ci: harden P0 workflow checks (#1077)

.github/workflows/docker-publish.yml

@@ -1,36 +1,107 @@
 name: Build and Push Docker Image to Docker Hub
 
 on:
-  workflow_dispatch:    # 手动触发
+  pull_request:
+    branches:
+      - main
+      - base
+    paths:
+      - .dockerignore
+      - Dockerfile
+      - package.json
+      - package-lock.json
+      - tsconfig*.json
+      - vite.config*.ts
+      - packages/**
+      - bin/**
+      - scripts/**
+      - .github/workflows/docker-publish.yml
+  workflow_dispatch:
   release:
-    types: [published]  # 发布 release 时自动触发
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  IMAGE_NAME: hermes-web-ui
 
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
 
     steps:
-      # 1. 检出当前仓库代码
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      # 2. 设置 QEMU (用于跨平台构建 ARM64)
       - name: Set up QEMU
+        if: github.event_name != 'pull_request'
         uses: docker/setup-qemu-action@v3
 
-      # 3. 设置 Docker Buildx (用于构建镜像的高级工具)
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # 4. 登录到 Docker Hub (使用你截图里配置的 Secrets)
       - name: Log in to Docker Hub
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      # 5. 构建并推送镜像 (支持 AMD64 和 ARM64)
+      - name: Build PR image
+        if: github.event_name == 'pull_request'
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          load: true
+          push: false
+          tags: ${{ env.IMAGE_NAME }}:ci
+
+      - name: Smoke test PR image
+        if: github.event_name == 'pull_request'
+        run: |
+          set -euo pipefail
+          cid=""
+          cleanup() {
+            if [ -n "$cid" ]; then
+              docker logs "$cid" || true
+              docker rm -f "$cid" || true
+            fi
+          }
+          trap cleanup EXIT
+
+          cid=$(docker run -d \
+            -e PORT=6060 \
+            -e BIND_HOST=0.0.0.0 \
+            -e HERMES_WEB_UI_HOME=/tmp/hermes-web-ui \
+            -e HERMES_HOME=/home/agent/.hermes \
+            -p 6060:6060 \
+            "${IMAGE_NAME}:ci")
+
+          for attempt in $(seq 1 60); do
+            if curl -fsS http://127.0.0.1:6060/health | grep -q '"status":"ok"'; then
+              echo "Docker image smoke test passed."
+              exit 0
+            fi
+            if ! docker ps --quiet --no-trunc | grep -q "$cid"; then
+              echo "Container exited before becoming healthy." >&2
+              exit 1
+            fi
+            sleep 2
+          done
+
+          echo "Timed out waiting for /health." >&2
+          exit 1
+
       - name: Build and push Docker image
+        if: github.event_name != 'pull_request'
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -40,4 +111,4 @@ jobs:
           tags: |
             ${{ secrets.DOCKERHUB_USERNAME }}/hermes-web-ui:latest
             ${{ secrets.DOCKERHUB_USERNAME }}/hermes-web-ui:${{ github.sha }}
-            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-web-ui:${{ github.ref_name || github.event.release.tag_name }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/hermes-web-ui:${{ github.event.release.tag_name || github.ref_name }}