feat: 新增 Python 3.14t 自由线程镜像 (#6434)

* fix(resource): select free-threaded extension ABI * chore(deps): require moviepilot-rust 0.2.9 * perf: add free-threaded runtime comparison * feat: add free-threaded runtime profile * chore(deps): require moviepilot-rust 0.3.0 * test: isolate system endpoint import graph * fix(docker): preserve runtime profile during recovery * feat(runtime): expose active GIL state * feat(plugin): log GIL fallback attribution * test: refresh runtime observability dependency baseline * fix(plugin): validate the active uv runtime profile * test(runtime): expand free-threaded benchmark evidence * docs(runtime): define v3t governance gates * test(runtime): separate rust benchmark modes * docs: sync free-threaded architecture baseline * perf: add PostgreSQL driver comparison * docs(runtime): record final free-threaded evidence * fix(runtime): converge dual-profile dependency verification * fix(runtime): scope Python 3.14 warning filter * fix(runtime): match actual oss2 syntax warning * docs(runtime): refresh free-threaded benchmark evidence * test(architecture): refresh runtime dependency baseline * ci: skip unused Trivy Java database * build: exclude local verification artifacts * docs(runtime): refresh PostgreSQL driver benchmarks * docs(runtime): record plugin restore acceptance * docs(runtime): record amd64 candidate acceptance * ci: pin beta image publisher action * test(architecture): merge runtime dependency baseline * feat(runtime): expose Python GIL status * docs(runtime): document Python runtime status fields
2026-08-29 03:56:43 +08:00 · 2026-08-24 17:48:14 +08:00
parent 88dce4ca8e
commit 326b5cf3ad
63 changed files with 5294 additions and 253 deletions
@@ -10,6 +10,9 @@ jobs:
  Docker-build:
    runs-on: ubuntu-latest
    name: Build Docker Image
+    env:
+      TRIVY_SKIP_DIRS: /usr/share/java
+      TRIVY_SKIP_JAVA_DB_UPDATE: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -22,6 +25,25 @@ jobs:
      - name: Verify dependency lock
        run: uv lock --check

+      - name: Audit locked Python dependencies
+        run: |
+          uv export --quiet --locked --no-default-groups --group runtime-standard \
+            --no-emit-project --output-file /tmp/moviepilot-audit-standard.txt
+          uvx --from pip-audit==2.10.1 pip-audit \
+            --require-hashes --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-standard.txt
+
+          uv export --quiet --locked --no-default-groups --group runtime-free-threaded \
+            --no-emit-project --no-hashes \
+            --output-file /tmp/moviepilot-audit-free-threaded.txt
+          python3 scripts/normalize_audit_requirements.py \
+            --lock uv.lock \
+            --input /tmp/moviepilot-audit-free-threaded.txt \
+            --output /tmp/moviepilot-audit-free-threaded-normalized.txt
+          uvx --from pip-audit==2.10.1 pip-audit \
+            --no-deps --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-free-threaded-normalized.txt
+
      - name: Release version
        id: release_version
        run: |
@@ -97,7 +119,17 @@ jobs:
            ${{ secrets.DOCKER_USERNAME }}/moviepilot-v3
            ghcr.io/${{ github.repository }}-v3
          tags: |
-            type=raw,value=beta
+            type=raw,value=beta-${{ github.run_id }}-${{ github.run_attempt }}
+
+      - name: Docker Meta free-threaded
+        id: meta_ft
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ secrets.DOCKER_USERNAME }}/moviepilot-v3t
+            ghcr.io/${{ github.repository }}-v3t
+          tags: |
+            type=raw,value=beta-${{ github.run_id }}-${{ github.run_attempt }}

      - name: Set Up QEMU
        uses: docker/setup-qemu-action@v3
@@ -105,6 +137,134 @@ jobs:
      - name: Set Up Buildx
        uses: docker/setup-buildx-action@v3

