CI 架构（维护者）

\n\n四条线共用 `.github/workflows/_image.yml`（workflow_call），各自只有一个约 30 行的调用方，\n差异全部由 `with` 传入。\n\n### 流水线\n\n```\nplan 按 dispatch 的 platforms 输入计算架构分组\n ├─ build x86 (ubuntu-latest) amd64(原生) + 386\n ├─ build arm (ubuntu-24.04-arm) arm64(原生) + armv7 + armv6\n ├─ build ppc64le (ubuntu-latest) ppc64le\n ├─ build s390x (ubuntu-latest) s390x\n ├─ build riscv64 (ubuntu-latest) riscv64\n └─ build loong64 (ubuntu-latest) loong64（latest 与 lite 线）\n ↓ 全部构建成功\n smoke（每个平台一个 job）复用构建层缓存重建镜像后逐平台实跑\n ↓ 全部冒烟通过\n publish 各架构组按 digest 合并成正式 tag → 校验 manifest 平台完整性\n```\n\n### 设计原则\n\n1. **发布即全绿**：`publish` 需要所有构建与所有冒烟成功，测试失败不产生 tag。\n2. **零重复编译**：构建阶段把层缓存写入 GHA cache（scope 按「线-架构组」隔离），冒烟与\n 发布阶段 `cache-from` 命中同一份缓存，同一次提交不重复编译。\n3. **不产临时 tag**：发布模式下各架构组以 `push-by-digest` 推到 Docker Hub（不带 tag），\n `publish` 用 `imagetools create` 合并成正式多架构 tag。\n\n### 触发与跳过\n\ntag 推送始终全量构建。workflow_dispatch 会先比对「该分支最近一次成功运行的 commit」，\n按线判定是否需要重建：共享输入（`patches/`、`tests/`、`_image.yml`）改动重建全部；\n某个 Dockerfile 改动只重建对应那条线，派生文件跟着基准走（改 `Dockerfile.ja3` 会同时\n重建 ja3 与 ja3-lite）；只改文档、或同一 commit 已有成功运行则整体跳过。`force` 可强制重跑。\n\n### workflow_dispatch 输入\n\n| 输入 | 默认 | 说明 |\n|---|---|---|\n| `push` | false | 不勾选即只构建与冒烟，不发布任何镜像 |\n| `platforms` | 空（该条线的全部平台） | 平台子集用于加速迭代；子集构建默认禁止发布 |\n| `native_arm` | true | 用 `ubuntu-24.04-arm` 原生构建 arm64；该 runner 不可用时取消勾选回退 QEMU |\n| `pycurl_version` | 空（用 Dockerfile 默认值） | 指定 pycurl 版本 |\n| `force` | false | 强制重新构建，跳过「仅文档改动 / 同一 commit 已有成功运行」的判定 |\n\n### 冒烟\n\n`tests/smoke.py` 按线与 OCR 期望显式传参（ja3-lite 复用 ja3 角色）：\n\n```bash\ndocker run --rm -i --platform \\\n python3 - < tests/smoke.py\n```\n\n- pycurl 可导入、libcurl 特性位含 HTTP/3、真实 HTTPS 请求成功\n- ja3 线额外在本地起 TCP 监听，直接读 ClientHello 计算 ja3n，与 chrome152 的期望值比对，\n 不依赖外部站点\n- 按目标平台校验原生产物（pycurl 扩展、libcurl、libssl）ELF 头中的 `e_machine`\n\n

\n","has_starred","hub_user","immutable_tags_settings",{"_401":11,"_402":403},"enabled","rules",[404],".*","is_automated","permissions",{"_408":22,"_409":11,"_410":11},"read","write","admin","user","storage_size",17540354558,"isOrg","reponame","tag","sha256:1dd2a5e72ae8e1d830c65c84c2eeb1ac00b103298083e795185db75c22bcc95e","canDeleteTags","isHubSbxKitsEnabled","currentTab","tagAttestations","displaySecurityMetadata","showSbxLogoOverride","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_28":29,"_363":-7,"_361":-7,"_362":-7,"_30":426,"_36":417,"_434":-7,"_435":11},{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":427,"_93":94,"_95":35,"_96":97,"_98":99,"_100":101,"_102":103,"_104":77,"_105":94,"_106":61,"_107":22},[428,429,430,431,432,433],{"_45":46,"_36":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":49,"_57":-5,"_58":59,"_60":61,"_62":-5},{"_45":64,"_36":65,"_48":49,"_50":66,"_52":67,"_54":55,"_56":49,"_57":-5,"_58":39,"_60":61,"_62":-5},{"_45":69,"_36":70,"_48":49,"_50":71,"_52":72,"_54":55,"_56":49,"_57":-5,"_58":73,"_60":61,"_62":-5},{"_45":75,"_36":76,"_48":49,"_50":77,"_52":78,"_54":55,"_56":49,"_57":-5,"_58":79,"_60":61,"_62":80},{"_45":75,"_36":82,"_48":49,"_50":83,"_52":84,"_54":55,"_56":49,"_57":-5,"_58":85,"_60":61,"_62":86},{"_45":88,"_36":89,"_48":49,"_50":90,"_52":91,"_54":55,"_56":49,"_57":-5,"_58":92,"_60":61,"_62":-5},"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

a76yyyy/pycurl:ja3-latest