ci(deploy): Gitea Actions 自动接入微信OAuth（构建期+运行期双链路注入）\n\n- deploy.yml preflight/nuxt build step: env 注入 6 条 OAuth secrets；显式 export 给子进程，构建日志打印 AGGREGATE_OAUTH_APP_ID 有无值便于排错\n- deploy.yml deploy/SSH step: env 注入 6 条 OAuth secrets 传给远端 bash -s\n - 远端新增 upsert_env_key()：对 .env 做 awk 整行覆盖 / 不存在追加，幂等（保证不破坏原有 POSTGRES_* / JWT_SECRET / NUXT_PUBLIC_* 等其它变量）\n - 仅当 AGGREGATE_OAUTH_APP_ID 非空才写入，避免把空值覆盖已有配置\n - 合并写入后立即在日志输出 [OAuth] 成功/跳过提示，无需手改服务器 .env\n- docker-compose.yml 已含 env_file: .env，合并写入后的变量会被容器自动加载为 process.env

.gitea/workflows/deploy.yml

@@ -196,6 +196,13 @@ jobs:
           echo "package.json 未发现 pnpm 声明"
 
       - name: 执行 nuxt build
+        env:
+          OAUTH_REDIRECT_URI: ${{ secrets.OAUTH_REDIRECT_URI }}
+          OAUTH_STATE_SECRET: ${{ secrets.OAUTH_STATE_SECRET }}
+          AGGREGATE_OAUTH_APP_ID: ${{ secrets.AGGREGATE_OAUTH_APP_ID }}
+          AGGREGATE_OAUTH_APP_KEY: ${{ secrets.AGGREGATE_OAUTH_APP_KEY }}
+          AGGREGATE_OAUTH_LOGIN_TYPE: ${{ secrets.AGGREGATE_OAUTH_LOGIN_TYPE }}
+          AGGREGATE_OAUTH_ENDPOINT: ${{ secrets.AGGREGATE_OAUTH_ENDPOINT }}
         run: |
           set -euxo pipefail
           echo "=== 构建前系统内存状态 ==="
@@ -206,6 +213,19 @@ jobs:
           export NITRO_PRESET=node-server
           export NITRO_MINIFY=false
           export DISABLE_ROLLDOWN=1
+          # OAuth 相关 secrets 已通过 env: 注入，在此显式 export 一遍确保子进程继承
+          export OAUTH_REDIRECT_URI="${OAUTH_REDIRECT_URI:-}"
+          export OAUTH_STATE_SECRET="${OAUTH_STATE_SECRET:-}"
+          export AGGREGATE_OAUTH_APP_ID="${AGGREGATE_OAUTH_APP_ID:-}"
+          export AGGREGATE_OAUTH_APP_KEY="${AGGREGATE_OAUTH_APP_KEY:-}"
+          export AGGREGATE_OAUTH_LOGIN_TYPE="${AGGREGATE_OAUTH_LOGIN_TYPE:-}"
+          export AGGREGATE_OAUTH_ENDPOINT="${AGGREGATE_OAUTH_ENDPOINT:-}"
+          # 构建期诊断：仅展示 AGGREGATE_OAUTH_APP_ID 是否有值（不打印敏感信息）
+          if [ -n "${AGGREGATE_OAUTH_APP_ID}" ]; then
+            echo "[OAuth] build-time AGGREGATE_OAUTH_APP_ID 已配置（前端第三方登录按钮会显示）, LOGIN_TYPE=${AGGREGATE_OAUTH_LOGIN_TYPE:-<unset>}"
+          else
+            echo "[OAuth] build-time AGGREGATE_OAUTH_APP_ID 未配置——前端第三方登录将显示占位提示，请先在 Repository Secrets 中配置 AGGREGATE_OAUTH_APP_ID"
+          fi
           npm run build
           echo "=== 构建完成，.output/ 生成结果 ==="
           ls -la .output/ 2>/dev/null || true
@@ -516,6 +536,13 @@ jobs:
           GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
+          # === OAuth / 第三方登录（构建期注入到 nuxt runtimeConfig；运行期写入远端 .env） ===
