新增 CI secrets 同步到注册中心的独立 workflow

2026-09-20 20:32:54 +08:00
parent 508419180c
commit 53f63e0986
2 changed files with 229 additions and 0 deletions
@@ -0,0 +1,52 @@
+name: Sync Secrets to Registry
+
+# 将本仓库 Gitea CI/CD secrets 明文写回注册中心 (Registry 配置管理中心) 的 MCP 服务
+# 目标: service-iboard 项目 (proj-msid70ql-6xbq4w)
+# 触发: 仅手动 (workflow_dispatch)
+# 依赖 secret:
+#   - REGISTRY_MCP_TOKEN  : 注册中心 MCP 访问令牌 (在注册中心 🔑Token 管理 里生成)
+#   - 其余 secret 与三个构建 workflow 引用的保持一致 (未设置则跳过对应键)
+# 注意: 传输为明文 http, 请保证注册中心仅内网可达; 若可访问则改用 https
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: '仅预演不写入 (true=只打印计划)'
+        required: false
+        default: 'false'
+
+jobs:
+  sync-secrets:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      REGISTRY_MCP_URL: http://bh.vps.honor3.com:8008/mcp
+      REGISTRY_PROJECT_ID: proj-msid70ql-6xbq4w
+      REGISTRY_IDC: '1'
+      REGISTRY_ENVIRONMENT: '1'
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Sync secrets via MCP
+        run: |
+          if [ "${{ inputs.dry_run }}" = "true" ]; then
+            node scripts/sync-registry.mjs --dry-run
+          else
+            node scripts/sync-registry.mjs
+          fi
+        env:
+          REGISTRY_MCP_TOKEN: ${{ secrets.REGISTRY_MCP_TOKEN }}
+          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          JWT_SECRET: ${{ secrets.JWT_SECRET }}
+          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}