1` 执行 `scripts/check-gitea-ci-job-image.sh`，同时校验工具链、缓存锁命中状态、bwrap 和 Chrome headless。它们仍各自运行干净的 `npm ci` 以校验当前 lockfile 并隔离 PR 依赖，但使用镜像内 npm cache 和 `prefer-offline`；锁文件新增依赖时允许经受控网络补齐，本阶段不启用共享 Actions cache。
+runner 配置保留原 `ubuntu-latest` 映射，另外增加 `genarrative-ci:docker://sha256:8b4b30f5a096522942947927b06cf47bdb1a1016dde9a3573f9780e79d8e40cf`。内层 Docker 数据必须持久化，`force_pull` 保持 `false`；该精确 Image ID 在内层不存在时 job 应直接失败，不回退到浮动 tag 或现场拉取。四个 job 使用镜像内 `genarrative-gitea-checkout` 直接从当前 Gitea 拉取事件 commit，带 5 次有界重试，不再运行时下载 GitHub checkout action；随后以 `GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1` 执行 `scripts/check-gitea-ci-job-image.sh`，同时校验工具链、五份缓存锁命中状态、bwrap 和 Chrome headless。锁不匹配时校验会输出 `partial` 和醒目的 Actions warning，提示在可信分支落地后刷新镜像。各 job 仍运行干净的 `npm ci` 以校验当前 lockfile 并隔离 PR 依赖，但统一通过 `scripts/ci-npm-ci-with-retry.sh` 最多执行 3 次整命令级有界重试，并使用镜像内 npm cache 和 `prefer-offline`；锁文件新增依赖时允许经受控网络补齐，本阶段不启用共享 Actions cache。
 
 更新顺序固定为：
 

deploy/container/gitea-ci-job.Dockerfile

@@ -15,6 +15,7 @@ ENV CARGO_HTTP_MULTIPLEXING=false \
 
 COPY server-rs /tmp/genarrative-cargo-cache/server-rs
 COPY apps/desktop-shell/src-tauri /tmp/genarrative-cargo-cache/desktop-shell
+COPY apps/ai-game-creator-shell/src-tauri /tmp/genarrative-cargo-cache/apps/ai-game-creator-shell/src-tauri
 
 RUN find /tmp/genarrative-cargo-cache -name Cargo.toml -exec dirname {} \; \
         | while IFS= read -r crate_dir; do \
@@ -39,12 +40,16 @@ RUN find /tmp/genarrative-cargo-cache -name Cargo.toml -exec dirname {} \; \
       } \
     && cargo_fetch_with_retry /tmp/genarrative-cargo-cache/server-rs/Cargo.toml \
     && cargo_fetch_with_retry /tmp/genarrative-cargo-cache/desktop-shell/Cargo.toml \
+    && cargo_fetch_with_retry /tmp/genarrative-cargo-cache/apps/ai-game-creator-shell/src-tauri/Cargo.toml \
     && CARGO_NET_OFFLINE=true cargo fetch --locked \
         --target x86_64-unknown-linux-gnu \
         --manifest-path /tmp/genarrative-cargo-cache/server-rs/Cargo.toml \
     && CARGO_NET_OFFLINE=true cargo fetch --locked \
         --target x86_64-unknown-linux-gnu \
         --manifest-path /tmp/genarrative-cargo-cache/desktop-shell/Cargo.toml \
+    && CARGO_NET_OFFLINE=true cargo fetch --locked \
+        --target x86_64-unknown-linux-gnu \
+        --manifest-path /tmp/genarrative-cargo-cache/apps/ai-game-creator-shell/src-tauri/Cargo.toml \
     && rm -rf /tmp/genarrative-cargo-cache
 
 FROM ${RUNNER_IMAGE}
@@ -123,21 +128,31 @@ COPY --from=rust-dependency-cache /usr/local/cargo /usr/local/cargo
 COPY --from=rust-dependency-cache /usr/local/rustup /usr/local/rustup
 
 ARG NPM_LOCK_SHA256
+ARG AGC_NPM_LOCK_SHA256
 ARG SERVER_RUST_LOCK_SHA256
 ARG DESKTOP_RUST_LOCK_SHA256
+ARG AGC_RUST_LOCK_SHA256
 
 COPY package.json package-lock.json /usr/local/share/genarrative-ci/npm/
+COPY apps/ai-game-creator-shell/package.json apps/ai-game-creator-shell/package-lock.json /usr/local/share/genarrative-ci/agc-npm/
 COPY server-rs/Cargo.lock /usr/local/share/genarrative-ci/locks/server-rs.Cargo.lock
 COPY apps/desktop-shell/src-tauri/Cargo.lock /usr/local/share/genarrative-ci/locks/desktop-shell.Cargo.lock
+COPY apps/ai-game-creator-shell/src-tauri/Cargo.lock /usr/local/share/genarrative-ci/locks/ai-game-creator-shell.Cargo.lock
 COPY deploy/container/gitea-ci-checkout.sh /usr/local/bin/genarrative-gitea-checkout
 