+          OAUTH_REDIRECT_URI: ${{ secrets.OAUTH_REDIRECT_URI }}
+          OAUTH_STATE_SECRET: ${{ secrets.OAUTH_STATE_SECRET }}
+          AGGREGATE_OAUTH_APP_ID: ${{ secrets.AGGREGATE_OAUTH_APP_ID }}
+          AGGREGATE_OAUTH_APP_KEY: ${{ secrets.AGGREGATE_OAUTH_APP_KEY }}
+          AGGREGATE_OAUTH_LOGIN_TYPE: ${{ secrets.AGGREGATE_OAUTH_LOGIN_TYPE }}
+          AGGREGATE_OAUTH_ENDPOINT: ${{ secrets.AGGREGATE_OAUTH_ENDPOINT }}
         run: |
           set -euo pipefail
           # 全小写规范（Docker Registry 硬性要求 + Gitea raw URL 路径大小写敏感）
@@ -554,10 +581,13 @@ jobs:
           # 用 printf + \n 拼接完整 shell 脚本通过 stdin 注入到 ssh 远端 cat，
           # 不用 heredoc，避免 YAML 冒号/缩进解析误判。
           ENV_SH="/tmp/deploy_env_$$"
-          ENV_PAYLOAD="$(printf 'export IMAGE_NEW=%q\nexport IMAGE_LATEST=%q\nexport DEPLOY_PATH=%q\nexport GITEA_HOST=%q\nexport GH_PROXY_PREFIX=%q\nexport REGISTRY_PULL_USER=%q\nexport REGISTRY_PULL_TOKEN=%q\nexport IMAGE_NAME=%q\nexport NUXT_PUBLIC_SITE_URL=%q\nexport GITHUB_SERVER_URL=%q\nexport GITHUB_REPOSITORY=%q\nexport GITHUB_REF_NAME=%q\n' \
+          ENV_PAYLOAD="$(printf 'export IMAGE_NEW=%q\nexport IMAGE_LATEST=%q\nexport DEPLOY_PATH=%q\nexport GITEA_HOST=%q\nexport GH_PROXY_PREFIX=%q\nexport REGISTRY_PULL_USER=%q\nexport REGISTRY_PULL_TOKEN=%q\nexport IMAGE_NAME=%q\nexport NUXT_PUBLIC_SITE_URL=%q\nexport GITHUB_SERVER_URL=%q\nexport GITHUB_REPOSITORY=%q\nexport GITHUB_REF_NAME=%q\nexport OAUTH_REDIRECT_URI=%q\nexport OAUTH_STATE_SECRET=%q\nexport AGGREGATE_OAUTH_APP_ID=%q\nexport AGGREGATE_OAUTH_APP_KEY=%q\nexport AGGREGATE_OAUTH_LOGIN_TYPE=%q\nexport AGGREGATE_OAUTH_ENDPOINT=%q\n' \
             "${IMAGE_NEW}" "${IMAGE_LATEST}" "${DEPLOY_PATH}" "${GITEA_HOST}" "${GH_PROXY_PREFIX}" \
             "${REGISTRY_PULL_USER}" "${REGISTRY_PULL_TOKEN}" "${IMAGE_NAME}" "${NUXT_PUBLIC_SITE_URL}" \
-            "${GITHUB_SERVER_URL}" "${GITHUB_REPOSITORY}" "${GITHUB_REF_NAME}")"
+            "${GITHUB_SERVER_URL}" "${GITHUB_REPOSITORY}" "${GITHUB_REF_NAME}" \
+            "${OAUTH_REDIRECT_URI}" "${OAUTH_STATE_SECRET}" \
+            "${AGGREGATE_OAUTH_APP_ID}" "${AGGREGATE_OAUTH_APP_KEY}" \
+            "${AGGREGATE_OAUTH_LOGIN_TYPE}" "${AGGREGATE_OAUTH_ENDPOINT}")"
           printf '%s' "${ENV_PAYLOAD}" | ssh "${SSH_OPTS[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" "cat > ${ENV_SH}"
           echo "[Deploy] env script written to ${ENV_SH} on remote"
           # 立即回读验证远端文件非空 & IMAGE_NEW 非空，避免后面空跑
@@ -610,6 +640,44 @@ jobs:
