From 357230a2edd18244d60f485f6767c7ebd1573397 Mon Sep 17 00:00:00 2001
From: tianma-if <yingwaizhiying@gmail.com>
Date: Sat, 22 Aug 2026 11:20:09 +0800
Subject: [PATCH] fix(docker): publish releases to Tencent TCR

---
 .github/workflows/docker-image.yml | 63 ++++++++++++++++++++++--------
 docs/deploy-docker.md              |  7 +++-
 docs/deploy-docker.zh-CN.md        |  6 ++-
 docs/release.md                    | 14 ++++++-
 docs/release.zh-CN.md              | 10 ++++-
 scripts/docker-release.test.mjs    |  9 +++++
 6 files changed, 86 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index f9a96f04..46a0c762 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -53,7 +53,8 @@ permissions:
   contents: read
 
 env:
-  IMAGE_NAME: ghcr.io/tianma-if/edgeever
+  GHCR_IMAGE_NAME: ghcr.io/tianma-if/edgeever
+  TCR_IMAGE_NAME: ccr.ccs.tencentyun.com/edgeever/edgeever
 
 jobs:
   container-test:
@@ -139,9 +140,12 @@ jobs:
             fi
             {
               echo "tags<<EOF"
-              echo "${IMAGE_NAME}:${RELEASE_TAG}"
-              echo "${IMAGE_NAME}:${version}"
-              echo "${IMAGE_NAME}:latest"
+              echo "${GHCR_IMAGE_NAME}:${RELEASE_TAG}"
+              echo "${GHCR_IMAGE_NAME}:${version}"
+              echo "${GHCR_IMAGE_NAME}:latest"
+              echo "${TCR_IMAGE_NAME}:${RELEASE_TAG}"
+              echo "${TCR_IMAGE_NAME}:${version}"
+              echo "${TCR_IMAGE_NAME}:latest"
               echo "EOF"
               echo "version=${version}"
               echo "audit_tag=${RELEASE_TAG}"
@@ -150,8 +154,10 @@ jobs:
             short_sha="${GITHUB_SHA:0:12}"
             {
               echo "tags<<EOF"
-              echo "${IMAGE_NAME}:main"
-              echo "${IMAGE_NAME}:sha-${short_sha}"
+              echo "${GHCR_IMAGE_NAME}:main"
+              echo "${GHCR_IMAGE_NAME}:sha-${short_sha}"
+              echo "${TCR_IMAGE_NAME}:main"
+              echo "${TCR_IMAGE_NAME}:sha-${short_sha}"
               echo "EOF"
               echo "version=main"
               echo "audit_tag=main"
@@ -171,6 +177,13 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Sign in to Tencent Cloud Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ccr.ccs.tencentyun.com
+          username: ${{ secrets.TENCENT_TCR_USERNAME }}
+          password: ${{ secrets.TENCENT_TCR_PASSWORD }}
+
       - name: Build and publish image
         uses: docker/build-push-action@v6
         with:
@@ -185,10 +198,20 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Verify anonymous image access
+      - name: Verify mirrored anonymous image access
         run: |
           docker logout ghcr.io
-          docker buildx imagetools inspect "${IMAGE_NAME}:${{ steps.image.outputs.audit_tag }}"
+          docker logout ccr.ccs.tencentyun.com
+          ghcr_inspect="$(docker buildx imagetools inspect "${GHCR_IMAGE_NAME}:${{ steps.image.outputs.audit_tag }}")"
+          tcr_inspect="$(docker buildx imagetools inspect "${TCR_IMAGE_NAME}:${{ steps.image.outputs.audit_tag }}")"
+          ghcr_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${ghcr_inspect}" | head -n 1)"
+          tcr_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${tcr_inspect}" | head -n 1)"
+          test -n "${ghcr_digest}"
+          test "${ghcr_digest}" = "${tcr_digest}"
+          for image in "${GHCR_IMAGE_NAME}" "${TCR_IMAGE_NAME}"; do
+            docker buildx imagetools inspect --raw "${image}:${{ steps.image.outputs.audit_tag }}" |
+              jq -e '([.manifests[].platform.architecture] | index("amd64") != null) and ([.manifests[].platform.architecture] | index("arm64") != null)'
+          done
 
