修改dockerfile

.project-docs/30-worklog/tasks/20260815-go-mod-download-timeout-5b8e2c.md

@@ -16,12 +16,14 @@
 - Verify whether `github.com/jackc/pgpassfile@v1.0.0` is invalid or whether the failure is limited to dependency-network access.
 - Identify the repository-supported build path for China-hosted CI and provide a target-environment verification command.
 - Make the standard Go Docker build use a China-reachable, integrity-checked module source by default while allowing CI to override it.
+- Diagnose and fix the root Next.js image's `npm ci` registry timeout using a free mirror without changing dependency versions.
 
 ## Intent And Constraints
 
 - Treat the supplied Jenkins log as the production-environment failure artifact and keep confirmed repository facts separate from target-network assumptions.
 - Keep the implementation surgical: change only the standard Go Docker build configuration and its task record; Jenkins configuration is outside this repository.
 - Do not weaken module integrity checks (`go.sum`/`GOSUMDB`) to work around a transport timeout.
+- Keep the package lockfile authoritative; do not regenerate dependency versions merely to change registry routing.
 
 ## Outcome
 
@@ -30,6 +32,9 @@
 - A cold download of the failing module and then the complete module set succeeded through `https://goproxy.cn,direct`; the individual fetch completed in 0.18 seconds and the complete set in 1 second in the diagnostic environment.
 - The repository already supplies `backend/Dockerfile.alpine` as the recommended China-CI build. It uses the Aliyun Alpine package mirror, `GOPROXY=https://goproxy.cn,direct`, and `GOSUMDB=sum.golang.google.cn`.
 - Updated the standard `backend/Dockerfile` to use the same integrity-checked Go module endpoints by default and expose `GOPROXY`/`GOSUMDB` as build arguments for internal or global proxy overrides.
+- The later Jenkins failure was a separate root-image issue: `npm ci` used the default npm registry and ran for 1769 seconds before npm reported `Exit handler never called`.
+- Updated the root `Dockerfile` deps stage to use the free `https://registry.npmmirror.com` mirror by default, expose `NPM_REGISTRY` as a build argument, add bounded retries/timeouts, and skip audit/fund network calls. The package lockfile and dependency versions were not changed.
+- An initial `--replace-registry-host=always` experiment was rejected because 16 lockfile entries point to Tencent's `/npm/...` tarball paths, which do not map to the npmmirror path layout; the retained command only sets `--registry` and leaves those explicit URLs intact.
 - No application, deployment manifest, dependency, checksum, or CI file was changed.
 
 ## Verification
@@ -42,12 +47,15 @@
 - `go test ./...` passed for all 19 Go packages, and `go vet ./...` passed.
 - Re-ran a fresh-cache full module download using the new defaults: exit 0.
 - Ran `go mod verify`: all downloaded modules verified.
+- Ran a fresh-cache root `npm ci` with the Dockerfile's registry, retry, timeout, `--no-audit`, and `--no-fund` options: exit 0 in 15.29 seconds.
+- Confirmed the root lockfile contains 241 `registry.npmjs.org` entries and 16 explicit Tencent mirror entries; no lockfile rewrite was performed.
 - Could not run a full Docker image build because the local Docker Desktop Linux daemon is unavailable; the Jenkins-node rerun remains the authoritative end-to-end check.
 
 ## Follow-ups
 
 - Re-run the existing standard Docker build on the Jenkins agent; `backend/Dockerfile.alpine` remains the more self-contained fallback when Alpine package downloads also need an Aliyun mirror.
 - If that command still times out, test HTTPS egress/DNS from the Jenkins Docker build network to `mirrors.aliyun.com`, `goproxy.cn`, and `sum.golang.google.cn`, or use the organization's internal Go module proxy.
+- Re-run the root image build on Jenkins with `docker build --progress=plain --no-cache -t <image> .`; if it still fails, capture the first failing package URL because the lockfile has explicit Tencent mirror URLs for a small subset of packages.
 
 ## Promotion Candidates
 

Dockerfile

@@ -2,8 +2,19 @@ FROM node:22-alpine AS deps
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
 
+# Use a free mainland-China npm mirror by default. CI can override this with
+# --build-arg NPM_REGISTRY=https://registry.npmjs.org if its egress allows it.
+ARG NPM_REGISTRY=https://registry.npmmirror.com
+
 COPY package.json package-lock.json ./
-RUN npm ci
+RUN npm ci \
+    --registry="${NPM_REGISTRY}" \
+    --fetch-retries=5 \
+    --fetch-timeout=120000 \
+    --fetch-retry-mintimeout=10000 \
+    --fetch-retry-maxtimeout=60000 \
+    --no-audit \
+    --no-fund
 
 FROM node:22-alpine AS builder
 WORKDIR /app