CI 架构（维护者）

\n\n四条线共用 `.github/workflows/_image.yml`（workflow_call），各自只有一个约 30 行的调用方，\n差异全部由 `with` 传入。\n\n### 流水线\n\n```\nplan 按 dispatch 的 platforms 输入计算架构分组\n ├─ build x86 (ubuntu-latest) amd64(原生) + 386\n ├─ build arm (ubuntu-24.04-arm) arm64(原生) + armv7 + armv6\n ├─ build ppc64le (ubuntu-latest) ppc64le\n ├─ build s390x (ubuntu-latest) s390x\n ├─ build riscv64 (ubuntu-latest) riscv64\n └─ build loong64 (ubuntu-latest) loong64（latest 与 lite 线）\n ↓ 全部构建成功\n smoke（每个平台一个 job）复用构建层缓存重建镜像后逐平台实跑\n ↓ 全部冒烟通过\n publish 各架构组按 digest 合并成正式 tag → 校验 manifest 平台完整性\n```\n\n### 设计原则\n\n1. **发布即全绿**：`publish` 需要所有构建与所有冒烟成功，测试失败不产生 tag。\n2. **零重复编译**：构建阶段把层缓存写入 GHA cache（scope 按「线-架构组」隔离），冒烟与\n 发布阶段 `cache-from` 命中同一份缓存，同一次提交不重复编译。\n3. **不产临时 tag**：发布模式下各架构组以 `push-by-digest` 推到 Docker Hub（不带 tag），\n `publish` 用 `imagetools create` 合并成正式多架构 tag。\n\n### 触发与跳过\n\ntag 推送始终全量构建。workflow_dispatch 会先比对「该分支最近一次成功运行的 commit」，\n按线判定是否需要重建：共享输入（`patches/`、`tests/`、`_image.yml`）改动重建全部；\n某个 Dockerfile 改动只重建对应那条线，派生文件跟着基准走（改 `Dockerfile.ja3` 会同时\n重建 ja3 与 ja3-lite）；只改文档、或同一 commit 已有成功运行则整体跳过。`force` 可强制重跑。\n\n### workflow_dispatch 输入\n\n| 输入 | 默认 | 说明 |\n|---|---|---|\n| `push` | false | 不勾选即只构建与冒烟，不发布任何镜像 |\n| `platforms` | 空（该条线的全部平台） | 平台子集用于加速迭代；子集构建默认禁止发布 |\n| `native_arm` | true | 用 `ubuntu-24.04-arm` 原生构建 arm64；该 runner 不可用时取消勾选回退 QEMU |\n| `pycurl_version` | 空（用 Dockerfile 默认值） | 指定 pycurl 版本 |\n| `force` | false | 强制重新构建，跳过「仅文档改动 / 同一 commit 已有成功运行」的判定 |\n\n### 冒烟\n\n`tests/smoke.py` 按线与 OCR 期望显式传参（ja3-lite 复用 ja3 角色）：\n\n```bash\ndocker run --rm -i --platform \\\n python3 - < tests/smoke.py\n```\n\n- pycurl 可导入、libcurl 特性位含 HTTP/3、真实 HTTPS 请求成功\n- ja3 线额外在本地起 TCP 监听，直接读 ClientHello 计算 ja3n，与 chrome152 的期望值比对，\n 不依赖外部站点\n- 按目标平台校验原生产物（pycurl 扩展、libcurl、libssl）ELF 头中的 `e_machine`\n\n

\n","has_starred","hub_user","immutable_tags_settings",{"_420":11,"_421":422},"enabled","rules",[423],".*","is_automated","permissions",{"_427":22,"_428":11,"_429":11},"read","write","admin","user","storage_size",19432164558,"isOrg","reponame","tag","sha256:1dd2a5e72ae8e1d830c65c84c2eeb1ac00b103298083e795185db75c22bcc95e","canDeleteTags","isHubSbxKitsEnabled","currentTab","tagAttestations","displaySecurityMetadata","showSbxLogoOverride","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_27":28,"_382":-7,"_380":-7,"_381":-7,"_29":445,"_35":436,"_453":-7,"_454":11},{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":446,"_92":93,"_94":34,"_95":96,"_97":98,"_99":100,"_101":102,"_103":70,"_104":93,"_105":60,"_106":22},[447,448,449,450,451,452],{"_44":45,"_35":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":48,"_56":-5,"_57":58,"_59":60,"_61":-5},{"_44":63,"_35":64,"_47":48,"_49":65,"_51":66,"_53":54,"_55":48,"_56":-5,"_57":38,"_59":60,"_61":-5},{"_44":68,"_35":69,"_47":48,"_49":70,"_51":71,"_53":54,"_55":48,"_56":-5,"_57":72,"_59":60,"_61":-5},{"_44":74,"_35":75,"_47":48,"_49":76,"_51":77,"_53":54,"_55":48,"_56":-5,"_57":78,"_59":60,"_61":79},{"_44":74,"_35":81,"_47":48,"_49":82,"_51":83,"_53":54,"_55":48,"_56":-5,"_57":84,"_59":60,"_61":85},{"_44":87,"_35":88,"_47":48,"_49":89,"_51":90,"_53":54,"_55":48,"_56":-5,"_57":91,"_59":60,"_61":-5},"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

a76yyyy/pycurl:ja3-latest