From 3a5acaa72afa27c4903e376116ef093ed95b0e54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=B8=A1=E5=8F=A3=E6=B5=AA=E4=BA=BA?=
 <maintainer@example.com>
Date: Sun, 18 Oct 2026 21:58:10 +0800
Subject: [PATCH] fix: allow a pinned CI base-image mirror on Server

---
 .github/workflows/verify.yml | 1 +
 SHA256SUMS                   | 6 +++---
 docs/BUILDING.md             | 4 ++++
 scripts/build-verify.sh      | 6 +++++-
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 69cbd0e..dc0b3c3 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -15,6 +15,7 @@ jobs:
       DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
       CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
       CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
+      CI_PYTHON_BASE: ${{ vars.CI_PYTHON_BASE }}
       ALPINE_MIRROR: ${{ vars.ALPINE_MIRROR }}
     steps:
       - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
diff --git a/SHA256SUMS b/SHA256SUMS
index 322961e..83611f9 100644
--- a/SHA256SUMS
+++ b/SHA256SUMS
@@ -2,7 +2,7 @@ c2792b2c75880ff09822804632b1b3b6dd6190b38841b8c3567bb1b7e7b59a8c  .dockerignore
 d20031a8e861a0f3e19b7750ddb53bc84c480c469c44a70ecdf8261ec05431c0  .env.example
 0c7f4585d62a8d35bfc22e0bebdf7a479a179122b2b092bfe434e3038cddd3d5  .gitattributes
 b45d35d737f119a70bf40cb1f9626ff80772ed7913cb35f6e9b870d6ada01a15  .github/workflows/community.yml
-2c49cb94db2c7679d5fdb0da4b67a4b90d5f00c3c76f7f0d0226938eeb75ef04  .github/workflows/verify.yml
+c8c545718e9b9880555c950a078cac160c82e0cd6e593afcf20bc13727539ec5  .github/workflows/verify.yml
 3931cc314019760a582e0914e2d9c0f3b862a004d0a30d374900edcad5f599e5  .gitignore
 4b4ed4926a350cbeb71436541b4566e4ba7d2494ac95236b88827a9f5dd171c2  CONTRIBUTING.md
 c6fc984a1ca46cbd3e06de4591e41d21e4eb592416385d4000ade8fd570aad0c  Dockerfile
@@ -21,7 +21,7 @@ fd53125a5359dcae1d81e95b8447aac755270f9aeb354d3e1140d7fccb57c42e  deploy/docker-
 4464545a9d91bbc9fff9cd9941db63f44fa61120caca426687d1ed06635cc3e6  deploy/organized-photos-source.json
 f78d6c3d40e6c5246601bb99c2b46eef91e883a8f83841d85c925394708af0c0  docker-compose.yml
 30d3e705870ebb012ce122bd7d8f95192d86664c4d2bb45a3169c86988fbaf72  docs/AUTOMATIC_COLLAGE.md
-27a8e9f33459cdb4e873fc14e965c40557324707c10a6e6f8567c81bfe457de7  docs/BUILDING.md
+93b6e60570d9ca2ce14a454641a32885ca84d16a82db05db22cd62e488191dff  docs/BUILDING.md
 d9f07164c75c757e85f4ace2b55deaf82b8b904216c5222be6c0e3ab7b28cb36  docs/EXTENSIONS.md
 1d8c5f79eff3115b1cd13d8f63fff1332b80d1fe1bec6b0f2713b5f80b0cbf67  docs/KOKONNA_RECOVERY.md
 0fe1896a53cef4cfd2e380a0b979eceda493733082a9b56c3d7e89e7f62a65b3  docs/NAS.md
@@ -127,7 +127,7 @@ cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  pigway_frame_f
 1ac324f7dcd27e4b9386b4bd6421271ec147e922a22c05ba24b11515e9aa6321  pigway_frame_flow/web/swagger-ui.css
 97aaf8a332dcf472b8933b0a39aa329865133171e828892d932d29694e011ea5  pyproject.toml
 d34ac82e4c3feacd38546aa2f0a4491ab17ddbf3ad8f489375783166d78923f0  requirements.lock
-ae264ad19391bb2515def85963f39458cfa75a8611ff54e5329106c35bd8cc6e  scripts/build-verify.sh
+008af5f4adf616c86e805febc016faad60be0008abf5dddad6e955f1d03606cf  scripts/build-verify.sh
 43e8345ac5f29c2a5d1fa751c0e7c963b00b5391817393541e72c52919f0f2b4  scripts/check-compose-remote.py
 8186d4d9c2542d42d786404b096fbbdee22e4c74edae78ddebab5bd3f632764c  scripts/ci-audit.py
 b0ec44fba0adfceca3655628021683030469be77c9e303c3f5cf830e8fd0cee3  scripts/ci-compose-verify.py
diff --git a/docs/BUILDING.md b/docs/BUILDING.md
index b0bedf9..7749ba0 100644
--- a/docs/BUILDING.md
+++ b/docs/BUILDING.md
@@ -7,6 +7,10 @@ locked Python dependencies, and `font-noto-cjk` for Chinese rendering. APK
 repository signatures and offline wheel SHA256 checks remain enabled.
 Production uses `scripts/build-verify.sh`; CI uses `scripts/ci-compose-verify.py`.
 Both build the same Dockerfile with BuildKit and `docker compose build --pull`.
+For a CI host that cannot reach Docker Hub, the optional `CI_PYTHON_BASE`
+repository variable passes a registry mirror reference through the build script.
+Keep the same official Python image digest; an unset variable preserves the
+Dockerfile default. This setting does not change the shared Docker daemon.
 
 `ALPINE_MIRROR` accepts a mirror host (without scheme or path), defaulting to
 `dl-cdn.alpinelinux.org`. For mainland-China builds:
diff --git a/scripts/build-verify.sh b/scripts/build-verify.sh
index b22cff8..5e26b0b 100755
--- a/scripts/build-verify.sh
+++ b/scripts/build-verify.sh
@@ -6,5 +6,9 @@ cd "$(dirname "$0")/.."
 DOCKER_BIN=${DOCKER_BIN:-docker}
 "$DOCKER_BIN" info >/dev/null
 "$DOCKER_BIN" compose config --quiet
-"$DOCKER_BIN" compose build --pull
+set -- --pull
+if [ -n "${CI_PYTHON_BASE:-}" ]; then
+  set -- "$@" --build-arg "PYTHON_BASE=$CI_PYTHON_BASE"
+fi
+"$DOCKER_BIN" compose build "$@"
 "$DOCKER_BIN" image inspect "${FRAME_FLOW_IMAGE:-pigway-frame-flow:latest}" --format 'image={{.Id}} size_bytes={{.Size}} architecture={{.Architecture}}'