From 2ddfa641a7316d1053aa689d32063db1b88a74cf Mon Sep 17 00:00:00 2001
From: Xiaoxia AI <xiaoxia@localhost>
Date: Thu, 25 Jun 2026 00:31:23 +0800
Subject: [PATCH] fix(ci): build staging web on runtime builder

---
 .gitea/workflows/deploy.yml | 103 +++++++++++++++++++++++++++---------
 1 file changed, 77 insertions(+), 26 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 33c44ac94..03ab5f65e 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   deploy-staging:
     name: Deploy Staging
-    runs-on: ubuntu-latest
+    runs-on: runtime-builder
     if: github.ref_name == 'main' || github.ref_name == 'develop'
 
     steps:
@@ -24,38 +24,88 @@ jobs:
         tar -xzf /tmp/repo.tar.gz --strip-components=1 -C .
         rm -f /tmp/repo.tar.gz
 
-    - name: Sync code to staging workspace
+    - name: Build staging web artifact
       shell: sh
       run: |
         set -eu
-        mkdir -p /var/lib/xiaoxia-saas-staging
+        docker run --rm \
+          --pull=never \
+          -v "$PWD:/workspace" \
+          -w /workspace/apps/web \
+          docker.m.daocloud.io/library/node:20 \
+          sh -lc 'npm ci && npm run build'
+        docker build --pull=false \
+          -f infra/docker/web-artifact.Dockerfile \
+          -t "xiaoxia-saas-web:staging-${GITHUB_SHA}" \
+          .
+        test -f apps/web/dist/index.html
+
+    - name: Package staging release artifact
+      shell: sh
+      run: |
+        set -eu
+        rm -rf dist/staging-artifacts
+        mkdir -p dist/staging-artifacts
+        tar --exclude=.git --exclude=apps/web/node_modules --exclude=./dist \
+          -czf dist/staging-artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz .
+        docker save -o "dist/staging-artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar" "xiaoxia-saas-web:staging-${GITHUB_SHA}"
+
+    - name: Upload staging artifact to business host
+      shell: sh
+      env:
+        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
+      run: |
+        set -eu
+        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
+        staging_user="${STAGING_SSH_USER:-root}"
+        mkdir -p ~/.ssh
+        if [ -n "${STAGING_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+          printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
+          chmod 600 "$key_path"
+        else
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+          test -f "$key_path"
+        fi
+        ssh-keyscan -H "$staging_host" >> ~/.ssh/known_hosts
+        ssh -i "$key_path" "$staging_user@$staging_host" "mkdir -p /var/lib/xiaoxia-saas-staging/artifacts"
+        scp -i "$key_path" "dist/staging-artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz" \
+          "$staging_user@$staging_host:/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz"
+        scp -i "$key_path" "dist/staging-artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar" \
+          "$staging_user@$staging_host:/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar"
+
+    - name: Deploy staging stack on business host
+      shell: sh
+      env:
+        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
+      run: |
+        set -eu
+        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
+        staging_user="${STAGING_SSH_USER:-root}"
+        if [ -n "${STAGING_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+        else
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+        fi
+        ssh -i "$key_path" "$staging_user@$staging_host" "GITHUB_SHA='${GITHUB_SHA}' sh -s" <<'REMOTE_DEPLOY'
+        set -eu
+        artifact="/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz"
+        image_tar="/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar"
+        test -f "$artifact"
+        test -f "$image_tar"
+        test -f /var/lib/xiaoxia-saas-staging/.env
+        docker load -i "$image_tar"
         rm -rf /var/lib/xiaoxia-saas-staging/repo
         mkdir -p /var/lib/xiaoxia-saas-staging/repo
-        tar --exclude=.git -cf - . | tar -xf - -C /var/lib/xiaoxia-saas-staging/repo
-
-    - name: Verify staging env file
-      shell: sh
-      run: |
-        set -eu
-        test -f /var/lib/xiaoxia-saas-staging/.env
-
-    - name: Prepare staging env
-      shell: sh
-      run: |
-        set -eu
+        tar -xzf "$artifact" -C /var/lib/xiaoxia-saas-staging/repo
+        test -f /var/lib/xiaoxia-saas-staging/repo/apps/web/dist/index.html
         cp /var/lib/xiaoxia-saas-staging/.env /var/lib/xiaoxia-saas-staging/repo/.env
-
-    - name: Deploy staging stack
-      shell: sh
-      run: |
-        set -eu
         chmod +x /var/lib/xiaoxia-saas-staging/repo/infra/docker/deploy-staging.sh
-        HOST_PREFIX= WEB_PORT=3001 /var/lib/xiaoxia-saas-staging/repo/infra/docker/deploy-staging.sh
-
-    - name: Verify staging health
-      shell: sh
-      run: |
-        set -eu
+        WEB_IMAGE="xiaoxia-saas-web:staging-${GITHUB_SHA}" HOST_PREFIX= WEB_PORT=3001 REBUILD_BACKEND=0 BUILD_WEB=0 RUN_MIGRATIONS=0 /var/lib/xiaoxia-saas-staging/repo/infra/docker/deploy-staging.sh
         i=0
         while [ "$i" -lt 30 ]; do
           if wget -qO- http://127.0.0.1:8000/health; then
@@ -65,6 +115,7 @@ jobs:
           sleep 2
         done
         exit 1
+        REMOTE_DEPLOY
 
   build-production-runtime-images:
     name: Build Production Runtime Images