ci: use scoped Gitea release token

.gitea/workflows/release.yml

@@ -5,14 +5,18 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+  releases: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     env:
-      GITEA_BASE_URL: ${{ vars.GITEA_BASE_URL }}
+      GITEA_BASE_URL: ${{ github.server_url }}
       GITEA_REPOSITORY: ${{ github.repository }}
       GITEA_ALLOW_INSECURE_HTTP: ${{ vars.GITEA_ALLOW_INSECURE_HTTP }}
-      GITEA_TOKEN: ${{ secrets.RELEASE_GITEA_TOKEN }}
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
       RELEASE_PRIVATE_KEY_B64: ${{ secrets.RELEASE_PRIVATE_KEY_B64 }}
       NODE_OPTIONS: --max-old-space-size=8192
     steps:
@@ -44,7 +48,7 @@ jobs:
           esac
           [[ "$repository" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] \
             || { printf 'invalid GITEA_REPOSITORY\n' >&2; exit 1; }
-          [[ -n "${GITEA_TOKEN:-}" ]] || { printf 'missing RELEASE_GITEA_TOKEN secret\n' >&2; exit 1; }
+          [[ -n "${GITEA_TOKEN:-}" ]] || { printf 'missing built-in GITEA_TOKEN\n' >&2; exit 1; }
           [[ -n "${RELEASE_PRIVATE_KEY_B64:-}" ]] \
             || { printf 'missing RELEASE_PRIVATE_KEY_B64 secret\n' >&2; exit 1; }
 

docs/online-install-and-update.md

@@ -12,11 +12,9 @@ Kaidi ERP 的生产安装不依赖 Docker。安装器支持 64 位 Linux 和 mac
 
 Gitea Actions runner 需要预装 Java 17 或更高版本、Node.js/npm、Python 3、tar、curl 和 OpenSSL 3。
 
-在仓库 Actions 设置中创建：
+流水线使用 Gitea 1.27 提供的短期 `GITEA_TOKEN`，权限限定为代码只读、当前仓库 Release 可写，不需要创建个人访问令牌。仓库 Actions 设置只需创建：
 
-- Secret `RELEASE_GITEA_TOKEN`：具备当前仓库 Release 写权限的 Gitea token。
 - Secret `RELEASE_PRIVATE_KEY_B64`：Ed25519 私钥的单行 Base64 内容。
-- Variable `GITEA_BASE_URL`：生产 Gitea 的 HTTPS 外部地址。
 - Variable `GITEA_ALLOW_INSECURE_HTTP`：生产环境不要设置；当前 HTTP 测试服务器必须显式设为 `1`。
 
 本机现有签名私钥位于 `~/.config/kaidi-erp/release-signing-key.pem`，不得提交到 Git。macOS 可用以下命令生成 Secret 值：

tests/release-scripts.test.sh

@@ -488,6 +488,16 @@ test_no_service_install_disables_online_update() (
   grep -Fqx 'OA_UPDATE_ENABLED=false' "$CONFIG_ROOT/erp.env"
 )
 
+test_release_workflow_uses_scoped_job_token() (
+  local workflow="$PROJECT_ROOT/.gitea/workflows/release.yml"
+  grep -Fqx '  contents: read' "$workflow"
+  grep -Fqx '  releases: write' "$workflow"
+  grep -Fq 'GITEA_BASE_URL: ${{ github.server_url }}' "$workflow"
+  grep -Fq 'GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}' "$workflow"
+  ! grep -Fq 'RELEASE_GITEA_TOKEN' "$workflow"
+  ! grep -Fq 'vars.GITEA_BASE_URL' "$workflow"
+)
+
 run_test 'erp-run preserves Java option arguments' test_erp_run_preserves_java_option_arguments
 run_test 'installer accepts a correctly signed archive' test_installer_verifies_signed_safe_archive
 run_test 'installer rejects symlinks in release archives' test_installer_rejects_archive_symlinks
@@ -499,6 +509,7 @@ run_test 'update helper rejects a concurrent process' test_update_lock_rejects_c
 run_test 'noninteractive install reports a missing database password' test_noninteractive_installer_reports_missing_password
 run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url
 run_test 'no-service install disables online update' test_no_service_install_disables_online_update
+run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token
 
 printf 'RESULT pass=%s fail=%s\n' "$PASS" "$FAIL"
 [[ "$FAIL" -eq 0 ]]