ci: 用 GitHub Actions 构建并推送发布镜像 - #11
Open
binyangzhu000-sudo wants to merge 1 commit into
Open
binyangzhu000-sudo wants to merge 1 commit into
binyangzhu000-sudo wants to merge 1 commit into
Conversation
This repo had no build pipeline - the only workflow syncs the model catalog - so every image so far was built by hand on the jump host and tagged with a date slug like 20260910-preview-logs. Nothing ties such an image back to a commit, and the same tag was serving dev, so rebuilding it moved production too. Follows the pattern already proven on the website repo, including its runner choice: the build stays on a GitHub-hosted runner because the self-hosted one loses DNS packets on egress and the login to registry.atlascloud.ai fails resolving dockerauth-*.aliyuncs.com. This job only needs the public internet. Two gates make the image traceable, which is the whole point of tagging: the tag must look like vX.Y.Z, and it must match package.json's version. A mismatch fails with the exact edit to make rather than publishing an image whose name says nothing about what is inside it. Triggers are a v* tag push and a manual dispatch, both of which require write access - this repo is public, so a fork's pull request must never reach the registry credentials. Those live in the production environment rather than at repo level for the same reason: sync-models and anything added later cannot read them. Build and push only. Deployment stays with kustomize in deploy/kubernetes, so no cluster credential is needed here. The run summary prints the tag and the digest for pasting into the production overlay. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
为什么
这个仓没有构建流水线——唯一的 workflow 是同步模型目录。所以至今每个镜像都是在跳板机上手工
docker build出来的，标签是20260910-preview-logs这样的日期串。两个后果：
怎么做
照官网那条 workflow 的模式，包括它的 runner 选择：构建放 GitHub 托管 runner，不要换成自建那台——机房出网 DNS 丢包，登录
registry.atlascloud.ai时解析dockerauth-*.aliyuncs.com会反复 i/o timeout（2026-08 运维确认）。这个 job 只需要公网。两个门禁保证镜像可追溯，这也是打 tag 的全部意义：
vX.Y.Zpackage.json的version一致对不上就报错并给出该改哪一行，而不是推出一个名字说明不了内容的镜像。
触发与凭据
触发只有两个：push 一个
v*标签，或手动 dispatch。两者都要求对本仓有写权限——本仓是公开仓，fork 的 PR 绝不能碰到 registry 凭据。凭据放在
production环境而不是仓库级，理由同上：sync-models和以后新增的任何 workflow 都读不到它们。合并后需要在 Settings → Environments → production 里加：
DOCKER_REGISTRYregistry.atlascloud.aiDOCKER_USERNAMEDOCKER_PASSWORD范围
只构建和推送，不部署。 部署仍走
deploy/kubernetes/的 kustomize，所以这里不需要任何集群凭据。运行摘要会打印标签和 digest，直接复制进 production overlay 即可。🤖 Generated with Claude Code