xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 11 Pull Requests 3 Actions Packages Projects Releases 7 Wiki Activity

deploy(#1718): 微信OAuth凭证纳入env模板+CI渲染，修复staging部署覆盖丢失 #1721

Merged
auto-approve-bot merged 1 commits from deploy/wechat-env-templates-1718 into develop 2026-09-05 17:39:48 +08:00
Conversation 3 Commits 1 Files Changed 4
+17 -1
xiaoxia commented 2026-09-05 17:27:40 +08:00
Owner
Copy Link
Copy Source

背景

Issue #1718 配置微信登录环境变量时发现：staging 服务器 /var/lib/xiaoxia-saas-staging/.env 由 CI 每次部署从 deploy/configs/.env.staging 模板渲染后 scp 覆盖，手工写入的 WECHAT_* 变量在下次部署时丢失（实测 17:19 部署后被冲掉）。

修改

  • deploy/configs/.env.staging / .env.production：新增 WECHAT_OPEN_APP_ID / WECHAT_OPEN_APP_SECRET / WECHAT_OPEN_REDIRECT_URI
    • staging 回调 https://staging.xiaoxiajianji.com/auth/wechat/callback
    • 生产回调 https://saas.xiaoxiajianji.com/auth/wechat/callback（前端真实域名；www/根域 301 跳转至此）
  • scripts/render_env.sh：WECHAT_APP_ID / WECHAT_APP_SECRET 加入 SHARED_SECRETS
  • .gitea/workflows/ci-pipeline.yml：Render .env step 传入 WECHAT_APP_ID / WECHAT_APP_SECRET
  • Gitea repo secrets WECHAT_APP_ID / WECHAT_APP_SECRET 已配置

说明

  • 生产 canary 部署只 pull 镜像、不重写 .env，生产环境变量已在服务器 .env 持久化；模板补齐是为未来统一渲染时不缺项
  • 本地 render_env.sh staging 干跑验证通过（16 个占位符全替换，无残留）
  • 配合 #1719（OAuth 工厂单例修复）共同完成微信登录上线
## 背景 Issue #1718 配置微信登录环境变量时发现：staging 服务器 `/var/lib/xiaoxia-saas-staging/.env` 由 CI 每次部署从 `deploy/configs/.env.staging` 模板渲染后 scp 覆盖，手工写入的 WECHAT_* 变量在下次部署时丢失（实测 17:19 部署后被冲掉）。 ## 修改 - `deploy/configs/.env.staging` / `.env.production`：新增 WECHAT_OPEN_APP_ID / WECHAT_OPEN_APP_SECRET / WECHAT_OPEN_REDIRECT_URI - staging 回调 `https://staging.xiaoxiajianji.com/auth/wechat/callback` - 生产回调 `https://saas.xiaoxiajianji.com/auth/wechat/callback`（前端真实域名；www/根域 301 跳转至此） - `scripts/render_env.sh`：WECHAT_APP_ID / WECHAT_APP_SECRET 加入 SHARED_SECRETS - `.gitea/workflows/ci-pipeline.yml`：Render .env step 传入 WECHAT_APP_ID / WECHAT_APP_SECRET - Gitea repo secrets `WECHAT_APP_ID` / `WECHAT_APP_SECRET` 已配置 ## 说明 - 生产 canary 部署只 pull 镜像、不重写 .env，生产环境变量已在服务器 .env 持久化；模板补齐是为未来统一渲染时不缺项 - 本地 render_env.sh staging 干跑验证通过（16 个占位符全替换，无残留） - 配合 #1719（OAuth 工厂单例修复）共同完成微信登录上线
xiaoxia added 1 commit 2026-09-05 17:27:40 +08:00
deploy(#1718): 微信OAuth凭证纳入env模板+CI渲染，staging部署不再丢WECHAT变量
CI/CD Pipeline / Dedup Check - skip PR tests when covered by push pipeline (pull_request) Successful in 1s
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 2s
Details
CI/CD Pipeline / Check push changed paths (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 28s
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Has been skipped
Details
AI Code Review / AI Code Review (pull_request) Successful in 44s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Worker Image (pull_request) Has been skipped
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 1m4s
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 28s
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
CI/CD Pipeline / Validate - Python (mypy + alembic) (pull_request) Successful in 1m37s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m50s
Details
CI/CD Pipeline / Validate - Style (pull_request) Successful in 2m18s
Details
PR Automation / Auto Approve on CI Green (pull_request) Successful in 2m56s
Details
CI/CD Pipeline / Validate - Security (pull_request) Successful in 4m53s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 11m21s
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
CI/CD Pipeline / Canary Release to Production (pull_request) Has been skipped
Details
CI/CD Pipeline / CI Gate (pull_request) Successful in 4s
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Successful in 9m10s
Details
ACR Cleanup / ACR Image Cleanup (pull_request_target) Successful in 8s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 26s
Details
41eac3b613 
- deploy/configs/.env.staging/.env.production 增加 WECHAT_OPEN_APP_ID/SECRET/REDIRECT_URI
  （staging 回调 staging.xiaoxiajianji.com，生产 saas.xiaoxiajianji.com）
- scripts/render_env.sh: WECHAT_APP_ID/WECHAT_APP_SECRET 加入 SHARED_SECRETS
- ci-pipeline.yml: Render .env step 传入 WECHAT_APP_ID/WECHAT_APP_SECRET secrets
- Gitea secrets WECHAT_APP_ID/WECHAT_APP_SECRET 已配置