+      - name: Build standard amd64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3-candidate:linux-amd64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=standard
+          cache-from: type=gha,scope=moviepilot-v3-standard-docker-amd64,version=2
+          cache-to: type=gha,scope=moviepilot-v3-standard-docker-amd64,mode=max,version=2
+
+      - name: Scan standard amd64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3-candidate:linux-amd64
+          version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
+      - name: Build standard arm64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/arm64/v8
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3-candidate:linux-arm64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=standard
+          cache-from: type=gha,scope=moviepilot-v3-standard-docker-arm64,version=2
+          cache-to: type=gha,scope=moviepilot-v3-standard-docker-arm64,mode=max,version=2
+
+      - name: Scan standard arm64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3-candidate:linux-arm64
+          version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
+      - name: Build free-threaded amd64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3t-candidate:linux-amd64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=free-threaded
+          cache-from: type=gha,scope=moviepilot-v3t-docker-amd64,version=2
+          cache-to: type=gha,scope=moviepilot-v3t-docker-amd64,mode=max,version=2
+
+      - name: Scan free-threaded amd64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3t-candidate:linux-amd64
+          version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
+      - name: Build free-threaded arm64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/arm64/v8
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3t-candidate:linux-arm64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=free-threaded
+          cache-from: type=gha,scope=moviepilot-v3t-docker-arm64,version=2
+          cache-to: type=gha,scope=moviepilot-v3t-docker-arm64,mode=max,version=2
+
+      - name: Scan free-threaded arm64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3t-candidate:linux-arm64
+          version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
      - name: Login DockerHub
        uses: docker/login-action@v3
        with:
@@ -118,8 +278,8 @@ jobs:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Build Image
-        uses: docker/build-push-action@v7
+      - name: Publish standard multi-architecture image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: docker/Dockerfile
@@ -133,6 +293,7 @@ jobs:
            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=standard
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.revision=${{ env.SOURCE_COMMIT }}
@@ -143,5 +304,52 @@ jobs:
            org.moviepilot.resources-revision=${{ steps.payloads.outputs.resources_revision }}
            org.moviepilot.plugin-market-wiki-revision=${{ steps.plugin_market.outputs.wiki_commit }}
            org.moviepilot.models-catalog-digest=${{ steps.models_catalog.outputs.digest }}
-          cache-from: type=gha,scope=moviepilot-v3-docker,version=2
-          cache-to: type=gha,scope=moviepilot-v3-docker,mode=max,version=2
+          cache-from: |
+            type=gha,scope=moviepilot-v3-standard-docker-amd64,version=2
+            type=gha,scope=moviepilot-v3-standard-docker-arm64,version=2
+
+      - name: Publish free-threaded multi-architecture image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: |
+            linux/amd64
+            linux/arm64/v8
+          push: true
+          pull: false
+          tags: ${{ steps.meta_ft.outputs.tags }}
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=free-threaded
+          labels: |
+            ${{ steps.meta_ft.outputs.labels }}
+            org.opencontainers.image.revision=${{ env.SOURCE_COMMIT }}
+            org.moviepilot.source-revision=${{ env.SOURCE_COMMIT }}
+            org.moviepilot.frontend-version=${{ steps.release_version.outputs.frontend_version }}
+            org.moviepilot.frontend-digest=${{ steps.payloads.outputs.frontend_digest }}
+            org.moviepilot.plugins-revision=${{ steps.payloads.outputs.plugins_revision }}
+            org.moviepilot.resources-revision=${{ steps.payloads.outputs.resources_revision }}
+            org.moviepilot.plugin-market-wiki-revision=${{ steps.plugin_market.outputs.wiki_commit }}
+            org.moviepilot.models-catalog-digest=${{ steps.models_catalog.outputs.digest }}
+          cache-from: |
+            type=gha,scope=moviepilot-v3t-docker-amd64,version=2
+            type=gha,scope=moviepilot-v3t-docker-arm64,version=2
+
+      - name: Promote beta image pair
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: |
+          candidate="beta-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          for image in \
+            "${DOCKER_USERNAME}/moviepilot-v3" \
+            "ghcr.io/${GITHUB_REPOSITORY}-v3" \
+            "${DOCKER_USERNAME}/moviepilot-v3t" \
+            "ghcr.io/${GITHUB_REPOSITORY}-v3t"; do
+            docker buildx imagetools create \
+              --tag "${image}:beta" \
+              "${image}:${candidate}"
+          done
@@ -15,6 +15,9 @@ jobs:
  Docker-build:
    runs-on: ubuntu-latest
    name: Build Docker Image
+    env:
+      TRIVY_SKIP_DIRS: /usr/share/java
+      TRIVY_SKIP_JAVA_DB_UPDATE: "true"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -32,14 +35,22 @@ jobs:

      - name: Audit locked Python dependencies
        run: |
-          uv export --quiet --locked --no-dev --no-emit-project \
-            --output-file /tmp/moviepilot-audit-requirements.txt
+          uv export --quiet --locked --no-default-groups --group runtime-standard \
+            --no-emit-project --output-file /tmp/moviepilot-audit-standard.txt
          uvx --from pip-audit==2.10.1 pip-audit \
-            --require-hashes \
-            --disable-pip \
-            --strict \
-            --progress-spinner off \
-            --requirement /tmp/moviepilot-audit-requirements.txt
+            --require-hashes --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-standard.txt
+
+          uv export --quiet --locked --no-default-groups --group runtime-free-threaded \
+            --no-emit-project --no-hashes \
+            --output-file /tmp/moviepilot-audit-free-threaded.txt
+          python3 scripts/normalize_audit_requirements.py \
+            --lock uv.lock \
+            --input /tmp/moviepilot-audit-free-threaded.txt \
+            --output /tmp/moviepilot-audit-free-threaded-normalized.txt
+          uvx --from pip-audit==2.10.1 pip-audit \
+            --no-deps --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-free-threaded-normalized.txt

      - name: Release version
        id: release_version
@@ -130,7 +141,16 @@ jobs:
            ghcr.io/${{ github.repository }}-v3
          tags: |
            type=raw,value=${{ env.app_version }}
-            type=raw,value=latest
+
+      - name: Docker Meta free-threaded
+        id: meta_ft
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ secrets.DOCKER_USERNAME }}/moviepilot-v3t
+            ghcr.io/${{ github.repository }}-v3t
+          tags: |
+            type=raw,value=${{ env.app_version }}

      - name: Set Up QEMU
        uses: docker/setup-qemu-action@v3
@@ -153,8 +173,9 @@ jobs:
            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
-          cache-from: type=gha,scope=moviepilot-v3-docker-amd64,version=2
-          cache-to: type=gha,scope=moviepilot-v3-docker-amd64,mode=max,version=2
+            MOVIEPILOT_PYTHON_VARIANT=standard
+          cache-from: type=gha,scope=moviepilot-v3-standard-docker-amd64,version=2
+          cache-to: type=gha,scope=moviepilot-v3-standard-docker-amd64,mode=max,version=2

      - name: Scan amd64 candidate vulnerabilities
        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
@@ -184,8 +205,9 @@ jobs:
            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
-          cache-from: type=gha,scope=moviepilot-v3-docker-arm64,version=2
-          cache-to: type=gha,scope=moviepilot-v3-docker-arm64,mode=max,version=2
+            MOVIEPILOT_PYTHON_VARIANT=standard
+          cache-from: type=gha,scope=moviepilot-v3-standard-docker-arm64,version=2
+          cache-to: type=gha,scope=moviepilot-v3-standard-docker-arm64,mode=max,version=2

      - name: Scan arm64 candidate vulnerabilities
        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
@@ -200,6 +222,70 @@ jobs:
          trivyignores: .trivyignore.yaml
          exit-code: 1

