52 lines
1.8 KiB
YAML
52 lines
1.8 KiB
YAML
name: Sync Secrets to Registry
|
|
|
|
# 将本仓库 Gitea CI/CD secrets 明文写回注册中心 (Registry 配置管理中心) 的 MCP 服务
|
|
# 目标: service-iboard 项目 (proj-msid70ql-6xbq4w)
|
|
# 触发: 仅手动 (workflow_dispatch)
|
|
# 依赖 secret:
|
|
# - REGISTRY_MCP_TOKEN : 注册中心 MCP 访问令牌 (在注册中心 🔑Token 管理 里生成)
|
|
# - 其余 secret 与三个构建 workflow 引用的保持一致 (未设置则跳过对应键)
|
|
# 注意: 传输为明文 http, 请保证注册中心仅内网可达; 若可访问则改用 https
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: '仅预演不写入 (true=只打印计划)'
|
|
required: false
|
|
default: 'false'
|
|
|
|
jobs:
|
|
sync-secrets:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
REGISTRY_MCP_URL: http://bh.vps.honor3.com:8008/mcp
|
|
REGISTRY_PROJECT_ID: proj-msid70ql-6xbq4w
|
|
REGISTRY_IDC: '1'
|
|
REGISTRY_ENVIRONMENT: '1'
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: https://gitea.com/actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Sync secrets via MCP
|
|
run: |
|
|
if [ "${{ inputs.dry_run }}" = "true" ]; then
|
|
node scripts/sync-registry.mjs --dry-run
|
|
else
|
|
node scripts/sync-registry.mjs
|
|
fi
|
|
env:
|
|
REGISTRY_MCP_TOKEN: ${{ secrets.REGISTRY_MCP_TOKEN }}
|
|
MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
|
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
JWT_SECRET: ${{ secrets.JWT_SECRET }}
|
|
ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
|
|
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }} |