ci: serialize registry-based environment deployments

deploy/scripts/deploy-built-service.sh

@@ -13,6 +13,7 @@ SERVICE="$4"
 ENV_FILE="$5"
 COMPOSE_FILE="deploy/docker-compose.yml"
 IMAGE="$IMAGE_REPOSITORY/$SERVICE:$IMAGE_TAG"
+REGISTRY_HOST="${IMAGE_REPOSITORY%%/*}"
 PROJECT_NAME="firstleg-$DEPLOY_ENV"
 
 case "$DEPLOY_ENV" in
@@ -74,9 +75,17 @@ if [ "$SERVICE" = "file" ]; then
   fi
 fi
 
-docker image inspect "$IMAGE" >/dev/null
+: "${REGISTRY_USER:?REGISTRY_USER 未设置}"
+: "${REGISTRY_PASSWORD:?REGISTRY_PASSWORD 未设置}"
+
+local_registry_logout() {
+  docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true
+}
 
 deploy_local() {
+  printf '%s' "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
+  trap local_registry_logout EXIT HUP INT TERM
+  docker pull "$IMAGE"
   export DEPLOY_ENV IMAGE_REPOSITORY IMAGE_TAG
   docker compose \
     --project-name "$PROJECT_NAME" \
@@ -88,6 +97,8 @@ deploy_local() {
     --env-file "$ENV_FILE" \
     -f "$COMPOSE_FILE" \
     ps "$SERVICE"
+  local_registry_logout
+  trap - EXIT HUP INT TERM
 }
 
 if [ "${TARGET_IS_LOCAL:-false}" = "true" ]; then
@@ -146,8 +157,14 @@ mv -f "$env_tmp" "$remote_dir/.env"
 mv -f "$compose_tmp" "$remote_dir/docker-compose.yml"
 REMOTE_PREPARE
 
-echo "传输镜像到 $SSH_TARGET: $IMAGE"
-docker save "$IMAGE" | gzip -1 | run_ssh 'gzip -dc | docker load'
+remote_registry_logout() {
+  run_ssh docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true
+}
+
+echo "目标服务器从共享仓库拉取增量镜像: $IMAGE"
+printf '%s' "$REGISTRY_PASSWORD" | run_ssh docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
+trap remote_registry_logout EXIT HUP INT TERM
+run_ssh docker pull "$IMAGE"
 
 run_ssh sh -s -- "$REMOTE_DIR" "$DEPLOY_ENV" "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE" <<'REMOTE_DEPLOY'
 set -eu
@@ -171,3 +188,6 @@ docker compose \
   -f docker-compose.yml \
   ps "$service"
 REMOTE_DEPLOY
+
+remote_registry_logout
+trap - EXIT HUP INT TERM