                 exit 3
               fi
 
+              # ========== 合并写入 OAuth 配置到 .env（幂等：有 key 则覆盖，无 key 追加） ==========
+              # 仅当 AGGREGATE_OAUTH_APP_ID 非空时才写入，避免把空值写进远端 .env 覆盖已有配置
+              if [ -n "${AGGREGATE_OAUTH_APP_ID}" ]; then
+                ENV_FILE="${DEPLOY_DIR}/.env"
+                touch "${ENV_FILE}"
+                MERGE_OK=1
+                upsert_env_key() {
+                  # $1 = KEY, $2 = VALUE；VALUE 已在调用方 printf %q 保证安全
+                  _K="$1"; _V="$2"
+                  if [ -z "${_V}" ]; then return 0; fi
+                  # 远端 .env 中若 KEY= 开头存在则整行覆盖；不存在则追加
+                  if grep -q "^${_K}=" "${ENV_FILE}" 2>/dev/null; then
+                    if command -v awk >/dev/null 2>&1; then
+                      awk -v K="${_K}" -v V="${_V}" 'BEGIN{FS=OFS="="} $1==K{$2="\"" V "\""} 1' "${ENV_FILE}" > "${ENV_FILE}.tmp.$$" \
+                        && mv "${ENV_FILE}.tmp.$$" "${ENV_FILE}" || MERGE_OK=0
+                    else
+                      MERGE_OK=0
+                    fi
+                  else
+                    printf '%s="%s"\n' "${_K}" "${_V}" >> "${ENV_FILE}"
+                  fi
+                }
+                upsert_env_key OAUTH_REDIRECT_URI "${OAUTH_REDIRECT_URI}" || MERGE_OK=0
+                upsert_env_key OAUTH_STATE_SECRET "${OAUTH_STATE_SECRET}" || MERGE_OK=0
+                upsert_env_key AGGREGATE_OAUTH_APP_ID "${AGGREGATE_OAUTH_APP_ID}" || MERGE_OK=0
+                upsert_env_key AGGREGATE_OAUTH_APP_KEY "${AGGREGATE_OAUTH_APP_KEY}" || MERGE_OK=0
+                upsert_env_key AGGREGATE_OAUTH_LOGIN_TYPE "${AGGREGATE_OAUTH_LOGIN_TYPE}" || MERGE_OK=0
+                upsert_env_key AGGREGATE_OAUTH_ENDPOINT "${AGGREGATE_OAUTH_ENDPOINT}" || MERGE_OK=0
+                rm -f "${ENV_FILE}.tmp.$$"
+                if [ "${MERGE_OK}" = "1" ]; then
+                  echo "[OAuth] 运行期配置已合并写入 ${ENV_FILE}（AGGREGATE_OAUTH_LOGIN_TYPE=${AGGREGATE_OAUTH_LOGIN_TYPE}，AGGREATE_OAUTH_ENDPOINT=${AGGREGATE_OAUTH_ENDPOINT}）"
+                else
+                  echo "[OAuth] WARNING：运行期配置合并写入失败，请手动检查 ${ENV_FILE}；仍尝试继续部署"
+                fi
+              else
+                echo "[OAuth] AGGREGATE_OAUTH_APP_ID 未设置——跳过写入远端 .env。如已在服务器手动配置过 .env 则无需担心。"
+              fi
+
               if [ -n "${REGISTRY_PULL_TOKEN}" ] && [ -n "${REGISTRY_PULL_USER}" ]; then
                 echo "使用专用 pull 凭证登录 Gitea Container Registry"
                 printf '%s' "${REGISTRY_PULL_TOKEN}" \