From 81d73340d7309bd5a5a66c66921c49958a256101 Mon Sep 17 00:00:00 2001
From: hexin-codex-bot <hexin-codex-bot@gitea.entroia.local>
Date: Mon, 5 Oct 2026 10:34:03 +0800
Subject: [PATCH] fix: allow service to read deployment password

---
 .gitea/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index edd870b..460e3a7 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -81,7 +81,8 @@ jobs:
           $SUDO ln -sfn "$RELEASE_DIR" "$APP_ROOT/current"
 
           printf '%s' "$STUDIO_PASSWORD" | $SUDO tee /etc/rednote-tool-studio.password >/dev/null
-          $SUDO chmod 600 /etc/rednote-tool-studio.password
+          $SUDO chown root:"$SERVICE_USER" /etc/rednote-tool-studio.password
+          $SUDO chmod 640 /etc/rednote-tool-studio.password
 
           cat > rednote-tool-studio.service <<EOF
           [Unit]