From 41c717d319b33326bfe445cbd4852ca09a250d29 Mon Sep 17 00:00:00 2001
From: cheney <qian.huang@sunyard.com>
Date: Thu, 16 Jul 2026 13:37:46 +0800
Subject: [PATCH] =?UTF-8?q?=E9=87=8D=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy.yml | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 8aaa995..fc4d294 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,5 +1,7 @@
 # Gitea Actions 工作流：构建 Docker 镜像并通过 SSH 触发部署
-# 前置：Gitea Runner 已开放 Docker 访问（挂载 /var/run/docker.sock）
+# 前置：
+#   1. Gitea Runner 已开放 Docker 访问（挂载 /var/run/docker.sock 到容器内）
+#   2. 仓库 Secret 中已添加 SSH_PRIVATE_KEY（内容为部署机私钥全文）
 name: build-and-deploy
 
 on:
@@ -8,11 +10,9 @@ on:
   workflow_dispatch:
 
 env:
-  # 部署目标（CI/CD 与部署机同机，仅用 SSH 触发 start.sh）
   DEPLOY_HOST: bh.vps.honor3.com
   DEPLOY_USER: root
   DEPLOY_DIR: /app/registry
-  SSH_KEY: /keypair/id_rsa
   IMAGE_NAME: registry-app
 
 jobs:
@@ -33,16 +33,22 @@ jobs:
             -t "${IMAGE_NAME}:latest" \
             .
 
+      - name: 准备 SSH 私钥
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          printf "%s\n" "${SSH_PRIVATE_KEY}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+
       - name: 上传 start.sh 到部署目录
         run: |
-          install -m 600 "${SSH_KEY}" /tmp/deploy_key
-          mkdir -p ~/.ssh
-          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
-          ssh -i /tmp/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
-          scp -i /tmp/deploy_key deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
-          ssh -i /tmp/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
+          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
+          scp -i ~/.ssh/deploy_key deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
+          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
 
       - name: 远程执行部署
         run: |
-          ssh -i /tmp/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" \
+          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" \
             "IMAGE_TAG=${{ steps.meta.outputs.tag }} ${DEPLOY_DIR}/start.sh"
\ No newline at end of file