chore(Dockerfile): 建置時驗證 Codex 帳號電子郵件

Dockerfile

@@ -1,6 +1,8 @@
+# syntax=docker/dockerfile:1.4
 FROM ubuntu:latest
 
 ENV DEBIAN_FRONTEND=noninteractive
+ARG EXPECTED_CODEX_EMAIL=temp@gmail.com
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -14,8 +16,16 @@ RUN apt-get update \
 WORKDIR /workspace
 
 COPY app/codex_account.js /usr/local/bin/codex-account
-RUN chmod +x /usr/local/bin/codex-account
+COPY app/verify_codex_email.sh /usr/local/bin/verify-codex-email
+RUN chmod +x /usr/local/bin/codex-account /usr/local/bin/verify-codex-email
 
-ENV EXPECTED_CODEX_EMAIL=temp@gmail.com
+ENV EXPECTED_CODEX_EMAIL=${EXPECTED_CODEX_EMAIL}
 
-CMD ["sh", "-c", "email=\"$(codex-account)\"; if [ \"$email\" = \"$EXPECTED_CODEX_EMAIL\" ]; then printf 'Codex account email verified: %s\\n' \"$email\"; else printf 'Codex account email mismatch: expected %s, got %s\\n' \"$EXPECTED_CODEX_EMAIL\" \"${email:-<empty>}\" >&2; exit 1; fi"]
+RUN --mount=type=secret,id=codex_auth,required=true \
+    install -d -m 700 /root/.codex \
+    && cp /run/secrets/codex_auth /root/.codex/auth.json \
+    && chmod 600 /root/.codex/auth.json \
+    && EXPECTED_CODEX_EMAIL="$EXPECTED_CODEX_EMAIL" verify-codex-email \
+    && rm -f /root/.codex/auth.json
+
+CMD ["codex-account"]