ci: isolate staging dependency install

2026-08-09 13:18:47 +08:00
parent 918b02ff0a
commit 04c4bd3ead
3 changed files with 57 additions and 6 deletions
@@ -32,6 +32,8 @@ jobs:
    timeout-minutes: 45
    env:
      GITEA_SHA: ${{ gitea.sha }}
+      NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+      NODE_TOOL_IMAGE: node:22-bookworm-slim
    steps:
      - name: Checkout exact Gitea revision
        run: |
@@ -96,9 +98,6 @@ jobs:
          docker compose --help | grep -q -- '--project-name'

      - name: Prepare pinned Node tooling
-        env:
-          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
-          NODE_TOOL_IMAGE: node:22-bookworm-slim
        run: |
          set -euo pipefail
          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
@@ -167,7 +166,23 @@ jobs:
            "pandas==2.3.3" \
            "timezonefinder==8.2.5" \
            -r requirements.txt -r requirements-dev.txt
-          npm ci --prefix frontend
+          workdir="$(pwd -P)"
+          docker run --rm \
+            --cpus=1.5 \
+            --memory=2g \
+            --memory-swap=2g \
+            --pids-limit=256 \
+            --user "$(id -u):$(id -g)" \
+            --volume "$workdir:$workdir" \
+            --workdir "$workdir" \
+            --env HOME=/tmp \
+            --env "NPM_CONFIG_REGISTRY=$NPM_CONFIG_REGISTRY" \
+            "$NODE_TOOL_SOURCE_IMAGE" \
+            npm ci --prefix frontend \
+              --no-audit \
+              --no-fund \
+              --progress=false \
+              --maxsockets=4

      - name: Validate backend, package, frontend, and database contracts
        run: |