ci: 建立镜像发布前供应链门禁 (#6393)

.github/workflows/build-v3.yml

@@ -30,6 +30,17 @@ jobs:
       - name: Verify dependency lock
         run: uv lock --check
 
+      - name: Audit locked Python dependencies
+        run: |
+          uv export --quiet --locked --no-dev --no-emit-project \
+            --output-file /tmp/moviepilot-audit-requirements.txt
+          uvx --from pip-audit==2.10.1 pip-audit \
+            --require-hashes \
+            --disable-pip \
+            --strict \
+            --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-requirements.txt
+
       - name: Release version
         id: release_version
         run: |
@@ -127,6 +138,66 @@ jobs:
       - name: Set Up Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Build amd64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3-candidate:linux-amd64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+          cache-from: type=gha,scope=moviepilot-v3-docker-amd64,version=2
+          cache-to: type=gha,scope=moviepilot-v3-docker-amd64,mode=max,version=2
+
+      - name: Scan amd64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3-candidate:linux-amd64
+          version: v0.70.0
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
+      - name: Build arm64 candidate
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/arm64/v8
+          load: true
+          push: false
+          pull: true
+          tags: moviepilot-v3-candidate:linux-arm64
+          build-args: |
+            MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
+            MOVIEPILOT_FRONTEND_SHA256=${{ steps.payloads.outputs.frontend_sha256 }}
+            MOVIEPILOT_PLUGINS_REF=${{ steps.payloads.outputs.plugins_revision }}
+            MOVIEPILOT_RESOURCES_REF=${{ steps.payloads.outputs.resources_revision }}
+          cache-from: type=gha,scope=moviepilot-v3-docker-arm64,version=2
+          cache-to: type=gha,scope=moviepilot-v3-docker-arm64,mode=max,version=2
+
+      - name: Scan arm64 candidate vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: moviepilot-v3-candidate:linux-arm64
+          version: v0.70.0
+          scanners: vuln
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          trivyignores: .trivyignore.yaml
+          exit-code: 1
+
       - name: Login DockerHub
         uses: docker/login-action@v3
         with:
@@ -140,8 +211,8 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build Image
-        uses: docker/build-push-action@v7
+      - name: Publish multi-architecture image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: docker/Dockerfile
@@ -149,6 +220,7 @@ jobs:
             linux/amd64
             linux/arm64/v8
           push: true
+          pull: false
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
             MOVIEPILOT_FRONTEND_VERSION=${{ steps.release_version.outputs.frontend_version }}
@@ -166,8 +238,9 @@ jobs:
             org.moviepilot.resources-revision=${{ steps.payloads.outputs.resources_revision }}
             org.moviepilot.plugin-market-wiki-revision=${{ steps.plugin_market.outputs.wiki_commit }}
             org.moviepilot.models-catalog-digest=${{ steps.models_catalog.outputs.digest }}
-          cache-from: type=gha,scope=moviepilot-v3-docker,version=2
-          cache-to: type=gha,scope=moviepilot-v3-docker,mode=max,version=2
+          cache-from: |
+            type=gha,scope=moviepilot-v3-docker-amd64,version=2
+            type=gha,scope=moviepilot-v3-docker-arm64,version=2
 
       - name: Generate Changelog
         id: changelog