chore: add Docker deployment workflow

Wesley-Young · Wesley-Young · commit 10a397f355a9 · 2026-03-06T22:47:31.000+08:00
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,13 @@
+.git
+.github
+.gradle
+.idea
+.kotlin
+**/build
+**/node_modules
+acidify-core-js
+acidify-docs
+kotlin-js-store
+yogurt-scripting
+yogurt-npm-packages
+*.iml
diff --git a/.github/workflows/build-yogurt-pmhq.yml b/.github/workflows/build-yogurt-pmhq.yml
@@ -5,9 +5,56 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 jobs:
+  resolve-meta:
+    runs-on: ubuntu-latest
+
+    outputs:
+      release_version: ${{ steps.meta.outputs.release_version }}
+      release_tag: ${{ steps.meta.outputs.release_tag }}
+      release_name: ${{ steps.meta.outputs.release_name }}
+      docker_image: ${{ steps.meta.outputs.docker_image }}
+      docker_version_tag: ${{ steps.meta.outputs.docker_version_tag }}
+      docker_sha_tag: ${{ steps.meta.outputs.docker_sha_tag }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Resolve release metadata
+        id: meta
+        run: |
+          set -euo pipefail
+
+          version="$(python3 <<'PY'
+          import re
+          from pathlib import Path
+
+          gradle_file = Path("yogurt") / "build.gradle.kts"
+          content = gradle_file.read_text(encoding="utf-8")
+          match = re.search(r'version\s*=\s*"([^"]+)"', content)
+          if not match:
+              raise SystemExit("Cannot find version in yogurt/build.gradle.kts")
+          print(match.group(1))
+          PY
+          )"
+          short_hash="$(git rev-parse --short=7 HEAD)"
+          release_tag="v${version}+${short_hash}"
+          docker_version_tag="${version}-${short_hash}"
+          docker_sha_tag="sha-${short_hash}"
+          docker_image="ghcr.io/llonebot/yogurt-pmhq"
+
+          echo "release_version=${version}" >> "$GITHUB_OUTPUT"
+          echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT"
+          echo "release_name=${release_tag}" >> "$GITHUB_OUTPUT"
+          echo "docker_image=${docker_image}" >> "$GITHUB_OUTPUT"
+          echo "docker_version_tag=${docker_version_tag}" >> "$GITHUB_OUTPUT"
+          echo "docker_sha_tag=${docker_sha_tag}" >> "$GITHUB_OUTPUT"
+
   build-native:
+    needs: resolve-meta
     runs-on: ${{ matrix.runs-on }}
 
     strategy:
@@ -75,6 +122,7 @@ jobs:
           path: yogurt/build/bin/${{ matrix.target }}/releaseExecutable/**
 
   build-jvm:
+    needs: resolve-meta
     runs-on: ubuntu-latest
 
     env:
@@ -102,6 +150,7 @@ jobs:
 
   release-yogurt:
     needs:
+      - resolve-meta
       - build-native
       - build-jvm
     runs-on: ubuntu-latest
@@ -134,34 +183,59 @@ jobs:
             cp release-input/yogurt-jvm/yogurt-jvm-all.jar release-assets/yogurt-jvm-all.jar
           fi
 
-      - name: Resolve release metadata
-        id: release_meta
-        run: |
-          set -euo pipefail
-          version="$(python3 <<'PY'
-          import re
-          from pathlib import Path
-
-          gradle_file = Path("yogurt") / "build.gradle.kts"
-          content = gradle_file.read_text(encoding="utf-8")
-          match = re.search(r'version\s*=\s*"([^"]+)"', content)
-          if not match:
-              raise SystemExit("Cannot find version in yogurt/build.gradle.kts")
-          print(match.group(1))
-          PY
-          )"
-          short_hash="$(git rev-parse --short=7 HEAD)"
-          tag="v${version}+${short_hash}"
-          echo "release_version=${version}" >> "$GITHUB_OUTPUT"
-          echo "release_tag=${tag}" >> "$GITHUB_OUTPUT"
-          echo "release_name=${tag}" >> "$GITHUB_OUTPUT"
-
       - name: Create GitHub release
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ steps.release_meta.outputs.release_tag }}
-          name: ${{ steps.release_meta.outputs.release_name }}
+          tag_name: ${{ needs.resolve-meta.outputs.release_tag }}
+          name: ${{ needs.resolve-meta.outputs.release_name }}
           generate_release_notes: false
           files: release-assets/*
           body: |
             Yogurt PMHQ build for commit `${{ github.sha }}`
+
+  publish-docker:
+    needs: resolve-meta
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: docker_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ needs.resolve-meta.outputs.docker_image }}
+          tags: |
+            type=raw,value=latest
+            type=raw,value=${{ needs.resolve-meta.outputs.release_version }}
+            type=raw,value=${{ needs.resolve-meta.outputs.docker_version_tag }}
+            type=raw,value=${{ needs.resolve-meta.outputs.docker_sha_tag }}
+          labels: |
+            org.opencontainers.image.title=yogurt-pmhq
+            org.opencontainers.image.description=Yogurt PMHQ Docker image
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ needs.resolve-meta.outputs.release_tag }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/README.md b/README.md
@@ -87,6 +87,18 @@ Yogurt 启动并登录完成后，HTTP API 的地址是 `http://<host>:<port>/ap
 
 见 [Yogurt 文档的“日志配置”部分](https://acidify.ntqqrev.org/yogurt/configuration#%E6%97%A5%E5%BF%97%E9%85%8D%E7%BD%AE)。
 
+## Docker 部署
+
+如果准备把 Yogurt 和 PMHQ 一起部署，仓库里已经提供了一套可以直接使用的 Docker 文件，位于 `docker/` 目录。`docker/docker-compose.yml` 默认使用 `ghcr.io/llonebot/yogurt-pmhq:latest`，并将 `pmhq` 和 `yogurt` 放在同一个网络里。Yogurt 会直接通过容器名 `pmhq` 连接 `ws://pmhq:13000/ws`，不需要再额外处理容器间通信。
+
+PMHQ 的 QQ 配置目录会挂载到独立卷 `qq_volume`。Yogurt 的运行目录会挂载到 `./data`，启动时自动生成 `config.json` 和脚本目录，适合长期保留登录状态与本地数据。镜像内部运行的是 `linuxX64` 的 Kotlin/Native 可执行文件，而不是 JVM fat jar，因此运行时占用会更小一些。
+
+首次使用时，在仓库根目录执行 `docker compose -f docker/docker-compose.yml up -d` 即可。启动后，Yogurt 会根据容器环境变量自动写出配置文件。最常用的几项已经放在 compose 文件里，包括 `YOGURT_PORT`、`YOGURT_ACCESS_TOKEN`、`QUICK_LOGIN_UIN`、`PRELOAD_CONTACTS`、`REPORT_SELF_MESSAGE` 和 `SKIP_SECURITY_CHECK`。
+
+如果需要跨域访问，可以填写 `HTTP_CORS_ORIGINS`，多个来源使用逗号分隔。如果需要事件推送，可以填写 `WEBHOOK_URLS`，同样使用逗号分隔，并在需要时通过 `WEBHOOK_ACCESS_TOKEN` 配置推送鉴权。默认情况下，HTTP 接口会映射到宿主机的 `3000` 端口，PMHQ 不对外暴露端口，只在 compose 内部网络中提供服务。
+
+Yogurt 容器额外写入了 `host.docker.internal:host-gateway`，因此 webhook 或其他回调服务如果运行在宿主机上，也可以直接从容器内访问。如果你确实需要从宿主机直接访问 PMHQ，再自行给 `pmhq` 服务补端口映射即可。
+
 ## 支持平台
 
