From a64fa6bc72acdeb5be1402e5af234c231dc3b669 Mon Sep 17 00:00:00 2001 From: HenryDu8133 <813367384@qq.com> Date: Sun, 13 Sep 2026 00:10:54 +0800 Subject: [PATCH] =?UTF-8?q?ci(deploy):=20Gitea=20Actions=20=E8=87=AA?= =?UTF-8?q?=E5=8A=A8=E6=8E=A5=E5=85=A5=E5=BE=AE=E4=BF=A1OAuth=EF=BC=88?= =?UTF-8?q?=E6=9E=84=E5=BB=BA=E6=9C=9F+=E8=BF=90=E8=A1=8C=E6=9C=9F?= =?UTF-8?q?=E5=8F=8C=E9=93=BE=E8=B7=AF=E6=B3=A8=E5=85=A5=EF=BC=89\n\n-=20d?= =?UTF-8?q?eploy.yml=20preflight/nuxt=20build=20step:=20env=20=E6=B3=A8?= =?UTF-8?q?=E5=85=A5=206=20=E6=9D=A1=20OAuth=20secrets=EF=BC=9B=E6=98=BE?= =?UTF-8?q?=E5=BC=8F=20export=20=E7=BB=99=E5=AD=90=E8=BF=9B=E7=A8=8B?= =?UTF-8?q?=EF=BC=8C=E6=9E=84=E5=BB=BA=E6=97=A5=E5=BF=97=E6=89=93=E5=8D=B0?= =?UTF-8?q?=20AGGREGATE=5FOAUTH=5FAPP=5FID=20=E6=9C=89=E6=97=A0=E5=80=BC?= =?UTF-8?q?=E4=BE=BF=E4=BA=8E=E6=8E=92=E9=94=99\n-=20deploy.yml=20deploy/S?= =?UTF-8?q?SH=20step:=20env=20=E6=B3=A8=E5=85=A5=206=20=E6=9D=A1=20OAuth?= =?UTF-8?q?=20secrets=20=E4=BC=A0=E7=BB=99=E8=BF=9C=E7=AB=AF=20bash=20-s\n?= =?UTF-8?q?=20=20-=20=E8=BF=9C=E7=AB=AF=E6=96=B0=E5=A2=9E=20upsert=5Fenv?= =?UTF-8?q?=5Fkey()=EF=BC=9A=E5=AF=B9=20.env=20=E5=81=9A=20awk=20=E6=95=B4?= =?UTF-8?q?=E8=A1=8C=E8=A6=86=E7=9B=96=20/=20=E4=B8=8D=E5=AD=98=E5=9C=A8?= =?UTF-8?q?=E8=BF=BD=E5=8A=A0=EF=BC=8C=E5=B9=82=E7=AD=89=EF=BC=88=E4=BF=9D?= =?UTF-8?q?=E8=AF=81=E4=B8=8D=E7=A0=B4=E5=9D=8F=E5=8E=9F=E6=9C=89=20POSTGR?= =?UTF-8?q?ES=5F*=20/=20JWT=5FSECRET=20/=20NUXT=5FPUBLIC=5F*=20=E7=AD=89?= =?UTF-8?q?=E5=85=B6=E5=AE=83=E5=8F=98=E9=87=8F=EF=BC=89\n=20=20-=20?= =?UTF-8?q?=E4=BB=85=E5=BD=93=20AGGREGATE=5FOAUTH=5FAPP=5FID=20=E9=9D=9E?= =?UTF-8?q?=E7=A9=BA=E6=89=8D=E5=86=99=E5=85=A5=EF=BC=8C=E9=81=BF=E5=85=8D?= =?UTF-8?q?=E6=8A=8A=E7=A9=BA=E5=80=BC=E8=A6=86=E7=9B=96=E5=B7=B2=E6=9C=89?= =?UTF-8?q?=E9=85=8D=E7=BD=AE\n=20=20-=20=E5=90=88=E5=B9=B6=E5=86=99?= =?UTF-8?q?=E5=85=A5=E5=90=8E=E7=AB=8B=E5=8D=B3=E5=9C=A8=E6=97=A5=E5=BF=97?= =?UTF-8?q?=E8=BE=93=E5=87=BA=20[OAuth]=20=E6=88=90=E5=8A=9F/=E8=B7=B3?= =?UTF-8?q?=E8=BF=87=E6=8F=90=E7=A4=BA=EF=BC=8C=E6=97=A0=E9=9C=80=E6=89=8B?= =?UTF-8?q?