Dockerfile

# syntax=docker/dockerfile:1.7

FROM ghcr.io/rachelos/base-full:latest AS runtime

ARG REPO_URL=https://github.com/CaPaCaptain/WeRSS.git
ARG REPO_REF=main

ENV DEBIAN_FRONTEND=noninteractive \
    INSTALL=True \
    BROWSER_TYPE=webkit \
    PLANT_PATH=/app/env \
    PORT=7860 \
    DB=sqlite:////data/db.db \
    THREADS=1 \
    AUTO_RELOAD=False \
    LOG_LEVEL=INFO \
    PYTHONUNBUFFERED=1

USER root

RUN apt-get update \
    && apt-get install -y --no-install-recommends bash ca-certificates git \
    && rm -rf /var/lib/apt/lists/*

RUN --mount=type=secret,id=GITHUB_TOKEN,required=false \
    set -eu; \
    TOKEN="$(cat /run/secrets/GITHUB_TOKEN 2>/dev/null || true)"; \
    rm -rf /app; \
    git init /app; \
    git -C /app remote add origin "${REPO_URL}"; \
    if [ -n "${TOKEN}" ]; then \
      AUTH_HEADER="$(printf 'x-access-token:%s' "${TOKEN}" | base64 | tr -d '\n')"; \
      git -C /app -c http.extraHeader="Authorization: Basic ${AUTH_HEADER}" fetch --depth 1 origin "${REPO_REF}"; \
    else \
      git -C /app fetch --depth 1 origin "${REPO_REF}"; \
    fi; \
    git -C /app checkout --detach FETCH_HEAD

WORKDIR /app

RUN python3 - <<'PY'
from pathlib import Path
import re

config_path = Path("/app/config.example.yaml")
config_text = config_path.read_text(encoding="utf-8")
config_text = re.sub(
    r"\$\{([A-Z][A-Z0-9_.]*)(?=[:-])",
    lambda match: "${" + match.group(1).replace(".", "_"),
    config_text,
)
config_path.write_text(config_text, encoding="utf-8")

main_path = Path("/app/main.py")
main_text = main_path.read_text(encoding="utf-8")
unsafe = '    print("环境变量:")\n    for k,v in os.environ.items():\n        print(f"{k}={v}")\n'
safe = '    print("Environment configuration loaded; values are hidden.")\n'
if unsafe in main_text:
    main_text = main_text.replace(unsafe, safe)
main_path.write_text(main_text, encoding="utf-8")
PY

RUN chmod +x /app/install.sh /app/start.sh \
    && /app/install.sh \
    && cp /app/config.example.yaml /app/config.template.yaml

EXPOSE 7860

CMD ["bash", "-lc", "set -eu; unset GITHUB_TOKEN || true; mkdir -p /data; if [ ! -f /data/config.yaml ]; then cp /app/config.template.yaml /data/config.yaml; fi; rm -f /app/config.yaml; ln -s /data/config.yaml /app/config.yaml; rm -rf /app/data; ln -s /data /app/data; exec /app/start.sh"]