ci(deploy): support pulling published docker images

.githooks/post-receive

@@ -1,5 +1,6 @@
 #!/bin/sh
-# Post-receive hook: push 后自动构建 Docker 镜像并重启容器
+# Post-receive hook: push 后自动部署容器
+# 默认在服务器本机构建镜像；配置 .deploy.env 后也可从镜像仓库拉取 CI 构建好的镜像。
 
 REPO_TOPLEVEL=""
 LOG_FILE=""
@@ -8,6 +9,8 @@ DEPLOY_ENV=""
 ENV_FILE=""
 START_PORT=""
 IMAGE_TAG=""
+IMAGE_SOURCE=""
+REMOTE_IMAGE_TAG=""
 CONTAINER_NAME=""
 COMPOSE_PROJECT_NAME=""
 COMPOSE_EXIT=0
@@ -45,6 +48,19 @@ sync_worktree() {
     git reset --hard HEAD >> "$LOG_FILE" 2>&1
 }
 
+load_deploy_config() {
+    if [ ! -f ".deploy.env" ]; then
+        echo "=== deploy config: .deploy.env not found, use defaults ===" >> "$LOG_FILE"
+        return 0
+    fi
+
+    echo "=== deploy config: loading .deploy.env ===" >> "$LOG_FILE"
+    set -a
+    # shellcheck disable=SC1091
+    . ./.deploy.env
+    set +a
+}
+
 copy_env_by_branch() {
     CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
     echo "=== branch: $CURRENT_BRANCH ===" >> "$LOG_FILE"
@@ -81,7 +97,26 @@ copy_env_by_branch() {
 
 prepare_compose_env() {
     SHORT_SHA="$(git rev-parse --short HEAD)"
-    IMAGE_TAG="cozsweet-web:${DEPLOY_ENV}-${SHORT_SHA}"
+    IMAGE_SOURCE="${COZSWEET_DEPLOY_IMAGE_SOURCE:-build}"
+    REMOTE_IMAGE_TAG="${COZSWEET_REMOTE_IMAGE_TAG:-${DEPLOY_ENV}-${SHORT_SHA}}"
+
+    case "$IMAGE_SOURCE" in
+        build)
+            IMAGE_TAG="cozsweet-web:${DEPLOY_ENV}-${SHORT_SHA}"
+            ;;
+        pull)
+            if [ -z "${COZSWEET_REGISTRY_IMAGE:-}" ]; then
+                echo "=== missing COZSWEET_REGISTRY_IMAGE for pull deploy ===" >> "$LOG_FILE"
+                exit 64
+            fi
+            IMAGE_TAG="${COZSWEET_REGISTRY_IMAGE}:${REMOTE_IMAGE_TAG}"
+            ;;
+        *)
+            echo "=== unsupported COZSWEET_DEPLOY_IMAGE_SOURCE: $IMAGE_SOURCE ===" >> "$LOG_FILE"
+            exit 64
+            ;;
+    esac
+
     CONTAINER_NAME="cozsweet-web-${DEPLOY_ENV}"
     COMPOSE_PROJECT_NAME="cozsweet-web-${DEPLOY_ENV}"
 
@@ -95,8 +130,10 @@ prepare_compose_env() {
 
     {
         echo "=== deploy env: $DEPLOY_ENV ==="
+        echo "=== image source: $IMAGE_SOURCE ==="
         echo "=== env file: $COZSWEET_ENV_FILE ==="
         echo "=== image: $COZSWEET_IMAGE ==="
+        echo "=== remote image tag: $REMOTE_IMAGE_TAG ==="
         echo "=== container: $COZSWEET_CONTAINER_NAME ==="
         echo "=== host port: $COZSWEET_HOST_PORT ==="
         echo "=== compose project: $COMPOSE_PROJECT_NAME ==="
@@ -128,9 +165,22 @@ run_container_build() {
     return $COMPOSE_EXIT
 }
 
+pull_container_image() {
+    echo "=== docker pull START @ $(date +%Y-%m-%dT%H:%M:%S%z) ===" >> "$LOG_FILE"
+    docker_compose pull web >> "$LOG_FILE" 2>&1
+    COMPOSE_EXIT=$?
+    echo "=== docker pull EXIT_CODE=$COMPOSE_EXIT @ $(date +%Y-%m-%dT%H:%M:%S%z) ===" >> "$LOG_FILE"
+    echo "" >> "$LOG_FILE"
+    return $COMPOSE_EXIT
+}
+
 launch_container() {
     echo "=== docker compose up START @ $(date +%Y-%m-%dT%H:%M:%S%z) ===" >> "$LOG_FILE"
-    docker_compose up -d --remove-orphans web >> "$LOG_FILE" 2>&1
+    if [ "$IMAGE_SOURCE" = "pull" ]; then
+        docker_compose up -d --remove-orphans --no-build web >> "$LOG_FILE" 2>&1
+    else
+        docker_compose up -d --remove-orphans web >> "$LOG_FILE" 2>&1
+    fi
     COMPOSE_EXIT=$?
     echo "=== docker compose up EXIT_CODE=$COMPOSE_EXIT @ $(date +%Y-%m-%dT%H:%M:%S%z) ===" >> "$LOG_FILE"
     echo "" >> "$LOG_FILE"
@@ -147,12 +197,20 @@ main() {
     write_metadata_header
 
     sync_worktree
+    load_deploy_config
     copy_env_by_branch
     prepare_compose_env
 
-    if ! run_container_build; then
-        log_abort "docker build failed, old container kept running"
-        exit $COMPOSE_EXIT
+    if [ "$IMAGE_SOURCE" = "pull" ]; then
+        if ! pull_container_image; then
+            log_abort "docker pull failed, old container kept running"
+            exit $COMPOSE_EXIT
+        fi
+    else
+        if ! run_container_build; then
+            log_abort "docker build failed, old container kept running"
+            exit $COMPOSE_EXIT
+        fi
     fi
 
     if ! launch_container; then