feat(init_mega): ship mega-init image and drop libra import

Add Dockerfile and deploy workflow for buckal-bundles sync only,
and remove the optional --with-libra / import-buck2-deps path from
init_mega so the Job stays focused on toolchains sync.

Author: benjamin-747

.dockerignore

@@ -13,7 +13,13 @@ tools/**
 
 docs
 
-scripts
+# Exclude scripts by default (large / unused in most images), but keep the
+# paths required by scripts/init_mega/Dockerfile (mega-init image).
+scripts/*
+!scripts/init_mega/
+!scripts/init_mega/**
+!scripts/import-buck2-deps/
+!scripts/import-buck2-deps/**
 
 tests
 

.github/workflows/base.yml

@@ -24,6 +24,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   format:
     if: ${{ !(github.repository == 'gitmono-dev/mega' && github.event_name == 'push') }}

.github/workflows/mega-init-deploy.yml

@@ -0,0 +1,53 @@
+name: Mega Init deploy
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/mega-init-deploy.yml"
+      - "scripts/init_mega/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  REPOSITORY: mega/mega-init
+  IMAGE_TAG: latest
+  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Build, tag, and push docker image to Harbor
+        run: |
+          set -euo pipefail
+
+          HARBOR_IMAGE_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
+          IMAGE_TAG="${{ env.IMAGE_TAG }}"
+          SHORT_SHA="${GITHUB_SHA:0:7}"
+
+          docker build \
+            -f scripts/init_mega/Dockerfile \
+            -t "$HARBOR_IMAGE_BASE:$IMAGE_TAG" \
+            -t "$HARBOR_IMAGE_BASE:$SHORT_SHA" \
+            .
+
+          docker push "$HARBOR_IMAGE_BASE:$IMAGE_TAG"
+          docker push "$HARBOR_IMAGE_BASE:$SHORT_SHA"

.github/workflows/release.yml

@@ -27,6 +27,10 @@ jobs:
             context: .
             dockerfile: orion-server/Dockerfile
 
+          - name: mega-init
+            context: .
+            dockerfile: scripts/init_mega/Dockerfile
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/services.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # Label of the runner job
   runner-job:

.github/workflows/web-sync-server-deploy.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   REGISTRY_ALIAS: m8q5m4u3
   REPOSITORY: mega/web-sync-server

.github/workflows/web-test.yml

@@ -8,6 +8,9 @@ on:
       - '.github/workflows/web-deploy.yml'
       - 'moon/**'
 
+permissions:
+  contents: read
+
 env:
   TIPTAP_PRIVATE_REGISTRY_KEY: CjqFil0n7z4GGur+RPric21fBBeSB4R4FoNdRYOE1bQEz6AXLCoANCc+o9rLIg6Q
 

Cargo.lock

@@ -42,8 +42,8 @@ git-internal = "0.8.4"
 libvault-core = "0.1.0"
 
 #====
-anyhow = "1.0.103"
-serde = { version = "1.0.228", features = ["derive"] }
+anyhow = "1.0.104"
+serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 serde_urlencoded = "0.7"
 tracing = "0.1.44"
@@ -56,11 +56,11 @@ clap = "4.6.4"
 tokio = "1.53.1"
 tokio-stream = "0.1.19"
 tokio-util = "0.7.19"
-async-trait = "0.1.89"
+async-trait = "0.1.91"
 async-stream = "0.3.6"
 async-recursion = "1.1.1"
-futures = "0.3.32"
-futures-util = "0.3.32"
+futures = "0.3.33"
+futures-util = "0.3.33"
 axum = { version = "0.8.9", features = ["macros", "json"] }
 axum-extra = "0.12.6"
 russh = "0.62.4"
@@ -94,8 +94,8 @@ hmac = "0.13"
 idgenerator = "2.0.0"
 config = "0.15.25"
 reqwest = "0.13.4"
-uuid = "1.23.5"
-regex = "1.13.0"
+uuid = "1.24.0"
+regex = "1.13.1"
 ctrlc = "3.5.2"
 cedar-policy = "4.11.2"
 secp256k1 = "0.31.1"
@@ -123,12 +123,12 @@ bs58 = "0.5.1"
 indexmap = "2.14"
 envsubst = "0.2.1"
 directories = "6.0.0"
-redis = "1.3.0"
+redis = "1.4.1"
 redis-test = "1.0.4"
 rustls = "0.23.42"
-object_store = "0.14.0"
+object_store = "0.14.1"
 parse-display = "0.11.0"
-toml = "1.1.2"
+toml = "1.1.3"
 rkyv = "0.8.17"
 percent-encoding = "2.3"
 

Cargo.toml

@@ -105,6 +105,23 @@ impl AdminApplicationService {
         })
     }
 
+    /// Ensure mega-init bot + fresh push token (for unauthenticated bootstrap-init).
+    pub async fn ensure_init_bot_token(
+        &self,
+    ) -> Result<crate::model::bots::BootstrapInitBotResponse, MegaError> {
+        let (bot, token_plain) = self
+            .ctx
+            .storage()
+            .bots_storage()
+            .ensure_init_bot_token()
+            .await?;
+        Ok(crate::model::bots::BootstrapInitBotResponse {
+            bot_id: bot.id,
+            bot_name: bot.name,
+            token: token_plain,
+        })
+    }
+
     pub async fn list_bot_tokens(&self, bot_id: i64) -> Result<Vec<ListBotTokenItem>, MegaError> {
         Ok(self
             .ctx