背景：staging .env 由 CI 每次部署从模板渲染覆盖，手写变量会丢失（#1718 实测）。
auto-approve-bot commented 2026-09-05 17:28:24 +08:00
Collaborator
Copy Link
Copy Source

【阻塞级判定】

  • 是否存在阻塞级问题：否
  • 阻塞级问题数量：0 个

📊 审查概览

  • 整体评价：通过
  • 建议级问题数量：0 个

🔴 阻塞级问题（必须修复）

无

💡 改进建议（不阻塞合并）

无

✅ 良好实践

  1. 敏感信息处理规范：在 CI 流水线中正确使用 ${{ secrets.xxx }} 引用微信凭证，避免了敏感信息硬编码泄露风险。
  2. 环境隔离配置：Production 和 Staging 环境配置文件中的 WECHAT_OPEN_REDIRECT_URI 分别正确指向了对应的域名，符合多环境部署规范。
  3. 配置一致性：在 YAML、Shell 脚本和 Env 模板中，新增的变量名（WECHAT_APP_ID, WECHAT_APP_SECRET）保持高度一致，降低了配置错误的风险。

🤖 由 AI 代码审查机器人自动生成 | 2026-09-05 09:28:23 | 模型:

### 【阻塞级判定】 - 是否存在阻塞级问题：否 - 阻塞级问题数量：0 个 ### 📊 审查概览 - 整体评价：通过 - 建议级问题数量：0 个 ### 🔴 阻塞级问题（必须修复） 无 ### 💡 改进建议（不阻塞合并） 无 ### ✅ 良好实践 1. **敏感信息处理规范**：在 CI 流水线中正确使用 `${{ secrets.xxx }}` 引用微信凭证，避免了敏感信息硬编码泄露风险。 2. **环境隔离配置**：Production 和 Staging 环境配置文件中的 `WECHAT_OPEN_REDIRECT_URI` 分别正确指向了对应的域名，符合多环境部署规范。 3. **配置一致性**：在 YAML、Shell 脚本和 Env 模板中，新增的变量名（`WECHAT_APP_ID`, `WECHAT_APP_SECRET`）保持高度一致，降低了配置错误的风险。 --- <sub>🤖 由 AI 代码审查机器人自动生成 | 2026-09-05 09:28:23 | 模型: </sub> <!-- AI_CODE_REVIEW_AUTO_COMMENT -->
gitea-actions bot commented 2026-09-05 17:28:44 +08:00
Copy Link
Copy Source

🚀 预览环境已部署

项目 详情
PR号 #1721
预览链接 https://pr-1721.preview.xiaoxiajianji.com
API环境 staging

💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。

🔄 每次提交新代码后预览环境会自动更新。

🗑️ PR 关闭或合并后，预览环境会自动清理。

🚀 **预览环境已部署** | 项目 | 详情 | |------|------| | PR号 | #1721 | | 预览链接 | [https://pr-1721.preview.xiaoxiajianji.com](https://pr-1721.preview.xiaoxiajianji.com) | | API环境 | staging | > 💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。 > > 🔄 每次提交新代码后预览环境会自动更新。 > > 🗑️ PR 关闭或合并后，预览环境会自动清理。
auto-approve-bot merged commit 9840d5d778 into develop 2026-09-05 17:39:48 +08:00
auto-approve-bot deleted branch deploy/wechat-env-templates-1718 2026-09-05 17:39:49 +08:00
gitea-actions bot commented 2026-09-05 17:40:04 +08:00
Copy Link
Copy Source

🗑️ 预览环境已清理

PR #1721 已关闭或合并，对应的预览环境已被清理。

如有需要，可以重新打开 PR 来重新生成预览环境。

🗑️ **预览环境已清理** PR #1721 已关闭或合并，对应的预览环境已被清理。 > 如有需要，可以重新打开 PR 来重新生成预览环境。
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#1721
Delete Branch "deploy/wechat-env-templates-1718"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?