源码快照 @ 2026-09-01 (source-only, 剔除非源码素材)

.github/workflows/docker-release.yml

@@ -0,0 +1,110 @@
+# Build QwenPaw multi-arch Docker image and push to DockerHub + Aliyun ACR on release.
+# Pre-release: update <version> and pre only.
+# Formal release: update <version>, pre and latest.
+#
+# Pipeline: verify (build amd64 + health-check) → build-and-push (multi-arch).
+name: Docker Build and Push on Release
+
+on:
+  # NOTE: legacy fallback path. The standard release flow is now release.yml
+  # (see RELEASING.md). Publishing a GitHub Release directly still triggers this
+  # OLD publish, which is NOT gated on the desktop build. Kept only as an
+  # emergency rollback until the old release workflows are removed.
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image tag (e.g. v1.2.3 or v1.2.3-beta.1)"
+        required: true
+        type: string
+      is_prerelease:
+        description: "Pre-release (do not update latest tag)"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  ACR_REGISTRY: agentscope-registry.ap-southeast-1.cr.aliyuncs.com
+  IMAGE: agentscope/qwenpaw
+
+jobs:
+  # ── Stage 1: Verify Docker image boots correctly ───────────────────────────
+  verify-docker:
+    uses: ./.github/workflows/release-verify.yml
+    with:
+      verify_docker: true
+    secrets: inherit
+
+  # ── Stage 2: Build multi-arch and push ─────────────────────────────────────
+  build-and-push:
+    needs: [verify-docker]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Get QwenPaw version
+        id: qwenpaw_version
+        uses: ./.github/actions/get-version
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to DockerHub
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Log in to Aliyun ACR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.ACR_REGISTRY }}
+          username: ${{ secrets.ALIYUN_ACR_USERNAME }}
+          password: ${{ secrets.ALIYUN_ACR_PASSWORD }}
+
+      - name: Set version and prerelease flag
+        id: vars
+        run: |
+          if [ -n "${{ github.event.release.tag_name }}" ]; then
+            VERSION="${{ github.event.release.tag_name }}"
+            echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+            # Parse version to determine if it's a pre-release
+            # Beta/alpha/rc/dev are pre-releases, but .post is NOT
+            if [[ "$VERSION" =~ (beta|alpha|rc|dev) ]]; then
+              echo "is_prerelease=true" >> $GITHUB_OUTPUT
+            elif [[ "$VERSION" =~ post ]]; then
+              # .post versions should update latest (post-release patches)
+              echo "is_prerelease=false" >> $GITHUB_OUTPUT
+            else
+              # Use GitHub's prerelease flag as fallback
+              echo "is_prerelease=${{ github.event.release.prerelease }}" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
+            echo "is_prerelease=${{ github.event.inputs.is_prerelease }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and push multi-arch (version + pre [+ latest])
+        env:
+          VERSION: ${{ steps.vars.outputs.version }}
+          IS_PRERELEASE: ${{ steps.vars.outputs.is_prerelease }}
+          QWENPAW_DISABLED_CHANNELS: "imessage"
+          QWENPAW_VERSION: ${{ steps.qwenpaw_version.outputs.version }}
+        run: |
+          TAGS="-t ${ACR_REGISTRY}/${IMAGE}:${VERSION} -t ${ACR_REGISTRY}/${IMAGE}:pre"
+          TAGS="${TAGS} -t docker.io/${IMAGE}:${VERSION} -t docker.io/${IMAGE}:pre"
+          if [ "${IS_PRERELEASE}" != "true" ]; then
+            TAGS="${TAGS} -t ${ACR_REGISTRY}/${IMAGE}:latest -t docker.io/${IMAGE}:latest"
+          fi
+          docker buildx build --platform linux/amd64,linux/arm64 \
+            -f deploy/Dockerfile \
+            --build-arg QWENPAW_DISABLED_CHANNELS="${QWENPAW_DISABLED_CHANNELS}" \
+            --build-arg \
+            QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="${QWENPAW_VERSION}" \
+            ${TAGS} --push .