From 33719a549b3540b8ac65a98b713dcc969cde7d7a Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Thu, 5 Nov 2026 00:57:53 +0800 Subject: [PATCH] Keep deployment smoke checks backend-only --- .gitea/workflows/deploy.yml | 2 +- README.md | 2 +- deploy/release.sh | 11 ++--------- 3 files changed, 4 insertions(+), 11 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index c728eeb..0839aca 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -31,7 +31,7 @@ jobs: test -z "$(gofmt -l cmd internal)" go test -mod=readonly ./... CGO_ENABLED=0 go build -mod=readonly -o bin/foundry ./cmd/foundry - - name: Deploy and verify OAuth entry + - name: Deploy and verify backend readiness env: GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }} GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }} diff --git a/README.md b/README.md index 740d98e..856d3f8 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ 在仓库的 Actions Secrets 配置 `GOOGLE_CLIENT_ID` 和 `GOOGLE_CLIENT_SECRET`，在 Actions Variables 配置 `FOUNDRY_PROJECTS`。变量值为 JSON 对象，例如 `{"prompt":"http://localhost:17321/auth/callback"}`。部署读取服务器上预先配置的 `/opt/endoleap-infra/foundry/database.env`，OAuth 值由 Actions 在启动容器时注入。 -Google OAuth 的授权回调地址为 `https://api.foundry.entroia.com/auth/google/callback`。工作流会验证数据库就绪、匿名请求返回 401、Google 授权跳转参数和 HTTPS 就绪。完整登录还需在浏览器用 Google 测试账号走完回调、兑换和会话验证。 +Google OAuth 的授权回调地址为 `https://api.foundry.entroia.com/auth/google/callback`。工作流会验证数据库就绪、匿名请求返回 401 和 HTTPS 就绪。前端接入后，可在浏览器用 Google 测试账号验证完整登录、回调、兑换和会话。 ## 前端接入 diff --git a/deploy/release.sh b/deploy/release.sh index 0d9633d..a610ee4 100644 --- a/deploy/release.sh +++ b/deploy/release.sh @@ -51,15 +51,8 @@ docker exec "$candidate" node -e ' const project = Object.keys(JSON.parse(process.env.FOUNDRY_PROJECTS))[0]; const route = base + "/projects/" + encodeURIComponent(project) + "/auth"; assert.equal((await fetch(route + "/me")).status, 401); - const challenge = require("node:crypto").randomBytes(32).toString("base64url"); - const start = await fetch(route + "/google?challenge=" + challenge, {redirect: "manual"}); - assert.ok([302, 303].includes(start.status)); - const location = new URL(start.headers.get("location")); - assert.equal(location.hostname, "accounts.google.com"); - assert.equal(location.searchParams.get("client_id"), process.env.GOOGLE_CLIENT_ID); - assert.equal(location.searchParams.get("redirect_uri"), process.env.PUBLIC_ORIGIN + "/auth/google/callback"); } - verify().catch(() => { console.error("Foundry readiness or OAuth entry check failed"); process.exit(1); }); + verify().catch(() => { console.error("Foundry readiness or anonymous access check failed"); process.exit(1); }); ' # Keep the previous running container until the new candidate has passed checks. @@ -70,4 +63,4 @@ docker rename "$candidate" "$live" docker update --restart unless-stopped "$live" >/dev/null bash "$(dirname "$0")/route.sh" "$live" trap - EXIT -printf 'Foundry readiness, unauthenticated rejection and Google redirect verified.\n' +printf 'Foundry readiness and unauthenticated rejection verified.\n' -- 2.52.0