From 50b413a6faaf02152a5a4e7f829b9c107e97b239 Mon Sep 17 00:00:00 2001
From: xiaoxia-agent <agent@xiaoxiajianji.com>
Date: Wed, 16 Sep 2026 12:36:19 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E7=94=9F=E4=BA=A7=E7=8E=AF=E5=A2=83?=
 =?UTF-8?q?=E9=83=A8=E7=BD=B2=E4=B9=9F=E9=80=9A=E8=BF=87=20CI=20=E6=B8=B2?=
 =?UTF-8?q?=E6=9F=93=20+=20=E4=B8=8A=E4=BC=A0=20.env=EF=BC=88=E4=B8=8E=20s?=
 =?UTF-8?q?taging=20=E5=AF=B9=E9=BD=90=EF=BC=8C=E9=81=BF=E5=85=8D=20DOUBAO?=
 =?UTF-8?q?=20=E7=AD=89=E5=AF=86=E9=92=A5=E4=B8=A2=E5=A4=B1=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- deploy-production 新增 Render .env from template 步骤（复用 render_env.sh production）
- Deploy production over SSH 在拉镜像前加 SCP 上传渲染后的 .env + config diff 检查
- ci_production_deploy.sh: .env 不存在时给出清晰错误提示（对齐 staging）

本次主因修复：#1958 只补了 staging 的 DOUBAO 注入路径，但生产环境
deploy-production 直接读取服务器上手写的 .env，下次 release 到 main 时
AI 端点同样会因缺 DOUBAO_API_KEY 返回 502。本次同步补齐，确保生产也走
CI 统一渲染管线。
---
 .gitea/workflows/ci-pipeline.yml | 932 +++++++++++++++----------------
 scripts/ci_production_deploy.sh  |   6 +-
 2 files changed, 470 insertions(+), 468 deletions(-)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 2acb1799d..e8d1d0ce5 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -1,28 +1,28 @@
 name: CI/CD Pipeline
-on:
+true:
   push:
     branches:
     - main
     - develop
     tags:
-    - v*
+    - "v*"
   pull_request:
     branches:
     - main
     - develop
   schedule:
-    - cron: '0 19 * * *'  # UTC 19:00 = 北京时间凌晨3:00，每日全量CI回归
+  - cron: "0 19 * * *"
   workflow_dispatch:
     inputs:
       reason:
-        description: "触发原因"
+        description: 触发原因
         required: false
-        default: "手动触发 - CI漏触发补跑"
+        default: 手动触发 - CI漏触发补跑
 permissions:
   contents: read
   pull-requests: read
 concurrency:
-  group: ci-pipeline-${{ gitea.ref }}
+  group: "ci-pipeline-${{ gitea.ref }}"
   cancel-in-progress: true
 jobs:
   dedupe-check:
@@ -30,17 +30,17 @@ jobs:
     runs-on: ci-l1
     timeout-minutes: 3
     outputs:
-      skip_tests: ${{ steps.dedupe.outputs.skip_tests }}
-      reason: ${{ steps.dedupe.outputs.reason }}
+      skip_tests: "${{ steps.dedupe.outputs.skip_tests }}"
+      reason: "${{ steps.dedupe.outputs.reason }}"
     steps:
     - name: Decide test dedup
       id: dedupe
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        PR_NUMBER: ${{ github.event.pull_request.number }}
-        HEAD_SHA: ${{ github.sha }}
-        EVENT_NAME: ${{ github.event_name }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        PR_NUMBER: "${{ github.event.pull_request.number }}"
+        HEAD_SHA: "${{ github.sha }}"
+        EVENT_NAME: "${{ github.event_name }}"
       run: |
         set -eu
         if [ "$EVENT_NAME" != "pull_request" ]; then
@@ -73,20 +73,19 @@ jobs:
         echo "skip_tests=false" >> $GITHUB_OUTPUT
         echo "reason=no-duplicate" >> $GITHUB_OUTPUT
         echo "无重复 push 流水线，PR 侧测试照跑"
-
   check-frontend-only:
     name: Check if frontend-only change
     runs-on: ci-l2
-    if: github.event_name == 'pull_request'
+    if: "github.event_name == 'pull_request'"
     outputs:
-      skip_backend: ${{ steps.check.outputs.skip_backend }}
-      skip_frontend: ${{ steps.check.outputs.skip_frontend }}
+      skip_backend: "${{ steps.check.outputs.skip_backend }}"
+      skip_frontend: "${{ steps.check.outputs.skip_frontend }}"
     steps:
     - name: Check changed files
       id: check
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         set -eu
         # 优先用 git diff 判断 PR 改动范围（比 API 稳定）
@@ -122,22 +121,20 @@ jobs:
           echo "skip_frontend=false" >> $GITHUB_OUTPUT
           echo "🔧 包含全栈变更，运行完整CI"
         fi
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   validate-style:
     needs: dedupe-check
-    if: always() && needs.dedupe-check.outputs.skip_tests != 'true'
+    if: "always() && needs.dedupe-check.outputs.skip_tests != 'true'"
     name: Validate - Style
     runs-on: ci-l2
     timeout-minutes: 6
@@ -150,24 +147,24 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
       run: bash scripts/ci/step_timer_start.sh
     - name: Cache pip dependencies
-      uses: actions/cache@v4
+      uses: "actions/cache@v4"
       continue-on-error: true
       with:
         path: /root/.cache/pip
-        key: ${{ runner.os }}-pip-style-${{ hashFiles('requirements*.txt') }}
+        key: "${{ runner.os }}-pip-style-${{ hashFiles('requirements*.txt') }}"
         restore-keys: |
           ${{ runner.os }}-pip-style-
           ${{ runner.os }}-pip-
@@ -200,15 +197,15 @@ jobs:
       if: failure()
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        REVIEW_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        REVIEW_TOKEN: "${{ secrets.REVIEW_GITEA_TOKEN }}"
       run: python3 scripts/ci/auto_fix_formatting.py
     - name: CI failure notification
       if: failure()
       shell: sh
       env:
-        GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        CI_WEBHOOK_URL: ${{ secrets.CI_WEBHOOK_URL }}
+        GITEA_TOKEN: "${{ secrets.GITEA_TOKEN }}"
+        CI_WEBHOOK_URL: "${{ secrets.CI_WEBHOOK_URL }}"
       run: |
         set +e
         FAILED_JOB="Validate - Style" python3 scripts/ci_notify_failure.py
@@ -221,7 +218,7 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Validate - Style" python3 scripts/ci_notify.py
@@ -229,18 +226,16 @@ jobs:
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
-
   validate-security:
     needs: dedupe-check
-    if: always() && needs.dedupe-check.outputs.skip_tests != 'true'
+    if: "always() && needs.dedupe-check.outputs.skip_tests != 'true'"
     name: Validate - Security
     runs-on: ci-l2
     timeout-minutes: 8
@@ -253,24 +248,24 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
       run: bash scripts/ci/step_timer_start.sh
     - name: Cache pip dependencies
-      uses: actions/cache@v4
+      uses: "actions/cache@v4"
       continue-on-error: true
       with:
         path: /root/.cache/pip
-        key: ${{ runner.os }}-pip-security-${{ hashFiles('requirements*.txt') }}
+        key: "${{ runner.os }}-pip-security-${{ hashFiles('requirements*.txt') }}"
         restore-keys: |
           ${{ runner.os }}-pip-security-
           ${{ runner.os }}-pip-
@@ -297,17 +292,17 @@ jobs:
