From 3353865f5b16fe28c19e188bf3d50a9636ff95aa Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Tue, 28 Jul 2026 15:56:01 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E4=BF=AE=E5=A4=8D2=E4=B8=AAP0?=
 =?UTF-8?q?=E7=BA=A7bug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P0-1: acr-cleanup.yml 完全不可用
- $GITEA_OUTPUT → $GITHUB_OUTPUT（outputs写入完全失效）
- PREVIEW_SSH_KEY → STAGING_SSH_KEY（用错了密钥）
- 增加 STAGING_SSH_HOST/PORT/USER 从secret读取
- SSH连接用户从写死root改为变量

P0-2: production-e2e DooD模式下必然失败
- -v "$PWD:/workspace" 改为 docker create + docker cp 模式
- 与 staging-e2e 保持一致
---
 .gitea/workflows/acr-cleanup.yml | 27 +++++++++++++++++++--------
 .gitea/workflows/ci-pipeline.yml | 16 ++++++++++++----
 2 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/.gitea/workflows/acr-cleanup.yml b/.gitea/workflows/acr-cleanup.yml
index d752e4531..d6f2d6922 100644
--- a/.gitea/workflows/acr-cleanup.yml
+++ b/.gitea/workflows/acr-cleanup.yml
@@ -47,22 +47,33 @@ jobs:
         id: protected_images
         if: gitea.event_name != 'pull_request_target' && !gitea.event.inputs.pr_sha
         env:
-          STAGING_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
+          STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+          STAGING_SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
+          STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+          STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
         run: |
           set +e
           echo "获取staging服务器运行中镜像作为白名单..."
-          mkdir -p ~/.ssh
-          echo "$STAGING_SSH_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-
           staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
           staging_port="${STAGING_SSH_PORT:-22222}"
+          staging_user="${STAGING_SSH_USER:-root}"
+
+          key_path=~/.ssh/id_rsa
+          if [ -n "${STAGING_SSH_KEY:-}" ]; then
+            printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
+            chmod 600 "$key_path"
+            echo "Using key from STAGING_SSH_KEY secret"
+          else
+            echo "⚠️  STAGING_SSH_KEY not set, skipping whitelist"
+            echo "protected_tags=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
 
           ssh-keyscan -p "$staging_port" -H "$staging_host" >> ~/.ssh/known_hosts 2>/dev/null
 
           # 获取所有运行容器的镜像，提取tag部分
-          IMAGES=$(ssh -p "$staging_port" -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no \
-            "root@$staging_host" "docker ps --format '{{.Image}}' 2>/dev/null" 2>/dev/null | grep -v "^$" | sort -u)
+          IMAGES=$(ssh -p "$staging_port" -i "$key_path" -o StrictHostKeyChecking=no \
+            "$staging_user@$staging_host" "docker ps --format '{{.Image}}' 2>/dev/null" 2>/dev/null | grep -v "^$" | sort -u)
 
           PROTECTED_TAGS=""
           if [ -n "$IMAGES" ]; then
@@ -80,7 +91,7 @@ jobs:
           fi
 
           echo "staging运行中镜像tag: ${PROTECTED_TAGS:-（无）}"
-          echo "protected_tags=$PROTECTED_TAGS" >> $GITEA_OUTPUT
+          echo "protected_tags=$PROTECTED_TAGS" >> $GITHUB_OUTPUT
 
       # ====== Docker登录 ======
       - name: Docker login to ACR
diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 192bad25d..195721213 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -1481,18 +1481,26 @@ jobs:
       shell: sh
       run: bash scripts/ci/step_timer_start.sh
     - name: Run production browser E2E
-      shell: sh
+      shell: bash
       run: |
         set -eu
-        docker run --rm --ipc=host \
+        # DooD模式下不能用-v挂载（宿主机路径与CI容器路径不一致）
+        # 改用 docker create + docker cp 方式把代码拷进容器
+        CONTAINER_NAME="production-e2e-$$"
+        docker create --name "$CONTAINER_NAME" --ipc=host \
           -e E2E_BASE_URL=https://saas.xiaoxiajianji.com \
           -e E2E_API_BASE=https://api.xiaoxiajianji.com/api/v1 \
           -e E2E_BROWSER_CHANNEL=chromium \
           -e PLAYWRIGHT_HEADLESS=1 \
-          -v "$PWD:/workspace" \
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
-          sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts'
+          sh -lc "npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts"
+        docker cp apps "$CONTAINER_NAME:/workspace/"
+        docker cp package-lock.json "$CONTAINER_NAME:/workspace/" 2>/dev/null || true
+        docker start -a "$CONTAINER_NAME"
+        EXIT_CODE=$(docker wait "$CONTAINER_NAME")
+        docker rm "$CONTAINER_NAME" 2>/dev/null || true
+        exit $EXIT_CODE
 
     - name: Job duration summary
       if: always()