   release-audit:
     if: github.repository == 'tianma-if/edgeever' && github.event_name == 'release'
@@ -200,11 +223,19 @@ jobs:
         env:
           RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          release_inspect="$(docker buildx imagetools inspect "${IMAGE_NAME}:${RELEASE_TAG}")"
-          latest_inspect="$(docker buildx imagetools inspect "${IMAGE_NAME}:latest")"
-          release_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${release_inspect}" | head -n 1)"
-          latest_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${latest_inspect}" | head -n 1)"
-          test -n "${release_digest}"
-          test "${release_digest}" = "${latest_digest}"
-          docker buildx imagetools inspect --raw "${IMAGE_NAME}:${RELEASE_TAG}" |
-            jq -e '([.manifests[].platform.architecture] | index("amd64") != null) and ([.manifests[].platform.architecture] | index("arm64") != null)'
+          expected_digest=""
+          for image in "${GHCR_IMAGE_NAME}" "${TCR_IMAGE_NAME}"; do
+            release_inspect="$(docker buildx imagetools inspect "${image}:${RELEASE_TAG}")"
+            latest_inspect="$(docker buildx imagetools inspect "${image}:latest")"
+            release_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${release_inspect}" | head -n 1)"
+            latest_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${latest_inspect}" | head -n 1)"
+            test -n "${release_digest}"
+            test "${release_digest}" = "${latest_digest}"
+            if [[ -z "${expected_digest}" ]]; then
+              expected_digest="${release_digest}"
+            else
+              test "${release_digest}" = "${expected_digest}"
+            fi
+            docker buildx imagetools inspect --raw "${image}:${RELEASE_TAG}" |
+              jq -e '([.manifests[].platform.architecture] | index("amd64") != null) and ([.manifests[].platform.architecture] | index("arm64") != null)'
+          done
diff --git a/docs/deploy-docker.md b/docs/deploy-docker.md
index 72e6c7ea..a2bfc211 100644
--- a/docs/deploy-docker.md
+++ b/docs/deploy-docker.md
@@ -69,13 +69,16 @@ switch to Tencent Cloud TCR:
 
 ```sh
 export EDGE_EVER_IMAGE=ccr.ccs.tencentyun.com/edgeever/edgeever
-export EDGE_EVER_VERSION=v1.33.0
+export EDGE_EVER_VERSION=vX.Y.Z
 docker compose pull
 docker compose up -d
 ```
 
 The public TCR image requires no `docker login` and supports `linux/amd64` and
-`linux/arm64`. Pin `EDGE_EVER_VERSION` to a release tag in production.
+`linux/arm64`. Formal releases publish the same version tags and `latest`
+multi-platform image to GHCR and TCR; the release audit rejects missing, stale,
+or mismatched mirror content. Pin `EDGE_EVER_VERSION` to a release tag in
+production.
 
 Compose creates one named volume. Everything that must survive a container
 replacement is under `/data`:
diff --git a/docs/deploy-docker.zh-CN.md b/docs/deploy-docker.zh-CN.md
index 35a60b72..c3fc189c 100644
--- a/docs/deploy-docker.zh-CN.md
+++ b/docs/deploy-docker.zh-CN.md
@@ -58,13 +58,15 @@ docker compose ps
 
 ```sh
 export EDGE_EVER_IMAGE=ccr.ccs.tencentyun.com/edgeever/edgeever
-export EDGE_EVER_VERSION=v1.33.0
+export EDGE_EVER_VERSION=vX.Y.Z
 docker compose pull
 docker compose up -d
 ```
 
 腾讯云公共镜像无需执行 `docker login`，支持 `linux/amd64` 与 `linux/arm64`。
-生产环境应通过 `EDGE_EVER_VERSION` 固定正式版本标签。
+正式发布会向 GHCR 和 TCR 同时写入相同的版本标签与 `latest` 多平台镜像；发布
+审计会拒绝缺失、滞后或内容不一致的镜像。生产环境应通过
+`EDGE_EVER_VERSION` 固定正式版本标签。
 
 Compose 会创建一个命名卷。所有需要在容器替换后保留的数据都位于 `/data`：
 
diff --git a/docs/release.md b/docs/release.md
index ecfda28b..0c959ff8 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -51,12 +51,22 @@ installed and launched after the Release.
   Release asset rather than the overall GitHub tag. This prevents a Web-only or
   API-only Release from prompting an unnecessary native update.
 - The script creates the tracking Issue and Draft Release, validates or reuses
-  native assets, prepares the multi-platform Docker image, publishes, closes
-  the Issue, and installs the matching DMG.
+  native assets, prepares the multi-platform Docker image in both GHCR and the
+  public Tencent TCR mirror, publishes, closes the Issue, and installs the
+  matching DMG.
   Demo deployment continues independently after its Actions URL is printed.
 - Mobile store delivery is not part of this command. See
   [Mobile Store Delivery](store-delivery.md).
 
