fix: 修复 GitHub Actions Docker 构建 SSL 证书过期问题

- Dockerfile 添加 NPM_REGISTRY build-arg，默认保持 npmmirror 兼容本地构建
- CI 中传入官方 registry 绕过镜像证书过期

Author: QAbot-zh

.github/workflows/docker.yml

@@ -52,8 +52,11 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
+          pull: true
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          build-args: |
+            NPM_REGISTRY=https://registry.npmjs.org

Dockerfile

@@ -1,14 +1,17 @@
+# 全局参数：镜像源（CI 时通过 --build-arg NPM_REGISTRY=... 覆盖）
+ARG NPM_REGISTRY=https://registry.npmjs.org/
+
 # 阶段1：基础镜像准备
-FROM node:18-alpine AS base
+FROM node:20-alpine AS base
 
 # 设置工作目录
 WORKDIR /app
 
-# 配置国内镜像源
-RUN npm config set registry https://registry.npmmirror.com/
+# 配置镜像源
+RUN npm config set registry ${NPM_REGISTRY}
 
 # 安装必要的系统依赖（例如 CA 证书）
-RUN apk add --no-cache ca-certificates
+RUN apk update && apk add --no-cache ca-certificates && update-ca-certificates
 
 # 阶段2：构建应用程序
 FROM base AS builder
@@ -19,6 +22,7 @@ WORKDIR /app
 COPY package.json yarn.lock ./
 
 # 安装所有依赖，包括开发依赖
+RUN yarn config set registry ${NPM_REGISTRY}
 RUN yarn install
 
 # 复制项目源代码
@@ -40,7 +44,7 @@ RUN yarn install --production --ignore-scripts --prefer-offline
 RUN yarn cache clean --all
 
 # 阶段3：构建最终的生产镜像
-FROM node:18-alpine
+FROM node:20-alpine
 
 # 设置工作目录
 WORKDIR /app