 RUN test -n "${NPM_LOCK_SHA256}" \
+    && test -n "${AGC_NPM_LOCK_SHA256}" \
     && test -n "${SERVER_RUST_LOCK_SHA256}" \
     && test -n "${DESKTOP_RUST_LOCK_SHA256}" \
+    && test -n "${AGC_RUST_LOCK_SHA256}" \
     && printf '%s  %s\n' \
         "${NPM_LOCK_SHA256}" \
         /usr/local/share/genarrative-ci/npm/package-lock.json \
         | sha256sum --check --strict \
+    && printf '%s  %s\n' \
+        "${AGC_NPM_LOCK_SHA256}" \
+        /usr/local/share/genarrative-ci/agc-npm/package-lock.json \
+        | sha256sum --check --strict \
     && printf '%s  %s\n' \
         "${SERVER_RUST_LOCK_SHA256}" \
         /usr/local/share/genarrative-ci/locks/server-rs.Cargo.lock \
@@ -146,6 +161,10 @@ RUN test -n "${NPM_LOCK_SHA256}" \
         "${DESKTOP_RUST_LOCK_SHA256}" \
         /usr/local/share/genarrative-ci/locks/desktop-shell.Cargo.lock \
         | sha256sum --check --strict \
+    && printf '%s  %s\n' \
+        "${AGC_RUST_LOCK_SHA256}" \
+        /usr/local/share/genarrative-ci/locks/ai-game-creator-shell.Cargo.lock \
+        | sha256sum --check --strict \
     && chmod 0755 /usr/local/bin/genarrative-gitea-checkout \
     && npm ci \
         --ignore-scripts \
@@ -154,6 +173,13 @@ RUN test -n "${NPM_LOCK_SHA256}" \
         --prefer-offline \
         --prefix /usr/local/share/genarrative-ci/npm \
     && rm -rf /usr/local/share/genarrative-ci/npm/node_modules \
+    && npm ci \
+        --ignore-scripts \
+        --no-audit \
+        --no-fund \
+        --prefer-offline \
+        --prefix /usr/local/share/genarrative-ci/agc-npm \
+    && rm -rf /usr/local/share/genarrative-ci/agc-npm/node_modules \
     && npm cache verify
 
 RUN install -m 0755 /usr/local/cargo/bin/rustup /usr/local/bin/rustup \
@@ -162,6 +188,8 @@ RUN install -m 0755 /usr/local/cargo/bin/rustup /usr/local/bin/rustup \
     done
 
 ENV CARGO_HOME=/usr/local/cargo \
+    GENARRATIVE_GITEA_CI_AGC_NPM_LOCK_SHA256=${AGC_NPM_LOCK_SHA256} \
+    GENARRATIVE_GITEA_CI_AGC_RUST_LOCK_SHA256=${AGC_RUST_LOCK_SHA256} \
     GENARRATIVE_GITEA_CI_DESKTOP_RUST_LOCK_SHA256=${DESKTOP_RUST_LOCK_SHA256} \
     GENARRATIVE_GITEA_CI_NPM_LOCK_SHA256=${NPM_LOCK_SHA256} \
     GENARRATIVE_GITEA_CI_SERVER_RUST_LOCK_SHA256=${SERVER_RUST_LOCK_SHA256} \
@@ -178,6 +206,7 @@ ENV CARGO_HOME=/usr/local/cargo \
 
 ARG IMAGE_REVISION=uncommitted
 LABEL org.opencontainers.image.vendor="GenarrativeAI" \
+    org.opencontainers.image.version="2026.08.07.1" \
     org.opencontainers.image.source="https://git.genarrative.world/GenarrativeAI/Genarrative" \
     org.opencontainers.image.revision="${IMAGE_REVISION}" \
     org.opencontainers.image.base.name="docker.gitea.com/runner-images:ubuntu-latest@sha256:58ea92624c7c09582e05594d95488331045053d3a3f34cf09649f2a32313a614" \

deploy/container/gitea-ci-job.Dockerfile.dockerignore

@@ -12,6 +12,12 @@
 !server-rs/crates/*/
 !server-rs/crates/*/Cargo.toml
 !apps/
+!apps/ai-game-creator-shell/
+!apps/ai-game-creator-shell/package.json
+!apps/ai-game-creator-shell/package-lock.json
+!apps/ai-game-creator-shell/src-tauri/
+!apps/ai-game-creator-shell/src-tauri/Cargo.toml
+!apps/ai-game-creator-shell/src-tauri/Cargo.lock
 !apps/desktop-shell/
 !apps/desktop-shell/src-tauri/
 !apps/desktop-shell/src-tauri/Cargo.toml