Harden publishing and improve search performance (#1477)

.github/workflows/website.yml

@@ -26,35 +26,34 @@ concurrency:
 
 jobs:
   website:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           ref: ${{ github.event_name == 'pull_request' && github.ref || 'master' }}
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
           cache: pip
           cache-dependency-path: website/requirements.txt
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
+          package-manager-cache: false
       - name: 安装固定版本依赖
         run: |
           python -m pip install -r website/requirements.txt
           npm ci --prefix website/deploy --ignore-scripts
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: website/.cache/site-assets
-          key: site-webp-v1-${{ runner.os }}-${{ hashFiles('website/requirements.txt', 'website/builder/site_assets.py', 'notes/pics/**', 'assets/**') }}
-          restore-keys: site-webp-v1-${{ runner.os }}-
+          key: site-webp-${{ runner.os }}-${{ hashFiles('website/requirements.txt') }}-${{ hashFiles('website/builder/site_assets.py', 'notes/pics/**', 'assets/**', 'docs/_media/**') }}
+          restore-keys: site-webp-${{ runner.os }}-${{ hashFiles('website/requirements.txt') }}-
       - name: 生成并校验网站与配图
-        run: |
-          python website/refresh.py --from-checkout
-          python website/deploy/package_site.py
+        run: python website/refresh.py --from-checkout
       - name: 检查搜索和发布保护
         run: |
           python website/builder/test_site_assets.py
@@ -68,7 +67,7 @@ jobs:
         run: node website/deploy/deploy.mjs
       - name: 保留小型版本报告
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: website-report-${{ github.run_id }}-${{ github.run_attempt }}
           path: |