xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 8 Pull Requests 8 Actions Packages Projects Releases 7 Wiki Activity

fix(ci): check-push-paths 缺少 checkout 导致 push pipeline 全链路断裂 #1583

Closed
xiaoxia wants to merge 1 commits from fix/check-push-paths-no-checkout into develop
pull from: fix/check-push-paths-no-checkout
merge into: xiaoxia:develop
Conversation 3 Commits 1 Files Changed 1
+1 -1
xiaoxia commented 2026-08-31 19:53:03 +08:00
Owner
Copy Link
Copy Source

问题

PR #1577 第一批提速时移除了 check-push-paths job 的 checkout 步骤，但脚本仍用 bash scripts/ci/ci_push_paths.sh 引用本地文件。

结果：

  1. check-push-paths 失败（No such file or directory）
  2. build-staging 三个 job 全部 skipped（依赖 check-push-paths 的 outputs）
  3. deploy-staging 无镜像可部署

修复

将 bash scripts/ci/ci_push_paths.sh 改为 curl 下载后执行：

-        bash scripts/ci/ci_push_paths.sh
+        curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_push_paths.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_push_paths.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_push_paths.sh

scripts/ci/ci_push_paths.sh 内容完全不变（PR #1578 的修改不受影响）。

## 问题 PR #1577 第一批提速时移除了 `check-push-paths` job 的 checkout 步骤，但脚本仍用 `bash scripts/ci/ci_push_paths.sh` 引用本地文件。 结果： 1. `check-push-paths` 失败（`No such file or directory`） 2. `build-staging` 三个 job 全部 skipped（依赖 check-push-paths 的 outputs） 3. `deploy-staging` 无镜像可部署 ## 修复 将 `bash scripts/ci/ci_push_paths.sh` 改为 curl 下载后执行： ```diff - bash scripts/ci/ci_push_paths.sh + curl -sfH "Authorization: token $GITHUB_TOKEN" -o /tmp/_ci_push_paths.sh "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/ci_push_paths.sh?ref=${GITHUB_SHA}" && bash /tmp/_ci_push_paths.sh ``` `scripts/ci/ci_push_paths.sh` 内容完全不变（PR #1578 的修改不受影响）。
xiaoxia added 1 commit 2026-08-31 19:53:03 +08:00
fix(ci): check-push-paths 缺少 checkout 导致脚本找不到文件
CI/CD Pipeline / Check push changed paths (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Dedup Check - skip PR tests when covered by push pipeline (pull_request) Successful in 4s
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 4s
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Successful in 3m45s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 27s
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 28s
Details
CI/CD Pipeline / Retag skipped Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Worker Image (pull_request) Has been skipped
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 4m49s
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
PR Automation / Auto Approve on CI Green (pull_request) Successful in 5m47s
Details
AI Code Review / AI Code Review (pull_request) Failing after 6m30s
Details
CI/CD Pipeline / Validate - Style (pull_request) Successful in 10m47s
Details
CI/CD Pipeline / Validate - Security (pull_request) Failing after 10m48s
Details
CI/CD Pipeline / Validate - Python (mypy + alembic) (pull_request) Successful in 11m48s
Details
ACR Cleanup / ACR Image Cleanup (pull_request_target) Successful in 1m30s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 2m53s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 26m58s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 36m59s
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / CI Gate (pull_request) Failing after 1s
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Canary Release to Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
c897082a13 
PR #1577 移除了 check-push-paths 的 checkout 步骤提速，
但脚本仍用 bash scripts/ci/ci_push_paths.sh 引用本地文件，
导致 push pipeline 中 check-push-paths 失败，
进而 build-staging 全部 skipped，deploy-staging 无镜像可部署。

修复：改为 curl 下载脚本后执行，与其他无 checkout job 保持一致。
不影响 scripts/ci/ci_push_paths.sh 的内容（PR #1578 的修改保持不变）。
gitea-actions bot commented 2026-08-31 19:57:56 +08:00
Copy Link
Copy Source

🚀 预览环境已部署

项目 详情
PR号 #1583
预览链接 https://pr-1583.preview.xiaoxiajianji.com
API环境 staging

💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。

🔄 每次提交新代码后预览环境会自动更新。

🗑️ PR 关闭或合并后，预览环境会自动清理。

🚀 **预览环境已部署** | 项目 | 详情 | |------|------| | PR号 | #1583 | | 预览链接 | [https://pr-1583.preview.xiaoxiajianji.com](https://pr-1583.preview.xiaoxiajianji.com) | | API环境 | staging | > 💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。 > > 🔄 每次提交新代码后预览环境会自动更新。 > > 🗑️ PR 关闭或合并后，预览环境会自动清理。
auto-approve-bot commented 2026-08-31 19:59:34 +08:00
Collaborator
Copy Link
Copy Source

【阻塞级】

  • 是否存在阻塞级问题：是
  • 阻塞级问题数量：2 个

📊 审查概览

  • 整体评价：需修改
  • 建议级问题数量：1 个

🔴 阻塞级问题（必须修复）

  1. [.gitea/workflows/ci-pipeline.yml: 879] 敏感信息泄露风险

    • 问题类型：安全漏洞
    • 问题描述：curl 命令通过 -H "Authorization: token $GITHUB_TOKEN" 将 Token 作为命令行参数传递。在 Linux/Unix 系统中，进程的命令行参数对所有具备读权限的用户可见（如通过 ps 命令）。这会导致 CI Token 泄露，存在严重的安全隐患。
    • 修改建议：使用 ~/.netrc 文件或通过环境变量配置认证，避免将 Token 直接暴露在命令行中。例如：echo "machine $(echo $GITHUB_API_URL | sed 's|https://||') login $GITHUB_TOKEN" > ~/.netrc && curl -n ...