           sleep 5
         done
     - name: Run security checks
-      continue-on-error: true  # Security scan is advisory; runner failure must not block deploy
+      continue-on-error: true
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: bash scripts/ci/validate_security.sh
     - name: CI failure notification
       if: failure()
       shell: sh
       env:
-        GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        CI_WEBHOOK_URL: ${{ secrets.CI_WEBHOOK_URL }}
+        GITEA_TOKEN: "${{ secrets.GITEA_TOKEN }}"
+        CI_WEBHOOK_URL: "${{ secrets.CI_WEBHOOK_URL }}"
       run: |
         set +e
         FAILED_JOB="Validate - Security" python3 scripts/ci_notify_failure.py
@@ -320,7 +315,7 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Validate - Security" python3 scripts/ci_notify.py
@@ -328,25 +323,23 @@ jobs:
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
-
   validate-python:
     needs: dedupe-check
-    if: always() && needs.dedupe-check.outputs.skip_tests != 'true'
+    if: "always() && needs.dedupe-check.outputs.skip_tests != 'true'"
     name: Validate - Python (mypy + alembic)
     runs-on: ci-l2
     timeout-minutes: 10
     env:
       PIP_CACHE_DIR: /root/.cache/pip
       PIP_NO_CACHE_DIR: ''
-      DATABASE_URL: postgresql+psycopg://postgres:postgres@host.docker.internal:5432/xiaoxia_saas
+      DATABASE_URL: "postgresql+psycopg://postgres:postgres@host.docker.internal:5432/xiaoxia_saas"
       USE_IN_MEMORY_DB: 'false'
       CI_USE_SHARED_PG: 'false'
     permissions:
@@ -355,24 +348,24 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
       run: bash scripts/ci/step_timer_start.sh
     - name: Cache pip dependencies
-      uses: actions/cache@v4
+      uses: "actions/cache@v4"
       continue-on-error: true
       with:
         path: /root/.cache/pip
-        key: ${{ runner.os }}-pip-python-${{ hashFiles('requirements*.txt') }}
+        key: "${{ runner.os }}-pip-python-${{ hashFiles('requirements*.txt') }}"
         restore-keys: |
           ${{ runner.os }}-pip-python-
           ${{ runner.os }}-pip-
@@ -408,8 +401,8 @@ jobs:
       if: failure()
       shell: sh
       env:
-        GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        CI_WEBHOOK_URL: ${{ secrets.CI_WEBHOOK_URL }}
+        GITEA_TOKEN: "${{ secrets.GITEA_TOKEN }}"
+        CI_WEBHOOK_URL: "${{ secrets.CI_WEBHOOK_URL }}"
       run: |
         set +e
         FAILED_JOB="Validate - Python (mypy + alembic)" python3 scripts/ci_notify_failure.py
@@ -422,7 +415,7 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Validate - Python (mypy + alembic)" python3 scripts/ci_notify.py
@@ -430,18 +423,18 @@ jobs:
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
-
   unit-tests:
-    needs: [check-frontend-only, dedupe-check]
-    if: always() && needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_backend != 'true'
+    needs:
+    - check-frontend-only
+    - dedupe-check
+    if: "always() && needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_backend != 'true'"
     name: Unit Tests
     runs-on: ci-l2
     timeout-minutes: 8
@@ -457,14 +450,14 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -473,25 +466,25 @@ jobs:
       shell: sh
       run: bash scripts/ci/step_install_ffmpeg.sh
     - name: Cache pip dependencies
-      uses: actions/cache@v4
+      uses: "actions/cache@v4"
       continue-on-error: true
       with:
         path: /root/.cache/pip
-        key: ${{ runner.os }}-pip-unittests-${{ hashFiles('requirements*.txt') }}
+        key: "${{ runner.os }}-pip-unittests-${{ hashFiles('requirements*.txt') }}"
         restore-keys: |
           ${{ runner.os }}-pip-unittests-
           ${{ runner.os }}-pip-
     - name: Run unit tests with coverage
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: bash scripts/ci/run_unit_tests.sh
     - name: CI failure notification
       if: failure()
       shell: sh
       env:
-        GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        CI_WEBHOOK_URL: ${{ secrets.CI_WEBHOOK_URL }}
+        GITEA_TOKEN: "${{ secrets.GITEA_TOKEN }}"
+        CI_WEBHOOK_URL: "${{ secrets.CI_WEBHOOK_URL }}"
       run: |
         set +e
         FAILED_JOB="Unit Tests" python3 scripts/ci_notify_failure.py
@@ -504,33 +497,31 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Unit Tests" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   integration-tests:
     name: Integration Tests
     runs-on: ci-l2
     timeout-minutes: 30
-    if: always() && needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_backend != 'true'
+    if: "always() && needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_backend != 'true'"
     needs:
-      - check-frontend-only
-      - dedupe-check
+    - check-frontend-only
+    - dedupe-check
     env:
-      DATABASE_URL: postgresql+psycopg://postgres:postgres@host.docker.internal:5432/xiaoxia_saas
+      DATABASE_URL: "postgresql+psycopg://postgres:postgres@host.docker.internal:5432/xiaoxia_saas"
       USE_IN_MEMORY_DB: 'false'
       CI_USE_SHARED_PG: 'false'
       OSS_ACCESS_KEY_ID: placeholder
@@ -541,14 +532,14 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -560,8 +551,8 @@ jobs:
       if: failure()
       shell: sh
       env:
-        GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        CI_WEBHOOK_URL: ${{ secrets.CI_WEBHOOK_URL }}
+        GITEA_TOKEN: "${{ secrets.GITEA_TOKEN }}"
+        CI_WEBHOOK_URL: "${{ secrets.CI_WEBHOOK_URL }}"
       run: |
         set +e
         FAILED_JOB="Integration Tests" python3 scripts/ci_notify_failure.py
@@ -574,41 +565,41 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Integration Tests" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   frontend-lint:
     name: Frontend Lint
     runs-on: ci-l2
     timeout-minutes: 10
-    needs: [check-frontend-only, dedupe-check]
-    if: needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_frontend != 'true'
+    needs:
+    - check-frontend-only
+    - dedupe-check
+    if: "needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_frontend != 'true'"
     steps:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -626,13 +617,13 @@ jobs:
         done
     - name: Run ESLint
       shell: sh
