deepdata: delivery stack (docker compose, helm, CI, build scripts)

.github/workflows/codeql.yml

@@ -0,0 +1,86 @@
+# 对于大多数项目，此工作流文件无需更改；只需提交到您的仓库即可。
+#
+# 您可以根据需要修改此文件，以覆盖分析的语言集，或提供自定义查询或构建逻辑。
+#
+# ******** 注意 ********
+# 我们已尝试检测您的仓库中的语言。请检查下面定义的 `language` 矩阵，确保包含了所有受支持的 CodeQL 语言。
+name: "CodeQL Advanced"
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '23 5 * * 2'
+  workflow_dispatch:
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner 的规格会影响 CodeQL 分析时间。详情请参阅：
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (仅限 GitHub.com)
+    # 建议使用更高规格的 Runner 或更大资源的机器以提升分析速度。
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # 所有工作流都需要
+      security-events: write
+      # 获取内部或私有 CodeQL 包时需要
+      packages: read
+      # 仅私有仓库工作流需要
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: javascript-typescript
+          build-mode: none
+        - language: python
+          build-mode: none
+        - language: java-kotlin
+          build-mode: none
+        # CodeQL 支持以下 'language' 关键字：'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
+        # 使用 `c-cpp` 可分析 C、C++ 或两者的代码
+        # 使用 'java-kotlin' 可分析 Java、Kotlin 或两者的代码
+        # 使用 'javascript-typescript' 可分析 JavaScript、TypeScript 或两者的代码
+        # 了解如何更改分析语言或自定义分析模式，请参阅：
+        # https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning
+        # 如果分析编译型语言，可修改 'build-mode' 以自定义分析方式，详见：
+        # https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    # 在运行 `github/codeql-action/init` 之前可添加任何设置步骤。
+    # 包括安装编译器或运行环境（如 `actions/setup-node` 等）。通常仅手动构建时需要。
+    # - name: Setup runtime (示例)
+    #   uses: actions/setup-example@v1
+    # 初始化 CodeQL 工具以进行扫描。
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # 如需指定自定义查询，可在此处或配置文件中设置。
+        # 默认情况下，此处列出的查询会覆盖配置文件中指定的查询。
+        # 在列表前加 "+" 可同时使用此处和配置文件中的查询。
+        # 更多 CodeQL 查询包详情请参阅：
+        # https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+    # 如果某种语言的 analyze 步骤失败，提示“无法自动构建您的代码”，请在上方矩阵中将该语言的 build-mode 设置为 "manual"，并在此步骤中添加构建命令。
+    # ℹ️ 可使用操作系统 shell 运行命令行程序。
+    # 📚 详见 https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo '如果您为一种或多种语言使用了 "manual" 构建模式，请在此处替换为您的构建命令，例如：'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"
+

.github/workflows/docker-image-backend-python.yml

@@ -0,0 +1,30 @@
+name: Python Backend Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'scripts/images/backend-python/**'
+      - 'runtime/deepdata-python/**'
+      - '.github/workflows/docker-image-backend-python.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'scripts/images/backend-python/**'
+      - 'runtime/deepdata-python/**'
+      - '.github/workflows/docker-image-backend-python.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  call-docker-build:
+    name: Build and Push Backend Python Docker Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      service_name: backend-python
+      build_dir: .

.github/workflows/docker-image-backend.yml

@@ -0,0 +1,32 @@
+name: Backend Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'backend/**'
+      - '!backend/api-gateway/**'
+      - 'scripts/images/backend/**'
+      - '.github/workflows/docker-image-backend.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'backend/**'
+      - '!backend/api-gateway/**'
+      - 'scripts/images/backend/**'
+      - '.github/workflows/docker-image-backend.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  call-docker-build:
+    name: Build and Push Backend Docker Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      service_name: backend
+      build_dir: .

.github/workflows/docker-image-database.yml

@@ -0,0 +1,30 @@
+name: Database Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'scripts/db/**'
+      - 'scripts/images/database/**'
+      - '.github/workflows/docker-image-database.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'scripts/db/**'
+      - 'scripts/images/database/**'
+      - '.github/workflows/docker-image-database.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  call-docker-build:
+    name: Build and Push Database Docker Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      service_name: database
+      build_dir: .

