chore: 重构 CI/CD 与 Docker 发布流程

将部署链路调整为 CI 构建推送镜像、服务器拉取镜像运行，并拆分/复用 Gitea workflow 与公共准备脚本；同时统一 APP_NAME 与端口变量配置，补充 Docker 与 ESLint 相关配置文件以提升可维护性。

Made-with: Cursor

.gitea/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+
+jobs:
+  # workflow_call 调用示例（先保留注释，不启用）：
+  # ci:
+  #   uses: ./.gitea/workflows/reusable-ci.yml
+  #   with:
+  #     node_major: "22"
+  #     yarn_version: "stable"
+  #     run_lint: true
+  #     run_tsc: true
+
+  ci:
+    runs-on: ubuntu-latest
+    env:
+      NODE_MAJOR: "22"
+      YARN_VERSION: "stable"
+    steps:
+      - name: Prepare workspace (checkout + node/yarn)
+        run: |
+          set -euo pipefail
+          chmod +x .gitea/scripts/prepare-workspace.sh
+          ./.gitea/scripts/prepare-workspace.sh \
+            "${{ github.server_url }}/${{ github.repository }}.git" \
+            "${{ github.sha }}"
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+      - name: Lint
+        run: yarn lint
+      - name: TypeScript check
+        run: yarn tsc --noEmit

.gitea/workflows/deploy.yml

@@ -0,0 +1,80 @@
+name: Deploy Production
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v') }}
+    runs-on: ubuntu-latest
+    env:
+      NODE_MAJOR: "22"
+      YARN_VERSION: "stable"
+      DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+      DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+      DEPLOY_USER: ${{ vars.DEPLOY_USER }}
+      DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
+      IMAGE_REPO: ${{ vars.IMAGE_REPO }}
+      REGISTRY: ${{ vars.REGISTRY }}
+
+    steps:
+      - name: Prepare workspace (checkout + node/yarn)
+        run: |
+          set -euo pipefail
+          chmod +x .gitea/scripts/prepare-workspace.sh
+          ./.gitea/scripts/prepare-workspace.sh \
+            "${{ github.server_url }}/${{ github.repository }}.git" \
+            "${{ github.sha }}"
+
+      - name: Setup SSH
+        run: |
+          set -euo pipefail
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -p "${DEPLOY_PORT:-22}" "${DEPLOY_HOST}" >> ~/.ssh/known_hosts
+
+      - name: Prepare image tag
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
+            IMAGE_TAG="${GITHUB_REF_NAME}"
+          else
+            IMAGE_TAG="${GITHUB_SHA:0:12}"
+          fi
+          echo "IMAGE_TAG=${IMAGE_TAG}" >> "$GITHUB_ENV"
+
+      - name: Build and push image
+        run: |
+          set -euo pipefail
+          if [ -z "${REGISTRY}" ] || [ -z "${IMAGE_REPO}" ]; then
+            echo "REGISTRY and IMAGE_REPO vars are required"
+            exit 1
+          fi
+
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          docker build -f deploy/docker/Dockerfile -t "${IMAGE_REPO}:${IMAGE_TAG}" .
+          docker push "${IMAGE_REPO}:${IMAGE_TAG}"
+
+      - name: Deploy
+        run: |
+          set -euo pipefail
+          ssh -p "${DEPLOY_PORT:-22}" "${DEPLOY_USER}@${DEPLOY_HOST}" <<EOF
+          set -euo pipefail
+          cd "${DEPLOY_PATH}"
+
+          mkdir -p deploy/docker
+          cat > deploy/docker/.env <<EOT
+          ${{ vars.DEPLOY_DOCKER_ENV }}
+          IMAGE_REPO=${IMAGE_REPO}
+          IMAGE_TAG=${IMAGE_TAG}
+          EOT
+
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          docker compose -f deploy/docker/docker-compose.yml --env-file deploy/docker/.env pull app
+          docker compose -f deploy/docker/docker-compose.yml --env-file deploy/docker/.env up -d app
+          docker compose -f deploy/docker/docker-compose.yml ps
+          curl -fsS "http://127.0.0.1:\${HOST_BIND_PORT:-3000}/api/docs" >/dev/null
+          EOF

.gitea/workflows/reusable-ci.yml

@@ -0,0 +1,51 @@
+name: Reusable CI
+
+on:
+  workflow_call:
+    inputs:
+      node_major:
+        description: "Node 主版本（例如 22）"
+        required: false
+        type: string
+        default: "22"
+      yarn_version:
+        description: "Yarn 版本（例如 stable 或 1.22.22）"
+        required: false
+        type: string
+        default: "stable"
+      run_lint:
+        description: "是否执行 yarn lint"
+        required: false
+        type: boolean
+        default: true
+      run_tsc:
+        description: "是否执行 yarn tsc --noEmit"
+        required: false
+        type: boolean
+        default: true
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    env:
+      NODE_MAJOR: ${{ inputs.node_major }}
+      YARN_VERSION: ${{ inputs.yarn_version }}
+    steps:
+      - name: Prepare workspace (checkout + node/yarn)
+        run: |
+          set -euo pipefail
+          chmod +x .gitea/scripts/prepare-workspace.sh
+          ./.gitea/scripts/prepare-workspace.sh \
+            "${{ github.server_url }}/${{ github.repository }}.git" \
+            "${{ github.sha }}"
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Lint
+        if: ${{ inputs.run_lint }}
+        run: yarn lint
+
+      - name: TypeScript check
+        if: ${{ inputs.run_tsc }}
+        run: yarn tsc --noEmit