-      run: bash scripts/ci/step_frontend_run.sh "npx --no-install eslint src --ext .ts,.tsx --max-warnings 0"
+      run: "bash scripts/ci/step_frontend_run.sh \"npx --no-install eslint src --ext .ts,.tsx --max-warnings 0\""
     - name: Run TypeScript type check
       shell: sh
-      run: bash scripts/ci/step_frontend_run.sh "npx --no-install tsc --noEmit"
+      run: "bash scripts/ci/step_frontend_run.sh \"npx --no-install tsc --noEmit\""
     - name: Run Prettier check
       shell: sh
-      run: bash scripts/ci/step_frontend_run.sh "npx --no-install prettier --check \"src/**/*.{ts,tsx,md}\""
+      run: "bash scripts/ci/step_frontend_run.sh \"npx --no-install prettier --check \\\"src/**/*.{ts,tsx,md}\\\"\""
     - name: Job duration summary
       if: always()
       shell: sh
@@ -642,51 +633,51 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Frontend Lint" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   frontend-unit-test:
     name: Frontend Unit Tests
     runs-on: ci-l2
     timeout-minutes: 15
-    needs: [check-frontend-only, dedupe-check]
-    if: always() && needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_frontend != 'true'
+    needs:
+    - check-frontend-only
+    - dedupe-check
+    if: "always() && needs.dedupe-check.outputs.skip_tests != 'true' && needs.check-frontend-only.outputs.skip_frontend != 'true'"
     steps:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
       run: bash scripts/ci/step_timer_start.sh
     - name: Cache npm dependencies
-      uses: actions/cache@v4
+      uses: "actions/cache@v4"
       continue-on-error: true
       with:
         path: /root/.npm
-        key: ${{ runner.os }}-npm-vitest-${{ hashFiles('apps/web/package-lock.json') }}
+        key: "${{ runner.os }}-npm-vitest-${{ hashFiles('apps/web/package-lock.json') }}"
         restore-keys: |
           ${{ runner.os }}-npm-
     - name: Install frontend dependencies (vitest only, with retry)
@@ -702,7 +693,7 @@ jobs:
     - name: Run Vitest (incremental for PRs, full for main branches)
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: bash scripts/ci/vitest_incremental.sh
     - name: Job duration summary
       if: always()
@@ -713,28 +704,25 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Frontend Unit Tests" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
-
   build-pr:
-    name: PR Build ${{ matrix.service_display }} Image
+    name: "PR Build ${{ matrix.service_display }} Image"
     runs-on: runtime-builder
-    timeout-minutes: ${{ matrix.timeout }}
+    timeout-minutes: "${{ matrix.timeout }}"
     needs: check-frontend-only
     if: |
       github.event_name == 'pull_request' && (
@@ -767,14 +755,14 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -782,10 +770,10 @@ jobs:
     - name: Docker login to Registry (for cache read)
       shell: sh
       env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
         GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        GITEA_REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
       run: |
         set -eu
         for i in 1 2 3; do
@@ -798,14 +786,14 @@ jobs:
           sleep 5
         done
     - name: Pre-build worker base image (fallback if not exist)
-      if: matrix.service == 'worker'
+      if: "matrix.service == 'worker'"
       id: prebuild
       shell: sh
       run: |
         set -eu
         REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
         BASE_IMAGE="${REGISTRY}/saas-worker-base:latest"
-        
+
         # 尝试拉取基础镜像
         echo "检查 Worker 基础镜像..."
         if docker pull "$BASE_IMAGE" 2>/dev/null; then
@@ -817,7 +805,6 @@ jobs:
           echo "fallback=true" >> $GITHUB_OUTPUT
           echo "✅ Worker 基础镜像本地构建完成"
         fi
-
     - name: Build PR image (verify only, no push)
       shell: sh
       run: |
@@ -863,7 +850,7 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="PR Build ${{ matrix.service_display }} Image" python3 scripts/ci_notify.py
@@ -871,45 +858,43 @@ jobs:
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   check-push-paths:
     name: Check push changed paths
     runs-on: ci-l2
-    if: github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')
+    if: "github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')"
     outputs:
-      skip_backend: ${{ steps.check.outputs.skip_backend }}
-      skip_frontend: ${{ steps.check.outputs.skip_frontend }}
+      skip_backend: "${{ steps.check.outputs.skip_backend }}"
+      skip_frontend: "${{ steps.check.outputs.skip_frontend }}"
     steps:
     - name: Check changed paths
       id: check
       shell: bash
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_push_paths.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_push_paths.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_push_paths.sh
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   build-staging:
-    name: Build Staging ${{ matrix.service_display }} Image
+    name: "Build Staging ${{ matrix.service_display }} Image"
     runs-on: runtime-builder
-    timeout-minutes: ${{ matrix.timeout }}
+    timeout-minutes: "${{ matrix.timeout }}"
     needs: check-push-paths
     if: |
       github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop') && (
@@ -942,14 +927,14 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -957,10 +942,10 @@ jobs:
     - name: Docker login to Registry
       shell: sh
       env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
         GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        GITEA_REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
       run: |
         set -eu
         # Docker login 带重试（网络波动时自动重试）
@@ -984,17 +969,15 @@ jobs:
           echo "CACHE_MODE=read-only" >> $GITHUB_ENV
           echo "Cache mode: read-only"
         fi
-
     - name: Ensure persistent buildx builder
       shell: sh
       run: bash scripts/ci/ensure_persistent_builder.sh
-
     - name: Pre-pull worker base image (fallback build if not exist)
-      if: matrix.service == 'worker'
+      if: "matrix.service == 'worker'"
       shell: sh
       env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
       run: |
         set -eu
         REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
@@ -1010,8 +993,7 @@ jobs:
             -t "$BASE_IMAGE" --push .
           echo "✅ Worker 基础镜像构建推送完成"
         fi
-
-    - name: Build and push ${{ matrix.service_display }} image
+    - name: "Build and push ${{ matrix.service_display }} image"
       shell: sh
       run: |
         set -eu
@@ -1051,7 +1033,6 @@ jobs:
         done
 
         echo "${{ matrix.service_display }} image pushed: ${IMAGE_TAG} (+ ${PUSHED_TAGS_SUMMARY})"
-
     - name: Job duration summary
       if: always()
       shell: sh
@@ -1061,25 +1042,23 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Build Staging ${{ matrix.service_display }} Image" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   retag-staging-skipped:
-    name: Retag skipped Staging ${{ matrix.service_display }} Image
+    name: "Retag skipped Staging ${{ matrix.service_display }} Image"
     runs-on: ci-l2
     timeout-minutes: 10
     needs:
@@ -1107,16 +1086,16 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Docker login to Registry
       shell: sh
       env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
         GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        GITEA_REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
       run: |
         set -eu
         for i in 1 2 3; do
@@ -1142,7 +1121,7 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Retag Staging ${{ matrix.service_display }} Image" python3 scripts/ci_notify.py
@@ -1150,31 +1129,30 @@ jobs:
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   deploy-staging:
     name: Deploy Staging (Watchtower auto-deploy)
     runs-on: ci-l2
     timeout-minutes: 15
     concurrency:
-      group: deploy-staging-${{ gitea.ref }}
+      group: "deploy-staging-${{ gitea.ref }}"
       cancel-in-progress: false
     needs:
     - check-push-paths
     - build-staging
     - retag-staging-skipped
-    if: (!cancelled()) && github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')
+    if: "(!cancelled()) && github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')"
     steps:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Record job start time
@@ -1184,32 +1162,32 @@ jobs:
       continue-on-error: true
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=start JOB_NAME="Deploy Staging" python3 scripts/ci_notify.py
     - name: Render .env from template
       shell: sh
       env:
-        STAGING_DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }}
-        STAGING_REDIS_URL: ${{ secrets.STAGING_REDIS_URL }}
-        STAGING_CELERY_BROKER_URL: ${{ secrets.STAGING_CELERY_BROKER_URL }}
-        STAGING_CELERY_RESULT_BACKEND: ${{ secrets.STAGING_CELERY_RESULT_BACKEND }}
-        STAGING_JWT_SECRET_KEY: ${{ secrets.STAGING_JWT_SECRET_KEY }}
-        STAGING_MINIO_ENDPOINT: ${{ secrets.STAGING_MINIO_ENDPOINT }}
-        STAGING_MINIO_ACCESS_KEY: ${{ secrets.STAGING_MINIO_ACCESS_KEY }}
-        STAGING_MINIO_SECRET_KEY: ${{ secrets.STAGING_MINIO_SECRET_KEY }}
-        STAGING_MINIO_BUCKET: ${{ secrets.STAGING_MINIO_BUCKET }}
-        OSS_ACCESS_KEY_ID: ${{ secrets.OSS_ACCESS_KEY_ID }}
-        OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
-        COSYVOICE_API_KEY: ${{ secrets.COSYVOICE_API_KEY }}
-        DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }}
-        MEDIAKIT_API_KEY: ${{ secrets.MEDIAKIT_API_KEY }}
-        DOUBAO_API_KEY: ${{ secrets.DOUBAO_API_KEY }}
-        DOUBAO_MODEL: ${{ secrets.DOUBAO_MODEL }}
-        DOUBAO_BASE_URL: ${{ secrets.DOUBAO_BASE_URL }}
-        WECHAT_APP_ID: ${{ secrets.WECHAT_APP_ID }}
-        WECHAT_APP_SECRET: ${{ secrets.WECHAT_APP_SECRET }}
+        STAGING_DATABASE_URL: "${{ secrets.STAGING_DATABASE_URL }}"
+        STAGING_REDIS_URL: "${{ secrets.STAGING_REDIS_URL }}"
+        STAGING_CELERY_BROKER_URL: "${{ secrets.STAGING_CELERY_BROKER_URL }}"
+        STAGING_CELERY_RESULT_BACKEND: "${{ secrets.STAGING_CELERY_RESULT_BACKEND }}"
+        STAGING_JWT_SECRET_KEY: "${{ secrets.STAGING_JWT_SECRET_KEY }}"
+        STAGING_MINIO_ENDPOINT: "${{ secrets.STAGING_MINIO_ENDPOINT }}"
+        STAGING_MINIO_ACCESS_KEY: "${{ secrets.STAGING_MINIO_ACCESS_KEY }}"
+        STAGING_MINIO_SECRET_KEY: "${{ secrets.STAGING_MINIO_SECRET_KEY }}"
+        STAGING_MINIO_BUCKET: "${{ secrets.STAGING_MINIO_BUCKET }}"
+        OSS_ACCESS_KEY_ID: "${{ secrets.OSS_ACCESS_KEY_ID }}"
+        OSS_ACCESS_KEY_SECRET: "${{ secrets.OSS_ACCESS_KEY_SECRET }}"
+        COSYVOICE_API_KEY: "${{ secrets.COSYVOICE_API_KEY }}"
+        DASHSCOPE_API_KEY: "${{ secrets.DASHSCOPE_API_KEY }}"
+        MEDIAKIT_API_KEY: "${{ secrets.MEDIAKIT_API_KEY }}"
+        DOUBAO_API_KEY: "${{ secrets.DOUBAO_API_KEY }}"
+        DOUBAO_MODEL: "${{ secrets.DOUBAO_MODEL }}"
+        DOUBAO_BASE_URL: "${{ secrets.DOUBAO_BASE_URL }}"
+        WECHAT_APP_ID: "${{ secrets.WECHAT_APP_ID }}"
+        WECHAT_APP_SECRET: "${{ secrets.WECHAT_APP_SECRET }}"
       run: |
         set -eu
         echo "Rendering .env from template + secrets..."
@@ -1221,10 +1199,10 @@ jobs:
     - name: Docker login to Registry
       shell: sh
       env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
         GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        GITEA_REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
       run: |
         set -eu
         # Docker login 带重试（网络波动时自动重试）
@@ -1244,17 +1222,16 @@ jobs:
         set -eu
         apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null 2>&1
         echo "openssh-client installed"
-
     - name: Deploy staging over SSH (Registry pull)
       if: success()
       shell: sh
       env:
-        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
-        STAGING_SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
-        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        STAGING_SSH_HOST: "${{ secrets.STAGING_SSH_HOST }}"
+        STAGING_SSH_USER: "${{ secrets.STAGING_SSH_USER }}"
+        STAGING_SSH_PORT: "${{ secrets.STAGING_SSH_PORT }}"
+        STAGING_SSH_KEY: "${{ secrets.STAGING_SSH_KEY }}"
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
       run: |
         set -eux
         # CI runner (act_runner) 部署在 116 staging 本机（116.62.226.203 公网 22 未开放），
@@ -1316,18 +1293,17 @@ jobs:
 
         # 清理 CI runner 上的渲染文件
         rm -f .env.rendered
-
     - name: Staging health check + auto rollback
       if: success()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
-        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
-        STAGING_SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
-        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
+        STAGING_SSH_HOST: "${{ secrets.STAGING_SSH_HOST }}"
+        STAGING_SSH_USER: "${{ secrets.STAGING_SSH_USER }}"
+        STAGING_SSH_PORT: "${{ secrets.STAGING_SSH_PORT }}"
+        STAGING_SSH_KEY: "${{ secrets.STAGING_SSH_KEY }}"
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
       run: |
         set -eu
         echo "=========================================="
@@ -1344,7 +1320,7 @@ jobs:
       if: success()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=success JOB_NAME="Deploy Staging" python3 scripts/ci_notify.py
@@ -1353,41 +1329,39 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Deploy Staging" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   staging-e2e:
     name: Staging E2E Tests
     runs-on: runtime-builder
     timeout-minutes: 15
-    if: success() && (github.ref_name == 'develop' || github.ref_name == 'main')
+    if: "success() && (github.ref_name == 'develop' || github.ref_name == 'main')"
     needs: deploy-staging
     steps:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -1396,7 +1370,6 @@ jobs:
       shell: bash
       run: |
         bash scripts/ci/run_staging_tests.sh e2e
-
     - name: Job duration summary
       if: always()
       shell: sh
@@ -1406,41 +1379,39 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Staging E2E Tests" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   staging-api-tests:
     name: Staging API Integration Tests
     runs-on: runtime-builder
     timeout-minutes: 10
-    if: success() && (github.ref_name == 'develop' || github.ref_name == 'main')
+    if: "success() && (github.ref_name == 'develop' || github.ref_name == 'main')"
     needs: deploy-staging
     steps:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -1449,7 +1420,6 @@ jobs:
       shell: bash
       run: |
         bash scripts/ci/run_staging_tests.sh api
-
     - name: Job duration summary
       if: always()
       shell: sh
@@ -1459,34 +1429,32 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Staging API Integration Tests" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   build-production:
-    name: Build Production ${{ matrix.service_display }} Image
+    name: "Build Production ${{ matrix.service_display }} Image"
     runs-on: runtime-builder
-    timeout-minutes: ${{ matrix.timeout }}
+    timeout-minutes: "${{ matrix.timeout }}"
     needs:
-      - validate-style
-      - validate-security
-      - validate-python
-      - unit-tests
-      - frontend-unit-test
-    if: github.event_name == 'push' && github.ref_name == 'main' && !failure() && !cancelled()
+    - validate-style
+    - validate-security
+    - validate-python
+    - unit-tests
+    - frontend-unit-test
+    if: "github.event_name == 'push' && github.ref_name == 'main' && !failure() && !cancelled()"
     strategy:
       fail-fast: false
       matrix:
@@ -1513,14 +1481,14 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Zombie run selfcheck
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-        GITHUB_RUN_ID: ${{ github.run_id }}
+        GITHUB_TOKEN: "${{ github.token }}"
+        GITHUB_RUN_ID: "${{ github.run_id }}"
       run: bash scripts/ci/ci_run_selfcheck.sh
     - name: Record job start time
       shell: sh
@@ -1528,10 +1496,10 @@ jobs:
     - name: Docker login to Registry
       shell: sh
       env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
         GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        GITEA_REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
       run: |
         set -eu
         # Docker login 带重试（网络波动时自动重试）
@@ -1550,7 +1518,6 @@ jobs:
         set -eu
         echo "CACHE_MODE=read-only" >> $GITHUB_ENV
         echo "Cache mode: read-only (production build uses cached layers)"
-
     - name: Setup buildx builder
       shell: sh
       run: |
@@ -1563,8 +1530,7 @@ jobs:
           echo "Using existing ci-builder"
         fi
         docker buildx inspect --bootstrap
-
-    - name: Build and push production ${{ matrix.service_display }} image (with retry)
+    - name: "Build and push production ${{ matrix.service_display }} image (with retry)"
       shell: bash
       run: |
         set -eu
@@ -1605,38 +1571,36 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Build Production ${{ matrix.service_display }} Image" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   deploy-production:
     name: Deploy Production
     runs-on: runtime-builder
     timeout-minutes: 30
     concurrency:
-      group: deploy-production-${{ gitea.ref }}
+      group: "deploy-production-${{ gitea.ref }}"
       cancel-in-progress: false
-    if: github.event_name == 'push' && github.ref_name == 'main'
+    if: "github.event_name == 'push' && github.ref_name == 'main'"
     needs:
     - build-production
     steps:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Record job start time
@@ -1646,10 +1610,36 @@ jobs:
       continue-on-error: true
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=start JOB_NAME="Deploy Production" python3 scripts/ci_notify.py
+    - name: Render .env from template
+      shell: sh
+      env:
+        PRODUCTION_DATABASE_URL: "${{ secrets.PRODUCTION_DATABASE_URL }}"
+        PRODUCTION_REDIS_URL: "${{ secrets.PRODUCTION_REDIS_URL }}"
+        PRODUCTION_CELERY_BROKER_URL: "${{ secrets.PRODUCTION_CELERY_BROKER_URL }}"
+        PRODUCTION_CELERY_RESULT_BACKEND: "${{ secrets.PRODUCTION_CELERY_RESULT_BACKEND }}"
+        PRODUCTION_JWT_SECRET_KEY: "${{ secrets.PRODUCTION_JWT_SECRET_KEY }}"
+        OSS_ACCESS_KEY_ID: "${{ secrets.OSS_ACCESS_KEY_ID }}"
+        OSS_ACCESS_KEY_SECRET: "${{ secrets.OSS_ACCESS_KEY_SECRET }}"
+        COSYVOICE_API_KEY: "${{ secrets.COSYVOICE_API_KEY }}"
+        DASHSCOPE_API_KEY: "${{ secrets.DASHSCOPE_API_KEY }}"
+        MEDIAKIT_API_KEY: "${{ secrets.MEDIAKIT_API_KEY }}"
+        DOUBAO_API_KEY: "${{ secrets.DOUBAO_API_KEY }}"
+        DOUBAO_MODEL: "${{ secrets.DOUBAO_MODEL }}"
+        DOUBAO_BASE_URL: "${{ secrets.DOUBAO_BASE_URL }}"
+        WECHAT_APP_ID: "${{ secrets.WECHAT_APP_ID }}"
+        WECHAT_APP_SECRET: "${{ secrets.WECHAT_APP_SECRET }}"
+      run: |
+        set -eu
+        echo "Rendering .env from template + secrets..."
+        bash scripts/render_env.sh production
+        echo "✅ .env rendered (file contains secrets, not printed to log)"
+        # 验证文件存在且非空
+        test -s .env.rendered
+        echo "✅ .env.rendered validated ($(wc -l < .env.rendered) lines)"
     - name: Install SSH client
       shell: sh
       run: |
@@ -1660,12 +1650,12 @@ jobs:
       if: success()
       shell: sh
       env:
-        PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
-        PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
-        PRODUCTION_SSH_PORT: ${{ secrets.PRODUCTION_SSH_PORT }}
-        PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        PRODUCTION_SSH_HOST: "${{ secrets.PRODUCTION_SSH_HOST }}"
+        PRODUCTION_SSH_USER: "${{ secrets.PRODUCTION_SSH_USER }}"
+        PRODUCTION_SSH_PORT: "${{ secrets.PRODUCTION_SSH_PORT }}"
+        PRODUCTION_SSH_KEY: "${{ secrets.PRODUCTION_SSH_KEY }}"
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
       run: |
         set -eux
         production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
@@ -1701,20 +1691,39 @@ jobs:
         ssh -p "$production_port" -i "$key_path" -o StrictHostKeyChecking=no "${production_user}@${production_host}" "echo SSH_CONNECTION_OK && hostname"
         echo "SSH connection verified"
 
+        # 配置 Diff 检查：下载服务器当前 .env，对比渲染结果，检测漂移
+        echo "Running config diff check..."
+        scp -P "$production_port" -i "$key_path" -o StrictHostKeyChecking=no \
+          "${production_user}@${production_host}:/var/lib/xiaoxia-saas-production/.env" .env.current 2>/dev/null \
+          || touch .env.current  # 首次部署时文件不存在，创建空文件
+        bash scripts/config_diff_check.sh .env.rendered .env.current
+        rm -f .env.current
+        echo "Config diff check done"
+
+        # 上传渲染后的 .env 到服务器（替代服务器上旧的 .env）
+        echo "Uploading rendered .env to production server..."
+        ssh -p "$production_port" -i "$key_path" -o StrictHostKeyChecking=no "${production_user}@${production_host}" \
+          "cp -f /var/lib/xiaoxia-saas-production/.env /var/lib/xiaoxia-saas-production/.env.bak.\$(date +%Y%m%d%H%M%S) 2>/dev/null || true"
+        scp -P "$production_port" -i "$key_path" -o StrictHostKeyChecking=no .env.rendered \
+          "${production_user}@${production_host}:/var/lib/xiaoxia-saas-production/.env"
+        echo "✅ .env uploaded to production server"
+
+        # 清理 CI runner 上的渲染文件
+        rm -f .env.rendered
+
         # 通过环境变量传递凭证，避免命令行引号转义问题
         cat scripts/ci_production_deploy.sh | ssh -p "$production_port" -i "$key_path" -o StrictHostKeyChecking=no "${production_user}@${production_host}" "IMAGE_TAG=${GITHUB_SHA} ACR_USERNAME=${ACR_USERNAME} ACR_PASSWORD=${ACR_PASSWORD} sh"
-
     - name: Production health check + auto rollback
       if: success()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-        PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
-        PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
-        PRODUCTION_SSH_PORT: ${{ secrets.PRODUCTION_SSH_PORT }}
-        PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
+        PRODUCTION_SSH_HOST: "${{ secrets.PRODUCTION_SSH_HOST }}"
+        PRODUCTION_SSH_USER: "${{ secrets.PRODUCTION_SSH_USER }}"
+        PRODUCTION_SSH_PORT: "${{ secrets.PRODUCTION_SSH_PORT }}"
+        PRODUCTION_SSH_KEY: "${{ secrets.PRODUCTION_SSH_KEY }}"
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
       run: |
         set -eu
         echo "=========================================="
@@ -1731,7 +1740,7 @@ jobs:
       if: success()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=success JOB_NAME="Deploy Production" python3 scripts/ci_notify.py
@@ -1740,34 +1749,31 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Deploy Production" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   production-e2e:
     name: Production Browser E2E
     runs-on: runtime-builder
     timeout-minutes: 15
-    # if: removed - runs after deploy-production succeeds
     needs: deploy-production
     steps:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Record job start time
@@ -1785,7 +1791,6 @@ jobs:
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
           bash -c 'for i in 1 2 3; do npm ci --registry=https://registry.npmmirror.com && break; echo "npm ci attempt $i failed, retrying..."; sleep 15; done && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts'
-
     - name: Job duration summary
       if: always()
       shell: sh
@@ -1795,30 +1800,28 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Production Browser E2E" python3 scripts/ci_notify.py
-
     - name: Report CI trace
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   acr-cleanup:
     name: ACR Image Cleanup
     runs-on: ci-l2
     timeout-minutes: 10
     needs:
     - deploy-staging
-    if: github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')
+    if: "github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')"
     env:
       ACR_REGISTRY: xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com
       ACR_NAMESPACE: xiaoxiakeji
@@ -1826,7 +1829,7 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Record job start time
@@ -1835,16 +1838,15 @@ jobs:
     - name: Run ACR cleanup
       shell: sh
       env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-        PROTECTED_TAG: ${{ github.sha }}
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
+        PROTECTED_TAG: "${{ github.sha }}"
       run: |
         set -eu
         python3 scripts/ci/acr_cleanup.py \
           --keep 20 \
           --pr-days 7 \
           --execute
-
     - name: Job duration summary
       if: always()
       shell: sh
@@ -1854,7 +1856,7 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="ACR Image Cleanup" python3 scripts/ci_notify.py
@@ -1862,14 +1864,13 @@ jobs:
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   canary-release:
     name: Canary Release to Production
     runs-on: runtime-builder
@@ -1877,7 +1878,7 @@ jobs:
     concurrency:
       group: canary-release-production
       cancel-in-progress: false
-    if: github.event_name == 'push' && github.ref_name == 'main'
+    if: "github.event_name == 'push' && github.ref_name == 'main'"
     needs:
     - build-production
     - staging-api-tests
@@ -1885,7 +1886,7 @@ jobs:
     - name: Checkout code
       shell: sh
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
       run: |
         curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_checkout.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_checkout.sh
     - name: Record job start time
@@ -1895,7 +1896,7 @@ jobs:
       continue-on-error: true
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=start JOB_NAME="Canary Release" python3 scripts/ci_notify.py
@@ -1908,13 +1909,13 @@ jobs:
     - name: Run canary release
       shell: bash
       env:
-        PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
-        PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
-        PRODUCTION_SSH_PORT: ${{ secrets.PRODUCTION_SSH_PORT }}
-        PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        PRODUCTION_SSH_HOST: "${{ secrets.PRODUCTION_SSH_HOST }}"
+        PRODUCTION_SSH_USER: "${{ secrets.PRODUCTION_SSH_USER }}"
+        PRODUCTION_SSH_PORT: "${{ secrets.PRODUCTION_SSH_PORT }}"
+        PRODUCTION_SSH_KEY: "${{ secrets.PRODUCTION_SSH_KEY }}"
+        ACR_USERNAME: "${{ secrets.ACR_USERNAME }}"
+        ACR_PASSWORD: "${{ secrets.ACR_PASSWORD }}"
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set -eu
         IMAGE_TAG="main-${GITHUB_SHA::8}"
@@ -1930,7 +1931,7 @@ jobs:
       if: success()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=success JOB_NAME="Canary Release" python3 scripts/ci_notify.py
@@ -1939,7 +1940,7 @@ jobs:
       if: failure()
       shell: sh
       env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        CI_NOTIFY_WEBHOOK: "${{ secrets.CI_NOTIFY_WEBHOOK }}"
       run: |
         set +e
         NOTIFY_MODE=failure JOB_NAME="Canary Release" python3 scripts/ci_notify.py
@@ -1947,195 +1948,192 @@ jobs:
       if: always()
       shell: sh
       env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
       run: |
         STATUS="ok"
         [ ${{ job.status }} = "success" ] || STATUS="error"
         START_TIME=""
         [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
         python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   ci-gate:
     name: CI Gate
     runs-on: ci-l2
-    if: always() && github.event_name == 'pull_request'
+    if: "always() && github.event_name == 'pull_request'"
     needs:
-      - check-frontend-only
-      - validate-style
-      - validate-security
-      - validate-python
-      - unit-tests
-      - integration-tests
-      - frontend-lint
-      - frontend-unit-test
-      - build-pr
+    - check-frontend-only
+    - validate-style
+    - validate-security
+    - validate-python
+    - unit-tests
+    - integration-tests
+    - frontend-lint
+    - frontend-unit-test
+    - build-pr
     timeout-minutes: 3
     steps:
-      - name: Evaluate CI Gate
-        id: gate
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          RESULT_CHECK_FRONTEND: ${{ needs.check-frontend-only.result }}
-          RESULT_STYLE: ${{ needs.validate-style.result }}
-          RESULT_SECURITY: ${{ needs.validate-security.result }}
-          RESULT_PYTHON: ${{ needs.validate-python.result }}
-          RESULT_UNIT_TESTS: ${{ needs.unit-tests.result }}
-          RESULT_INTEGRATION: ${{ needs.integration-tests.result }}
-          RESULT_FRONTEND_LINT: ${{ needs.frontend-lint.result }}
-          RESULT_FRONTEND_UNIT: ${{ needs.frontend-unit-test.result }}
-          RESULT_BUILD_PR: ${{ needs.build-pr.result }}
-        run: |
-          set -eu
-          echo "=== CI Gate 评估 ==="
-          echo ""
-          echo "各job结果:"
-          echo "  check-frontend-only: $RESULT_CHECK_FRONTEND"
-          echo "  validate-style: $RESULT_STYLE"
-          echo "  validate-security: $RESULT_SECURITY"
-          echo "  validate-python: $RESULT_PYTHON"
-          echo "  unit-tests: $RESULT_UNIT_TESTS"
-          echo "  integration-tests: $RESULT_INTEGRATION"
-          echo "  frontend-lint: $RESULT_FRONTEND_LINT"
-          echo "  frontend-unit-test: $RESULT_FRONTEND_UNIT"
-          echo "  build-pr: $RESULT_BUILD_PR"
+    - name: Evaluate CI Gate
+      id: gate
+      shell: bash
+      env:
+        GITHUB_TOKEN: "${{ github.token }}"
+        PR_NUMBER: "${{ github.event.pull_request.number }}"
+        PR_HEAD_SHA: "${{ github.event.pull_request.head.sha }}"
+        RESULT_CHECK_FRONTEND: "${{ needs.check-frontend-only.result }}"
+        RESULT_STYLE: "${{ needs.validate-style.result }}"
+        RESULT_SECURITY: "${{ needs.validate-security.result }}"
+        RESULT_PYTHON: "${{ needs.validate-python.result }}"
+        RESULT_UNIT_TESTS: "${{ needs.unit-tests.result }}"
+        RESULT_INTEGRATION: "${{ needs.integration-tests.result }}"
+        RESULT_FRONTEND_LINT: "${{ needs.frontend-lint.result }}"
+        RESULT_FRONTEND_UNIT: "${{ needs.frontend-unit-test.result }}"
+        RESULT_BUILD_PR: "${{ needs.build-pr.result }}"
+      run: |
+        set -eu
+        echo "=== CI Gate 评估 ==="
+        echo ""
+        echo "各job结果:"
+        echo "  check-frontend-only: $RESULT_CHECK_FRONTEND"
+        echo "  validate-style: $RESULT_STYLE"
+        echo "  validate-security: $RESULT_SECURITY"
+        echo "  validate-python: $RESULT_PYTHON"
+        echo "  unit-tests: $RESULT_UNIT_TESTS"
+        echo "  integration-tests: $RESULT_INTEGRATION"
+        echo "  frontend-lint: $RESULT_FRONTEND_LINT"
+        echo "  frontend-unit-test: $RESULT_FRONTEND_UNIT"
+        echo "  build-pr: $RESULT_BUILD_PR"
 
-          # 查询 AI Code Review 状态（跨workflow，读commit status）
-          AI_REVIEW_STATUS="pending"
-          AI_REVIEW_DESC=""
-          STATUS_JSON=$(curl -sfH "Authorization: token $GITHUB_TOKEN" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/commits/${PR_HEAD_SHA}/status" 2>/dev/null || true)
-          if [ -n "$STATUS_JSON" ]; then
-            AI_STATUS=$(echo "$STATUS_JSON" | python3 -c "
-          import json,sys
-          try:
-              data=json.load(sys.stdin)
-              for s in data.get('statuses',[]):
-                  if 'AI Code Review' in s.get('context',''):
-                      print(s['state']+'|'+s.get('description',''))
-                      break
-          except: pass
-          " 2>/dev/null)
-            if [ -n "$AI_STATUS" ]; then
-              AI_REVIEW_STATUS="${AI_STATUS%%|*}"
-              AI_REVIEW_DESC="${AI_STATUS#*|}"
-            fi
+        # 查询 AI Code Review 状态（跨workflow，读commit status）
+        AI_REVIEW_STATUS="pending"
+        AI_REVIEW_DESC=""
+        STATUS_JSON=$(curl -sfH "Authorization: token $GITHUB_TOKEN" \
+          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/commits/${PR_HEAD_SHA}/status" 2>/dev/null || true)
+        if [ -n "$STATUS_JSON" ]; then
+          AI_STATUS=$(echo "$STATUS_JSON" | python3 -c "
+        import json,sys
+        try:
+            data=json.load(sys.stdin)
+            for s in data.get('statuses',[]):
+                if 'AI Code Review' in s.get('context',''):
+                    print(s['state']+'|'+s.get('description',''))
+                    break
+        except: pass
+        " 2>/dev/null)
+          if [ -n "$AI_STATUS" ]; then
+            AI_REVIEW_STATUS="${AI_STATUS%%|*}"
+            AI_REVIEW_DESC="${AI_STATUS#*|}"
           fi
-          echo "  ai-code-review: $AI_REVIEW_STATUS ($AI_REVIEW_DESC)"
+        fi
+        echo "  ai-code-review: $AI_REVIEW_STATUS ($AI_REVIEW_DESC)"
 
+        echo ""
+
+        # 判断PR类型
+        SKIP_BACKEND="${{ needs.check-frontend-only.outputs.skip_backend }}"
+        SKIP_FRONTEND="${{ needs.check-frontend-only.outputs.skip_frontend }}"
+        echo "PR类型: skip_backend=$SKIP_BACKEND, skip_frontend=$SKIP_FRONTEND"
+
+        # 必填检查项（根据PR类型决定）
+        # 通用检查（所有PR都必须过）
+        REQUIRED_GENERAL=(
+          "validate-style:$RESULT_STYLE"
+          "validate-security:$RESULT_SECURITY"
+          "validate-python:$RESULT_PYTHON"
+          "frontend-lint:$RESULT_FRONTEND_LINT"
+          "build-pr:$RESULT_BUILD_PR"
+          "ai-code-review:$AI_REVIEW_STATUS"
+        )
+
+        # 后端检查
+        REQUIRED_BACKEND=(
+          "unit-tests:$RESULT_UNIT_TESTS"
+          "integration-tests:$RESULT_INTEGRATION"
+        )
+
+        # 前端检查
+        REQUIRED_FRONTEND=(
+          "frontend-unit-test:$RESULT_FRONTEND_UNIT"
+        )
+
+        ALL_PASSED=true
+        FAILED_ITEMS=()
+
+        check_job() {
+          local name=$1
+          local result=$2
+          if [ "$result" = "success" ]; then
+            echo "  ✅ $name: success"
+          elif [ "$result" = "skipped" ]; then
+            echo "  ⏭️  $name: skipped（跳过，不影响）"
+          else
+            echo "  ❌ $name: $result"
+            ALL_PASSED=false
+            FAILED_ITEMS+=("$name=$result")
+          fi
+        }
+
+        echo ""
+        echo "=== 通用检查（所有PR必填）==="
+        for item in "${REQUIRED_GENERAL[@]}"; do
+          name="${item%%:*}"
+          result="${item##*:}"
+          # AI Code Review pending时不阻塞（可能还在跑），等它跑完自然会重跑Gate
+          if [ "$name" = "ai-code-review" ] && [ "$result" = "pending" ]; then
+            echo "  ⏳ $name: pending（审查中，暂不阻塞）"
+            continue
+          fi
+          # Security scan cancelled/failed时不阻塞部署（runner故障不应卡住流水线）
+          if [ "$name" = "validate-security" ] && { [ "$result" = "cancelled" ] || [ "$result" = "failure" ]; }; then
+            echo "  ⚠️  $name: $result（安全扫描为非阻塞项，不卡住部署）"
+            continue
+          fi
+          check_job "$name" "$result"
+        done
+
+        if [ "$SKIP_BACKEND" != "true" ]; then
           echo ""
-
-          # 判断PR类型
-          SKIP_BACKEND="${{ needs.check-frontend-only.outputs.skip_backend }}"
-          SKIP_FRONTEND="${{ needs.check-frontend-only.outputs.skip_frontend }}"
-          echo "PR类型: skip_backend=$SKIP_BACKEND, skip_frontend=$SKIP_FRONTEND"
-
-          # 必填检查项（根据PR类型决定）
-          # 通用检查（所有PR都必须过）
-          REQUIRED_GENERAL=(
-            "validate-style:$RESULT_STYLE"
-            "validate-security:$RESULT_SECURITY"
-            "validate-python:$RESULT_PYTHON"
-            "frontend-lint:$RESULT_FRONTEND_LINT"
-            "build-pr:$RESULT_BUILD_PR"
-            "ai-code-review:$AI_REVIEW_STATUS"
-          )
-
-          # 后端检查
-          REQUIRED_BACKEND=(
-            "unit-tests:$RESULT_UNIT_TESTS"
-            "integration-tests:$RESULT_INTEGRATION"
-          )
-
-          # 前端检查
-          REQUIRED_FRONTEND=(
-            "frontend-unit-test:$RESULT_FRONTEND_UNIT"
-          )
-
-          ALL_PASSED=true
-          FAILED_ITEMS=()
-
-          check_job() {
-            local name=$1
-            local result=$2
-            if [ "$result" = "success" ]; then
-              echo "  ✅ $name: success"
-            elif [ "$result" = "skipped" ]; then
-              echo "  ⏭️  $name: skipped（跳过，不影响）"
-            else
-              echo "  ❌ $name: $result"
-              ALL_PASSED=false
-              FAILED_ITEMS+=("$name=$result")
-            fi
-          }
-
-          echo ""
-          echo "=== 通用检查（所有PR必填）==="
-          for item in "${REQUIRED_GENERAL[@]}"; do
+          echo "=== 后端检查 ==="
+          for item in "${REQUIRED_BACKEND[@]}"; do
             name="${item%%:*}"
             result="${item##*:}"
-            # AI Code Review pending时不阻塞（可能还在跑），等它跑完自然会重跑Gate
-            if [ "$name" = "ai-code-review" ] && [ "$result" = "pending" ]; then
-              echo "  ⏳ $name: pending（审查中，暂不阻塞）"
-              continue
-            fi
-            # Security scan cancelled/failed时不阻塞部署（runner故障不应卡住流水线）
-            if [ "$name" = "validate-security" ] && { [ "$result" = "cancelled" ] || [ "$result" = "failure" ]; }; then
-              echo "  ⚠️  $name: $result（安全扫描为非阻塞项，不卡住部署）"
-              continue
-            fi
             check_job "$name" "$result"
           done
-
-          if [ "$SKIP_BACKEND" != "true" ]; then
-            echo ""
-            echo "=== 后端检查 ==="
-            for item in "${REQUIRED_BACKEND[@]}"; do
-              name="${item%%:*}"
-              result="${item##*:}"
-              check_job "$name" "$result"
-            done
-          else
-            echo ""
-            echo "=== 后端检查（纯前端PR，跳过）==="
-          fi
-
-          if [ "$SKIP_FRONTEND" != "true" ]; then
-            echo ""
-            echo "=== 前端检查 ==="
-            for item in "${REQUIRED_FRONTEND[@]}"; do
-              name="${item%%:*}"
-              result="${item##*:}"
-              check_job "$name" "$result"
-            done
-          else
-            echo ""
-            echo "=== 前端检查（纯后端PR，跳过）==="
-          fi
-
+        else
           echo ""
-          if [ "$ALL_PASSED" = "true" ]; then
-            echo "✅ CI Gate: PASSED"
-            echo "gate_result=success" >> $GITHUB_OUTPUT
-            exit 0
-          else
-            echo "❌ CI Gate: FAILED"
-            echo "失败项: ${FAILED_ITEMS[*]}"
-            echo "gate_result=failure" >> $GITHUB_OUTPUT
-            exit 1
-          fi
+          echo "=== 后端检查（纯前端PR，跳过）==="
+        fi
 
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ "${{ steps.gate.outputs.gate_result }}" = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-# CI retry trigger
+        if [ "$SKIP_FRONTEND" != "true" ]; then
+          echo ""
+          echo "=== 前端检查 ==="
+          for item in "${REQUIRED_FRONTEND[@]}"; do
+            name="${item%%:*}"
+            result="${item##*:}"
+            check_job "$name" "$result"
+          done
+        else
+          echo ""
+          echo "=== 前端检查（纯后端PR，跳过）==="
+        fi
+
+        echo ""
+        if [ "$ALL_PASSED" = "true" ]; then
+          echo "✅ CI Gate: PASSED"
+          echo "gate_result=success" >> $GITHUB_OUTPUT
+          exit 0
+        else
+          echo "❌ CI Gate: FAILED"
+          echo "失败项: ${FAILED_ITEMS[*]}"
+          echo "gate_result=failure" >> $GITHUB_OUTPUT
+          exit 1
+        fi
+    - name: Report CI trace
+      if: always()
+      shell: sh
+      env:
+        AGENTLOOP_LICENSE_KEY: "${{ secrets.AGENTLOOP_LICENSE_KEY }}"
+      run: |
+        STATUS="ok"
+        [ "${{ steps.gate.outputs.gate_result }}" = "success" ] || STATUS="error"
+        START_TIME=""
+        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
+        curl -sfH "Authorization: token ${GITHUB_TOKEN:-$GITEA_TOKEN}" -o /tmp/_ci_trace.py "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_trace_report.py?ref=${GITHUB_SHA}" 2>/dev/null && python3 /tmp/_ci_trace.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
diff --git a/scripts/ci_production_deploy.sh b/scripts/ci_production_deploy.sh
index f3804f489..b5c5df2cb 100644
--- a/scripts/ci_production_deploy.sh
+++ b/scripts/ci_production_deploy.sh
@@ -69,7 +69,11 @@ if [ -z "$IMAGE_TAG" ]; then
   exit 1
 fi
 
-test -f "$ENV_FILE"
+if [ ! -f "$ENV_FILE" ]; then
+  echo "ERROR: $ENV_FILE 不存在。CI 应先在 render_env 步骤渲染并上传此文件"
+  exit 1
+fi
+echo "✅ .env file found: $ENV_FILE ($(wc -l < $ENV_FILE) lines)"
 mkdir -p "$GENERATED_DIR"
 mkdir -p "$LEGACY_ASSETS_DIR"