wangdl/api-server
2
0
Fork 0
Code Issues 28 Pull Requests Actions Packages Projects Releases Wiki Activity

security: replace hardcoded production credentials with Gitea Secrets
Some checks failed
Deploy API Server / build-and-deploy (push) Failing after 24s
Details

Browse Source 
- DATABASE_URL, DB_USER, DB_PASSWORD, DB_NAME
- REDIS_PASSWORD, MYSQL_ROOT_PASSWORD, CREDENTIAL_ENCRYPTION_KEY
- All 7 secrets created in Gitea repo settings

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
wangdl 2026-06-20 12:26:07 +08:00
parent 27fe009e75
commit 2437cc0aa3
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
.gitea/workflows/deploy.yml
View File

@ -5,7 +5,7 @@ on:
branches: [main] branches: [main]
env: env:
DATABASE_URL: mysql://zhixi_user:hKHQ+N0wBjJAiLukFu5OMEI8@127.0.0.1:3306/zhixi_prod DATABASE_URL: ${{ secrets.DATABASE_URL }}
jobs: jobs:
build-and-deploy: build-and-deploy:
@ -37,7 +37,7 @@ jobs:
- name: Resolve failed migrations - name: Resolve failed migrations
run: | run: |
MYSQL_CMD="docker exec mysql mysql -u zhixi_user -phKHQ+N0wBjJAiLukFu5OMEI8 zhixi_prod" MYSQL_CMD="docker exec mysql mysql -u ${{ secrets.DB_USER }} -p${{ secrets.DB_PASSWORD }} ${{ secrets.DB_NAME }}"
FAILED=$($MYSQL_CMD -N -e \ FAILED=$($MYSQL_CMD -N -e \
"SELECT migration_name FROM _prisma_migrations WHERE logs LIKE '%failed%' LIMIT 1;" 2>/dev/null || true) "SELECT migration_name FROM _prisma_migrations WHERE logs LIKE '%failed%' LIMIT 1;" 2>/dev/null || true)
if [ -n "$FAILED" ]; then if [ -n "$FAILED" ]; then
@ -109,15 +109,15 @@ jobs:
cd /tmp/api-server cd /tmp/api-server
bash test/run-integration-tests.sh bash test/run-integration-tests.sh
env: env:
DATABASE_URL: mysql://zhixi_user:hKHQ+N0wBjJAiLukFu5OMEI8@127.0.0.1:3306/zhixi_prod DATABASE_URL: ${{ secrets.DATABASE_URL }}
REDIS_HOST: 127.0.0.1 REDIS_HOST: 127.0.0.1
REDIS_PORT: '6379' REDIS_PORT: '6379'
REDIS_PASSWORD: THTC2B5wXvhlMw/ZB6TYwB6MI9r1tO0F REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
JWT_SECRET: test-integration-secret JWT_SECRET: test-integration-secret
INTERNAL_API_KEY: test-key INTERNAL_API_KEY: test-key
CREDENTIAL_ENCRYPTION_KEY: '0123456789abcdef0123456789abcdef' CREDENTIAL_ENCRYPTION_KEY: ${{ secrets.CREDENTIAL_ENCRYPTION_KEY }}
STORAGE_DRIVER: local STORAGE_DRIVER: local
MYSQL_ROOT_PASSWORD: Zhixi@2026!Root_8C MYSQL_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }}
timeout-minutes: 10 timeout-minutes: 10
- name: Deploy RAG Worker - name: Deploy RAG Worker