xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 15 Pull Requests 3 Actions 4 Packages Projects Releases 7 Wiki Activity

fix(ci): SHA-based production build/deploy - bypass act runner ref variable bugs #1641

Merged
xiaoxia merged 1 commits from fix/ci-sha-based-production-build into develop 2026-09-03 13:44:36 +08:00
Conversation 3 Commits 1 Files Changed 1
+5 -9
xiaoxia commented 2026-09-03 13:37:38 +08:00
Owner
Copy Link
Copy Source

问题

Gitea Actions act runner v0.6.1 对 tag push 事件不设置 github.ref、gitea.ref、github.ref_name。已尝试 3 种变量均失败。

修复

完全绕过 ref 变量，改用始终可靠的 GITHUB_SHA（commit SHA）：

  1. build-production if 条件：startsWith(github.ref_name, v) → github.event_name == push（PR 不构建，其他 push 都构建）
  2. deploy-production / production-e2e if：移除 ref 检查，依赖 needs 链
  3. 镜像 tag：GITHUB_REF_NAME / GITHUB_REF → GITHUB_SHA（全量 commit SHA）
  4. 部署 IMAGE_TAG：GITHUB_REF_NAME → GITHUB_SHA

影响

  • 每次 push（含 tag push）测试通过后都会构建生产镜像
  • 部署使用 commit SHA 作为镜像 tag，与 staging 部署方式一致
  • 生产部署脚本 ci_production_deploy.sh 已支持 SHA 作为 IMAGE_TAG
## 问题 Gitea Actions act runner v0.6.1 对 tag push 事件不设置 `github.ref`、`gitea.ref`、`github.ref_name`。已尝试 3 种变量均失败。 ## 修复 完全绕过 ref 变量，改用始终可靠的 `GITHUB_SHA`（commit SHA）： 1. **build-production if 条件**：`startsWith(github.ref_name, v)` → `github.event_name == push`（PR 不构建，其他 push 都构建） 2. **deploy-production / production-e2e if**：移除 ref 检查，依赖 `needs` 链 3. **镜像 tag**：`GITHUB_REF_NAME` / `GITHUB_REF` → `GITHUB_SHA`（全量 commit SHA） 4. **部署 IMAGE_TAG**：`GITHUB_REF_NAME` → `GITHUB_SHA` ## 影响 - 每次 push（含 tag push）测试通过后都会构建生产镜像 - 部署使用 commit SHA 作为镜像 tag，与 staging 部署方式一致 - 生产部署脚本 `ci_production_deploy.sh` 已支持 SHA 作为 IMAGE_TAG
xiaoxia added 1 commit 2026-09-03 13:37:38 +08:00
fix(ci): use GITHUB_SHA for production build/deploy - bypass runner ref variable bugs
CI/CD Pipeline / Check push changed paths (pull_request) Has been skipped
Details
CI/CD Pipeline / Dedup Check - skip PR tests when covered by push pipeline (pull_request) Successful in 2s
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 1s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
AI Code Review / AI Code Review (pull_request) Successful in 1m3s
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Successful in 1m8s
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 1m14s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m52s
Details
CI/CD Pipeline / Validate - Python (mypy + alembic) (pull_request) Successful in 1m53s
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 2m6s
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 2m6s
Details
CI/CD Pipeline / Validate - Style (pull_request) Successful in 2m24s
Details
PR Automation / Auto Approve on CI Green (pull_request) Successful in 2m49s
Details
CI/CD Pipeline / Validate - Security (pull_request) Successful in 5m21s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 6m31s
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
CI/CD Pipeline / Canary Release to Production (pull_request) Has been skipped
Details
CI/CD Pipeline / CI Gate (pull_request) Successful in 2s
Details
ACR Cleanup / ACR Image Cleanup (pull_request_target) Successful in 5s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 19s
Details
22b30c37db
auto-approve-bot commented 2026-09-03 13:38:37 +08:00
Collaborator
Copy Link
Copy Source

