feat(test): P0级测试质量体系 - 环境变量清单 + 覆盖率门禁

## 改造内容

### 1. CI环境变量清单 (docs/ci-env-vars.md)
- 全面扫描后端代码，整理所有环境变量配置
- 分类：CI必需(P0)、可选(有默认值)、测试专用、Worker服务专用
- 明确当前CI已配置的变量及缺失项
- 附环境变量读取位置索引，便于后续维护

### 2. 测试覆盖率门禁
- 单元测试：收集覆盖率数据（apps/目录）
- 集成测试：追加覆盖率 + 50%最低门槛门禁
- 输出格式：term + xml(cobertura格式)
- 初始门槛设为50%，后续逐步提升
- pytest-cov 已在 requirements-dev.txt 中，无需新增依赖

## 收益
- 环境变量管理透明化，便于CI配置排查
- 覆盖率可视化，量化测试质量
- 门禁机制防止代码质量回退

.gitea/workflows/auto-merge.yml

@@ -16,7 +16,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              top_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == top_prefix[:-1]:
+                      continue
+                  if name.startswith(top_prefix):
+                      member.name = name[len(top_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Auto merge develop PRs
         run: |
           bash scripts/auto_merge_prs.sh develop

.gitea/workflows/ci-cd.yml

@@ -15,7 +15,6 @@ on:
     branches:
       - main
       - develop
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -37,7 +36,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Verify CI environment
         shell: sh
         run: |
@@ -46,14 +84,6 @@ jobs:
           python3 -m pip --version
           echo "CI environment is ready"
 
-      - name: Cache pip dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
-
       - name: Install dependencies
         shell: sh
         run: |
@@ -134,7 +164,8 @@ jobs:
           USE_IN_MEMORY_DB: "true"
         run: |
           set -eu
-          PYTHONPATH="$PWD/apps/api:$PWD" python3 -m pytest tests/unit -q
+          PYTHONPATH="$PWD/apps/api:$PWD" python3 -m pytest tests/unit -q \
+            --cov=apps --cov-report=term --cov-report=xml
 
       - name: Start PostgreSQL for integration tests
         shell: sh
@@ -179,7 +210,8 @@ jobs:
         run: |
           set -eu
           pip install -q pytest-rerunfailures
-          PYTHONPATH="$PWD/apps/api:$PWD" python3 -m pytest tests/integration -q --timeout=60 -x --reruns 2 --reruns-delay 1 -m "not performance"
+          PYTHONPATH="$PWD/apps/api:$PWD" python3 -m pytest tests/integration -q --timeout=60 -x --reruns 2 --reruns-delay 1 -m "not performance" \
+            --cov=apps --cov-append --cov-report=term --cov-report=xml --cov-fail-under=50
 
       - name: Run API performance baseline tests
         shell: sh
@@ -251,14 +283,45 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
-      - name: Cache npm dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
 
       - name: Install dependencies
         shell: sh
@@ -266,7 +329,6 @@ jobs:
           set -eu
           docker run --rm \
             -v "$PWD:/workspace" \
-            -v "$HOME/.npm:/root/.npm" \
             -w /workspace/apps/web \
             docker.m.daocloud.io/library/node:20 \
             sh -lc 'npm ci'
@@ -325,7 +387,45 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
+        python3 - <<'INNERPY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        INNERPY
+
     - name: Build and push all images to Gitea Registry
       shell: sh
       env:
@@ -418,15 +518,45 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
-    - name: Cache npm dependencies
-      uses: actions/cache@v3
-      with:
-        path: ~/.npm
-        key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-        restore-keys: |
-          ${{ runner.os }}-npm-
-
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
     - name: Run Playwright E2E on staging
       shell: sh
       run: |
@@ -437,7 +567,6 @@ jobs:
           -e E2E_BROWSER_CHANNEL=chromium \
           -e PLAYWRIGHT_HEADLESS=1 \
           -v "$PWD:/workspace" \
-          -v "$HOME/.npm:/root/.npm" \
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
           sh -lc "npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts"
@@ -456,15 +585,45 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
-    - name: Cache npm dependencies
-      uses: actions/cache@v3
-      with:
-        path: ~/.npm
-        key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-        restore-keys: |
-          ${{ runner.os }}-npm-
-
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
     - name: Run API integration tests on staging
       shell: sh
       run: |
@@ -473,7 +632,6 @@ jobs:
           -e E2E_BASE_URL=https://staging.xiaoxiajianji.com \
           -e E2E_API_BASE=https://staging-api.xiaoxiajianji.com/api/v1 \
           -v "$PWD:/workspace" \
-          -v "$HOME/.npm:/root/.npm" \
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
           sh -lc 'npm ci && npx playwright test --reporter=line e2e/test_auth.spec.ts e2e/test_asset.spec.ts e2e/test_project.spec.ts'
@@ -494,7 +652,46 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
+
     - name: Build and push all images (api + worker + web, with buildx cache)
       shell: sh
       env:
@@ -598,14 +795,46 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
-        bash scripts/ci_checkout.sh
-    - name: Cache npm dependencies
-      uses: actions/cache@v3
-      with:
-        path: ~/.npm
-        key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-        restore-keys: |
-          ${{ runner.os }}-npm-
+        python3 - <<'PY'
+        import io, os, tarfile, time, urllib.request, urllib.error
+        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+        # Retry up to 5 times with backoff for transient 5xx errors
+        last_err = None
+        for attempt in range(5):
+            try:
+                with urllib.request.urlopen(request, timeout=120) as response:
+                    archive = response.read()
+                break
+            except urllib.error.HTTPError as e:
+                last_err = e
+                if e.code >= 500 and attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+            except Exception as e:
+                last_err = e
+                if attempt < 4:
+                    wait = 2 ** attempt
+                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                    time.sleep(wait)
+                    continue
+                raise
+        else:
+            raise last_err
+        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+            for member in tar.getmembers():
+                name = member.name
+                if name == root_prefix[:-1]:
+                    continue
+                if name.startswith(root_prefix):
+                    member.name = name[len(root_prefix):]
+                if member.name:
+                    tar.extract(member, '.')
+        PY
 
     - name: Run production browser E2E
       shell: sh
@@ -617,7 +846,6 @@ jobs:
           -e E2E_BROWSER_CHANNEL=chromium \
           -e PLAYWRIGHT_HEADLESS=1 \
           -v "$PWD:/workspace" \
-          -v "$HOME/.npm:/root/.npm" \
           -w /workspace/apps/web \
           git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
           sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts'

.gitea/workflows/daily-check.yml

@@ -24,7 +24,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Production health check & smoke test
         id: smoke
         shell: sh
@@ -82,7 +121,46 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Run API smoke test on staging
         id: smoke
         shell: sh
@@ -180,14 +258,45 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -eu
-          bash scripts/ci_checkout.sh
-      - name: Cache npm dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-npm-${{ hashFiles('apps/web/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
 
       - name: Run Playwright E2E on staging
         id: e2e
@@ -201,7 +310,6 @@ jobs:
             -e E2E_BROWSER_CHANNEL=chromium \
             -e PLAYWRIGHT_HEADLESS=1 \
             -v "$PWD:/workspace" \
-            -v "$HOME/.npm:/root/.npm" \
             -w /workspace/apps/web \
             git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
             sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts' 2>&1 | tee /tmp/staging-e2e.log

docs/ci-env-vars.md

@@ -0,0 +1,235 @@
+# CI 必需环境变量清单
+
+> 本文档整理小虾 SaaS 项目中所有从环境变量读取的配置项，明确哪些是 CI 测试必须的、哪些是可选的。
+> 最后更新：2026-07-09
+
+## 目录
+
+- [一、配置来源说明](#一配置来源说明)
+- [二、CI 必需环境变量（P0）](#二ci-必需环境变量p0)
+- [三、可选环境变量（有默认值）](#三可选环境变量有默认值)
+- [四、测试专用环境变量](#四测试专用环境变量)
+- [五、Worker 服务环境变量](#五worker-服务环境变量)
+- [六、当前 CI 配置对照](#六当前-ci-配置对照)
+
+---
+
+## 一、配置来源说明
+
+项目的环境变量配置主要来自以下几处：
+
+| 来源 | 文件路径 | 说明 |
+|------|---------|------|
+| API 主配置 | `apps/api/app/config.py` | pydantic `Settings` 类，API 服务核心配置 |
+| Worker 配置 | `apps/worker/worker_app/core/config.py` | pydantic `WorkerSettings` 类，Worker 服务配置 |
+| 共享配置 | `packages/shared/config.py` | pydantic `SharedSettings` 类，API + Worker 共享配置 |
+| 直接读取 | 各模块中 `os.environ` / `os.getenv` | 散落在各业务模块中的直接读取 |
+
+> **注意**：pydantic-settings 配置默认 `case_sensitive=False`，即环境变量名不区分大小写，但习惯上使用大写。
+
+---
+
+## 二、CI 必需环境变量（P0）
+
+以下变量是 CI 运行测试**必须配置**的，缺失会导致测试启动失败或核心功能异常。
+
+| 变量名 | 用途说明 | 默认值 | 影响范围 |
+|--------|---------|--------|---------|
+| `DATABASE_URL` | 数据库连接字符串 | `postgresql+psycopg://postgres:postgres@localhost:5432/xiaoxia_saas` | 集成测试、 Alembic 迁移验证 |
+| `USE_IN_MEMORY_DB` | 是否使用内存数据库（SQLite） | `false` | 单元测试（设为 `true` 可跳过 PostgreSQL 依赖） |
+| `JWT_SECRET_KEY` | JWT 签名密钥，**无安全默认值**，必须显式设置 | `None`（启动校验失败） | 所有涉及认证的 API 测试 |
+
+> **说明**：
+> - 单元测试通过 `USE_IN_MEMORY_DB=true` 使用 SQLite 内存数据库，无需 PostgreSQL
+> - 集成测试需要真实 PostgreSQL，需设置 `DATABASE_URL`
+> - `JWT_SECRET_KEY` 在测试文件中通过 `os.environ.setdefault()` 设置了测试用默认值，CI 中可不额外配置，但生产环境必须配置
+
+---
+
+## 三、可选环境变量（有默认值）
+
+以下变量都有合理的默认值，CI 中可以不配置，使用默认值即可。
+
+### 3.1 应用基础配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `APP_NAME` | 应用名称 | `xiaoxia-saas` |
+| `APP_VERSION` | 应用版本号 | `0.1.61` / `unknown` |
+| `ENVIRONMENT` | 运行环境标识 | `development` |
+| `DEBUG` | 是否开启调试模式 | `true` |
+| `APP_BASE_URL` | 应用基础 URL（用于生成邮件链接等） | `http://localhost:3000` |
+| `API_HOST` | API 服务绑定地址 | `0.0.0.0` |
+| `API_PORT` | API 服务端口 | `8000` |
+| `API_PREFIX` | API 路由前缀 | `/api/v1` |
+| `APP_ENV` | 环境标识（用于加载 .env.{env} 文件） | `development` |
+| `LOG_LEVEL` | 日志级别 | `INFO` |
+
+### 3.2 数据库连接池配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `DATABASE_POOL_SIZE` | 连接池大小 | `20` |
+| `DATABASE_MAX_OVERFLOW` | 最大溢出连接数 | `10` (API) / `40` (Worker) |
+| `DATABASE_POOL_TIMEOUT` | 获取连接超时时间（秒） | `30` |
+| `DATABASE_POOL_RECYLE` / `DATABASE_POOL_RECYCLE` | 连接回收时间（秒） | `3600` |
+| `AUTO_CREATE_SCHEMA` | 是否自动创建表结构 | `false` |
+
+### 3.3 Redis / Celery 配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `REDIS_URL` | Redis 连接地址 | `redis://localhost:6379/0` |
+| `REDIS_MAX_CONNECTION` | Redis 最大连接数 | `50` |
+| `ENABLE_REDIS_SESSIONS` | 是否启用 Redis 会话存储 | `false` |
+| `CELERY_BROKER_URL` / `BROKER_URL` | Celery Broker 地址 | `redis://localhost:6379/0` |
+| `CELERY_RESULT_BACKEND` / `RESULT_BACKEND` | Celery 结果后端 | `redis://localhost:6379/1` |
+
+### 3.4 JWT 配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `JWT_ALGORITHM` | JWT 签名算法 | `HS256`（隐式默认） |
+| `JWT_ACCESS_TOKEN_EXPIRE_MINUTES` | Access Token 过期时间（分钟） | `30`（隐式默认） |
+| `JWT_REFRESH_TOKEN_EXPIRE_DAYS` | Refresh Token 过期时间（天） | `30`（隐式默认） |
+| `JWT_SECRET_KEY_OLD` | 旧 JWT 密钥（用于密钥轮换） | `None` |
+| `SECRET_ROTATION_DAYS` | 密钥轮换建议天数 | `90` |
+
+### 3.5 邮件配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `ENABLE_EMAIL_DELIVERY` | 是否启用邮件发送 | `false` |
+| `SMTP_HOST` | SMTP 服务器地址 | `smtp.gmail.com` |
+| `SMTP_PORT` | SMTP 端口 | `587` |
+| `SMTP_USER` | SMTP 用户名 | `""`（空） |
+| `SMTP_PASSWORD` | SMTP 密码 | `""`（空） |
+| `SMTP_FROM_EMAIL` | 发件人邮箱 | `""`（空） |
+| `SMTP_FROM_NAME` | 发件人名称 | `小虾 SaaS` |
+| `SMTP_USE_TLS` | 是否使用 TLS | `true` |
+
+### 3.6 OSS 阿里云存储配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `OSS_ENDPOINT` | OSS Endpoint | `oss-cn-hangzhou.aliiyuncs.com` |
+| `OSS_ACCESS_KEY_ID` | OSS Access Key ID | `""`（空） |
+| `OSS_ACCESS_KEY_SECRET` | OSS Access Key Secret | `""`（空） |
+| `OSS_BUCKET_NAME` | OSS Bucket 名称 | `xiaoxia-autocut` |
+| `OSS_DIRECT_UPLOAD_MAX_MB` / `MAX_UPLOAD_SIZE_MB` | 直传最大文件大小（MB） | `2000` |
+| `OSS_DIRECT_UPLOAD_EXPIRE_SECONDS` | 直传签名过期时间（秒） | `900` |
+
+### 3.7 CosyVoice 语音合成配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `COSYVOICE_API_KEY` | CosyVoice API Key | `""`（空） |
+| `COSYVOICE_BASE_URL` | CosyVoice API 地址 | `https://dashscope.aliyuncs.com/api/v1/services/aigc/text2audio` |
+| `COSYVOICE_MODEL` | CosyVoice 模型 | `cosyvoice-v1` |
+| `COSYVOICE_VOICE` | 默认音色 | `longxiaochun` |
+| `COSYVOICE_SAMPLE_RATE` | 采样率 | `22050` |
+| `COSYVOICE_FORMAT` | 输出格式 | `mp3` |
+
+### 3.8 CORS 配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `CORS_ORIGINS_RAW` | CORS 允许的源（逗号分隔） | `http://localhost:3000,http://localhost:5173,http://localhost:8000` |
+
+### 3.9 文件存储 / 生成文件配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `GENERATED_FILES_DIR` | 生成文件本地存储目录 | `/app/generated` |
+| `GENERATED_FILES_URL_PREFIX` | 生成文件访问 URL 前缀 | `/generated-files` |
+| `VIDEO_OUTPUT_DIR` | 视频输出目录 | `{tempdir}/video_output` |
+| `PUBLIC_API_BASE_URL` | 公开 API 基础 URL | `https://api.xiaoxiajianji.com` |
+
+### 3.10 监控 / 指标配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `METRICS_AUTH_TOKEN` | Prometheus 指标接口认证 Token | `""`（空，不启用认证） |
+
+### 3.11 内部 API 配置
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `INTERNAL_API_KEYS` | 内部 API 调用密钥列表（逗号分隔） | `""`（空） |
+
+---
+
+## 四、测试专用环境变量
+
+以下变量仅在测试或冒烟测试脚本中使用。
+
+| 变量名 | 用途说明 | 默认值 | 使用位置 |
+|--------|---------|--------|---------|
+| `SMOKE_TEST_PASSWORD` | 冒烟测试用的测试账号密码 | `changeme` | `scripts/smoke_*.py` |
+| `MIGRATION_SINCE_REVISION` | 迁移安全检查的起始版本 | `None` | `scripts/check_migration_safety.py` |
+| `MIGRATION_DIFF_AGAINST` | 迁移 diff 对比的目标分支/版本 | `None` | `scripts/check_migration_safety.py` |
+
+---
+
+## 五、Worker 服务环境变量
+
+以下变量主要用于 Worker（Celery）服务，CI 的单元/集成测试通常不涉及。
+
+| 变量名 | 用途说明 | 默认值 |
+|--------|---------|--------|
+| `WORKER_NAME` | Worker 名称 | `xiaoxia-saas-worker` |
+| `WORKER_CONCURRENCY` | Worker 并发数 | `4` |
+| `WORKER_MAX_TASKS_PER_CHILD` | 每个子进程最大任务数 | `1000` |
+
+---
+
+## 六、当前 CI 配置对照
+
+当前 `.gitea/workflows/ci-cd.yml` 中 `validate` job 配置的环境变量：
+
+| 变量名 | CI 配置值 | 是否必需 | 备注 |
+|--------|----------|---------|------|
+| `DATABASE_URL` | `postgresql+psycopg://postgres:postgres@127.0.0.1:5432/xiaoxia_saas` | ✅ 是 | Job 级别配置 |
+| `USE_IN_MEMORY_DB` | `"false"`（Job 级） / `"true"`（单元测试 step 级） | ✅ 是 | 单元测试 step 覆盖为 `true` |
+| `JWT_SECRET_KEY` | （未配置） | ⚠️ 测试内置 | 测试文件中通过 `setdefault` 设置了测试密钥 |
+
+### 6.1 CI 环境变量现状评估
+
+- ✅ **数据库配置完备**：DATABASE_URL + USE_IN_MEMORY_DB 已正确配置
+- ✅ **JWT 密钥**：测试代码内置默认值，CI 可正常运行
+- ⚠️ **缺少 Redis 配置**：但当前测试不依赖 Redis，使用默认值即可
+- ⚠️ **缺少邮件/OSS/语音配置**：均为可选，CI 中使用空默认值不影响核心测试
+
+### 6.2 建议后续补充
+
+如果未来测试覆盖到以下功能，需要在 CI 中补充对应配置：
+
+1. **Redis 相关测试** → 配置 `REDIS_URL`
+2. **邮件发送测试** → 配置 `ENABLE_EMAIL_DELIVERY` 及 SMTP 相关变量
+3. **OSS 上传测试** → 配置 OSS 相关变量（或使用 mock）
+4. **语音合成测试** → 配置 CosyVoice 相关变量（或使用 mock）
+
+---
+
+## 附录：环境变量读取位置索引
+
+### pydantic Settings 类
+- `apps/api/app/config.py` → `Settings` 类（API 主配置）
+- `apps/worker/worker_app/core/config.py` → `WorkerSettings` 类（Worker 配置）
+- `packages/shared/config.py` → `SharedSettings` 类（共享配置）
+
+### 直接 os.environ / os.getenv 读取
+| 变量名 | 文件位置 |
+|--------|---------|
+| `VIDEO_OUTPUT_DIR` | `apps/worker/video_processing/video_compose_service.py`、`apps/worker/worker_app/tasks/compose_video.py` |
+| `INTERNAL_API_KEYS` | `apps/api/app/api/routes/auth.py` |
+| `APP_ENV` / `ENV` | `apps/api/app/api/routes/auth.py`、各 config.py 的 `get_settings()` |
+| `GENERATED_FILES_DIR` | `apps/worker/worker_app/tasks/generation.py`、`apps/api/main.py`、`scripts/cleanup_generated_files.py` |
+| `GENERATED_FILES_URL_PREFIX` | `apps/worker/worker_app/tasks/generation.py`、`apps/api/main.py`、`apps/api/app/core/storage.py` |
+| `PUBLIC_API_BASE_URL` | `apps/worker/worker_app/tasks/generation.py` |
+| `METRICS_AUTH_TOKEN` | `apps/api/app/middleware/prometheus_metrics.py` |
+| `APP_VERSION` | `apps/api/app/middleware/prometheus_metrics.py` |
+| `SMOKE_TEST_PASSWORD` | `scripts/smoke_*.py` |
+| `MIGRATION_SINCE_REVISION` | `scripts/check_migration_safety.py` |
+| `MIGRATION_DIFF_AGAINST` | `scripts/check_migration_safety.py` |
+| `DATABASE_URL` | `alembic/env.py` |

pytest.ini

@@ -1,3 +1,8 @@
 [pytest]
 pythonpath = . apps/api apps/worker
 testpaths = tests
+
+# ===== 覆盖率配置 =====
+# 覆盖率统计范围（供 --cov 使用时的默认源）
+# 注意：addopts 不默认开启 --cov，避免影响本地开发调试
+# CI 中通过命令行参数显式开启：--cov=apps --cov-report=term --cov-report=xml --cov-fail-under=50

scripts/ci_checkout.sh

@@ -1,97 +0,0 @@
-#!/bin/sh
-# CI Checkout script - 从 Gitea API 下载源码 tar 包并解压
-# 用法: ci_checkout.sh [repo_api_base] [ref] [target_dir] [token]
-#   repo_api_base: 仓库 API 基础 URL，如 https://git.xiaoxiajianji.com/api/v1/repos/xiaoxia/xiaoxia-saas
-#   ref:           commit SHA 或分支名
-#   target_dir:    目标目录（默认当前目录）
-#   token:         API token
-# 所有参数均可省略，将从 Gitea Actions 环境变量中读取
-
-set -eu
-
-# ── 参数解析 ──────────────────────────────────────────────────
-REPO_API_BASE="${1:-}"
-REF="${2:-}"
-TARGET_DIR="${3:-.}"
-TOKEN="${4:-}"
-
-# 从环境变量补全默认值（兼容 Gitea Actions）
-if [ -z "$REPO_API_BASE" ]; then
-  REPO_API_BASE="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}"
-fi
-if [ -z "$REF" ]; then
-  REF="${GITHUB_SHA}"
-fi
-if [ -z "$TOKEN" ]; then
-  TOKEN="${GITHUB_TOKEN:-}"
-fi
-
-if [ -z "$REPO_API_BASE" ] || [ -z "$REF" ]; then
-  echo "ERROR: repo API base and ref are required" >&2
-  echo "Usage: $0 [repo_api_base] [ref] [target_dir] [token]" >&2
-  exit 1
-fi
-
-# ── 下载并解压 ────────────────────────────────────────────────
-ARCHIVE_URL="${REPO_API_BASE}/archive/${REF}.tar.gz"
-
-echo "Checkout: ${ARCHIVE_URL}"
-echo "Target dir: ${TARGET_DIR}"
-
-mkdir -p "${TARGET_DIR}"
-
-# 通过环境变量传递给 Python
-_CHECKOUT_URL="${ARCHIVE_URL}" \
-_CHECKOUT_TOKEN="${TOKEN}" \
-_CHECKOUT_TARGET_DIR="${TARGET_DIR}" \
-python3 - <<'PY'
-import io, os, tarfile, time, urllib.request, urllib.error
-
-url = os.environ['_CHECKOUT_URL']
-token = os.environ.get('_CHECKOUT_TOKEN', '')
-target_dir = os.environ['_CHECKOUT_TARGET_DIR']
-
-headers = {}
-if token:
-    headers["Authorization"] = f"token {token}"
-
-request = urllib.request.Request(url, headers=headers)
-
-last_err = None
-for attempt in range(5):
-    try:
-        with urllib.request.urlopen(request, timeout=120) as response:
-            archive = response.read()
-        break
-    except urllib.error.HTTPError as e:
-        last_err = e
-        if e.code >= 500 and attempt < 4:
-            wait = 2 ** attempt
-            print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-            time.sleep(wait)
-            continue
-        raise
-    except Exception as e:
-        last_err = e
-        if attempt < 4:
-            wait = 2 ** attempt
-            print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-            time.sleep(wait)
-            continue
-        raise
-else:
-    raise last_err
-
-with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-    root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-    for member in tar.getmembers():
-        name = member.name
-        if name == root_prefix[:-1]:
-            continue
-        if name.startswith(root_prefix):
-            member.name = name[len(root_prefix):]
-        if member.name:
-            tar.extract(member, target_dir)
-
-print("Checkout complete.")
-PY