fix(ci): harden python dependency install against timeout

.gitea/workflows/ci.yml

@@ -192,9 +192,25 @@ jobs:
           set -euo pipefail
           IMAGE_REF="${{ steps.meta.outputs.image_ref }}"
           IMAGE_NAME="${{ steps.meta.outputs.image_name }}"
+          PIP_INDEX_URL="${{ secrets.PIP_INDEX_URL }}"
+          PIP_EXTRA_INDEX_URL="${{ secrets.PIP_EXTRA_INDEX_URL }}"
+          PIP_TRUSTED_HOST="${{ secrets.PIP_TRUSTED_HOST }}"
+
+          if [ -z "${PIP_INDEX_URL}" ]; then
+            PIP_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple"
+          fi
+          if [ -z "${PIP_EXTRA_INDEX_URL}" ]; then
+            PIP_EXTRA_INDEX_URL="https://pypi.org/simple"
+          fi
+          if [ -z "${PIP_TRUSTED_HOST}" ]; then
+            PIP_TRUSTED_HOST="pypi.tuna.tsinghua.edu.cn"
+          fi
 
           docker build \
             -f repo/backend/Dockerfile \
+            --build-arg PIP_INDEX_URL="${PIP_INDEX_URL}" \
+            --build-arg PIP_EXTRA_INDEX_URL="${PIP_EXTRA_INDEX_URL}" \
+            --build-arg PIP_TRUSTED_HOST="${PIP_TRUSTED_HOST}" \
             -t "${IMAGE_REF}" \
             -t "${IMAGE_NAME}:latest" \
             repo
@@ -222,7 +238,25 @@ jobs:
     steps:
       - name: Install PyYAML
         shell: bash
-        run: python3 -m pip install --quiet pyyaml
+        run: |
+          set -euo pipefail
+          PIP_INDEX_URL="${{ secrets.PIP_INDEX_URL }}"
+          PIP_EXTRA_INDEX_URL="${{ secrets.PIP_EXTRA_INDEX_URL }}"
+          PIP_TRUSTED_HOST="${{ secrets.PIP_TRUSTED_HOST }}"
+          if [ -z "${PIP_INDEX_URL}" ]; then
+            PIP_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple"
+          fi
+          if [ -z "${PIP_EXTRA_INDEX_URL}" ]; then
+            PIP_EXTRA_INDEX_URL="https://pypi.org/simple"
+          fi
+          if [ -z "${PIP_TRUSTED_HOST}" ]; then
+            PIP_TRUSTED_HOST="pypi.tuna.tsinghua.edu.cn"
+          fi
+
+          PIP_INDEX_URL="${PIP_INDEX_URL}" \
+          PIP_EXTRA_INDEX_URL="${PIP_EXTRA_INDEX_URL}" \
+          PIP_TRUSTED_HOST="${PIP_TRUSTED_HOST}" \
+          python3 -m pip install --quiet --timeout 120 --retries 10 pyyaml
 
       - name: Resolve deploy config
         id: cfg

backend/Dockerfile

@@ -3,6 +3,17 @@ FROM python:3.11-slim AS builder
 
 WORKDIR /app
 
+# Python dependency mirrors/timeouts for unstable public egress
+ARG PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
+ARG PIP_EXTRA_INDEX_URL=https://pypi.org/simple
+ARG PIP_TRUSTED_HOST=pypi.tuna.tsinghua.edu.cn
+ENV PIP_INDEX_URL=${PIP_INDEX_URL} \
+    PIP_EXTRA_INDEX_URL=${PIP_EXTRA_INDEX_URL} \
+    PIP_TRUSTED_HOST=${PIP_TRUSTED_HOST} \
+    PIP_DEFAULT_TIMEOUT=120 \
+    PIP_RETRIES=10 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
 # 安装构建依赖
 RUN apt-get update && apt-get install -y \
     gcc \
@@ -11,11 +22,12 @@ RUN apt-get update && apt-get install -y \
 
 # 复制依赖文件
 COPY backend/pyproject.toml .
+COPY backend/app ./app
 
 # 安装 Python 依赖到虚拟环境
-RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -e . && \
-    pip install --no-cache-dir uvicorn[standard]
+RUN python -m pip install --no-cache-dir --upgrade pip setuptools wheel && \
+    python -m pip install --no-cache-dir --prefer-binary --timeout 120 --retries 10 -e . && \
+    python -m pip install --no-cache-dir --prefer-binary --timeout 120 --retries 10 "uvicorn[standard]"
 
 # Runtime stage
 FROM python:3.11-slim