ci(release): allow builder-local production upload key

.gitea/workflows/deploy.yml

@@ -107,15 +107,20 @@ jobs:
         PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
       run: |
         set -eu
-        test -n "$PRODUCTION_SSH_HOST"
-        test -n "$PRODUCTION_SSH_USER"
-        test -n "$PRODUCTION_SSH_KEY"
+        production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
+        production_user="${PRODUCTION_SSH_USER:-root}"
         mkdir -p ~/.ssh
-        printf '%s\n' "$PRODUCTION_SSH_KEY" > ~/.ssh/id_ed25519
-        chmod 600 ~/.ssh/id_ed25519
-        ssh-keyscan -H "$PRODUCTION_SSH_HOST" >> ~/.ssh/known_hosts
-        scp "dist/release-images/xiaoxia-runtime-images-${GITHUB_REF_NAME}.tar" \
-          "$PRODUCTION_SSH_USER@$PRODUCTION_SSH_HOST:/var/lib/xiaoxia-saas-production/runtime-images-${GITHUB_REF_NAME}.tar"
+        if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+          printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
+          chmod 600 "$key_path"
+        else
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+          test -f "$key_path"
+        fi
+        ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts
+        scp -i "$key_path" "dist/release-images/xiaoxia-runtime-images-${GITHUB_REF_NAME}.tar" \
+          "$production_user@$production_host:/var/lib/xiaoxia-saas-production/runtime-images-${GITHUB_REF_NAME}.tar"
 
   deploy-production:
     name: Deploy Production

docs/GITEA-RUNTIME-BUILDER-RUNNER.md

@@ -26,12 +26,20 @@ Register the new runner with a label named `runtime-builder`. Keep the existing
 
 ## Required Gitea secrets
 
-Configure repository or organization secrets:
+The workflow can use either Gitea secrets or the dedicated runner-local upload key.
+
+Preferred repository or organization secrets:
 
 - `PRODUCTION_SSH_HOST`
 - `PRODUCTION_SSH_USER`
 - `PRODUCTION_SSH_KEY`
 
+If these secrets are absent, the workflow falls back to:
+
+- host: `47.98.113.167`
+- user: `root`
+- key path on the dedicated builder: `/root/.ssh/xiaoxia_runtime_builder`
+
 The key must allow uploading to:
 
 ```text

tests/unit/test_release_scripts.py

@@ -162,6 +162,9 @@ def test_gitea_production_deploy_requires_runtime_builder_job():
     assert "runs-on: runtime-builder" in build_section
     assert "scripts/build_release_images.sh \"${GITHUB_REF_NAME}\"" in build_section
     assert "PRODUCTION_SSH_HOST" in build_section
+    assert "PRODUCTION_SSH_USER" in build_section
+    assert "PRODUCTION_SSH_KEY" in build_section
+    assert "/root/.ssh/xiaoxia_runtime_builder" in build_section
     assert "runtime-images-${GITHUB_REF_NAME}.tar" in build_section
     assert "needs: build-production-runtime-images" in production_section
 
@@ -183,6 +186,7 @@ def test_runtime_builder_runner_runbook_matches_workflow():
     assert "PRODUCTION_SSH_HOST" in runbook
     assert "PRODUCTION_SSH_USER" in runbook
     assert "PRODUCTION_SSH_KEY" in runbook
+    assert "/root/.ssh/xiaoxia_runtime_builder" in runbook
     assert "Do not install this runner on the current production host" in runbook
     assert "production deploy waits for the image job" in runbook