NianAIGC/.project-docs/30-worklog/tasks/20260815-go-mod-download-timeout-5b8e2c.md

Task: Diagnose Go module download timeout during Docker build

Identity

• Task ID: 20260815-go-mod-download-timeout-5b8e2c
• Mode: Feature
• Branch: main
• Worktree: D:\Datas\OthersProjects\NianAIGC
• Base commit: 9f40162c6b
• Owner: codex
• Status: Ready for Integration

Scope

• Diagnose the Jenkins Docker build failure at backend/Dockerfile:20 without changing application or deployment code.
• Verify whether github.com/jackc/pgpassfile@v1.0.0 is invalid or whether the failure is limited to dependency-network access.
• Identify the repository-supported build path for China-hosted CI and provide a target-environment verification command.
• Make the standard Go Docker build use a China-reachable, integrity-checked module source by default while allowing CI to override it.
• Diagnose and fix the root Next.js image's npm ci registry timeout using a free mirror without changing dependency versions.

Intent And Constraints

• Treat the supplied Jenkins log as the production-environment failure artifact and keep confirmed repository facts separate from target-network assumptions.
• Keep the implementation surgical: change only the standard Go Docker build configuration and its task record; Jenkins configuration is outside this repository.
• Do not weaken module integrity checks (go.sum/GOSUMDB) to work around a transport timeout.
• Keep the package lockfile authoritative; do not regenerate dependency versions merely to change registry routing.

Outcome

• The failure occurs before compilation while the standard backend/Dockerfile runs go mod download; its build stage has no GOPROXY override and therefore attempted https://proxy.golang.org.
• The failing module is a valid indirect dependency of github.com/jackc/pgx/v5@v5.5.5, and both its module and checksum entries are present.
• A cold download of the failing module and then the complete module set succeeded through https://goproxy.cn,direct; the individual fetch completed in 0.18 seconds and the complete set in 1 second in the diagnostic environment.
• The repository already supplies backend/Dockerfile.alpine as the recommended China-CI build. It uses the Aliyun Alpine package mirror, GOPROXY=https://goproxy.cn,direct, and GOSUMDB=sum.golang.google.cn.
• Updated the standard backend/Dockerfile to use the same integrity-checked Go module endpoints by default and expose GOPROXY/GOSUMDB as build arguments for internal or global proxy overrides.
• The later Jenkins failure was a separate root-image issue: npm ci used the default npm registry and ran for 1769 seconds before npm reported Exit handler never called.
• Updated the root Dockerfile deps stage to use the free https://registry.npmmirror.com mirror by default, expose NPM_REGISTRY as a build argument, add bounded retries/timeouts, and skip audit/fund network calls. The package lockfile and dependency versions were not changed.
• An initial --replace-registry-host=always experiment was rejected because 16 lockfile entries point to Tencent's /npm/... tarball paths, which do not map to the npmmirror path layout; the retained command only sets --registry and leaves those explicit URLs intact.
• No application, deployment manifest, dependency, checksum, or CI file was changed.

Verification

• Confirmed that the supplied Dockerfile:20 location matches backend/Dockerfile and that backend/Dockerfile.alpine places its module download at line 17.
• Ran a fresh-cache go mod download -x github.com/jackc/pgpassfile@v1.0.0 through goproxy.cn: exit 0.
• Ran a fresh-cache full go mod download through goproxy.cn: exit 0.
• Confirmed with go mod graph that pgx/v5@v5.5.5 depends on pgpassfile@v1.0.0.
• Static Dockerfile contract check passed: both proxy arguments and their environment bindings precede RUN go mod download.
• go test ./... passed for all 19 Go packages, and go vet ./... passed.
• Re-ran a fresh-cache full module download using the new defaults: exit 0.
• Ran go mod verify: all downloaded modules verified.
• Ran a fresh-cache root npm ci with the Dockerfile's registry, retry, timeout, --no-audit, and --no-fund options: exit 0 in 15.29 seconds.
• Confirmed the root lockfile contains 241 registry.npmjs.org entries and 16 explicit Tencent mirror entries; no lockfile rewrite was performed.
• Could not run a full Docker image build because the local Docker Desktop Linux daemon is unavailable; the Jenkins-node rerun remains the authoritative end-to-end check.

Follow-ups

• Re-run the existing standard Docker build on the Jenkins agent; backend/Dockerfile.alpine remains the more self-contained fallback when Alpine package downloads also need an Aliyun mirror.
• If that command still times out, test HTTPS egress/DNS from the Jenkins Docker build network to mirrors.aliyun.com, goproxy.cn, and sum.golang.google.cn, or use the organization's internal Go module proxy.
• Re-run the root image build on Jenkins with docker build --progress=plain --no-cache -t <image> .; if it still fails, capture the first failing package URL because the lockfile has explicit Tencent mirror URLs for a small subset of packages.

Promotion Candidates

• None recorded.