xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 15 Pull Requests 1 Actions 3 Packages Projects Releases 7 Wiki Activity

ci(release): bind gitea token for archive checkout

Browse Source
This commit is contained in:
Xiaoxia AI
2026-06-22 18:05:26 +08:00
parent 313bb1b2cc
commit 9cf659b1d9
3 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+4
View File
@@ -17,6 +17,8 @@ jobs:
steps:
- name: Checkout code
shell: sh
env:
GITHUB_TOKEN: ${{ github.token }}
run: |
set -eu
archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
@@ -85,6 +87,8 @@ jobs:
steps:
- name: Checkout code
shell: sh
env:
GITHUB_TOKEN: ${{ github.token }}
run: |
set -eu
archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
docs/GITEA-RUNTIME-BUILDER-RUNNER.md
+7 -6
View File
@@ -53,12 +53,13 @@ Do not store SSH private keys in the repository.
On `v*` tag push:
1. `build-production-runtime-images` runs on `runtime-builder`.
2. It executes `scripts/build_release_images.sh <tag>`.
3. It builds `apps/web/dist` in a Node Docker container, not on production.
4. It packages `release-<tag>.tar.gz` with the prebuilt Web dist.
5. It uploads both `runtime-images-<tag>.tar` and `release-<tag>.tar.gz` to production.
6. `deploy-production` runs after the build job succeeds.
7. `deploy-production` extracts the prebuilt release artifact, loads `/var/lib/xiaoxia-saas-production/runtime-images-<tag>.tar`, and restarts API/Worker/Web.
2. Checkout downloads the repository archive using the explicit `${{ github.token }}` environment binding; runner shell environments must not assume `GITHUB_TOKEN` is implicitly set.
3. It executes `scripts/build_release_images.sh <tag>`.
4. It builds `apps/web/dist` in a Node Docker container, not on production.
5. It packages `release-<tag>.tar.gz` with the prebuilt Web dist.
6. It uploads both `runtime-images-<tag>.tar` and `release-<tag>.tar.gz` to production.
7. `deploy-production` runs after the build job succeeds.
8. `deploy-production` extracts the prebuilt release artifact, loads `/var/lib/xiaoxia-saas-production/runtime-images-<tag>.tar`, and restarts API/Worker/Web.
If either the release tar or runtime image tar is missing, production deploy must fail.
tests/unit/test_release_scripts.py
+2
View File
@@ -14,6 +14,7 @@ def test_gitea_production_deploy_uses_production_ports():
workflow = Path(".gitea/workflows/deploy.yml").read_text(encoding="utf-8")
production_section = workflow.split("deploy-production:", 1)[1]
assert "GITHUB_TOKEN: ${{ github.token }}" in workflow
assert "WEB_PORT=3001" not in production_section
assert "http://127.0.0.1:8001/health" in production_section
assert "RELEASE_VERSION=\"${GITHUB_REF_NAME}\"" in production_section
@@ -161,6 +162,7 @@ def test_gitea_production_deploy_requires_runtime_builder_job():
assert "runs-on: runtime-builder" in build_section
assert "scripts/build_release_images.sh \"${GITHUB_REF_NAME}\"" in build_section
assert "GITHUB_TOKEN: ${{ github.token }}" in build_section
assert "docker.m.daocloud.io/library/node:20" in build_section
assert "npm ci && npm run build" in build_section
assert "dist/release-artifacts/xiaoxia-release-${GITHUB_REF_NAME}.tar.gz" in build_section