refactor: 优化 CI 缓存隔离与镜像标签策略，重构 Nginx 为白名单路由模式

- CI: 按 scope 隔离 base/app 构建缓存，app 层使用 no-cache-filters 确保前端每次重建 - CI: 镜像标签改为 semver 优先，支持 pre/fix 预发布标签，启用 latest=auto - Nginx: 从 try_files + @backend 回退模式改为白名单路由（api/v1/health → 后端，其余 → SPA）
2026-09-01 17:00:21 +08:00 · 2026-02-09 16:04:54 +08:00
parent d0b9dc7a24
commit f22d2efb9d
3 changed files with 50 additions and 44 deletions
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -170,8 +170,8 @@ jobs:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=base
+          cache-to: type=gha,mode=max,scope=base
          platforms: linux/amd64,linux/arm64

  build-app:
@@ -208,12 +208,13 @@ jobs:
            ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}
            docker.io/fawney19/aether
          tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
-            type=ref,event=branch
-            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=pre,enable=${{ contains(github.ref, '-') }}
+            type=raw,value=fix,enable=${{ contains(github.ref, '-fix') }}
            type=sha,prefix=
+          flavor: |
+            latest=auto

      - name: Extract version from tag
        id: version
@@ -250,6 +251,7 @@ jobs:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          no-cache-filters: builder
+          cache-from: type=gha,scope=app
+          cache-to: type=gha,mode=min,scope=app
          platforms: linux/amd64,linux/arm64
--- a/Dockerfile.app
+++ b/Dockerfile.app
@@ -4,7 +4,7 @@
 # 用于 GitHub Actions CI（官方源）
 FROM aether-base:latest AS builder
 WORKDIR /app
-# 复制前端源码并构建
+# 复制前端源码并构建（CI 通过 no-cache-filters=builder 确保每次重建）
 COPY frontend/ ./frontend/
 RUN cd frontend && npm run build
 # ==================== 运行时镜像 ====================
@@ -33,6 +33,7 @@ COPY alembic.ini ./
 COPY alembic/ ./alembic/
 COPY gunicorn_conf.py ./
 # Nginx 配置模板
+# 策略：白名单后端路由 → 后端代理，其余全部 → 前端 SPA（index.html）
 # 智能处理 IP：有外层代理头就透传，没有就用直连 IP
 RUN printf '%s\n' \
 'map $http_x_real_ip $real_ip {' \
@@ -61,35 +62,21 @@ RUN printf '%s\n' \
 '    gzip_types application/json text/plain text/css text/javascript application/javascript application/octet-stream;' \
 '    gzip_disable "msie6";' \
 '' \
+'    # 静态资源：长期缓存' \
 '    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {' \
 '        expires 1y;' \
 '        add_header Cache-Control "public, no-transform";' \
 '        try_files $uri =404;' \
 '    }' \
 '' \
+'    # 安全：阻止访问源码目录' \
 '    location ~ ^/(src|node_modules)/ {' \
 '        deny all;' \
 '        return 404;' \
 '    }' \
 '' \
-'    location ~ ^/(dashboard|admin|login|auth)(/|$) {' \
-'        try_files $uri $uri/ /index.html;' \
-'    }' \
-'' \
-'    location ~ ^/(docs|redoc|openapi\\.json)$ {' \
-'        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
-'        proxy_http_version 1.1;' \
-'        proxy_set_header Host $host;' \
-'        proxy_set_header X-Real-IP $real_ip;' \
-'        proxy_set_header X-Forwarded-For $forwarded_for;' \
-'        proxy_set_header X-Forwarded-Proto $scheme;' \
-'    }' \
-'' \
-'    location / {' \
-'        try_files $uri $uri/ @backend;' \
-'    }' \
-'' \
-'    location @backend {' \
+'    # 后端 API 路由（白名单）→ 代理到后端' \
+'    location ~ ^/(api|v1|health)(/|$) {' \
 '        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
 '        proxy_http_version 1.1;' \
 '        proxy_set_header Host $host;' \
@@ -111,6 +98,21 @@ RUN printf '%s\n' \
 '        proxy_send_timeout 600s;' \
 '        proxy_read_timeout 600s;' \
 '    }' \
+'' \
+'    # API 文档路由 → 代理到后端' \
+'    location ~ ^/(docs|redoc|openapi\\.json)$ {' \
+'        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
+'        proxy_http_version 1.1;' \
+'        proxy_set_header Host $host;' \
+'        proxy_set_header X-Real-IP $real_ip;' \
+'        proxy_set_header X-Forwarded-For $forwarded_for;' \
+'        proxy_set_header X-Forwarded-Proto $scheme;' \
+'    }' \
+'' \
+'    # 所有其他路由 → 前端 SPA（先尝试静态文件，再回退到 index.html）' \
+'    location / {' \
+'        try_files $uri $uri/ /index.html;' \
+'    }' \
 '}' > /etc/nginx/sites-available/default.template
 # Supervisor 配置
 RUN printf '%s\n' \
--- a/Dockerfile.app.local
+++ b/Dockerfile.app.local
@@ -44,6 +44,7 @@ COPY alembic/ ./alembic/
 COPY gunicorn_conf.py ./

 # Nginx 配置模板
+# 策略：白名单后端路由 → 后端代理，其余全部 → 前端 SPA（index.html）
 # 智能处理 IP：有外层代理头就透传，没有就用直连 IP
 RUN printf '%s\n' \
 'map $http_x_real_ip $real_ip {' \
@@ -72,35 +73,21 @@ RUN printf '%s\n' \
 '    gzip_types application/json text/plain text/css text/javascript application/javascript application/octet-stream;' \
 '    gzip_disable "msie6";' \
 '' \
+'    # 静态资源：长期缓存' \
 '    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {' \
 '        expires 1y;' \
 '        add_header Cache-Control "public, no-transform";' \
 '        try_files $uri =404;' \
 '    }' \
 '' \
+'    # 安全：阻止访问源码目录' \
 '    location ~ ^/(src|node_modules)/ {' \
 '        deny all;' \
 '        return 404;' \
 '    }' \
 '' \
-'    location ~ ^/(dashboard|admin|login|auth)(/|$) {' \
-'        try_files $uri $uri/ /index.html;' \
-'    }' \
-'' \
-'    location ~ ^/(docs|redoc|openapi\\.json)$ {' \
-'        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
-'        proxy_http_version 1.1;' \
-'        proxy_set_header Host $host;' \
-'        proxy_set_header X-Real-IP $real_ip;' \
-'        proxy_set_header X-Forwarded-For $forwarded_for;' \
-'        proxy_set_header X-Forwarded-Proto $scheme;' \
-'    }' \
-'' \
-'    location / {' \
-'        try_files $uri $uri/ @backend;' \
-'    }' \
-'' \
-'    location @backend {' \
+'    # 后端 API 路由（白名单）→ 代理到后端' \
+'    location ~ ^/(api|v1|health)(/|$) {' \
 '        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
 '        proxy_http_version 1.1;' \
 '        proxy_set_header Host $host;' \
@@ -122,6 +109,21 @@ RUN printf '%s\n' \
 '        proxy_send_timeout 600s;' \
 '        proxy_read_timeout 600s;' \
 '    }' \
+'' \
+'    # API 文档路由 → 代理到后端' \
+'    location ~ ^/(docs|redoc|openapi\\.json)$ {' \
+'        proxy_pass http://127.0.0.1:PORT_PLACEHOLDER;' \
+'        proxy_http_version 1.1;' \
+'        proxy_set_header Host $host;' \
+'        proxy_set_header X-Real-IP $real_ip;' \
+'        proxy_set_header X-Forwarded-For $forwarded_for;' \
+'        proxy_set_header X-Forwarded-Proto $scheme;' \
+'    }' \
+'' \
+'    # 所有其他路由 → 前端 SPA（先尝试静态文件，再回退到 index.html）' \
+'    location / {' \
+'        try_files $uri $uri/ /index.html;' \
+'    }' \
 '}' > /etc/nginx/sites-available/default.template

 # Supervisor 配置