Make CI and Docker builds survive an unreachable npm registry

The Gitea runner hung for over 30 minutes on `npm ci` because it cannot
reach registry.npmjs.org. The registry is now configurable through the
NPM_REGISTRY repository variable, passed on to the server's Docker
build, and npm gives up after bounded retries. Jobs also have time
limits (test 15 min, deploy 30 min) so the runner is never held forever.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci-cd.yml

@@ -10,6 +10,8 @@
 #   DEPLOY_PORT          SSH port, default 22
 #   DEPLOY_KNOWN_HOSTS   optional output of `ssh-keyscan <host>`; otherwise the host key is scanned on each run
 # Repository settings → Actions → Variables (optional):
+#   NPM_REGISTRY         npm mirror used by the runner and the server's Docker build when
+#                        registry.npmjs.org is unreachable, e.g. from servers in Iran
 #   DEPLOY_PATH          directory on the server, default vending-machine-game (in the user's home)
 #   SITE_ADDRESS         domains served with HTTPS, default "robotmarkets.ir, www.robotmarkets.ir"
 #   HEALTH_URL           URL checked after deploy, e.g. https://robotmarkets.ir/
@@ -26,9 +28,16 @@ concurrency:
   group: ci-cd-${{ github.ref }}
   cancel-in-progress: false
 
+# Fail within minutes instead of hanging when the registry is slow or blocked.
+env:
+  NPM_CONFIG_REGISTRY: ${{ vars.NPM_REGISTRY || 'https://registry.npmjs.org/' }}
+  NPM_CONFIG_FETCH_RETRIES: '3'
+  NPM_CONFIG_FETCH_TIMEOUT: '60000'
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     container:
       image: node:22-bookworm
     steps:
@@ -44,6 +53,7 @@ jobs:
     needs: test
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     container:
       image: node:22-bookworm
     env:
@@ -77,7 +87,7 @@ jobs:
           # Ship the checked-out sources (no git history) and rebuild/restart the container there.
           tar czf - --exclude=./.git --exclude=./node_modules --exclude=./dist . \
             | ssh -i ~/.ssh/deploy_key -p "$port" "$target" \
-              "mkdir -p '$dir' && tar xzf - -C '$dir' && cd '$dir' && SITE_ADDRESS='$site' docker compose up -d --build --remove-orphans && docker image prune -f"
+              "mkdir -p '$dir' && tar xzf - -C '$dir' && cd '$dir' && SITE_ADDRESS='$site' NPM_REGISTRY='$NPM_CONFIG_REGISTRY' docker compose up -d --build --remove-orphans && docker image prune -f"
 
       - name: Check the site
         if: env.HEALTH_URL != '' && env.DEPLOY_HOST != ''

Dockerfile

@@ -1,8 +1,10 @@
 # Stage 1: run the tests and build the static game with Vite.
 FROM node:22-alpine AS build
 WORKDIR /app
+# Override with a reachable mirror where registry.npmjs.org is blocked (docker compose passes NPM_REGISTRY).
+ARG NPM_REGISTRY=https://registry.npmjs.org/
 COPY package.json package-lock.json ./
-RUN npm ci --no-audit --no-fund
+RUN npm ci --no-audit --no-fund --registry="$NPM_REGISTRY" --fetch-retries=3 --fetch-timeout=60000
 COPY . .
 RUN node --test tests/*.test.js && npm run build
 

README.md

@@ -130,8 +130,9 @@ docker compose logs -f
    - `DEPLOY_PATH`: پوشهٔ روی سرور
    - `SITE_ADDRESS`: دامنه‌ها
    - `HEALTH_URL`: مثلاً `https://robotmarkets.ir/`، تا بعد از انتشار بالا آمدن سایت چک شود
+   - `NPM_REGISTRY`: اگر runner یا سرور به `registry.npmjs.org` دسترسی ندارد (معمول در سرورهای ایران)، آدرس یک mirror در دسترس npm را اینجا بگذارید. همین مقدار برای build روی سرور هم استفاده می‌شود.
 
-تا وقتی `DEPLOY_HOST` تعریف نشده، مرحلهٔ انتشار رد می‌شود و فقط تست و build اجرا می‌شوند.
+تا وقتی `DEPLOY_HOST` تعریف نشده، مرحلهٔ انتشار رد می‌شود و فقط تست و build اجرا می‌شوند. هر مرحله محدودیت زمانی دارد (تست ۱۵ دقیقه، انتشار ۳۰ دقیقه) تا runner هیچ‌وقت بی‌پایان معطل نماند.
 
 ## ساخت دوبارهٔ دادهٔ نقشه
 

docker-compose.yml

@@ -1,6 +1,9 @@
 services:
   game:
-    build: .
+    build:
+      context: .
+      args:
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org/}
     image: robot-market-game:latest
     restart: unless-stopped
     ports: