xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 11 Pull Requests 2 Actions Packages Projects Releases 7 Wiki Activity

ci(preview): 预览环境切换专用SSH密钥(deploy用户+内网IP) #493

Merged
auto-approve-bot merged 2 commits from ci/preview-ssh-secrets into develop 2026-07-18 11:15:36 +08:00
Conversation 3 Commits 2 Files Changed 2
+29 -29
xiaoxia commented 2026-07-18 11:11:09 +08:00
Owner
Copy Link
Copy Source

变更内容

  • 预览部署/清理workflow从 STAGING_SSH_* 切换到 PREVIEW_SSH_* 专用密钥
  • 默认用户从 root 改为 deploy（专用部署账号，最小权限）
  • 默认服务器从公网 47.98.113.167 改为内网 172.30.18.197（CI同网段更快更安全）

配套

  • Gitea Secrets 已配置：PREVIEW_SSH_HOST / PREVIEW_SSH_PORT / PREVIEW_SSH_USER / PREVIEW_SSH_KEY
  • 服务器端 deploy 用户和 /var/www/preview 目录已由业务运维配置完成

相关工单

#446 P1-4 预览环境

## 变更内容 - 预览部署/清理workflow从 `STAGING_SSH_*` 切换到 `PREVIEW_SSH_*` 专用密钥 - 默认用户从 `root` 改为 `deploy`（专用部署账号，最小权限） - 默认服务器从公网 `47.98.113.167` 改为内网 `172.30.18.197`（CI同网段更快更安全） ## 配套 - Gitea Secrets 已配置：`PREVIEW_SSH_HOST` / `PREVIEW_SSH_PORT` / `PREVIEW_SSH_USER` / `PREVIEW_SSH_KEY` - 服务器端 deploy 用户和 /var/www/preview 目录已由业务运维配置完成 ## 相关工单 #446 P1-4 预览环境
xiaoxia added 2 commits 2026-07-18 11:11:09 +08:00
ci(preview): 切换到专用PREVIEW_SSH_*密钥，使用deploy用户+内网IP 7fdbc5c904
ci(preview): 清理脚本切换到PREVIEW_SSH_*密钥
CI Build & Deploy Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI Build & Deploy Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 15s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 44s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 2m34s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 2m50s
Details
Auto Approve CI PRs / Auto Approve on CI Green (pull_request) Successful in 3m9s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m25s
Details
AI Code Review / AI Code Review (pull_request) Successful in 4m23s
Details
Auto Merge CI PRs / Auto Merge on CI Green + Approved (pull_request) Successful in 4m27s
Details
3ca6db10c8
auto-approve-bot approved these changes 2026-07-18 11:14:17 +08:00
auto-approve-bot left a comment
Collaborator
Copy Link
Copy Source

CI全绿，自动审批通过。

CI全绿，自动审批通过。
auto-approve-bot approved these changes 2026-07-18 11:14:18 +08:00
auto-approve-bot left a comment
Collaborator
Copy Link
Copy Source

CI全绿，自动审批通过。

CI全绿，自动审批通过。
auto-approve-bot commented 2026-07-18 11:15:34 +08:00
Collaborator
Copy Link
Copy Source

📊 审查概览

  • 整体评价：有建议
  • 严重问题数量：0 个
  • 一般建议数量：2 个

❌ 需修改的问题（严重）

无

💡 改进建议（一般）

  1. [.gitea/workflows/preview-cleanup.yml & preview-deploy.yml: Shell脚本部分] 硬编码内网IP地址

    • 具体内容：代码中将默认 SSH Host 硬编码为 172.30.18.197（内网地址）。虽然这仅作为 Secret 缺失时的 Fallback，但将内网拓扑结构硬编码在代码库中降低了灵活性，且如果仓库是公开的，会暴露内部网络信息。建议移除硬编码的默认值，强制通过 Secrets 配置，或确保该 IP 为长期静态资源。

  2. [.gitea/workflows/preview-cleanup.yml & preview-deploy.yml: Shell脚本部分] 部署用户权限变更

    • 具体内容：SSH 连接用户从 root 变更为 deploy。这符合最小权限原则，是良好的安全实践。但请务必确认目标服务器上的 deploy 用户对 /var/www/preview 目录具有完整的读写权限，否则 mkdir、rm -rf 和 rsync 操作将会因权限不足而失败。

✅ 良好实践

  • 使用 set -eux 开启了严格模式，能及时发现变量未定义和命令执行错误。
  • 将 Staging 环境与 Preview 环境的配置分离，避免了环境混淆，逻辑清晰。
  • SSH 连接使用了 StrictHostKeyChecking=no 配合 ssh-keyscan，在自动化脚本中是合理的处理方式。
  • 敏感信息（SSH Key）通过 Secrets 传递，未明文硬编码。

🤖 由 AI 代码审查机器人自动生成 | 2026-07-18 11:15:34 | 模型:

### 📊 审查概览 - 整体评价：有建议 - 严重问题数量：0 个 - 一般建议数量：2 个 ### ❌ 需修改的问题（严重） 无 ### 💡 改进建议（一般） 1. **[.gitea/workflows/preview-cleanup.yml & preview-deploy.yml: Shell脚本部分] 硬编码内网IP地址** - 具体内容：代码中将默认 SSH Host 硬编码为 `172.30.18.197`（内网地址）。虽然这仅作为 Secret 缺失时的 Fallback，但将内网拓扑结构硬编码在代码库中降低了灵活性，且如果仓库是公开的，会暴露内部网络信息。建议移除硬编码的默认值，强制通过 Secrets 配置，或确保该 IP 为长期静态资源。 2. **[.gitea/workflows/preview-cleanup.yml & preview-deploy.yml: Shell脚本部分] 部署用户权限变更** - 具体内容：SSH 连接用户从 `root` 变更为 `deploy`。这符合最小权限原则，是良好的安全实践。但请务必确认目标服务器上的 `deploy` 用户对 `/var/www/preview` 目录具有完整的读写权限，否则 `mkdir`、`rm -rf` 和 `rsync` 操作将会因权限不足而失败。 ### ✅ 良好实践 - 使用 `set -eux` 开启了严格模式，能及时发现变量未定义和命令执行错误。 - 将 Staging 环境与 Preview 环境的配置分离，避免了环境混淆，逻辑清晰。 - SSH 连接使用了 `StrictHostKeyChecking=no` 配合 `ssh-keyscan`，在自动化脚本中是合理的处理方式。 - 敏感信息（SSH Key）通过 Secrets 传递，未明文硬编码。 --- <sub>🤖 由 AI 代码审查机器人自动生成 | 2026-07-18 11:15:34 | 模型: </sub> <!-- AI_CODE_REVIEW_AUTO_COMMENT -->
auto-approve-bot merged commit 32009f3998 into develop 2026-07-18 11:15:36 +08:00
auto-approve-bot deleted branch ci/preview-ssh-secrets 2026-07-18 11:15:36 +08:00
Sign in to join this conversation.
Reviewers
No Reviewers
auto-approve-bot
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#493
Delete Branch "ci/preview-ssh-secrets"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?