From 428b9eeb3b7b1125bfb66c418b71cd1011afe71f Mon Sep 17 00:00:00 2001
From: xiaoxia <xiaoxia@xiaoxiajianji.com>
Date: Thu, 17 Sep 2026 22:36:44 +0800
Subject: [PATCH] =?UTF-8?q?chore(ci):=20=E5=9C=A8CI=20secrets/env=E6=A8=A1?=
 =?UTF-8?q?=E6=9D=BF=E4=B8=AD=E6=B7=BB=E5=8A=A0TIKHUB=5FAPI=5FKEY=E5=92=8C?=
 =?UTF-8?q?APIZERO=5FAPI=5FKEY?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Gitea Actions Secrets已添加TIKHUB_API_KEY
- render_env.sh SHARED_SECRETS增加两个新key
- deploy/configs/.env.staging和.env.production模板增加三层兜底配置段
- ci-pipeline.yml的staging/production deploy步骤env中注入新secret
---
 .gitea/workflows/ci-pipeline.yml |  4 ++++
 deploy/configs/.env.production   | 11 ++++++++++-
 deploy/configs/.env.staging      | 10 +++++++++-
 scripts/render_env.sh            |  2 +-
 4 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 8105fad5f..95564ae3b 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -1188,6 +1188,8 @@ jobs:
         DOUBAO_BASE_URL: "${{ secrets.DOUBAO_BASE_URL }}"
         WECHAT_APP_ID: "${{ secrets.WECHAT_APP_ID }}"
         WECHAT_APP_SECRET: "${{ secrets.WECHAT_APP_SECRET }}"
+        TIKHUB_API_KEY: "${{ secrets.TIKHUB_API_KEY }}"
+        APIZERO_API_KEY: "${{ secrets.APIZERO_API_KEY }}"
       run: |
         set -eu
         echo "Rendering .env from template + secrets..."
@@ -1640,6 +1642,8 @@ jobs:
         DOUBAO_BASE_URL: "${{ secrets.DOUBAO_BASE_URL }}"
         WECHAT_APP_ID: "${{ secrets.WECHAT_APP_ID }}"
         WECHAT_APP_SECRET: "${{ secrets.WECHAT_APP_SECRET }}"
+        TIKHUB_API_KEY: "${{ secrets.TIKHUB_API_KEY }}"
+        APIZERO_API_KEY: "${{ secrets.APIZERO_API_KEY }}"
       run: |
         set -eu
         echo "Rendering .env from template + secrets..."
diff --git a/deploy/configs/.env.production b/deploy/configs/.env.production
index c604809e0..8a212f919 100644
--- a/deploy/configs/.env.production
+++ b/deploy/configs/.env.production
@@ -241,5 +241,14 @@ WECHAT_OPEN_APP_ID=${WECHAT_APP_ID}
 WECHAT_OPEN_APP_SECRET=${WECHAT_APP_SECRET}
 WECHAT_OPEN_REDIRECT_URI=https://saas.xiaoxiajianji.com/auth/wechat/callback
 
-# 抖音 cookies 文件路径（yt-dlp 解析抖音视频需要）
+# 抖音 cookies 文件路径（yt-dlp 已废弃，保留兼容）
 DOUYIN_COOKIES_FILE=/app/configs/douyin_cookies.txt
+DOUYIN_DEBUG_ERRORS=false
+
+
+# ==================== 抖音视频解析（三层兜底）====================
+# P0: App Feed API（免费，零 Key）— 内置，无需配置
+# P1: TikHub API（付费，https://tikhub.io）
+TIKHUB_API_KEY=${TIKHUB_API_KEY}
+# P2: apizero.cn（国内付费，https://apizero.cn）
+APIZERO_API_KEY=${APIZERO_API_KEY}
diff --git a/deploy/configs/.env.staging b/deploy/configs/.env.staging
index c4cc0afa5..e8b5f2412 100644
--- a/deploy/configs/.env.staging
+++ b/deploy/configs/.env.staging
@@ -258,6 +258,14 @@ WECHAT_OPEN_APP_ID=${WECHAT_APP_ID}
 WECHAT_OPEN_APP_SECRET=${WECHAT_APP_SECRET}
 WECHAT_OPEN_REDIRECT_URI=https://staging.xiaoxiajianji.com/auth/wechat/callback
 
-# 抖音 cookies 文件路径（yt-dlp 解析抖音视频需要）
+# 抖音 cookies 文件路径（yt-dlp 已废弃，保留兼容）
 DOUYIN_COOKIES_FILE=/app/configs/douyin_cookies.txt
 DOUYIN_DEBUG_ERRORS=false
+
+
+# ==================== 抖音视频解析（三层兜底）====================
+# P0: App Feed API（免费，零 Key）— 内置，无需配置
+# P1: TikHub API（付费，https://tikhub.io）
+TIKHUB_API_KEY=${TIKHUB_API_KEY}
+# P2: apizero.cn（国内付费，https://apizero.cn）
+APIZERO_API_KEY=${APIZERO_API_KEY}
diff --git a/scripts/render_env.sh b/scripts/render_env.sh
index 61ec789f8..15bdd76b4 100644
--- a/scripts/render_env.sh
+++ b/scripts/render_env.sh
@@ -57,7 +57,7 @@ if [ "$TARGET_ENV" = "staging" ]; then
 fi
 
 # 共用 secrets 直接导出（如果存在）
-SHARED_SECRETS="OSS_ACCESS_KEY_ID OSS_ACCESS_KEY_SECRET COSYVOICE_API_KEY DASHSCOPE_API_KEY MEDIAKIT_API_KEY DOUBAO_API_KEY DOUBAO_MODEL DOUBAO_BASE_URL WECHAT_APP_ID WECHAT_APP_SECRET"
+SHARED_SECRETS="OSS_ACCESS_KEY_ID OSS_ACCESS_KEY_SECRET COSYVOICE_API_KEY DASHSCOPE_API_KEY MEDIAKIT_API_KEY DOUBAO_API_KEY DOUBAO_MODEL DOUBAO_BASE_URL WECHAT_APP_ID WECHAT_APP_SECRET TIKHUB_API_KEY APIZERO_API_KEY"
 for var in $SHARED_SECRETS; do
   value="${!var:-}"
   # 已经在环境中了，无需额外操作