=E6=94=B9=E6=9C=8D=E5=8A=A1=E5=99=A8=20.env\n-=20docker-compose?= =?UTF-8?q?.yml=20=E5=B7=B2=E5=90=AB=20env=5Ffile:=20.env=EF=BC=8C?= =?UTF-8?q?=E5=90=88=E5=B9=B6=E5=86=99=E5=85=A5=E5=90=8E=E7=9A=84=E5=8F=98?= =?UTF-8?q?=E9=87=8F=E4=BC=9A=E8=A2=AB=E5=AE=B9=E5=99=A8=E8=87=AA=E5=8A=A8?= =?UTF-8?q?=E5=8A=A0=E8=BD=BD=E4=B8=BA=20process.env?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitea/workflows/deploy.yml | 72 +++++++++++++++++++++++++++++++++++-- 1 file changed, 70 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 5f46f56..327ef30 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -196,6 +196,13 @@ jobs: echo "package.json 未发现 pnpm 声明" - name: 执行 nuxt build + env: + OAUTH_REDIRECT_URI: ${{ secrets.OAUTH_REDIRECT_URI }} + OAUTH_STATE_SECRET: ${{ secrets.OAUTH_STATE_SECRET }} + AGGREGATE_OAUTH_APP_ID: ${{ secrets.AGGREGATE_OAUTH_APP_ID }} + AGGREGATE_OAUTH_APP_KEY: ${{ secrets.AGGREGATE_OAUTH_APP_KEY }} + AGGREGATE_OAUTH_LOGIN_TYPE: ${{ secrets.AGGREGATE_OAUTH_LOGIN_TYPE }} + AGGREGATE_OAUTH_ENDPOINT: ${{ secrets.AGGREGATE_OAUTH_ENDPOINT }} run: | set -euxo pipefail echo "=== 构建前系统内存状态 ===" @@ -206,6 +213,19 @@ jobs: export NITRO_PRESET=node-server export NITRO_MINIFY=false export DISABLE_ROLLDOWN=1 + # OAuth 相关 secrets 已通过 env: 注入，在此显式 export 一遍确保子进程继承 + export OAUTH_REDIRECT_URI="${OAUTH_REDIRECT_URI:-}" + export OAUTH_STATE_SECRET="${OAUTH_STATE_SECRET:-}" + export AGGREGATE_OAUTH_APP_ID="${AGGREGATE_OAUTH_APP_ID:-}" + export AGGREGATE_OAUTH_APP_KEY="${AGGREGATE_OAUTH_APP_KEY:-}" + export AGGREGATE_OAUTH_LOGIN_TYPE="${AGGREGATE_OAUTH_LOGIN_TYPE:-}" + export AGGREGATE_OAUTH_ENDPOINT="${AGGREGATE_OAUTH_ENDPOINT:-}" + # 构建期诊断：仅展示 AGGREGATE_OAUTH_APP_ID 是否有值（不打印敏感信息） + if [ -n "${AGGREGATE_OAUTH_APP_ID}" ]; then + echo "[OAuth] build-time AGGREGATE_OAUTH_APP_ID 已配置（前端第三方登录按钮会显示）, LOGIN_TYPE=${AGGREGATE_OAUTH_LOGIN_TYPE:-}" + else + echo "[OAuth] build-time AGGREGATE_OAUTH_APP_ID 未配置——前端第三方登录将显示占位提示，请先在 Repository Secrets 中配置 AGGREGATE_OAUTH_APP_ID" + fi npm run build echo "=== 构建完成，.output/ 生成结果 ===" ls -la .output/ 2>/dev/null || true @@ -516,6 +536,13 @@ jobs: GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_REF_NAME: ${{ github.ref_name }} + # === OAuth / 第三方登录（构建期注入到 nuxt runtimeConfig；运行期写入远端 .env） === + OAUTH_REDIRECT_URI: ${{ secrets.OAUTH_REDIRECT_URI }} + OAUTH_STATE_SECRET: ${{ secrets.OAUTH_STATE_SECRET }} + AGGREGATE_OAUTH_APP_ID: ${{ secrets.AGGREGATE_OAUTH_APP_ID }} + AGGREGATE_OAUTH_APP_KEY: ${{ secrets.AGGREGATE_OAUTH_APP_KEY }} + AGGREGATE_OAUTH_LOGIN_TYPE: ${{ secrets.AGGREGATE_OAUTH_LOGIN_TYPE }} + AGGREGATE_OAUTH_ENDPOINT: ${{ secrets.AGGREGATE_OAUTH_ENDPOINT }} run: | set -euo pipefail # 全小写规范（Docker Registry 硬性要求 + Gitea raw URL 路径大小写敏感） @@ -554,10 +581,13 @@ jobs: # 用 printf + \n 拼接完整 shell 脚本通过 stdin 注入到 ssh 远端 cat， # 不用 heredoc，避免 YAML 冒号/缩进解析误判。 ENV_SH="/tmp/deploy_env_$$" - ENV_PAYLOAD="$(printf 'export IMAGE_NEW=%q\nexport IMAGE_LATEST=%q\nexport DEPLOY_PATH=%q\nexport GITEA_HOST=%q\nexport GH_PROXY_PREFIX=%q\nexport REGISTRY_PULL_USER=%q\nexport REGISTRY_PULL_TOKEN=%q\nexport IMAGE_NAME=%q\nexport NUXT_PUBLIC_SITE_URL=%q\nexport GITHUB_SERVER_URL=%q\nexport GITHUB_REPOSITORY=%q\nexport GITHUB_REF_NAME=%q\n' \ + ENV_PAYLOAD="$(printf 'export IMAGE_NEW=%q\nexport IMAGE_LATEST=%q\nexport DEPLOY_PATH=%q\nexport GITEA_HOST=%q\nexport GH_PROXY_PREFIX=%q\nexport REGISTRY_PULL_USER=%q\nexport REGISTRY_PULL_TOKEN=%q\nexport IMAGE_NAME=%q\nexport NUXT_PUBLIC_SITE_URL=%q\nexport GITHUB_SERVER_URL=%q\nexport GITHUB_REPOSITORY=%q\nexport GITHUB_REF_NAME=%q\nexport OAUTH_REDIRECT_URI=%q\nexport OAUTH_STATE_SECRET=%q\nexport AGGREGATE_OAUTH_APP_ID=%q\nexport AGGREGATE_OAUTH_APP_KEY=%q\nexport AGGREGATE_OAUTH_LOGIN_TYPE=%q\nexport AGGREGATE_OAUTH_ENDPOINT=%q\n' \ "${IMAGE_NEW}" "${IMAGE_LATEST}" "${DEPLOY_PATH}" "${GITEA_HOST}" "${GH_PROXY_PREFIX}" \ "${REGISTRY_PULL_USER}" "${REGISTRY_PULL_TOKEN}" "${IMAGE_NAME}" "${NUXT_PUBLIC_SITE_URL}" \ - "${GITHUB_SERVER_URL}" "${GITHUB_REPOSITORY}" "${GITHUB_REF_NAME}")" + "${GITHUB_SERVER_URL}" "${GITHUB_REPOSITORY}" "${GITHUB_REF_NAME}" \ + "${OAUTH_REDIRECT_URI}" "${OAUTH_STATE_SECRET}" \ + "${AGGREGATE_OAUTH_APP_ID}" "${AGGREGATE_OAUTH_APP_KEY}" \ + "${AGGREGATE_OAUTH_LOGIN_TYPE}" "${AGGREGATE_OAUTH_ENDPOINT}")" printf '%s' "${ENV_PAYLOAD}" | ssh "${SSH_OPTS[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" "cat > ${ENV_SH}" echo "[Deploy] env script written to ${ENV_SH} on remote" # 立即回读验证远端文件非空 & IMAGE_NEW 非空，避免后面空跑 @@ -610,6 +640,44 @@ jobs: exit 3 fi + # ========== 合并写入 OAuth 配置到 .env（幂等：有 key 则覆盖，无 key 追加） ========== + # 仅当 AGGREGATE_OAUTH_APP_ID 非空时才写入，避免把空值写进远端 .env 覆盖已有配置 + if [ -n "${AGGREGATE_OAUTH_APP_ID}" ]; then + ENV_FILE="${DEPLOY_DIR}/.env" + touch "${ENV_FILE}" + MERGE_OK=1 + upsert_env_key() { + # $1 = KEY, $2 = VALUE；VALUE 已在调用方 printf %q 保证安全 + _K="$1"; _V="$2" + if [ -z "${_V}" ]; then return 0; fi + # 远端 .env 中若 KEY= 开头存在则整行覆盖；不存在则追加 + if grep -q "^${_K}=" "${ENV_FILE}" 2>/dev/null; then + if command -v awk >/dev/null 2>&1; then + awk -v K="${_K}" -v V="${_V}" 'BEGIN{FS=OFS="="} $1==K{$2="\"" V "\""} 1' "${ENV_FILE}" > "${ENV_FILE}.tmp.$$" \ + && mv "${ENV_FILE}.tmp.$$" "${ENV_FILE}" || MERGE_OK=0 + else + MERGE_OK=0 + fi + else + printf '%s="%s"\n' "${_K}" "${_V}" >> "${ENV_FILE}" + fi + } + upsert_env_key OAUTH_REDIRECT_URI "${OAUTH_REDIRECT_URI}" || MERGE_OK=0 + upsert_env_key OAUTH_STATE_SECRET "${OAUTH_STATE_SECRET}" || MERGE_OK=0 + upsert_env_key AGGREGATE_OAUTH_APP_ID "${AGGREGATE_OAUTH_APP_ID}" || MERGE_OK=0 + upsert_env_key AGGREGATE_OAUTH_APP_KEY "${AGGREGATE_OAUTH_APP_KEY}" || MERGE_OK=0 + upsert_env_key AGGREGATE_OAUTH_LOGIN_TYPE "${AGGREGATE_OAUTH_LOGIN_TYPE}" || MERGE_OK=0 + upsert_env_key AGGREGATE_OAUTH_ENDPOINT "${AGGREGATE_OAUTH_ENDPOINT}" || MERGE_OK=0 + rm -f "${ENV_FILE}.tmp.$$" + if [ "${MERGE_OK}" = "1" ]; then + echo "[OAuth] 运行期配置已合并写入 ${ENV_FILE}（AGGREGATE_OAUTH_LOGIN_TYPE=${AGGREGATE_OAUTH_LOGIN_TYPE}，AGGREATE_OAUTH_ENDPOINT=${AGGREGATE_OAUTH_ENDPOINT}）" + else + echo "[OAuth] WARNING：运行期配置合并写入失败，请手动检查 ${ENV_FILE}；仍尝试继续部署" + fi + else + echo "[OAuth] AGGREGATE_OAUTH_APP_ID 未设置——跳过写入远端 .env。如已在服务器手动配置过 .env 则无需担心。" + fi + if [ -n "${REGISTRY_PULL_TOKEN}" ] && [ -n "${REGISTRY_PULL_USER}" ]; then echo "使用专用 pull 凭证登录 Gitea Container Registry" printf '%s' "${REGISTRY_PULL_TOKEN}" \