From c321d020dda7954da19a1db004c53c0405852a30 Mon Sep 17 00:00:00 2001
From: nanxun <nanxun@nxsir.cn>
Date: Wed, 12 Aug 2026 00:02:14 +0800
Subject: [PATCH] ci: harden registry proxy and manifest output

---
 Jenkinsfile | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 1efea3f..731a3d8 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -133,7 +133,10 @@ pipeline {
                           --driver-opt network=host \
                           --driver-opt "env.http_proxy=$HTTP_PROXY_URL" \
                           --driver-opt "env.https_proxy=$HTTP_PROXY_URL" \
-                          --driver-opt "env.no_proxy=reg.nxsir.cn" --use
+                          --driver-opt "env.HTTP_PROXY=$HTTP_PROXY_URL" \
+                          --driver-opt "env.HTTPS_PROXY=$HTTP_PROXY_URL" \
+                          --driver-opt "env.no_proxy=reg.nxsir.cn" \
+                          --driver-opt "env.NO_PROXY=reg.nxsir.cn" --use
                         ./scripts/ci-docker.sh buildx inspect "$BUILDER_NAME" --bootstrap
                         ./scripts/ci-docker.sh buildx build --builder "$BUILDER_NAME" --platform linux/amd64 --network host \
                           --progress=plain --provenance=false --no-cache --load \
@@ -184,9 +187,12 @@ pipeline {
                 ]) {
                     sh '''
                         set -euo pipefail
+                        set +x
                         auth=$(printf '%s:%s' "$HARBOR_USERNAME" "$HARBOR_PASSWORD" | base64 -w0)
                         printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY_URL" "$auth" >"$DOCKER_CONFIG/config.json"
                         chmod 600 "$DOCKER_CONFIG/config.json"
+                        unset auth
+                        set -x
                         ./scripts/ci-docker.sh push "$IMAGE_REF"
                         digest=$(./scripts/ci-docker.sh image inspect --format '{{index .RepoDigests 0}}' "$IMAGE_REF" | sed -n 's/.*@//p'); test -n "$digest"; export digest
                         fpk_sha=$(awk '{print $1}' "$FPK_PATH.sha256"); export fpk_sha
@@ -201,7 +207,7 @@ payload = {
   'image':os.environ['IMAGE_REF'],'digest':os.environ['digest'],'platform':'linux/amd64',
   'database':'PostgreSQL 15 + pgvector 0.8.6 (embedded Docker runtime)'
 }
-path.write_text(json.dumps(payload,ensure_ascii=False,indent=2)+'\n',encoding='utf-8')
+path.write_text(json.dumps(payload,ensure_ascii=False,indent=2)+chr(10),encoding='utf-8')
 PY
                         sha256sum "$MANIFEST_PATH" >"$MANIFEST_PATH.sha256"
                     '''