diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 676df4883..0f48bce60 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -92,42 +92,80 @@ jobs:
           echo "=== Installing gitleaks ==="
           GITLEAKS_VERSION="v8.18.4"
           GITLEAKS_ARCH="linux_x64"
-          # 多个下载源，按顺序尝试（国内服务器GitHub常超时）
-          DOWNLOAD_URLS="
-            https://mirror.ghproxy.com/https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz
-            https://gh.api.99988866.xyz/https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz
-            https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz
+          GITLEAKS_FILE="gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz"
+          GITHUB_BASE="https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/${GITLEAKS_FILE}"
+          
+          # 国内镜像源（按大致稳定性排序）
+          MIRRORS="
+            https://gh-proxy.com/${GITHUB_BASE}
+            https://ghproxy.net/${GITHUB_BASE}
+            https://hub.gitmirror.com/${GITHUB_BASE}
+            https://ghps.cc/${GITHUB_BASE}
+            https://mirror.ghproxy.com/${GITHUB_BASE}
+            ${GITHUB_BASE}
           "
+          
           INSTALLED=false
-          for url in $DOWNLOAD_URLS; do
+          for url in $MIRRORS; do
             echo "Trying: $url"
-            if curl -fsSL --connect-timeout 15 --max-time 120 -o /tmp/gitleaks.tar.gz "$url"; then
+            if curl -fsSL --connect-timeout 8 --max-time 90 --retry 2 --retry-delay 3 \
+                 -o /tmp/gitleaks.tar.gz "$url" 2>/dev/null; then
               echo "Download successful from: $url"
-              tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
-              chmod +x /tmp/gitleaks
-              /tmp/gitleaks version
-              INSTALLED=true
-              break
+              if tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks 2>/dev/null; then
+                chmod +x /tmp/gitleaks
+                /tmp/gitleaks version
+                INSTALLED=true
+                break
+              else
+                echo "Download OK but tar extraction failed, trying next..."
+              fi
             else
               echo "Download failed from: $url, trying next..."
             fi
           done
+          
+          # Fallback: 尝试 go install 从源码编译
+          if [ "$INSTALLED" = "false" ] && command -v go >/dev/null 2>&1; then
+            echo "All binary mirrors failed, trying go install..."
+            if go install github.com/gitleaks/gitleaks/v8@${GITLEAKS_VERSION} 2>/dev/null; then
+              GOPATH_BIN="$(go env GOPATH)/bin"
+              if [ -x "$GOPATH_BIN/gitleaks" ]; then
+                cp "$GOPATH_BIN/gitleaks" /tmp/gitleaks
+                chmod +x /tmp/gitleaks
+                /tmp/gitleaks version
+                INSTALLED=true
+                echo "Installed via go install"
+              fi
+            fi
+          fi
+          
           if [ "$INSTALLED" = "false" ]; then
-            echo "ERROR: Failed to download gitleaks from all mirrors"
-            exit 1
+            echo "WARNING: Failed to install gitleaks from all sources"
+            echo "gitleaks 安装失败，密钥检测跳过（告警模式，不阻断流水线）"
+            echo "请检查Runner网络或手动安装gitleaks到Runner"
+            exit 0
           fi
           echo ""
           echo "=== Running gitleaks scan ==="
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             echo "PR mode: scanning changed files (origin/${{ github.base_ref }}..HEAD)"
             set +e
-            /tmp/gitleaks detect               --source .               --config .gitleaks.toml               --verbose               --exit-code 1               --log-opts="origin/${{ github.base_ref }}..HEAD"
+            /tmp/gitleaks detect \
+              --source . \
+              --config .gitleaks.toml \
+              --verbose \
+              --exit-code 1 \
+              --log-opts="origin/${{ github.base_ref }}..HEAD"
             GITLEAKS_EXIT=$?
             set -e
           else
             echo "Push mode: full repository scan"
             set +e
-            /tmp/gitleaks detect               --source .               --config .gitleaks.toml               --verbose               --exit-code 1
+            /tmp/gitleaks detect \
+              --source . \
+              --config .gitleaks.toml \
+              --verbose \
+              --exit-code 1
             GITLEAKS_EXIT=$?
             set -e
           fi