ci(infra): workflow 参照 CICD 参考项目重构

- 所有需要 docker 的 job 改用 container: dockerreg.eazygame.cn/node-with-docker:22

- ci-go.yml: quality 阶段用 golang:1.22-alpine，docker-build 阶段切到 node-with-docker:22

- ci-ts.yml/docker.yml/deploy.yml: 全部加 container 配置

- 移除 setup-node/setup-go action（容器内已有 node/go 或手动安装）

- 不配置 npm 代理（runner 已全局代理）

.github/workflows/ci-go.yml

@@ -1,5 +1,11 @@
 name: CI Go
 
+# 参考实现：E:\Desktop\CICD\.gitea\workflows\ci.yml
+# Go 服务分两阶段：
+#   - quality: golang:1.22-alpine 容器（不需要 docker）
+#   - docker-build: dockerreg.eazygame.cn/node-with-docker:22 + setup-go（需要 docker 命令）
+# 详见 docs/standards/cicd-runbook.md §10、project_rules §15.7
+
 on:
   push:
     branches: [main]
@@ -21,36 +27,34 @@ on:
 jobs:
   quality:
     runs-on: ubuntu-latest
+    container: golang:1.22-alpine
     defaults:
       run:
         working-directory: services/api-gateway
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+
-        with:
-          go-version: '1.22'
-          cache-dependency-path: services/api-gateway/go.sum
       - name: Download deps
         run: go mod download
+
       - name: Vet
         run: go vet ./...
+
       - name: Build
         run: go build ./...
+
       - name: Test
         run: go test ./... -v -coverprofile=coverage.out
 
   docker-build:
     runs-on: ubuntu-latest
+    container: dockerreg.eazygame.cn/node-with-docker:22
     needs: quality
     steps:
       - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
       - name: Build api-gateway
-        uses: docker/build-push-action@v5
+        run: |
-        with:
+          docker build \
-          context: ./services/api-gateway
+            -t edu/api-gateway:ci \
-          file: services/api-gateway/Dockerfile
+            -f services/api-gateway/Dockerfile \
-          push: false
+            services/api-gateway
-          tags: edu/api-gateway:ci
-          cache-from: type=gha
-          cache-to: type=gha,mode=max

.github/workflows/ci-ts.yml

@@ -1,5 +1,9 @@
 name: CI TypeScript
 
+# 参考实现：E:\Desktop\CICD\.gitea\workflows\ci.yml
+# 关键配置：container: dockerreg.eazygame.cn/node-with-docker:22（带 docker 的 node 22）
+# 详见 docs/standards/cicd-runbook.md §10、project_rules §15.7
+
 on:
   push:
     branches: [main]
@@ -24,44 +28,46 @@ on:
       - 'tsconfig.base.json'
       - '.github/workflows/ci-ts.yml'
 
+env:
+  SKIP_ENV_VALIDATION: '1'
+  NEXT_TELEMETRY_DISABLED: '1'
+
 jobs:
   quality:
     runs-on: ubuntu-latest
+    container: dockerreg.eazygame.cn/node-with-docker:22
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+
-        with:
+      - name: Install pnpm
-          version: 9
+        run: npm install -g pnpm@9
-      - uses: actions/setup-node@v4
+
-        with:
+      - name: Install dependencies
-          node-version: '20'
-          cache: 'pnpm'
-      - name: Install
         run: pnpm install --frozen-lockfile
+
       - name: Lint
         run: pnpm -r run lint
         continue-on-error: true # P1: ESLint 9 flat config 迁移未完成
+
       - name: Typecheck
         run: pnpm -r run typecheck
+
       - name: Test
         run: pnpm -r run test
         continue-on-error: true # P1: 部分服务无 test 脚本
+
       - name: Build
         run: pnpm -r run build
 
   arch-scan:
     runs-on: ubuntu-latest
+    container: dockerreg.eazygame.cn/node-with-docker:22
     needs: quality
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - name: Install pnpm
-        with:
+        run: npm install -g pnpm@9
-          version: 9
+      - name: Install dependencies
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'pnpm'
-      - name: Install
         run: pnpm install --frozen-lockfile
       - name: arch:scan
         run: pnpm run arch:scan
@@ -75,6 +81,7 @@ jobs:
 
   docker-build:
     runs-on: ubuntu-latest
+    container: dockerreg.eazygame.cn/node-with-docker:22
     needs: quality
     strategy:
       matrix:
@@ -83,13 +90,9 @@ jobs:
           - { name: teacher-portal, dockerfile: apps/teacher-portal/Dockerfile, context: . }
     steps:
       - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
       - name: Build ${{ matrix.service.name }}
-        uses: docker/build-push-action@v5
+        run: |
-        with:
+          docker build \
-          context: ${{ matrix.service.context }}
+            -t edu/${{ matrix.service.name }}:ci \
-          file: ${{ matrix.service.dockerfile }}
+            -f ${{ matrix.service.dockerfile }} \
-          push: false
+            ${{ matrix.service.context }}
-          tags: edu/${{ matrix.service.name }}:ci
-          cache-from: type=gha
-          cache-to: type=gha,mode=max

.github/workflows/deploy.yml

@@ -1,5 +1,7 @@
 name: Deploy
 
+# 参考实现：E:\Desktop\CICD\.gitea\workflows\ci.yml
+# 关键配置：container: dockerreg.eazygame.cn/node-with-docker:22（job 内执行 docker compose）
 # 部署到服务器
 # 触发条件：main 分支 docker.yml 完成后 自动，或手动 workflow_dispatch
 # 部署方式：Runner 直接执行 docker compose（Runner 跑在服务器上）
@@ -11,6 +13,7 @@ name: Deploy
 #   4. 服务器 Docker 已登录 Gitea Container Registry：
 #      docker login git.eazygame.cn -u <user> -p <token>
 #   5. MySQL + Redis 已在服务器 Docker 中运行（3306/6379）
+# 详见 docs/standards/cicd-runbook.md §10、project_rules §15.7
 
 on:
   workflow_dispatch:
@@ -43,6 +46,7 @@ jobs:
     # 仅在 docker.yml 成功后触发，或手动触发
     if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
+    container: dockerreg.eazygame.cn/node-with-docker:22
     environment:
       name: production
     steps:
@@ -52,7 +56,7 @@ jobs:
       - name: Setup deploy dir
         run: |
           sudo mkdir -p ${{ env.DEPLOY_DIR }}
-          sudo chown -R $USER:$USER ${{ env.DEPLOY_DIR }}
+          sudo chown -R $(id -u):$(id -g) ${{ env.DEPLOY_DIR }}
 
       - name: Sync compose file
         run: |
@@ -68,7 +72,8 @@ jobs:
           # 使用预存的 ~/.docker/config.json（首次部署时人工 docker login）
           # 或使用 secrets 注入
           if [ -n "${{ secrets.GITEA_REGISTRY_TOKEN }}" ]; then
-            echo "${{ secrets.GITEA_REGISTRY_TOKEN }}" | docker login ${{ env.REGISTRY }} -u ${{ secrets.GITEA_REGISTRY_USER }} --password-stdin
+            echo "${{ secrets.GITEA_REGISTRY_TOKEN }}" | \
+              docker login ${{ env.REGISTRY }} -u ${{ secrets.GITEA_REGISTRY_USER }} --password-stdin
           fi
 
       - name: Pull images

.github/workflows/docker.yml

@@ -1,7 +1,11 @@
 name: Docker Build & Push
 
+# 参考实现：E:\Desktop\CICD\.gitea\workflows\ci.yml
+# 关键配置：container: dockerreg.eazygame.cn/node-with-docker:22（job 内执行 docker build/push）
 # 触发条件：main 分支推送 或 打 v* tag
 # 镜像推送到 Gitea Container Registry: git.eazygame.cn/xiner/edu/<service>:<tag>
+# 详见 docs/standards/cicd-runbook.md §10、project_rules §15.7
+
 on:
   push:
     branches: [main]
@@ -26,6 +30,7 @@ env:
 jobs:
   build-push:
     runs-on: ubuntu-latest
+    container: dockerreg.eazygame.cn/node-with-docker:22
     strategy:
       matrix:
         service:
@@ -35,43 +40,46 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: docker/setup-buildx-action@v3
-
       # 登录 Gitea Container Registry
       # GITHUB_TOKEN 由 Gitea Actions 自动注入，对应仓库写权限
       - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
+        run: |
-        with:
+          echo "${{ secrets.GITHUB_TOKEN }}" | \
-          registry: ${{ env.REGISTRY }}
+            docker login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
 
       # 生成镜像 tag
       # main 分支：latest + git-sha
       # v* tag：v<version> + latest
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        run: |
-        with:
+          TAGS="${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_LOWER }}/${{ matrix.service.name }}:latest"
-          images: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_LOWER }}/${{ matrix.service.name }}
+          SHA_TAG="${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_LOWER }}/${{ matrix.service.name }}:sha-${GITHUB_SHA::7}"
-          tags: |
+          TAGS="$TAGS,$SHA_TAG"
-            type=raw,value=latest,enable={{is_default_branch}}
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
-            type=sha,prefix={{branch}}-,enable={{is_default_branch}}
+            VERSION="${GITHUB_REF#refs/tags/v}"
-            type=semver,pattern=v{{version}}
+            TAGS="$TAGS,${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_LOWER }}/${{ matrix.service.name }}:v${VERSION}"
-            type=semver,pattern=v{{major}}.{{minor}}
+          fi
-            type=ref,event=branch
+          echo "tags=$TAGS" >> $GITHUB_OUTPUT
+          echo "Resolved tags: $TAGS"
 
       - name: Build and push ${{ matrix.service.name }}
-        uses: docker/build-push-action@v5
+        run: |
-        with:
+          IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}"
-          context: ${{ matrix.service.context }}
+          TAG_ARGS=""
-          file: ${{ matrix.service.dockerfile }}
+          for tag in "${TAG_ARRAY[@]}"; do
-          push: true
+            TAG_ARGS="$TAG_ARGS -t $tag"
-          tags: ${{ steps.meta.outputs.tags }}
+          done
-          labels: ${{ steps.meta.outputs.labels }}
+
-          cache-from: type=gha
+          docker build \
-          cache-to: type=gha,mode=max
+            $TAG_ARGS \
-          provenance: false
+            -f ${{ matrix.service.dockerfile }} \
+            ${{ matrix.service.context }}
+
+          for tag in "${TAG_ARRAY[@]}"; do
+            echo "Pushing $tag..."
+            docker push $tag
+          done
 
       - name: Summary
         run: |