+## Registry Credentials
+
+The official repository must define `TENCENT_TCR_USERNAME` and
+`TENCENT_TCR_PASSWORD` Actions secrets. For the TCR Personal Edition registry,
+the username is the Tencent Cloud account ID and the password is the fixed
+registry password initialized in the TCR console. Draft preparation publishes
+the same tags to GHCR and TCR; both registries are checked anonymously before
+the Release can be published.
+
 ## Failure and Resume
 
 - Validation, Draft asset, or Docker image failures leave the Release unpublished.
diff --git a/docs/release.zh-CN.md b/docs/release.zh-CN.md
index dce92c9d..e7eb4402 100644
--- a/docs/release.zh-CN.md
+++ b/docs/release.zh-CN.md
@@ -45,11 +45,19 @@ bun run release -- \
 - 桌面端和 Android 更新检查使用对应 Release 资产中记录的版本，而不是整体
   GitHub Tag，避免仅涉及 Web 或 API 的 Release 触发无效原生更新。
 - 脚本负责创建跟踪 Issue 和 Draft Release、验证或复用原生资产、准备多架构
-  Docker 镜像、正式发布、关闭 Issue，并安装与当前 Mac 架构匹配的 DMG。
+  Docker 镜像并同时写入 GHCR 与腾讯云 TCR 公共镜像、正式发布、关闭 Issue，
+  并安装与当前 Mac 架构匹配的 DMG。
   输出 Actions 链接后，Demo 部署会独立继续执行。
 - 此命令不执行移动端商店交付，详见
   [移动端商店交付](store-delivery.zh-CN.md)。
 
+## 镜像仓库凭据
+
+官方仓库必须配置 `TENCENT_TCR_USERNAME` 和 `TENCENT_TCR_PASSWORD` 两个
+Actions Secret。对于 TCR 个人版，用户名是腾讯云账号 ID，密码是在 TCR 控制台
+初始化的固定登录密码。Draft 准备阶段会向 GHCR 与 TCR 写入相同标签；正式发布
+前会以匿名方式检查两个仓库。
+
 ## 失败与续跑
 
 - 本地验证、Draft 资产或 Docker 镜像失败时，Release 保持未发布状态。
diff --git a/scripts/docker-release.test.mjs b/scripts/docker-release.test.mjs
index db6c08ab..4aa5408f 100644
--- a/scripts/docker-release.test.mjs
+++ b/scripts/docker-release.test.mjs
@@ -81,6 +81,15 @@ describe("Docker release contract", () => {
     expect(workflow).toContain('gh release view "${RELEASE_TAG}"');
     expect(workflow).not.toContain('releases/tags/${RELEASE_TAG}');
     expect(workflow).toContain("docker logout ghcr.io");
+    expect(workflow).toContain("TCR_IMAGE_NAME: ccr.ccs.tencentyun.com/edgeever/edgeever");
+    expect(workflow).toContain("secrets.TENCENT_TCR_USERNAME");
+    expect(workflow).toContain("secrets.TENCENT_TCR_PASSWORD");
+    expect(workflow).toContain('echo "${TCR_IMAGE_NAME}:${RELEASE_TAG}"');
+    expect(workflow).toContain('echo "${TCR_IMAGE_NAME}:latest"');
+    expect(workflow).toContain('echo "${TCR_IMAGE_NAME}:sha-${short_sha}"');
+    expect(workflow).toContain('docker logout ccr.ccs.tencentyun.com');
+    expect(workflow).toContain('test "${ghcr_digest}" = "${tcr_digest}"');
+    expect(workflow).toContain('for image in "${GHCR_IMAGE_NAME}" "${TCR_IMAGE_NAME}"');
     expect(workflow).toContain("docker buildx imagetools inspect");
   });
 });