From dc452ad97ea8ffa4801176d2667220ba8017624d Mon Sep 17 00:00:00 2001
From: TJWater CI <ci@waternetwork.cn>
Date: Fri, 7 Aug 2026 17:43:25 +0800
Subject: [PATCH] fix(cd): stream candidate images to Dev over restricted SSH

---
 .gitea/workflows/container-cd.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/container-cd.yml b/.gitea/workflows/container-cd.yml
index ea07ebe..18b6a90 100644
--- a/.gitea/workflows/container-cd.yml
+++ b/.gitea/workflows/container-cd.yml
@@ -76,7 +76,7 @@ jobs:
           docker build --pull=false "${cache_args[@]}" -f "${{ inputs.dockerfile }}" \
             -t "${{ inputs.image_name }}:sha-${{ gitea.sha }}" "${{ inputs.build_context }}"
           docker push "${{ inputs.image_name }}:sha-${{ gitea.sha }}"
-      - name: Candidate pull on Dev
+      - name: Configure restricted Dev deployment key
         if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
         env:
           DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
@@ -87,6 +87,17 @@ jobs:
           printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H "${{ inputs.deploy_host }}" >> ~/.ssh/known_hosts
+      - name: Transfer candidate image to Dev
+        if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
+        run: |
+          set -euo pipefail
+          docker save "${{ inputs.image_name }}:sha-${{ gitea.sha }}" | \
+            ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
+              "load ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${{ gitea.sha }}"
+      - name: Candidate verification on Dev
+        if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
+        run: |
+          set -eu
           ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
             "candidate ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${{ gitea.sha }}"
       - name: Promote tagged release after candidate check