From f6ab812d80ba070e6a862f16c7463f8b885cf7e3 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Fri, 3 Jul 2026 16:16:03 +0800
Subject: [PATCH] fix(cd): avoid unauthorized web base mirror

---
 .gitea/workflows/cd.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index ef58a72b1..2dc9161db 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -1623,9 +1623,12 @@ jobs:
             return "$rc"
           }
 
+          # 2026-07-03 Codex: run #4610 proved the Harbor DockerHub proxy
+          # cache path returned 401 for node:20-alpine. Keep the public tag
+          # until proxy-cache pull auth has a deploy-log receipt.
           run_docker_step web_build "${DOCKER_WEB_BUILD_TIMEOUT_SECONDS:-1500}" \
             docker build -f apps/web/Dockerfile \
-            --build-arg NODE_BASE_IMAGE=${{ env.HARBOR }}/dockerhub/library/node:20-alpine \
+            --build-arg NODE_BASE_IMAGE=node:20-alpine \
             --build-arg NEXT_PUBLIC_API_URL=https://awoooi.wooo.work \
             --build-arg CACHE_BUST=${{ github.sha }} \
             --build-arg BUILDKIT_INLINE_CACHE=1 \