From 2437cc0aa363cdbb9c11da50bfcdd26bace8fa25 Mon Sep 17 00:00:00 2001 From: wangdl Date: Sat, 20 Jun 2026 12:26:07 +0800 Subject: [PATCH] security: replace hardcoded production credentials with Gitea Secrets - DATABASE_URL, DB_USER, DB_PASSWORD, DB_NAME - REDIS_PASSWORD, MYSQL_ROOT_PASSWORD, CREDENTIAL_ENCRYPTION_KEY - All 7 secrets created in Gitea repo settings Co-Authored-By: Claude --- .gitea/workflows/deploy.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index bdbb80b..1802bdc 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -5,7 +5,7 @@ on: branches: [main] env: - DATABASE_URL: mysql://zhixi_user:hKHQ+N0wBjJAiLukFu5OMEI8@127.0.0.1:3306/zhixi_prod + DATABASE_URL: ${{ secrets.DATABASE_URL }} jobs: build-and-deploy: @@ -37,7 +37,7 @@ jobs: - name: Resolve failed migrations run: | - MYSQL_CMD="docker exec mysql mysql -u zhixi_user -phKHQ+N0wBjJAiLukFu5OMEI8 zhixi_prod" + MYSQL_CMD="docker exec mysql mysql -u ${{ secrets.DB_USER }} -p${{ secrets.DB_PASSWORD }} ${{ secrets.DB_NAME }}" FAILED=$($MYSQL_CMD -N -e \ "SELECT migration_name FROM _prisma_migrations WHERE logs LIKE '%failed%' LIMIT 1;" 2>/dev/null || true) if [ -n "$FAILED" ]; then @@ -109,15 +109,15 @@ jobs: cd /tmp/api-server bash test/run-integration-tests.sh env: - DATABASE_URL: mysql://zhixi_user:hKHQ+N0wBjJAiLukFu5OMEI8@127.0.0.1:3306/zhixi_prod + DATABASE_URL: ${{ secrets.DATABASE_URL }} REDIS_HOST: 127.0.0.1 REDIS_PORT: '6379' - REDIS_PASSWORD: THTC2B5wXvhlMw/ZB6TYwB6MI9r1tO0F + REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }} JWT_SECRET: test-integration-secret INTERNAL_API_KEY: test-key - CREDENTIAL_ENCRYPTION_KEY: '0123456789abcdef0123456789abcdef' + CREDENTIAL_ENCRYPTION_KEY: ${{ secrets.CREDENTIAL_ENCRYPTION_KEY }} STORAGE_DRIVER: local - MYSQL_ROOT_PASSWORD: Zhixi@2026!Root_8C + MYSQL_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }} timeout-minutes: 10 - name: Deploy RAG Worker