From 5f825fb455b306f475c62571c8a68a3367437036 Mon Sep 17 00:00:00 2001
From: yiciheng <dy.yiciheng@gmail.com>
Date: Mon, 31 Aug 2026 14:33:16 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20=E6=94=B9=E7=94=A8=20container.options=20?=
 =?UTF-8?q?=E6=8C=82=E8=BD=BD=20/opt/freedom=EF=BC=88docker.sock=20?=
 =?UTF-8?q?=E7=94=B1=20runner=20=E8=87=AA=E5=8A=A8=E6=8C=82=E8=BD=BD?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy.yml | 148 +++++++++++++++---------------------
 1 file changed, 63 insertions(+), 85 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4c34e88..501b7c8 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,85 +1,63 @@
-# =============================================================
-# freedom-admin CI/CD 工作流（后端）
-# 触发条件：push 到 master 分支时自动构建并部署
-#
-# 环境（已确认）：
-#   - runner: local-runner (act_runner v0.6.1)，labels: ubuntu-latest
-#   - job 容器挂载 /var/run/docker.sock 与 /opt/freedom：由本 workflow 的 volumes 声明，
-#     并经 runner-config.yml 的 valid_volumes 白名单放行；host.docker.internal 解析由
-#     workflow options + runner-config.yml 的 container.options（--add-host）共同提供
-#   - Gitea 内网地址：host.docker.internal:3000（Gitea Actions 实例地址）
-#   - 部署目录：/opt/freedom/deploy（含 docker-compose.yml 与 .env）
-#
-# 前置条件（管理员一次性完成）：
-#   - 宿主 /opt/freedom/deploy/docker-compose.yml 与 .env 已就位（含 DB 凭据）
-# =============================================================
-name: CI/CD Deploy (Admin)
-
-on:
-  push:
-    branches:
-      - master
-  workflow_dispatch:
-
-jobs:
-  build-and-deploy:
-    name: 构建后端镜像并部署
-    runs-on: ubuntu-latest
-    container:
-      image: docker:24.0-cli
-      # 挂载与 host 解析：workflow 级 volumes/options + runner-config valid_volumes 白名单
-      # docker.sock 供 docker build / docker compose 使用；/opt/freedom 供 workspace 与部署目录使用
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-        - /opt/freedom:/opt/freedom
-      options: --add-host=host.docker.internal:host-gateway
-    steps:
-      - name: 安装 git
-        run: apk add --no-cache git
-
-      - name: Debug 网络环境
-        run: |
-          set -x
-          {
-            echo "=== /etc/hosts ==="
-            cat /etc/hosts
-            echo "=== getent hosts host.docker.internal ==="
-            getent hosts host.docker.internal || echo "NOT_RESOLVED"
-            echo "=== GITHUB_TOKEN len ==="
-            echo "len=${#GITHUB_TOKEN}"
-            echo "=== GITHUB_REPOSITORY ==="
-            echo "${GITHUB_REPOSITORY}"
-            echo "=== ping test ==="
-            wget -q -T 3 -O /dev/null http://host.docker.internal:3000/api/v1/version && echo HTTP_OK || echo HTTP_FAIL
-          } | tee /opt/freedom/workspace-debug.txt
-
-      - name: 拉取 master 代码
-        run: |
-          set -euo pipefail
-          rm -rf /opt/freedom/workspace-admin
-          git clone --depth 1 --branch master \
-            "http://oauth2:${GITHUB_TOKEN}@host.docker.internal:3000/${GITHUB_REPOSITORY}.git" \
-            /opt/freedom/workspace-admin
-          cd /opt/freedom/workspace-admin
-          echo "==> 已拉取代码，最新提交:"
-          git log -1 --oneline
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-
-      - name: 构建后端镜像
-        run: |
-          set -euo pipefail
-          docker build -t freedom-admin:latest /opt/freedom/workspace-admin
-
-      - name: 部署后端服务
-        run: |
-          set -euo pipefail
-          cd /opt/freedom/deploy
-          test -f docker-compose.yml || { echo "错误: 缺少 docker-compose.yml，请先初始化部署目录"; exit 1; }
-          test -f .env || { echo "错误: 缺少 .env，请先初始化部署目录"; exit 1; }
-          docker compose up -d --force-recreate backend
-
-      - name: 确认部署结果
-        run: |
-          cd /opt/freedom/deploy
-          docker compose ps backend
+# =============================================================
+# freedom-admin CI/CD 工作流（后端）
+# 触发条件：push 到 master 分支时自动构建并部署
+#
+# 环境（已实测确认，act_runner v0.6.1）：
+#   - runner: local-runner，labels: ubuntu-latest
+#   - /var/run/docker.sock 由 act_runner 自动挂载，切勿重复声明
+#     （重复会报 Duplicate mount point: /var/run/docker.sock）
+#   - /opt/freedom 必须经 container.options 的 -v 挂载，且在
+#     runner-config.yml 的 container.valid_volumes 白名单内，否则会被静默剥离
+#   - host.docker.internal 由 container.options 的 --add-host 解析到宿主
+#   - act_runner 不会自动检出代码到 /workspace（实测为空目录），需自行拉取
+#   - 部署目录：/opt/freedom/deploy（含 docker-compose.yml 与 .env）
+# =============================================================
+name: CI/CD Deploy (Admin)
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    name: 构建后端镜像并部署
+    runs-on: ubuntu-latest
+    container:
+      image: docker:24.0-cli
+      options: -v /opt/freedom:/opt/freedom --add-host=host.docker.internal:host-gateway
+    steps:
+      - name: 安装 git
+        run: apk add --no-cache git
+
+      - name: 拉取 master 代码
+        run: |
+          set -euo pipefail
+          rm -rf /opt/freedom/workspace-admin
+          git clone --depth 1 --branch master \
+            "http://oauth2:${GITHUB_TOKEN}@host.docker.internal:3000/${GITHUB_REPOSITORY}.git" \
+            /opt/freedom/workspace-admin
+          cd /opt/freedom/workspace-admin
+          echo "==> 已拉取代码，最新提交:"
+          git log -1 --oneline
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: 构建后端镜像
+        run: |
+          set -euo pipefail
+          docker build -t freedom-admin:latest /opt/freedom/workspace-admin
+
+      - name: 部署后端服务
+        run: |
+          set -euo pipefail
+          cd /opt/freedom/deploy
+          test -f docker-compose.yml || { echo "错误: 缺少 docker-compose.yml，请先初始化部署目录"; exit 1; }
+          test -f .env || { echo "错误: 缺少 .env，请先初始化部署目录"; exit 1; }
+          docker compose up -d --force-recreate backend
+
+      - name: 确认部署结果
+        run: |
+          cd /opt/freedom/deploy
+          docker compose ps backend