ci: use Tsinghua apt/apk mirrors on the runner

Install was pulling bookworm packages from deb.debian.org; the domestic
Gitea runner crawls that for minutes. Rewrite sources to TUNA before
apt-get/apk, with CST_CI_MIRROR to override.

.gitea/workflows/ci.yml

@@ -16,6 +16,7 @@ jobs:
       - name: Install dependencies
         run: |
           SUDO=$(command -v sudo || true)
+          $SUDO bash scripts/ci_pkg_mirror.sh
           $SUDO apt-get update
           $SUDO apt-get install -y --no-install-recommends \
             build-essential clang cmake pkg-config python3 \
@@ -42,6 +43,7 @@ jobs:
       - name: Install dependencies
         run: |
           SUDO=$(command -v sudo || true)
+          $SUDO bash scripts/ci_pkg_mirror.sh
           $SUDO apt-get update
           $SUDO apt-get install -y --no-install-recommends \
             build-essential pkg-config libcurl4-openssl-dev libncurses-dev
@@ -53,7 +55,11 @@ jobs:
     container: alpine:3.20
     steps:
       - name: Install dependencies
-        run: apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3
+        run: |
+          # Container has no checkout yet; rewrite apk repos in place.
+          sed -i 's#https\?://dl-cdn.alpinelinux.org/alpine#https://mirrors.tuna.tsinghua.edu.cn/alpine#g' \
+            /etc/apk/repositories
+          apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3
       - uses: actions/checkout@v4
       - name: Build + unit tests
         run: |

scripts/ci_pkg_mirror.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Point package managers at a China mirror before apt/apk install.
+# Gitea runners in CN are far too slow against deb.debian.org /
+# archive.ubuntu.com / dl-cdn.alpinelinux.org.
+#
+#   CST_CI_MIRROR=https://mirrors.tuna.tsinghua.edu.cn scripts/ci_pkg_mirror.sh
+# Default mirror: Tsinghua TUNA. Override with CST_CI_MIRROR if needed.
+set -euo pipefail
+
+MIRROR="${CST_CI_MIRROR:-https://mirrors.tuna.tsinghua.edu.cn}"
+MIRROR="${MIRROR%/}"
+
+if [[ -f /etc/alpine-release ]]; then
+  echo "==> apk mirror -> $MIRROR/alpine"
+  if [[ -f /etc/apk/repositories ]]; then
+    sed -i \
+      -e "s|https\\?://dl-cdn.alpinelinux.org/alpine|${MIRROR}/alpine|g" \
+      -e "s|https\\?://[^/[:space:]]*/alpine|${MIRROR}/alpine|g" \
+      /etc/apk/repositories
+  fi
+  exit 0
+fi
+
+if ! command -v apt-get >/dev/null; then
+  echo "==> no apt/apk; skip mirror"
+  exit 0
+fi
+
+# Debian vs Ubuntu: different path under the mirror root.
+id_like=""
+. /etc/os-release 2>/dev/null || true
+case "${ID:-}:${ID_LIKE:-}" in
+  ubuntu:*|*ubuntu*)
+    dist=ubuntu
+    ;;
+  debian:*|*debian*|*)
+    dist=debian
+    ;;
+esac
+
+echo "==> apt mirror -> $MIRROR/$dist (and ${dist}-security)"
+
+rewrite() {
+  local f="$1"
+  [[ -f "$f" ]] || return 0
+  # Classic one-line sources
+  sed -i \
+    -e "s|https\\?://deb.debian.org/debian-security|${MIRROR}/debian-security|g" \
+    -e "s|https\\?://deb.debian.org/debian|${MIRROR}/debian|g" \
+    -e "s|https\\?://security.debian.org/debian-security|${MIRROR}/debian-security|g" \
+    -e "s|https\\?://security.debian.org|${MIRROR}/debian-security|g" \
+    -e "s|https\\?://archive.ubuntu.com/ubuntu|${MIRROR}/ubuntu|g" \
+    -e "s|https\\?://security.ubuntu.com/ubuntu|${MIRROR}/ubuntu|g" \
+    -e "s|https\\?://ports.ubuntu.com/ubuntu-ports|${MIRROR}/ubuntu-ports|g" \
+    "$f"
+  # DEB822 (.sources): URIs: http://deb.debian.org/debian
+  sed -i \
+    -e "s|^URIs: *https\\?://deb.debian.org/debian-security|URIs: ${MIRROR}/debian-security|g" \
+    -e "s|^URIs: *https\\?://deb.debian.org/debian|URIs: ${MIRROR}/debian|g" \
+    -e "s|^URIs: *https\\?://security.debian.org/debian-security|URIs: ${MIRROR}/debian-security|g" \
+    -e "s|^URIs: *https\\?://security.debian.org|URIs: ${MIRROR}/debian-security|g" \
+    -e "s|^URIs: *https\\?://archive.ubuntu.com/ubuntu|URIs: ${MIRROR}/ubuntu|g" \
+    -e "s|^URIs: *https\\?://security.ubuntu.com/ubuntu|URIs: ${MIRROR}/ubuntu|g" \
+    "$f"
+}
+
+rewrite /etc/apt/sources.list
+shopt -s nullglob
+for f in /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
+  rewrite "$f"
+done