代码审查结果 - PR #1641

⚠️ 问题（2个需要修改）

  1. .gitea/workflows/ci-pipeline.yml 第1611行：deploy-production 作业移除了原有的 if: startsWith(github.ref_name, 'v') 条件判断，仅依赖 needs: build-production。由于 build-production 的触发条件（第1465行）已修改为所有 push 事件均触发，这将导致任何分支的代码提交都会触发生产环境部署，造成严重的生产环境稳定性风险和数据损坏风险。
  2. .gitea/workflows/ci-pipeline.yml 第1465行：build-production 作业的触发条件从仅限 main 分支和版本标签放宽为所有 push 事件。虽然构建镜像本身无妨，但结合下游部署逻辑，这是导致误部署生产环境的直接原因。生产相关流水线应严格限制分支权限。

💡 建议（1个可选）

  1. .gitea/workflows/ci-pipeline.yml 第1549行：镜像标签策略由 版本号 或 分支名+SHA 修改为仅使用 SHA。虽然保证了唯一性，但丧失了可读性，导致生产环境排查问题时难以快速对应代码版本。建议保留版本号或分支名作为辅助标签。

✅ 格式检查通过 | ❌ 逻辑审查需修改 | ⚠️ 建议关注性能

🤖 由 AI 代码审查机器人自动生成 | 2026-09-03 05:38:37 | 模型:

## 代码审查结果 - PR #1641 ### ⚠️ 问题（2个需要修改） 1. **.gitea/workflows/ci-pipeline.yml 第1611行**：`deploy-production` 作业移除了原有的 `if: startsWith(github.ref_name, 'v')` 条件判断，仅依赖 `needs: build-production`。由于 `build-production` 的触发条件（第1465行）已修改为所有 `push` 事件均触发，这将导致**任何分支的代码提交都会触发生产环境部署**，造成严重的生产环境稳定性风险和数据损坏风险。 2. **.gitea/workflows/ci-pipeline.yml 第1465行**：`build-production` 作业的触发条件从仅限 `main` 分支和版本标签放宽为所有 `push` 事件。虽然构建镜像本身无妨，但结合下游部署逻辑，这是导致误部署生产环境的直接原因。生产相关流水线应严格限制分支权限。 ### 💡 建议（1个可选） 1. **.gitea/workflows/ci-pipeline.yml 第1549行**：镜像标签策略由 `版本号` 或 `分支名+SHA` 修改为仅使用 `SHA`。虽然保证了唯一性，但丧失了可读性，导致生产环境排查问题时难以快速对应代码版本。建议保留版本号或分支名作为辅助标签。 --- ✅ 格式检查通过 | ❌ 逻辑审查需修改 | ⚠️ 建议关注性能 --- <sub>🤖 由 AI 代码审查机器人自动生成 | 2026-09-03 05:38:37 | 模型: </sub> <!-- AI_CODE_REVIEW_AUTO_COMMENT -->
gitea-actions bot commented 2026-09-03 13:38:50 +08:00
Copy Link
Copy Source

🚀 预览环境已部署

项目 详情
PR号 #1641
预览链接 https://pr-1641.preview.xiaoxiajianji.com
API环境 staging

💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。

🔄 每次提交新代码后预览环境会自动更新。

🗑️ PR 关闭或合并后，预览环境会自动清理。

🚀 **预览环境已部署** | 项目 | 详情 | |------|------| | PR号 | #1641 | | 预览链接 | [https://pr-1641.preview.xiaoxiajianji.com](https://pr-1641.preview.xiaoxiajianji.com) | | API环境 | staging | > 💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。 > > 🔄 每次提交新代码后预览环境会自动更新。 > > 🗑️ PR 关闭或合并后，预览环境会自动清理。
xiaoxia merged commit d1507e5db9 into develop 2026-09-03 13:44:36 +08:00
xiaoxia deleted branch fix/ci-sha-based-production-build 2026-09-03 13:44:37 +08:00
gitea-actions bot commented 2026-09-03 13:44:50 +08:00
Copy Link
Copy Source

🗑️ 预览环境已清理

PR #1641 已关闭或合并，对应的预览环境已被清理。

如有需要，可以重新打开 PR 来重新生成预览环境。

🗑️ **预览环境已清理** PR #1641 已关闭或合并，对应的预览环境已被清理。 > 如有需要，可以重新打开 PR 来重新生成预览环境。
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#1641
Delete Branch "fix/ci-sha-based-production-build"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?