 - Kotlin/JVM
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -0,0 +1,29 @@
+FROM eclipse-temurin:25-jdk AS builder
+
+WORKDIR /workspace
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential clang curl unzip xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY . .
+
+RUN ./gradlew :yogurt:linkReleaseExecutableLinuxX64 --no-daemon \
+    && cp /workspace/yogurt/build/bin/linuxX64/releaseExecutable/yogurt.kexe /tmp/yogurt
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates jq libcurl4 \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY --from=builder /tmp/yogurt /app/yogurt
+COPY docker/startup.sh /app/startup.sh
+
+RUN chmod +x /app/startup.sh /app/yogurt
+
+ENV YOGURT_DATA_DIR=/app/data
+
+ENTRYPOINT ["/app/startup.sh"]
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
@@ -0,0 +1,59 @@
+services:
+  pmhq:
+    image: linyuchen/pmhq:latest
+    container_name: pmhq
+    privileged: true
+    environment:
+      - ENABLE_HEADLESS=true
+      - AUTO_LOGIN_QQ=
+    volumes:
+      - qq_volume:/root/.config/QQ
+    networks:
+      - app_network
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:13000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+  yogurt:
+    image: ghcr.io/llonebot/yogurt-pmhq:latest
+    container_name: yogurt-pmhq
+    platform: linux/amd64
+    environment:
+      - PMHQ_HOST=pmhq
+      - PMHQ_PORT=13000
+      - YOGURT_HOST=0.0.0.0
+      - YOGURT_PORT=3000
+      - YOGURT_ACCESS_TOKEN=change-me
+      - HTTP_CORS_ORIGINS=
+      - WEBHOOK_URLS=
+      - WEBHOOK_ACCESS_TOKEN=
+      - QUICK_LOGIN_UIN=
+      - PRELOAD_CONTACTS=false
+      - REPORT_SELF_MESSAGE=true
+      - TRANSFORM_INCOMING_MFACE_TO_IMAGE=false
+      - SKIP_SECURITY_CHECK=true
+      - ANSI_LEVEL=ANSI256
+      - CORE_LOG_LEVEL=DEBUG
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - ./data:/app/data
+    ports:
+      - "3000:3000"
+    depends_on:
+      pmhq:
+        condition: service_healthy
+    networks:
+      - app_network
+    restart: unless-stopped
+
+volumes:
+  qq_volume:
+
+networks:
+  app_network:
+    driver: bridge
diff --git a/docker/startup.sh b/docker/startup.sh
@@ -0,0 +1,85 @@
+#!/bin/sh
+set -eu
+
+DATA_DIR="${YOGURT_DATA_DIR:-/app/data}"
+PMHQ_HOST="${PMHQ_HOST:-pmhq}"
+PMHQ_PORT="${PMHQ_PORT:-13000}"
+YOGURT_HOST="${YOGURT_HOST:-0.0.0.0}"
+YOGURT_PORT="${YOGURT_PORT:-3000}"
+YOGURT_ACCESS_TOKEN="${YOGURT_ACCESS_TOKEN:-}"
+HTTP_CORS_ORIGINS="${HTTP_CORS_ORIGINS:-}"
+WEBHOOK_URLS="${WEBHOOK_URLS:-}"
+WEBHOOK_ACCESS_TOKEN="${WEBHOOK_ACCESS_TOKEN:-}"
+QUICK_LOGIN_UIN="${QUICK_LOGIN_UIN:-}"
+PRELOAD_CONTACTS="${PRELOAD_CONTACTS:-false}"
+REPORT_SELF_MESSAGE="${REPORT_SELF_MESSAGE:-true}"
+TRANSFORM_INCOMING_MFACE_TO_IMAGE="${TRANSFORM_INCOMING_MFACE_TO_IMAGE:-false}"
+SKIP_SECURITY_CHECK="${SKIP_SECURITY_CHECK:-true}"
+ANSI_LEVEL="${ANSI_LEVEL:-ANSI256}"
+CORE_LOG_LEVEL="${CORE_LOG_LEVEL:-DEBUG}"
+
+mkdir -p "$DATA_DIR" "$DATA_DIR/scripts"
+
+if [ -n "$QUICK_LOGIN_UIN" ]; then
+  QUICK_LOGIN_UIN_JSON="$QUICK_LOGIN_UIN"
+else
+  QUICK_LOGIN_UIN_JSON="null"
+fi
+
+jq -n \
+  --arg pmhqUrl "ws://${PMHQ_HOST}:${PMHQ_PORT}/ws" \
+  --argjson quickLoginUin "$QUICK_LOGIN_UIN_JSON" \
+  --argjson preloadContacts "$PRELOAD_CONTACTS" \
+  --argjson reportSelfMessage "$REPORT_SELF_MESSAGE" \
+  --argjson transformIncomingMFaceToImage "$TRANSFORM_INCOMING_MFACE_TO_IMAGE" \
+  --argjson skipSecurityCheck "$SKIP_SECURITY_CHECK" \
+  --arg host "$YOGURT_HOST" \
+  --arg accessToken "$YOGURT_ACCESS_TOKEN" \
+  --arg corsOrigins "$HTTP_CORS_ORIGINS" \
+  --arg webhookUrls "$WEBHOOK_URLS" \
+  --arg webhookAccessToken "$WEBHOOK_ACCESS_TOKEN" \
+  --arg ansiLevel "$ANSI_LEVEL" \
+  --arg coreLogLevel "$CORE_LOG_LEVEL" \
+  --argjson port "$YOGURT_PORT" \
+  '{
+    signApiUrl: "",
+    pmhqUrl: $pmhqUrl,
+    quickLoginUin: $quickLoginUin,
+    protocol: {
+      os: "Linux",
+      version: "fetched"
+    },
+    androidCredentials: {
+      uin: 0,
+      password: ""
+    },
+    androidUseLegacySign: false,
+    reportSelfMessage: $reportSelfMessage,
+    preloadContacts: $preloadContacts,
+    transformIncomingMFaceToImage: $transformIncomingMFaceToImage,
+    httpConfig: {
+      host: $host,
+      port: $port,
+      accessToken: $accessToken,
+      corsOrigins: (
+        $corsOrigins
+        | if . == "" then [] else split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0)) end
+      )
+    },
+    webhookConfig: {
+      url: (
+        $webhookUrls
+        | if . == "" then [] else split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0)) end
+      ),
+      accessToken: $webhookAccessToken
+    },
+    logging: {
+      ansiLevel: $ansiLevel,
+      coreLogLevel: $coreLogLevel
+    },
+    skipSecurityCheck: $skipSecurityCheck
+  }' > "$DATA_DIR/config.json"
+
+cd "$DATA_DIR"
+
+exec /app/yogurt