.github/workflows/docker-image-deepflow.yml

@@ -0,0 +1,151 @@
+name: Deer Flow Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'runtime/deepflow/**'
+      - 'scripts/images/deepflow-backend/**'
+      - 'scripts/images/deepflow-frontend/**'
+      - '.github/workflows/docker-image-deepflow.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'runtime/deepflow/**'
+      - 'scripts/images/deepflow-backend/**'
+      - 'scripts/images/deepflow-frontend/**'
+      - '.github/workflows/docker-image-deepflow.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  build-and-push-amd:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set Docker Image Tag
+        id: set-tag
+        run: |
+          if [[ $GITHUB_REF == refs/tags/v* ]]; then
+            TAG=${GITHUB_REF#refs/tags/v}
+            echo "TAGS=amd64-$TAG" >> $GITHUB_OUTPUT
+          elif [[ $GITHUB_REF == refs/heads/main ]]; then
+            echo "TAGS=amd64" >> $GITHUB_OUTPUT
+          else
+            echo "TAGS=amd64-temp" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build Docker Image
+        run: |
+          docker build -t deepflow-backend:amd64 . -f scripts/images/deepflow-backend/Dockerfile
+          docker build -t deepflow-frontend:amd64 . -f scripts/images/deepflow-frontend/Dockerfile
+
+      - name: Tag & Push Docker Image
+        if: github.event_name != 'pull_request'
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          docker tag deepflow-backend:amd64 ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.TAGS }}
+          docker tag deepflow-frontend:amd64 ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.TAGS }}
+          docker push ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.TAGS }}
+          docker push ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.TAGS }}
+          
+
+  build-and-push-arm:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set Docker Image Tag
+        id: set-tag
+        run: |
+          if [[ $GITHUB_REF == refs/tags/v* ]]; then
+            TAG=${GITHUB_REF#refs/tags/v}
+            echo "TAGS=arm64-$TAG" >> $GITHUB_OUTPUT
+          elif [[ $GITHUB_REF == refs/heads/main ]]; then
+            echo "TAGS=arm64" >> $GITHUB_OUTPUT
+          else
+            echo "TAGS=arm64-temp" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build Docker Image
+        run: |
+          docker build -t deepflow-backend:arm64 . -f scripts/images/deepflow-backend/Dockerfile
+          docker build -t deepflow-frontend:arm64 . -f scripts/images/deepflow-frontend/Dockerfile
+
+      - name: Tag & Push Docker Image
+        if: github.event_name != 'pull_request'
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          docker tag deepflow-backend:arm64 ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.TAGS }}
+          docker tag deepflow-frontend:arm64 ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.TAGS }}
+          docker push ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.TAGS }}
+          docker push ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.TAGS }}
+
+  manifest:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    needs: [ build-and-push-amd, build-and-push-arm ]
+    steps:
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set Docker Image Tag
+        id: set-tag
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          BASE_IMAGE=ghcr.io/$LOWERCASE_REPO/deepdata-${{ inputs.service_name }}
+          if [[ $GITHUB_REF == refs/tags/v* ]]; then
+            TAG=${GITHUB_REF#refs/tags/v}
+            echo "TAGS=$TAG" >> $GITHUB_OUTPUT
+            echo "ARM_TAGS=arm64-$TAG" >> $GITHUB_OUTPUT
+            echo "AMD_TAGS=amd64-$TAG" >> $GITHUB_OUTPUT
+          elif [[ $GITHUB_REF == refs/heads/main ]]; then
+            echo "TAGS=latest" >> $GITHUB_OUTPUT
+            echo "ARM_TAGS=arm64" >> $GITHUB_OUTPUT
+            echo "AMD_TAGS=amd64" >> $GITHUB_OUTPUT
+          else
+            echo "TAGS=temp" >> $GITHUB_OUTPUT
+            echo "ARM_TAGS=arm64-temp" >> $GITHUB_OUTPUT
+            echo "AMD_TAGS=amd64-temp" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Manifest Docker Image
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          docker manifest create ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.TAGS }} \
+            ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.AMD_TAGS }} \
+            ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.ARM_TAGS }}
+          docker manifest push ghcr.io/$LOWERCASE_REPO/deepflow-backend:${{ steps.set-tag.outputs.TAGS }}
+          docker manifest create ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.TAGS }} \
+            ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.AMD_TAGS }} \
+            ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.ARM_TAGS }}
+          docker manifest push ghcr.io/$LOWERCASE_REPO/deepflow-frontend:${{ steps.set-tag.outputs.TAGS }}

.github/workflows/docker-image-frontend.yml

@@ -0,0 +1,30 @@
+name: Frontend Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'frontend/**'
+      - 'scripts/images/frontend/**'
+      - '.github/workflows/docker-image-frontend.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'frontend/**'
+      - 'scripts/images/frontend/**'
+      - '.github/workflows/docker-image-frontend.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  call-docker-build:
+    name: Build and Push Frontend Docker Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      service_name: frontend
+      build_dir: .

