From b9fb9d96e12e479a30243c7a36fd76a76ba76d94 Mon Sep 17 00:00:00 2001
From: jiang <huarch97@outlook.com>
Date: Fri, 7 Aug 2026 17:17:12 +0800
Subject: [PATCH] ci: add restricted Dev deployment contract

---
 .gitea/workflows/container-cd.yml | 57 ++++++++++++++++---------------
 1 file changed, 29 insertions(+), 28 deletions(-)

diff --git a/.gitea/workflows/container-cd.yml b/.gitea/workflows/container-cd.yml
index 263f5e5..d733659 100644
--- a/.gitea/workflows/container-cd.yml
+++ b/.gitea/workflows/container-cd.yml
@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       image_name:
-        description: Fully qualified image repository without a tag
+        description: Fully qualified Gitea Registry image repository without a tag
         required: true
         type: string
       dockerfile:
@@ -16,22 +16,17 @@ on:
         default: .
         type: string
       test_command:
-        description: Source-level test command supplied by the calling repository
+        description: Optional source-level test command
         required: false
         default: ""
         type: string
-      image_test_command:
-        description: Optional command executed inside the built image
+      deploy_service:
+        description: Dev service to candidate-test and promote
         required: false
         default: ""
         type: string
-      candidate_command:
-        description: Optional Dev candidate-stack command executed after image push
-        required: false
-        default: ""
-        type: string
-      promote_command:
-        description: Optional atomic Dev promotion command executed only for v* tags
+      deploy_host:
+        description: Restricted Dev deployment host
         required: false
         default: ""
         type: string
@@ -46,21 +41,19 @@ on:
 jobs:
   test-build-publish:
     runs-on: ubuntu-22.04
-    outputs:
-      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
-      - uses: actions/checkout@v4
-      - id: meta
-        run: echo "image_tag=sha-${GITEA_SHA}" >> "$GITHUB_OUTPUT"
+      - uses: https://gitea.waternetwork.cn/actions/checkout@v4
+        with:
+          fetch-depth: 1
       - name: Source tests
         if: ${{ inputs.test_command != '' }}
         run: ${{ inputs.test_command }}
       - name: Build immutable candidate image
-        run: docker build --pull=false -f "${{ inputs.dockerfile }}" -t "${{ inputs.image_name }}:sha-${GITEA_SHA}" "${{ inputs.build_context }}"
-      - name: Image tests
-        if: ${{ inputs.image_test_command != '' }}
-        run: docker run --rm "${{ inputs.image_name }}:sha-${GITEA_SHA}" sh -lc '${{ inputs.image_test_command }}'
-      - name: Publish candidate image
+        run: |
+          set -eu
+          docker build --pull=false -f "${{ inputs.dockerfile }}" \
+            -t "${{ inputs.image_name }}:sha-${GITEA_SHA}" "${{ inputs.build_context }}"
+      - name: Login and publish candidate image
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
@@ -69,16 +62,24 @@ jobs:
           registry="$(printf '%s' '${{ inputs.image_name }}' | cut -d/ -f1)"
           printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" -u "$REGISTRY_USERNAME" --password-stdin
           docker push "${{ inputs.image_name }}:sha-${GITEA_SHA}"
-      - name: Candidate test on Dev
-        if: ${{ inputs.candidate_command != '' && secrets.DEV_DEPLOY_SSH_KEY != '' }}
+      - name: Candidate pull on Dev
+        if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
         env:
           DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
         run: |
           set -eu
-          install -m 700 -d ~/.ssh
+          test -n "$DEV_DEPLOY_SSH_KEY"
+          install -d -m 700 ~/.ssh
           printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          ${{ inputs.candidate_command }} "${{ inputs.image_name }}:sha-${GITEA_SHA}"
-      - name: Promote release after candidate health check
-        if: ${{ startsWith(gitea.ref, 'refs/tags/v') && inputs.promote_command != '' && secrets.DEV_DEPLOY_SSH_KEY != '' }}
-        run: ${{ inputs.promote_command }} "${{ inputs.image_name }}:sha-${GITEA_SHA}"
+          ssh-keyscan -H "${{ inputs.deploy_host }}" >> ~/.ssh/known_hosts
+          ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
+            "candidate ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${GITEA_SHA}"
+      - name: Promote tagged release after candidate check
+        if: ${{ startsWith(gitea.ref, 'refs/tags/v') && inputs.deploy_service != '' && inputs.deploy_host != '' }}
+        env:
+          DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
+        run: |
+          set -eu
+          ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
+            "promote ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${GITEA_SHA}"