+      - name: Build free-threaded amd64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3t-candidate:linux-amd64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=free-threaded
+          cache-from: type=gha,scope=moviepilot-v3t-docker-amd64,version=2
+          cache-to: type=gha,scope=moviepilot-v3t-docker-amd64,mode=max,version=2
+
+      - name: Scan free-threaded amd64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3t-candidate:linux-amd64
+          version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
+      - name: Build free-threaded arm64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/arm64/v8
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3t-candidate:linux-arm64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=free-threaded
+          cache-from: type=gha,scope=moviepilot-v3t-docker-arm64,version=2
+          cache-to: type=gha,scope=moviepilot-v3t-docker-arm64,mode=max,version=2
+
+      - name: Scan free-threaded arm64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3t-candidate:linux-arm64
+          version: v0.70.0
+          cache-dir: ${{ runner.temp }}/trivy
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
      - name: Login DockerHub
        uses: docker/login-action@v3
        with:
@@ -229,6 +315,7 @@ jobs:
            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=standard
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.revision=${{ steps.release_snapshot.outputs.release_commit }}
@@ -241,8 +328,59 @@ jobs:
            org.moviepilot.plugin-market-wiki-revision=${{ steps.plugin_market.outputs.wiki_commit }}
            org.moviepilot.models-catalog-digest=${{ steps.models_catalog.outputs.digest }}
          cache-from: |
-            type=gha,scope=moviepilot-v3-docker-amd64,version=2
-            type=gha,scope=moviepilot-v3-docker-arm64,version=2
+            type=gha,scope=moviepilot-v3-standard-docker-amd64,version=2
+            type=gha,scope=moviepilot-v3-standard-docker-arm64,version=2
+
+      - name: Publish free-threaded multi-architecture image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: |
+            linux/amd64
+            linux/arm64/v8
+          push: true
+          pull: false
+          tags: ${{ steps.meta_ft.outputs.tags }}
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+            MOVIEPILOT_PYTHON_VARIANT=free-threaded
+          labels: |
+            ${{ steps.meta_ft.outputs.labels }}
+            org.opencontainers.image.revision=${{ steps.release_snapshot.outputs.release_commit }}
+            org.moviepilot.source-revision=${{ env.SOURCE_COMMIT }}
+            org.moviepilot.release-snapshot-revision=${{ steps.release_snapshot.outputs.release_commit }}
+            org.moviepilot.frontend-version=${{ steps.release_version.outputs.frontend_version }}
+            org.moviepilot.frontend-digest=${{ steps.payloads.outputs.frontend_digest }}
+            org.moviepilot.plugins-revision=${{ steps.payloads.outputs.plugins_revision }}
+            org.moviepilot.resources-revision=${{ steps.payloads.outputs.resources_revision }}
+            org.moviepilot.plugin-market-wiki-revision=${{ steps.plugin_market.outputs.wiki_commit }}
+            org.moviepilot.models-catalog-digest=${{ steps.models_catalog.outputs.digest }}
+          cache-from: |
+            type=gha,scope=moviepilot-v3t-docker-amd64,version=2
+            type=gha,scope=moviepilot-v3t-docker-arm64,version=2
+
+      - name: Promote latest image pair
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: |
+          for image in \
+            "${DOCKER_USERNAME}/moviepilot-v3" \
+            "ghcr.io/${GITHUB_REPOSITORY}-v3"; do
+            docker buildx imagetools create \
+              --tag "${image}:latest" \
+              "${image}:${app_version}"
+          done
+          for image in \
+            "${DOCKER_USERNAME}/moviepilot-v3t" \
+            "ghcr.io/${GITHUB_REPOSITORY}-v3t"; do
+            docker buildx imagetools create \
+              --tag "${image}:latest" \
+              "${image}:${app_version}"
+          done

