预热Gitea CI项目依赖缓存

将npm与Rust依赖下载缓存预热到固定CI镜像
改为直接从Gitea checkout并增加网络重试
收窄镜像构建上下文并补齐离线与运行时校验
同步Runner切换边界和运维文档

scripts/check-gitea-ci-job-image.sh

@@ -16,6 +16,57 @@ test "$(rustup show home)" = "/usr/local/rustup"
 for trusted_command in cargo rustc rustdoc rustfmt rustup; do
   test "$(command -v "${trusted_command}")" = "/usr/local/bin/${trusted_command}"
 done
+test "$(command -v genarrative-gitea-checkout)" = "/usr/local/bin/genarrative-gitea-checkout"
+bash -n /usr/local/bin/genarrative-gitea-checkout
+test -d /root/.npm/_cacache
+test -d /usr/local/cargo/registry/cache
+
+verify_cache_lock() {
+  local cache_name="$1"
+  local expected_sha256="$2"
+  local lock_path="$3"
+  local actual_sha256
+
+  test -n "${expected_sha256}"
+  actual_sha256="$(sha256sum "${lock_path}")"
+  actual_sha256="${actual_sha256%% *}"
+  if [[ "${actual_sha256}" == "${expected_sha256}" ]]; then
+    printf '%s_cache_lock=hit\n' "${cache_name}"
+    return
+  fi
+  if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
+    printf '%s_cache_lock=partial\n' "${cache_name}"
+    return
+  fi
+  echo "${cache_name} cache lock does not match the verification checkout." >&2
+  exit 1
+}
+
+npm_lock_path="${repo_root}/package-lock.json"
+server_rust_lock_path="${repo_root}/server-rs/Cargo.lock"
+desktop_rust_lock_path="${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock"
+if [[ ! -f "${npm_lock_path}" ]]; then
+  npm_lock_path='/usr/local/share/genarrative-ci/npm/package-lock.json'
+fi
+if [[ ! -f "${server_rust_lock_path}" ]]; then
+  server_rust_lock_path='/usr/local/share/genarrative-ci/locks/server-rs.Cargo.lock'
+fi
+if [[ ! -f "${desktop_rust_lock_path}" ]]; then
+  desktop_rust_lock_path='/usr/local/share/genarrative-ci/locks/desktop-shell.Cargo.lock'
+fi
+
+verify_cache_lock \
+  npm \
+  "${GENARRATIVE_GITEA_CI_NPM_LOCK_SHA256:-}" \
+  "${npm_lock_path}"
+verify_cache_lock \
+  server_rust \
+  "${GENARRATIVE_GITEA_CI_SERVER_RUST_LOCK_SHA256:-}" \
+  "${server_rust_lock_path}"
+verify_cache_lock \
+  desktop_rust \
+  "${GENARRATIVE_GITEA_CI_DESKTOP_RUST_LOCK_SHA256:-}" \
+  "${desktop_rust_lock_path}"
 
 for command_name in \
   bwrap \

scripts/gitea-ci-job-image.sh

@@ -3,11 +3,24 @@
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
-dockerfile="${repo_root}/deploy/container/gitea-ci-job.Dockerfile"
-build_context="${repo_root}/deploy/container"
-image_tag="${GENARRATIVE_GITEA_CI_IMAGE_TAG:-genarrative/gitea-project-ci:20260722.1}"
+dockerfile_context_path="deploy/container/gitea-ci-job.Dockerfile"
+image_tag="${GENARRATIVE_GITEA_CI_IMAGE_TAG:-genarrative/gitea-project-ci:20260722.2}"
 runner_container="${GENARRATIVE_GITEA_RUNNER_CONTAINER:-gitea-runner}"
 
+write_build_context_file_list() {
+  printf '%s\0' \
+    deploy/container/gitea-ci-job.Dockerfile \
+    deploy/container/gitea-ci-job.Dockerfile.dockerignore \
+    deploy/container/gitea-ci-checkout.sh \
+    package.json \
+    package-lock.json \
+    server-rs/Cargo.toml \
+    server-rs/Cargo.lock \
+    apps/desktop-shell/src-tauri/Cargo.toml \
+    apps/desktop-shell/src-tauri/Cargo.lock
+  find server-rs/crates -name Cargo.toml -print0 | sort -z
+}
+
 usage() {
   cat <<'EOF'
 用法：
@@ -39,14 +52,46 @@ verify_image() {
 command_name="${1:-}"
 case "${command_name}" in
   build)
-    image_revision="$(sha256sum "${dockerfile}")"
-    image_revision="${image_revision%% *}"
-    docker build \
-      --pull=false \
-      --build-arg "IMAGE_REVISION=${image_revision}" \
-      --file "${dockerfile}" \
-      --tag "${image_tag}" \
-      "${build_context}"
+    image_revision="$(
+      cd "${repo_root}"
+      {
+        sha256sum \
+          deploy/container/gitea-ci-job.Dockerfile \
+          deploy/container/gitea-ci-job.Dockerfile.dockerignore \
+          deploy/container/gitea-ci-checkout.sh \
+          package.json \
+          package-lock.json \
+          server-rs/Cargo.toml \
+          server-rs/Cargo.lock \
+          apps/desktop-shell/src-tauri/Cargo.toml \
+          apps/desktop-shell/src-tauri/Cargo.lock
+        find server-rs/crates -name Cargo.toml -print0 \
+          | sort -z \
+          | xargs -0 -r sha256sum
+      } \
+        | sha256sum \
+        | awk '{ print $1 }'
+    )"
+    npm_lock_sha256="$(sha256sum "${repo_root}/package-lock.json")"
+    npm_lock_sha256="${npm_lock_sha256%% *}"
+    server_rust_lock_sha256="$(sha256sum "${repo_root}/server-rs/Cargo.lock")"
+    server_rust_lock_sha256="${server_rust_lock_sha256%% *}"
+    desktop_rust_lock_sha256="$(sha256sum "${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock")"
+    desktop_rust_lock_sha256="${desktop_rust_lock_sha256%% *}"
+    (
+      cd "${repo_root}"
+      write_build_context_file_list \
+        | tar --null --create --file - --files-from=- \
+        | docker build \
+          --pull=false \
+          --build-arg "IMAGE_REVISION=${image_revision}" \
+          --build-arg "NPM_LOCK_SHA256=${npm_lock_sha256}" \
+          --build-arg "SERVER_RUST_LOCK_SHA256=${server_rust_lock_sha256}" \
+          --build-arg "DESKTOP_RUST_LOCK_SHA256=${desktop_rust_lock_sha256}" \
+          --file "${dockerfile_context_path}" \
+          --tag "${image_tag}" \
+          -
+    )
     verify_image "${image_tag}"
     printf 'image_tag=%s\n' "${image_tag}"
     printf 'image_id=%s\n' "$(image_id "${image_tag}")"