.github/workflows/docker-image-gateway.yml

@@ -0,0 +1,30 @@
+name: Gateway Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'backend/api-gateway/**'
+      - 'scripts/images/gateway/**'
+      - '.github/workflows/docker-image-gateway.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'backend/api-gateway/**'
+      - 'scripts/images/gateway/**'
+      - '.github/workflows/docker-image-gateway.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  call-docker-build:
+    name: Build and Push Gateway Docker Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      service_name: gateway
+      build_dir: .

.github/workflows/docker-image-label-studio.yml

@@ -0,0 +1,28 @@
+name: Label Studio Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'scripts/images/label-studio/**'
+      - '.github/workflows/docker-image-label-studio.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'scripts/images/label-studio/**'
+      - '.github/workflows/docker-image-label-studio.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  call-docker-build:
+    name: Build and Push Label Studio Docker Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      service_name: label-studio
+      build_dir: .

.github/workflows/docker-image-runtime.yml

@@ -0,0 +1,32 @@
+name: Runtime Docker Image CI
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'runtime/ops/**'
+      - 'runtime/python-executor/**'
+      - 'scripts/images/runtime/**'
+      - '.github/workflows/docker-image-runtime.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - 'runtime/ops/**'
+      - 'runtime/python-executor/**'
+      - 'scripts/images/runtime/**'
+      - '.github/workflows/docker-image-runtime.yml'
+      - '.github/workflows/docker-images-reusable.yml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  call-docker-build:
+    name: Build and Push Runtime Docker Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      service_name: runtime
+      build_dir: .

.github/workflows/docker-image-save.yml

@@ -0,0 +1,27 @@
+name: docker-image-save.yml
+on:
+  workflow_call:
+    inputs:
+      service_name:
+        required: true
+        type: string
+
+jobs:
+  pull-and-save:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Pull Docker Image
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          docker pull ghcr.io/$LOWERCASE_REPO/deepdata-${{ inputs.service_name }}:latest
+          docker tag ghcr.io/$LOWERCASE_REPO/deepdata-${{ inputs.service_name }}:latest deepdata-${{ inputs.service_name }}:latest
+
+      - name: Save Docker Image
+        run: |
+          docker save -o deepdata-${{ inputs.service_name }}.tar deepdata-${{ inputs.service_name }}:latest
+
+      - name: Upload Docker Image
+        uses: actions/upload-artifact@v4
+        with:
+          name: deepdata-${{ inputs.service_name }}
+          path: deepdata-${{ inputs.service_name }}.tar

.github/workflows/docker-images-release.yml

@@ -0,0 +1,55 @@
+name: Release Docker Images
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  frontend:
+    name: Frontend Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    with:
+      service_name: frontend
+      build_dir: .
+
+  gateway:
+    name: Gateway Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    with:
+      service_name: gateway
+      build_dir: .
+
+  backend:
+    name: Backend Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    with:
+      service_name: backend
+      build_dir: .
+
+  backend-python:
+    name: Backend Python Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    with:
+      service_name: backend-python
+      build_dir: .
+
+  database:
+    name: Database Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    with:
+      service_name: database
+      build_dir: .
+
+  runtime:
+    name: Runtime Image
+    uses: ./.github/workflows/docker-images-reusable.yml
+    with:
+      service_name: runtime
+      build_dir: .
+
+  deepflow:
+    name: Deer Flow Images
+    uses: ./.github/workflows/docker-image-deepflow.yml
+

