feat(ci): 集成 Harbor 镜像仓库

- 使用 secrets.IMAGE_REGISTRY 配置仓库地址
- 使用 Harbor Robot 账号进行镜像推送认证
- Knative Service 添加 harbor-registry-secret 拉取认证
- 支持动态替换镜像仓库地址和标签占位符

.gitea/workflows/deploy.yaml

@@ -6,7 +6,7 @@ on:
       - main
 
 env:
-  REGISTRY: gitea.tegical.world
+  REGISTRY: ${{ secrets.IMAGE_REGISTRY }}
   IMAGE_PREFIX: tegical/seclusion
 
 jobs:
@@ -27,12 +27,12 @@ jobs:
         run: |
           echo "tag=$(date +%Y%m%d%H%M%S)-${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
 
-      - name: Login to Gitea Container Registry
+      - name: Login to Harbor Registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.IMAGE_REGISTRY_ROBOT_USERNAME }}
+          password: ${{ secrets.IMAGE_REGISTRY_ROBOT_PASSWORD }}
 
       - name: Build and push Web image
         uses: docker/build-push-action@v6
@@ -78,7 +78,9 @@ jobs:
       - name: Update image tags in manifests
         run: |
           IMAGE_TAG=${{ needs.build-and-push.outputs.image_tag }}
+          IMAGE_REGISTRY=${{ secrets.IMAGE_REGISTRY }}
           sed -i "s|IMAGE_TAG_PLACEHOLDER|${IMAGE_TAG}|g" deploy/k8s/*.yaml
+          sed -i "s|IMAGE_REGISTRY_PLACEHOLDER|${IMAGE_REGISTRY}|g" deploy/k8s/*.yaml
 
       - name: Deploy to Knative
         run: |

deploy/k8s/api-ksvc.yaml

@@ -16,10 +16,12 @@ spec:
         # 每个实例的并发请求数
         autoscaling.knative.dev/target: "100"
     spec:
+      imagePullSecrets:
+        - name: harbor-registry-secret
       containerConcurrency: 0
       containers:
         - name: api
-          image: gitea.tegical.world/tegical/seclusion-api:IMAGE_TAG_PLACEHOLDER
+          image: IMAGE_REGISTRY_PLACEHOLDER/tegical/seclusion-api:IMAGE_TAG_PLACEHOLDER
           ports:
             - containerPort: 4000
           envFrom:

deploy/k8s/web-ksvc.yaml

@@ -16,10 +16,12 @@ spec:
         # 每个实例的并发请求数
         autoscaling.knative.dev/target: "100"
     spec:
+      imagePullSecrets:
+        - name: harbor-registry-secret
       containerConcurrency: 0
       containers:
         - name: web
-          image: gitea.tegical.world/tegical/seclusion-web:IMAGE_TAG_PLACEHOLDER
+          image: IMAGE_REGISTRY_PLACEHOLDER/tegical/seclusion-web:IMAGE_TAG_PLACEHOLDER
           ports:
             - containerPort: 3000
           envFrom: