ci(workflow): 更新 GitHub Actions 依赖至最新版本并优化 Docker 推送逻辑

更新 actions/cache、codecov-action 和 upload-artifact 至 v4 版本
优化 Docker 镜像构建推送逻辑，仅在配置 secrets 且为 main 分支时推送

Author: dengmengmian

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
         go-version: '1.23'
 
     - name: Cache Go modules
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -84,7 +84,7 @@ jobs:
         REDIS_PORT: 6379
 
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
       with:
         file: ./coverage.out
         flags: unittests
@@ -107,7 +107,7 @@ jobs:
         go build -v -ldflags "-X gotribe-admin/internal/pkg/common.GitVersion=$(git describe --tags --always --dirty) -X gotribe-admin/internal/pkg/common.GitCommit=$(git rev-parse HEAD) -X gotribe-admin/internal/pkg/common.GitTreeState=$(if [ -z "$(git status --porcelain)" ]; then echo "clean"; else echo "dirty"; fi) -X gotribe-admin/internal/pkg/common.BuildDate=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" -o gotribe-admin .
 
     - name: Upload build artifacts
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: gotribe-admin-linux-amd64
         path: gotribe-admin
@@ -122,7 +122,9 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
+    # 如果配置了 Docker Hub secrets，则登录
     - name: Login to Docker Hub
+      if: ${{ secrets.DOCKER_USERNAME && secrets.DOCKER_PASSWORD }}
       uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKER_USERNAME }}
@@ -140,12 +142,13 @@ jobs:
           type=semver,pattern={{major}}.{{minor}}
           type=raw,value=latest,enable={{is_default_branch}}
 
-    - name: Build and push Docker image
+    - name: Build and conditionally push Docker image
       uses: docker/build-push-action@v5
       with:
         context: .
         platforms: linux/amd64,linux/arm64
-        push: true
+        # 只有在配置了 secrets 且是 main 分支时才推送
+        push: ${{ secrets.DOCKER_USERNAME && secrets.DOCKER_PASSWORD && github.ref == 'refs/heads/main' }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
         cache-from: type=gha