      - name: Generate Changelog
        id: changelog
@@ -7,6 +7,9 @@ on:
    paths:
      - 'pyproject.toml'
      - 'uv.lock'
+      - 'app/doctor/dependencies.py'
+      - 'app/foundation/environment.py'
+      - 'app/runtime/dependencies.py'
      - 'docker/Dockerfile'
      - 'docker/**'
      - '.github/workflows/dependency-compat.yml'
@@ -16,6 +19,9 @@ on:
    paths:
      - 'pyproject.toml'
      - 'uv.lock'
+      - 'app/doctor/dependencies.py'
+      - 'app/foundation/environment.py'
+      - 'app/runtime/dependencies.py'
      - 'docker/Dockerfile'
      - 'docker/**'
      - '.github/workflows/dependency-compat.yml'
@@ -91,8 +97,8 @@ jobs:
          assert platform.machine() == os.environ['EXPECTED_MACHINE'], (platform.machine(), os.environ['EXPECTED_MACHINE']);
          import alembic, fastapi, pydantic, pydantic_settings, sqlalchemy, starlette, uvicorn"

-      - name: Verify installed dependency consistency
-        run: uv pip check
+      - name: Verify locked project consistency
+        run: uv sync --locked --offline --inexact --no-dev --check --python ${{ matrix.python-version }}

  docker-dependencies:
    name: Docker dependencies / ${{ matrix.platform }}
@@ -104,13 +110,27 @@ jobs:
        include:
          - runner: ubuntu-24.04
            platform: linux/amd64
-            cache-scope: linux-amd64
-            image-tag: moviepilot-dependency-gate:linux-amd64
+            python-variant: standard
+            cache-scope: linux-amd64-standard
+            image-tag: moviepilot-dependency-gate:linux-amd64-standard
            expected-machine: x86_64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
-            cache-scope: linux-arm64
-            image-tag: moviepilot-dependency-gate:linux-arm64
+            python-variant: standard
+            cache-scope: linux-arm64-standard
+            image-tag: moviepilot-dependency-gate:linux-arm64-standard
+            expected-machine: aarch64
+          - runner: ubuntu-24.04
+            platform: linux/amd64
+            python-variant: free-threaded
+            cache-scope: linux-amd64-free-threaded
+            image-tag: moviepilot-dependency-gate:linux-amd64-free-threaded
+            expected-machine: x86_64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64
+            python-variant: free-threaded
+            cache-scope: linux-arm64-free-threaded
+            image-tag: moviepilot-dependency-gate:linux-arm64-free-threaded
            expected-machine: aarch64

    steps:
@@ -127,6 +147,8 @@ jobs:
          file: docker/Dockerfile
          target: prepare_venv
          platforms: ${{ matrix.platform }}
+          build-args: |
+            MOVIEPILOT_PYTHON_VARIANT=${{ matrix.python-variant }}
          load: true
          push: false
          tags: ${{ matrix.image-tag }}
@@ -137,14 +159,23 @@ jobs:
        env:
          IMAGE_TAG: ${{ matrix.image-tag }}
          EXPECTED_MACHINE: ${{ matrix.expected-machine }}
+          EXPECTED_VARIANT: ${{ matrix.python-variant }}
        run: >-
          docker run --rm
          -e EXPECTED_MACHINE
+          -e EXPECTED_VARIANT
          "${IMAGE_TAG}"
          /opt/venv/bin/python -c
-          "import os, platform;
+          "import os, platform, sys, sysconfig;
          assert platform.machine() == os.environ['EXPECTED_MACHINE'], (platform.machine(), os.environ['EXPECTED_MACHINE']);
-          import alembic, fastapi, pydantic, pydantic_settings, sqlalchemy, starlette, uvicorn"
+          expected_free_threaded = os.environ['EXPECTED_VARIANT'] == 'free-threaded';
+          assert (sysconfig.get_config_var('Py_GIL_DISABLED') == 1) is expected_free_threaded;
+          assert sys._is_gil_enabled() == (not expected_free_threaded);
+          import alembic, fastapi, moviepilot_rust, pydantic, pydantic_settings, sqlalchemy, starlette, uvicorn;
+          assert moviepilot_rust.is_available();
+          assert moviepilot_rust.jieba_cut('中文分词');
+          assert not expected_free_threaded or callable(moviepilot_rust.zhconv_fast);
+          assert sys._is_gil_enabled() == (not expected_free_threaded)"

      - name: Verify pinned uv version
        env: