fix(build): 构建时 GitHub API 请求支持可选 GITHUB_TOKEN 避免限流

未认证 GitHub API 限流 60 次/小时/IP，频繁本地构建容易触发。
添加可选的 GITHUB_TOKEN 支持（认证后 5000 次/小时），不传 token 时行为不变。

Dockerfile.app

@@ -16,6 +16,7 @@ WORKDIR /app
 ARG HUB_RELEASE_REPO=fawney19/Aether
 ARG HUB_TAG
 ARG TARGETARCH
+ARG GITHUB_TOKEN
 
 # 运行时依赖（无 gcc/nodejs/npm，使用 BuildKit 缓存加速）
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
@@ -32,10 +33,15 @@ COPY --from=builder /usr/local/bin/gunicorn /usr/local/bin/
 COPY --from=builder /usr/local/bin/uvicorn /usr/local/bin/
 COPY --from=builder /usr/local/bin/alembic /usr/local/bin/
 # Hub 预编译二进制（构建时从 GitHub Release 下载）
+# GITHUB_TOKEN 可选：未认证 API 限流 60 次/小时，认证后 5000 次/小时
 RUN set -eux; \
+    auth_header=""; \
+    if [ -n "${GITHUB_TOKEN:-}" ]; then \
+        auth_header="Authorization: token ${GITHUB_TOKEN}"; \
+    fi; \
     tag="${HUB_TAG:-}"; \
     if [ -z "$tag" ]; then \
-        tag="$(curl -sL "https://api.github.com/repos/${HUB_RELEASE_REPO}/releases" | python3 -c "import json,sys;print(next((r['tag_name'] for r in json.load(sys.stdin) if r.get('tag_name','').startswith('hub-v') and not r.get('draft') and not r.get('prerelease')),''))")"; \
+        tag="$(curl -sL ${auth_header:+-H "$auth_header"} "https://api.github.com/repos/${HUB_RELEASE_REPO}/releases" | python3 -c "import json,sys;print(next((r['tag_name'] for r in json.load(sys.stdin) if r.get('tag_name','').startswith('hub-v') and not r.get('draft') and not r.get('prerelease')),''))")"; \
     fi; \
     if [ -z "$tag" ]; then \
         echo "Failed to resolve hub release tag"; \

Dockerfile.app.local

@@ -19,6 +19,7 @@ WORKDIR /app
 ARG HUB_RELEASE_REPO=fawney19/Aether
 ARG HUB_TAG
 ARG TARGETARCH
+ARG GITHUB_TOKEN
 
 # 运行时依赖（使用清华镜像源 + BuildKit 缓存加速）
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
@@ -39,10 +40,15 @@ COPY --from=builder /usr/local/bin/uvicorn /usr/local/bin/
 COPY --from=builder /usr/local/bin/alembic /usr/local/bin/
 
 # Hub 预编译二进制（构建时从 GitHub Release 下载）
+# GITHUB_TOKEN 可选：未认证 API 限流 60 次/小时，认证后 5000 次/小时
 RUN set -eux; \
+    auth_header=""; \
+    if [ -n "${GITHUB_TOKEN:-}" ]; then \
+        auth_header="Authorization: token ${GITHUB_TOKEN}"; \
+    fi; \
     tag="${HUB_TAG:-}"; \
     if [ -z "$tag" ]; then \
-        tag="$(curl -sL "https://api.github.com/repos/${HUB_RELEASE_REPO}/releases" | python3 -c "import json,sys;print(next((r['tag_name'] for r in json.load(sys.stdin) if r.get('tag_name','').startswith('hub-v') and not r.get('draft') and not r.get('prerelease')),''))")"; \
+        tag="$(curl -sL ${auth_header:+-H "$auth_header"} "https://api.github.com/repos/${HUB_RELEASE_REPO}/releases" | python3 -c "import json,sys;print(next((r['tag_name'] for r in json.load(sys.stdin) if r.get('tag_name','').startswith('hub-v') and not r.get('draft') and not r.get('prerelease')),''))")"; \
     fi; \
     if [ -z "$tag" ]; then \
         echo "Failed to resolve hub release tag"; \

deploy.sh

@@ -140,8 +140,13 @@ calc_code_hash() {
 }
 
 # 获取最新 hub release tag
+# 支持 GITHUB_TOKEN 环境变量以避免未认证 API 限流（60 次/小时 -> 5000 次/小时）
 get_latest_hub_tag() {
-    curl -sL "https://api.github.com/repos/$GITHUB_REPO/releases" | \
+    local auth_args=()
+    if [ -n "${GITHUB_TOKEN:-}" ]; then
+        auth_args=(-H "Authorization: token ${GITHUB_TOKEN}")
+    fi
+    curl -sL "${auth_args[@]}" "https://api.github.com/repos/$GITHUB_REPO/releases" | \
         python3 -c "
 import json, sys
 releases = json.load(sys.stdin)
@@ -272,14 +277,19 @@ EOF
 build_app() {
     echo ">>> Building app image (code only)..."
     if [ -z "${RESOLVED_HUB_TAG:-}" ]; then
-        echo "❌ RESOLVED_HUB_TAG 为空，无法构建 app 镜像"
+        echo ">>> RESOLVED_HUB_TAG 为空，无法构建 app 镜像"
         exit 1
     fi
     echo ">>> Build args: HUB_TAG=$RESOLVED_HUB_TAG"
     generate_version_file
+    local token_args=()
+    if [ -n "${GITHUB_TOKEN:-}" ]; then
+        token_args=(--build-arg "GITHUB_TOKEN=${GITHUB_TOKEN}")
+    fi
     docker build --pull=false \
         --build-arg HUB_RELEASE_REPO="$GITHUB_REPO" \
         --build-arg HUB_TAG="$RESOLVED_HUB_TAG" \
+        "${token_args[@]}" \
         -f Dockerfile.app.local \
         -t aether-app:latest .
     save_code_hash

docker-compose.build.yml

@@ -43,6 +43,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.app.local
+      args:
+        GITHUB_TOKEN: ${GITHUB_TOKEN:-}
     image: aether-app:latest
     container_name: aether-app
     env_file: