From 45e194cefb45a680e5b8fd29856980243888bac5 Mon Sep 17 00:00:00 2001
From: OG T <ogt@WOOOMacMiniM4.local>
Date: Wed, 1 Apr 2026 09:36:46 +0800
Subject: [PATCH] =?UTF-8?q?fix(cd):=20=E5=BC=B7=E5=88=B6=E9=87=8D=E5=BB=BA?=
 =?UTF-8?q?=20Web=20=E6=98=A0=E5=83=8F=EF=BC=8C=E4=BF=AE=E5=BE=A9=20CSRF?=
 =?UTF-8?q?=20bundle=20=E5=BF=AB=E5=8F=96=E5=95=8F=E9=A1=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

BuildKit inline cache 導致 COPY . . 層被重用，
Phase 22 CSRF fix (credentials:include) 未進入 JS bundle。
移除 --cache-from + --no-cache 強制完整重建。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitea/workflows/cd.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 1eed9e33..9a3c549a 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -85,15 +85,16 @@ jobs:
 
       # 2026-03-31 ogt: 移除中間通知，減少訊息雜訊
 
-      # ── Web 鏡像建置（含 Layer Cache 加速）──────────────────────────────
+      # ── Web 鏡像建置（強制無快取）──────────────────────────────
       # 2026-03-30 ogt: NEXT_PUBLIC_* 必須用公網域名 (build-time 寫死)
       # 內網 IP 會觸發瀏覽器「存取區域網路」權限對話框
+      # 2026-04-01 Claude Code: 移除 --cache-from，加 --no-cache
+      # 原因: BuildKit inline cache 導致 COPY . . 層被重用，CSRF fix 未進入 bundle
       - name: Build and Push Web
         run: |
           docker build -f apps/web/Dockerfile \
             --build-arg NEXT_PUBLIC_API_URL=https://awoooi.wooo.work \
-            --build-arg BUILDKIT_INLINE_CACHE=1 \
-            --cache-from ${{ env.HARBOR }}/awoooi/web:latest \
+            --no-cache \
             -t ${{ env.HARBOR }}/awoooi/web:${{ github.sha }} \
             -t ${{ env.HARBOR }}/awoooi/web:latest \
             .