.github/workflows/docker-images-reusable.yml

@@ -0,0 +1,158 @@
+name: Docker Image Build & Push
+
+on:
+  workflow_call:
+    inputs:
+      service_name:
+        required: true
+        type: string
+      build_dir:
+        required: true
+        type: string
+
+jobs:
+  build-and-push-amd:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set Docker Image Tag
+        id: set-tag
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          BASE_IMAGE=ghcr.io/$LOWERCASE_REPO/deepdata-${{ inputs.service_name }}
+          if [[ $GITHUB_REF == refs/tags/v* ]]; then
+            TAG=${GITHUB_REF#refs/tags/v}
+            echo "TAGS=$BASE_IMAGE:amd64-$TAG" >> $GITHUB_OUTPUT
+          elif [[ $GITHUB_REF == refs/heads/main ]]; then
+            echo "TAGS=$BASE_IMAGE:amd64" >> $GITHUB_OUTPUT
+          else
+            # 使用分支名作为 tag
+            if [[ $GITHUB_REF == refs/heads/* ]]; then
+              BRANCH_NAME=${GITHUB_REF#refs/heads/}
+              # 清理分支名，将特殊字符替换为连字符
+              BRANCH_TAG=$(echo "$BRANCH_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g')
+              echo "TAGS=$BASE_IMAGE:amd64-$BRANCH_TAG" >> $GITHUB_OUTPUT
+            else
+              echo "TAGS=$BASE_IMAGE:amd64-temp" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+      - name: Build Docker Image
+        run: |
+          docker build -t deepdata-${{ inputs.service_name }}:amd64 . -f scripts/images/${{ inputs.service_name }}/Dockerfile --platform amd64
+
+      - name: Tag & Push Docker Image
+        if: github.event_name != 'pull_request'
+        run: |
+          docker tag deepdata-${{ inputs.service_name }}:amd64 ${{ steps.set-tag.outputs.TAGS }}
+          docker push ${{ steps.set-tag.outputs.TAGS }}
+
+  build-and-push-arm:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set Docker Image Tag
+        id: set-tag
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          BASE_IMAGE=ghcr.io/$LOWERCASE_REPO/deepdata-${{ inputs.service_name }}
+          if [[ $GITHUB_REF == refs/tags/v* ]]; then
+            TAG=${GITHUB_REF#refs/tags/v}
+            echo "TAGS=$BASE_IMAGE:arm64-$TAG" >> $GITHUB_OUTPUT
+          elif [[ $GITHUB_REF == refs/heads/main ]]; then
+            echo "TAGS=$BASE_IMAGE:arm64" >> $GITHUB_OUTPUT
+          else
+            # 使用分支名作为 tag
+            if [[ $GITHUB_REF == refs/heads/* ]]; then
+              BRANCH_NAME=${GITHUB_REF#refs/heads/}
+              # 清理分支名，将特殊字符替换为连字符
+              BRANCH_TAG=$(echo "$BRANCH_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g')
+              echo "TAGS=$BASE_IMAGE:arm64-$BRANCH_TAG" >> $GITHUB_OUTPUT
+            else
+              echo "TAGS=$BASE_IMAGE:arm64-temp" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+      - name: Build Docker Image
+        run: |
+          docker build -t deepdata-${{ inputs.service_name }}:arm64 . -f scripts/images/${{ inputs.service_name }}/Dockerfile --platform arm64
+
+      - name: Tag & Push Docker Image
+        if: github.event_name != 'pull_request'
+        run: |
+          docker tag deepdata-${{ inputs.service_name }}:arm64 ${{ steps.set-tag.outputs.TAGS }}
+          docker push ${{ steps.set-tag.outputs.TAGS }}
+
+  manifest:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    needs: [ build-and-push-amd, build-and-push-arm ]
+    steps:
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set Docker Image Tag
+        id: set-tag
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          BASE_IMAGE=ghcr.io/$LOWERCASE_REPO/deepdata-${{ inputs.service_name }}
+          if [[ $GITHUB_REF == refs/tags/v* ]]; then
+            TAG=${GITHUB_REF#refs/tags/v}
+            echo "TAGS=$BASE_IMAGE:$TAG" >> $GITHUB_OUTPUT
+            echo "ARM_TAGS=$BASE_IMAGE:arm64-$TAG" >> $GITHUB_OUTPUT
+            echo "AMD_TAGS=$BASE_IMAGE:amd64-$TAG" >> $GITHUB_OUTPUT
+          elif [[ $GITHUB_REF == refs/heads/main ]]; then
+            echo "TAGS=$BASE_IMAGE:latest" >> $GITHUB_OUTPUT
+            echo "ARM_TAGS=$BASE_IMAGE:arm64" >> $GITHUB_OUTPUT
+            echo "AMD_TAGS=$BASE_IMAGE:amd64" >> $GITHUB_OUTPUT
+          else
+            # 使用分支名作为 tag
+            if [[ $GITHUB_REF == refs/heads/* ]]; then
+              BRANCH_NAME=${GITHUB_REF#refs/heads/}
+              # 清理分支名，将特殊字符替换为连字符
+              BRANCH_TAG=$(echo "$BRANCH_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g')
+              echo "TAGS=$BASE_IMAGE:$BRANCH_TAG" >> $GITHUB_OUTPUT
+              echo "ARM_TAGS=$BASE_IMAGE:arm64-$BRANCH_TAG" >> $GITHUB_OUTPUT
+              echo "AMD_TAGS=$BASE_IMAGE:amd64-$BRANCH_TAG" >> $GITHUB_OUTPUT
+            else
+              echo "TAGS=$BASE_IMAGE:temp" >> $GITHUB_OUTPUT
+              echo "ARM_TAGS=$BASE_IMAGE:arm64-temp" >> $GITHUB_OUTPUT
+              echo "AMD_TAGS=$BASE_IMAGE:amd64-temp" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+      - name: Manifest Docker Image
+        run: |
+          docker buildx imagetools create -t ${{ steps.set-tag.outputs.TAGS }} \
+            ${{ steps.set-tag.outputs.AMD_TAGS }} \
+            ${{ steps.set-tag.outputs.ARM_TAGS }}

.github/workflows/docker-push-to-huaweicloud-reusable.yml

@@ -0,0 +1,48 @@
+name: docker-push-to-huaweicloud-reusable.yml
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'image version (e.g. latest or v0.0.1-beta)'
+        required: true
+        default: 'latest'
+        type: string
+      service_name:
+        description: 'image version (e.g. latest or v0.0.1-beta)'
+        required: true
+        default: 'latest'
+        type: string
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD:
+        description: 'login pwd'
+        required: true
+
+jobs:
+  retag-and-push:
+    name: Retag and Push to Huawei Cloud SWR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Pull source image and retag (amd)
+        shell: bash
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository }}" | tr "[:upper:]" "[:lower:]")
+          SOURCE_IMAGE=ghcr.io/${LOWERCASE_REPO}/deepdata-${{ inputs.service_name}}:${{ inputs.version}}
+          TARGET_IMAGE=swr.cn-east-3.myhuaweicloud.com/deepdata/${{ inputs.service_name}}:${{ inputs.version}}
+          docker pull "${SOURCE_IMAGE}"
+          docker tag "${SOURCE_IMAGE}" "${TARGET_IMAGE}"-amd
+      - name: Pull source image and retag (arm)
+        shell: bash
+        run: |
+          LOWERCASE_REPO=$(echo "${{ github.repository }}" | tr "[:upper:]" "[:lower:]")
+          SOURCE_IMAGE=ghcr.io/${LOWERCASE_REPO}/deepdata-${{ inputs.service_name}}:${{ inputs.version}}
+          TARGET_IMAGE=swr.cn-east-3.myhuaweicloud.com/deepdata/${{ inputs.service_name}}:${{ inputs.version}}
+          docker pull "${SOURCE_IMAGE}" --platform=linux/arm64
+          docker tag "${SOURCE_IMAGE}" "${TARGET_IMAGE}"-arm
+      - name: Push image to Huawei SWR using
+        shell: bash
+        run: |
+          TARGET_IMAGE=swr.cn-east-3.myhuaweicloud.com/deepdata/${{ inputs.service_name}}:${{ inputs.version}}
+          echo "${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}" | docker login swr.cn-east-3.myhuaweicloud.com --username=cn-east-3@HPUA3ZGOTQFAFMM59DB9 --password-stdin
+          docker push "${TARGET_IMAGE}"-amd
+          docker push "${TARGET_IMAGE}"-arm
+          docker buildx imagetools create -t "${TARGET_IMAGE}" "${TARGET_IMAGE}"-amd "${TARGET_IMAGE}"-arm

.github/workflows/docker-push-to-huaweicloud.yml

@@ -0,0 +1,82 @@
+name: docker-push-to-huaweicloud.yml
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'image version (e.g. latest or v0.0.1-beta)'
+        required: true
+        default: 'latest'
+        type: string
+
+jobs:
+  frontend:
+    name: Push Frontend Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepdata-frontend
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}
+
+  gateway:
+    name: Push Gateway Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepdata-gateway
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}
+
+  backend:
+    name: Push Backend Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepdata-backend
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}
+
+  backend-python:
+    name: Push Backend-Python Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepdata-backend-python
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}
+
+  runtime:
+    name: Push Runtime Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepdata-runtime
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}
+
+  database:
+    name: Push Database Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepdata-database
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}
+
+  deepflow-backend:
+    name: Push deepflow-backend Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepflow-backend
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}
+
+  deepflow-frontend:
+    name: Push deepflow-frontend Image
+    uses: ./.github/workflows/docker-push-to-huaweicloud-reusable.yml
+    with:
+      service_name: deepflow-frontend
+      version: ${{ inputs.version}}
+    secrets:
+      HUAWEI_CLOUD_SWR_LOGIN_PWD: ${{ secrets.HUAWEI_CLOUD_SWR_LOGIN_PWD}}