From 41eac3b61356779176eadc94f0ba77bf6d3678a3 Mon Sep 17 00:00:00 2001
From: xiaoxia <xiaoxia@xiaoxiajianji.com>
Date: Sat, 5 Sep 2026 17:27:22 +0800
Subject: [PATCH] =?UTF-8?q?deploy(#1718):=20=E5=BE=AE=E4=BF=A1OAuth?=
 =?UTF-8?q?=E5=87=AD=E8=AF=81=E7=BA=B3=E5=85=A5env=E6=A8=A1=E6=9D=BF+CI?=
 =?UTF-8?q?=E6=B8=B2=E6=9F=93=EF=BC=8Cstaging=E9=83=A8=E7=BD=B2=E4=B8=8D?=
 =?UTF-8?q?=E5=86=8D=E4=B8=A2WECHAT=E5=8F=98=E9=87=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- deploy/configs/.env.staging/.env.production 增加 WECHAT_OPEN_APP_ID/SECRET/REDIRECT_URI
  （staging 回调 staging.xiaoxiajianji.com，生产 saas.xiaoxiajianji.com）
- scripts/render_env.sh: WECHAT_APP_ID/WECHAT_APP_SECRET 加入 SHARED_SECRETS
- ci-pipeline.yml: Render .env step 传入 WECHAT_APP_ID/WECHAT_APP_SECRET secrets
- Gitea secrets WECHAT_APP_ID/WECHAT_APP_SECRET 已配置

背景：staging .env 由 CI 每次部署从模板渲染覆盖，手写变量会丢失（#1718 实测）。
---
 .gitea/workflows/ci-pipeline.yml | 2 ++
 deploy/configs/.env.production   | 7 +++++++
 deploy/configs/.env.staging      | 7 +++++++
 scripts/render_env.sh            | 2 +-
 4 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 04902aef0..de0a655b5 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -1187,6 +1187,8 @@ jobs:
         COSYVOICE_API_KEY: ${{ secrets.COSYVOICE_API_KEY }}
         DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }}
         MEDIAKIT_API_KEY: ${{ secrets.MEDIAKIT_API_KEY }}
+        WECHAT_APP_ID: ${{ secrets.WECHAT_APP_ID }}
+        WECHAT_APP_SECRET: ${{ secrets.WECHAT_APP_SECRET }}
       run: |
         set -eu
         echo "Rendering .env from template + secrets..."
diff --git a/deploy/configs/.env.production b/deploy/configs/.env.production
index 55ab74ff3..f14279411 100644
--- a/deploy/configs/.env.production
+++ b/deploy/configs/.env.production
@@ -214,3 +214,10 @@ MEDIAKIT_TIMEOUT=60
 # ==================== 监控（可选）====================
 # Sentry DSN（取消注释并填入实际值以启用错误追踪）
 # SENTRY_DSN=${SENTRY_DSN}
+
+
+# ==================== 微信开放平台 OAuth（网页扫码登录）====================
+# 回调域名：xiaoxiajianji.com（微信开放平台已配置）
+WECHAT_OPEN_APP_ID=${WECHAT_APP_ID}
+WECHAT_OPEN_APP_SECRET=${WECHAT_APP_SECRET}
+WECHAT_OPEN_REDIRECT_URI=https://saas.xiaoxiajianji.com/auth/wechat/callback
diff --git a/deploy/configs/.env.staging b/deploy/configs/.env.staging
index 538417191..9e09b91eb 100644
--- a/deploy/configs/.env.staging
+++ b/deploy/configs/.env.staging
@@ -231,3 +231,10 @@ DASHSCOPE_API_KEY=${DASHSCOPE_API_KEY}
 MEDIAKIT_API_KEY=${MEDIAKIT_API_KEY}
 MEDIAKIT_BASE_URL=https://mediakit.cn-beijing.volces.com/api/v1
 MEDIAKIT_TIMEOUT=60
+
+
+# ==================== 微信开放平台 OAuth（网页扫码登录）====================
+# 回调域名：xiaoxiajianji.com（微信开放平台已配置）
+WECHAT_OPEN_APP_ID=${WECHAT_APP_ID}
+WECHAT_OPEN_APP_SECRET=${WECHAT_APP_SECRET}
+WECHAT_OPEN_REDIRECT_URI=https://staging.xiaoxiajianji.com/auth/wechat/callback
diff --git a/scripts/render_env.sh b/scripts/render_env.sh
index 42930f6e1..a5f128045 100644
--- a/scripts/render_env.sh
+++ b/scripts/render_env.sh
@@ -57,7 +57,7 @@ if [ "$TARGET_ENV" = "staging" ]; then
 fi
 
 # 共用 secrets 直接导出（如果存在）
-SHARED_SECRETS="OSS_ACCESS_KEY_ID OSS_ACCESS_KEY_SECRET COSYVOICE_API_KEY DASHSCOPE_API_KEY MEDIAKIT_API_KEY"
+SHARED_SECRETS="OSS_ACCESS_KEY_ID OSS_ACCESS_KEY_SECRET COSYVOICE_API_KEY DASHSCOPE_API_KEY MEDIAKIT_API_KEY WECHAT_APP_ID WECHAT_APP_SECRET"
 for var in $SHARED_SECRETS; do
   value="${!var:-}"
   # 已经在环境中了，无需额外操作
-- 
2.54.0