  2. [.gitea/workflows/ci-pipeline.yml: 879] 脚本执行上下文变更风险

    • 问题类型：逻辑bug
    • 问题描述：将脚本下载到 /tmp 并执行会改变脚本的 $0 值（从 scripts/ci/ci_push_paths.sh 变为 /tmp/_ci_push_paths.sh）。如果该脚本内部使用了 $(dirname $0) 来定位同级资源文件或配置，将导致路径错误，进而引发逻辑错误或数据操作异常。
    • 修改建议：确认脚本不依赖 $0 路径，或者通过 export SCRIPT_DIR=$(pwd) 等方式显式传递上下文，确保脚本行为符合预期。

💡 改进建议（不阻塞合并）

  1. [.gitea/workflows/ci-pipeline.yml: 879] 引入不必要的网络依赖
    • 具体内容：原代码直接执行本地文件系统中的脚本，新代码引入了网络请求（curl）和对 API 的依赖。这增加了 CI 流程的延迟和失败点（如网络抖动、API 限流）。除非是为了解决 Git Checkout 不一致或特定版本回溯问题，否则建议保持直接执行本地脚本的方式。

✅ 良好实践

  • 使用 curl -f 确保在 HTTP 错误（如 404）时正确返回失败状态码。
  • 使用 && 连接下载和执行命令，确保只有下载成功时才会执行脚本。

🤖 由 AI 代码审查机器人自动生成 | 2026-08-31 11:59:34 | 模型:

### 【阻塞级】 - 是否存在阻塞级问题：是 - 阻塞级问题数量：2 个 ### 📊 审查概览 - 整体评价：需修改 - 建议级问题数量：1 个 ### 🔴 阻塞级问题（必须修复） 1. **[.gitea/workflows/ci-pipeline.yml: 879] 敏感信息泄露风险** - 问题类型：安全漏洞 - 问题描述：`curl` 命令通过 `-H "Authorization: token $GITHUB_TOKEN"` 将 Token 作为命令行参数传递。在 Linux/Unix 系统中，进程的命令行参数对所有具备读权限的用户可见（如通过 `ps` 命令）。这会导致 CI Token 泄露，存在严重的安全隐患。 - 修改建议：使用 `~/.netrc` 文件或通过环境变量配置认证，避免将 Token 直接暴露在命令行中。例如：`echo "machine $(echo $GITHUB_API_URL | sed 's|https://||') login $GITHUB_TOKEN" > ~/.netrc && curl -n ...` 2. **[.gitea/workflows/ci-pipeline.yml: 879] 脚本执行上下文变更风险** - 问题类型：逻辑bug - 问题描述：将脚本下载到 `/tmp` 并执行会改变脚本的 `$0` 值（从 `scripts/ci/ci_push_paths.sh` 变为 `/tmp/_ci_push_paths.sh`）。如果该脚本内部使用了 `$(dirname $0)` 来定位同级资源文件或配置，将导致路径错误，进而引发逻辑错误或数据操作异常。 - 修改建议：确认脚本不依赖 `$0` 路径，或者通过 `export SCRIPT_DIR=$(pwd)` 等方式显式传递上下文，确保脚本行为符合预期。 ### 💡 改进建议（不阻塞合并） 1. **[.gitea/workflows/ci-pipeline.yml: 879] 引入不必要的网络依赖** - 具体内容：原代码直接执行本地文件系统中的脚本，新代码引入了网络请求（`curl`）和对 API 的依赖。这增加了 CI 流程的延迟和失败点（如网络抖动、API 限流）。除非是为了解决 Git Checkout 不一致或特定版本回溯问题，否则建议保持直接执行本地脚本的方式。 ### ✅ 良好实践 - 使用 `curl -f` 确保在 HTTP 错误（如 404）时正确返回失败状态码。 - 使用 `&&` 连接下载和执行命令，确保只有下载成功时才会执行脚本。 --- <sub>🤖 由 AI 代码审查机器人自动生成 | 2026-08-31 11:59:34 | 模型: </sub> <!-- AI_CODE_REVIEW_AUTO_COMMENT -->
xiaoxia closed this pull request 2026-08-31 20:08:12 +08:00
gitea-actions bot commented 2026-08-31 20:15:04 +08:00
Copy Link
Copy Source

🗑️ 预览环境已清理

PR #1583 已关闭或合并，对应的预览环境已被清理。

如有需要，可以重新打开 PR 来重新生成预览环境。

🗑️ **预览环境已清理** PR #1583 已关闭或合并，对应的预览环境已被清理。 > 如有需要，可以重新打开 PR 来重新生成预览环境。
Some required checks failed
CI/CD Pipeline / Check push changed paths (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Dedup Check - skip PR tests when covered by push pipeline (pull_request) Successful in 4s
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 4s
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Successful in 3m45s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 27s
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 28s
Details
CI/CD Pipeline / Retag skipped Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Worker Image (pull_request) Has been skipped
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 4m49s
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
PR Automation / Auto Approve on CI Green (pull_request) Successful in 5m47s
Details
AI Code Review / AI Code Review (pull_request) Failing after 6m30s
Required
Details
CI/CD Pipeline / Validate - Style (pull_request) Successful in 10m47s
Details
CI/CD Pipeline / Validate - Security (pull_request) Failing after 10m48s
Details
CI/CD Pipeline / Validate - Python (mypy + alembic) (pull_request) Successful in 11m48s
Details
ACR Cleanup / ACR Image Cleanup (pull_request_target) Successful in 1m30s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 2m53s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 26m58s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 36m59s
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / CI Gate (pull_request) Failing after 1s
Required
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Canary Release to Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#1583
Delete Branch "fix/check-push-paths-no-checkout"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?