From a6044605421d1845cadac9c6086233638f710871 Mon Sep 17 00:00:00 2001 From: Qiufeng Date: Tue, 4 Aug 2026 00:06:55 +0800 Subject: [PATCH] ci: use scoped Gitea release token --- .gitea/workflows/release.yml | 10 +++++++--- docs/online-install-and-update.md | 4 +--- tests/release-scripts.test.sh | 11 +++++++++++ 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 565e23b..569cd93 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -5,14 +5,18 @@ on: tags: - "v*" +permissions: + contents: read + releases: write + jobs: release: runs-on: ubuntu-latest env: - GITEA_BASE_URL: ${{ vars.GITEA_BASE_URL }} + GITEA_BASE_URL: ${{ github.server_url }} GITEA_REPOSITORY: ${{ github.repository }} GITEA_ALLOW_INSECURE_HTTP: ${{ vars.GITEA_ALLOW_INSECURE_HTTP }} - GITEA_TOKEN: ${{ secrets.RELEASE_GITEA_TOKEN }} + GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} RELEASE_PRIVATE_KEY_B64: ${{ secrets.RELEASE_PRIVATE_KEY_B64 }} NODE_OPTIONS: --max-old-space-size=8192 steps: @@ -44,7 +48,7 @@ jobs: esac [[ "$repository" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] \ || { printf 'invalid GITEA_REPOSITORY\n' >&2; exit 1; } - [[ -n "${GITEA_TOKEN:-}" ]] || { printf 'missing RELEASE_GITEA_TOKEN secret\n' >&2; exit 1; } + [[ -n "${GITEA_TOKEN:-}" ]] || { printf 'missing built-in GITEA_TOKEN\n' >&2; exit 1; } [[ -n "${RELEASE_PRIVATE_KEY_B64:-}" ]] \ || { printf 'missing RELEASE_PRIVATE_KEY_B64 secret\n' >&2; exit 1; } diff --git a/docs/online-install-and-update.md b/docs/online-install-and-update.md index bce65da..f786283 100644 --- a/docs/online-install-and-update.md +++ b/docs/online-install-and-update.md @@ -12,11 +12,9 @@ Kaidi ERP 的生产安装不依赖 Docker。安装器支持 64 位 Linux 和 mac Gitea Actions runner 需要预装 Java 17 或更高版本、Node.js/npm、Python 3、tar、curl 和 OpenSSL 3。 -在仓库 Actions 设置中创建： +流水线使用 Gitea 1.27 提供的短期 `GITEA_TOKEN`，权限限定为代码只读、当前仓库 Release 可写，不需要创建个人访问令牌。仓库 Actions 设置只需创建： -- Secret `RELEASE_GITEA_TOKEN`：具备当前仓库 Release 写权限的 Gitea token。 - Secret `RELEASE_PRIVATE_KEY_B64`：Ed25519 私钥的单行 Base64 内容。 -- Variable `GITEA_BASE_URL`：生产 Gitea 的 HTTPS 外部地址。 - Variable `GITEA_ALLOW_INSECURE_HTTP`：生产环境不要设置；当前 HTTP 测试服务器必须显式设为 `1`。 本机现有签名私钥位于 `~/.config/kaidi-erp/release-signing-key.pem`，不得提交到 Git。macOS 可用以下命令生成 Secret 值： diff --git a/tests/release-scripts.test.sh b/tests/release-scripts.test.sh index d60e628..f5d96a9 100755 --- a/tests/release-scripts.test.sh +++ b/tests/release-scripts.test.sh @@ -488,6 +488,16 @@ test_no_service_install_disables_online_update() ( grep -Fqx 'OA_UPDATE_ENABLED=false' "$CONFIG_ROOT/erp.env" ) +test_release_workflow_uses_scoped_job_token() ( + local workflow="$PROJECT_ROOT/.gitea/workflows/release.yml" + grep -Fqx ' contents: read' "$workflow" + grep -Fqx ' releases: write' "$workflow" + grep -Fq 'GITEA_BASE_URL: ${{ github.server_url }}' "$workflow" + grep -Fq 'GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}' "$workflow" + ! grep -Fq 'RELEASE_GITEA_TOKEN' "$workflow" + ! grep -Fq 'vars.GITEA_BASE_URL' "$workflow" +) + run_test 'erp-run preserves Java option arguments' test_erp_run_preserves_java_option_arguments run_test 'installer accepts a correctly signed archive' test_installer_verifies_signed_safe_archive run_test 'installer rejects symlinks in release archives' test_installer_rejects_archive_symlinks @@ -499,6 +509,7 @@ run_test 'update helper rejects a concurrent process' test_update_lock_rejects_c run_test 'noninteractive install reports a missing database password' test_noninteractive_installer_reports_missing_password run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url run_test 'no-service install disables online update' test_no_service_install_disables_online_update +run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token printf 'RESULT pass=%s fail=%s\n' "$PASS" "$FAIL" [[ "$FAIL" -eq 0 ]]