fix: mirror node:20-alpine to Gitea when Docker Hub TLS times out

BuildKit was failing on registry-1.docker.io even when a local base image existed. CI now prefers a Gitea-hosted NODE_IMAGE and retries docker build.
2026-09-05 19:12:37 +03:30
parent 663eafa3e8
commit c1846f8e22
6 changed files with 175 additions and 35 deletions
--- a/.gitea/workflows/prod-tag-deploy.yml
+++ b/.gitea/workflows/prod-tag-deploy.yml
@@ -101,15 +101,34 @@ jobs:
          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

+      - name: Resolve node:20-alpine (Gitea mirror, then local, then Hub)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
      - name: Build and push backend (tag only, not :latest)
        run: |
          $ErrorActionPreference = 'Stop'
          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
-          Write-Host "Building $prefix/dyolink-backend:$tag"
-          docker build -t "$prefix/dyolink-backend:$tag" ./backend
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
+          Write-Host "Building $prefix/dyolink-backend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
+            docker build --build-arg "NODE_IMAGE=$nodeImage" -t "$prefix/dyolink-backend:$tag" ./backend
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
          docker push "$prefix/dyolink-backend:$tag"
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

@@ -122,19 +141,32 @@ jobs:
          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
          $base = $env:PROD_PUBLIC_BASE_URL.Trim()
          if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
          $base = $base.TrimEnd('/')
-          Write-Host "Building $prefix/dyolink-frontend:$tag"
-          docker build `
-            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
-            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
-            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
-            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
-            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" `
-            -t "$prefix/dyolink-frontend:$tag" `
-            ./frontend
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          Write-Host "Building $prefix/dyolink-frontend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
+            docker build `
+              --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
+              --build-arg "NEXT_PUBLIC_APP_URL=$base" `
+              --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+              --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
+              --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" `
+              --build-arg "NODE_IMAGE=$nodeImage" `
+              -t "$prefix/dyolink-frontend:$tag" `
+              ./frontend
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
          docker push "$prefix/dyolink-frontend:$tag"
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

--- a/.gitea/workflows/registry-build-deploy.yml
+++ b/.gitea/workflows/registry-build-deploy.yml
@@ -84,6 +84,13 @@ jobs:
          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

+      - name: Resolve node:20-alpine (Gitea mirror, then local, then Hub)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
      - name: Build and push backend
        run: |
          $ErrorActionPreference = 'Stop'
@@ -93,12 +100,25 @@ jobs:
            Write-Host "Missing github.sha, REGISTRY_HOST, or REGISTRY_OWNER"
            exit 1
          }
-          Write-Host "Building $prefix/dyolink-backend:$tag"
-          docker build `
-            -t "$prefix/dyolink-backend:$tag" `
-            -t "$prefix/dyolink-backend:latest" `
-            ./backend
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
+          Write-Host "Building $prefix/dyolink-backend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
+            docker build `
+              --build-arg "NODE_IMAGE=$nodeImage" `
+              -t "$prefix/dyolink-backend:$tag" `
+              -t "$prefix/dyolink-backend:latest" `
+              ./backend
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
          docker push "$prefix/dyolink-backend:$tag"
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          docker push "$prefix/dyolink-backend:latest"
@@ -113,17 +133,30 @@ jobs:
          $tag = "${{ github.sha }}".Substring(0, 7)
          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
          $base = $env:PUBLIC_BASE_URL
-          Write-Host "Building $prefix/dyolink-frontend:$tag"
-          docker build `
-            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
-            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
-            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
-            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
-            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" `
-            -t "$prefix/dyolink-frontend:$tag" `
-            -t "$prefix/dyolink-frontend:latest" `
-            ./frontend
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
+          Write-Host "Building $prefix/dyolink-frontend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
+            docker build `
+              --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
+              --build-arg "NEXT_PUBLIC_APP_URL=$base" `
+              --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+              --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
+              --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" `
+              --build-arg "NODE_IMAGE=$nodeImage" `
+              -t "$prefix/dyolink-frontend:$tag" `
+              -t "$prefix/dyolink-frontend:latest" `
+              ./frontend
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
          docker push "$prefix/dyolink-frontend:$tag"
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          docker push "$prefix/dyolink-frontend:latest"