♻️ refactor(ci): use fixed workflow slots

.gitea/workflows/changelog_and_release.yml

@@ -29,16 +29,21 @@ env:
   #    - GIT_TOKEN: 用于 git clone/push
   #    - API_TOKEN: 用于 API 调用
   ACCESS_TOKEN: ${{ secrets.WORKFLOW }}
+  GIT_CONFIG_COUNT: "3"
+  GIT_CONFIG_KEY_0: "credential.helper"
+  GIT_CONFIG_VALUE_0: ""
+  GIT_CONFIG_KEY_1: "credential.helper"
+  GIT_CONFIG_VALUE_1: '!f() { test "$1" = get || exit 0; printf "%s\n" username=oauth2; printf "%s\n" "password=${ACCESS_TOKEN}"; }; f'
+  GIT_CONFIG_KEY_2: "credential.interactive"
+  GIT_CONFIG_VALUE_2: "never"
 
   # ===== 工作区配置 =====
-  # 持久化 mirror 缓存目录
-  MIRROR_ROOT: "/data/git-mirrors"
-  # 每个 job 的独立临时工作目录根路径
-  JOB_WORKSPACE_ROOT: "/home/workspace/jobs"
+  WORKSPACE_DIR: "/data/workspace"
+  WORKSPACE_SLOT: "release"
 
   # ===== 分支配置 =====
   # 主分支名称（用于推送 CHANGELOG 更新）
-  # 如果留空，会自动检测（main 或 master）
+  # 必须明确配置主分支（例如 main 或 master）
   MAIN_BRANCH: "main"
 
   # ===== 服务器配置 =====
@@ -233,6 +238,7 @@ jobs:
       - name: 📥 准备隔离仓库
         id: clone
         run: |
+          set -euo pipefail
           echo "======================================"
           echo "🚀 开始准备仓库"
           echo "======================================"
@@ -240,106 +246,69 @@ jobs:
           REPO_SLUG="${{ github.repository }}"
           REPO_NAME="${{ github.event.repository.name }}"
           MAIN_BRANCH="${{ env.MAIN_BRANCH }}"
-          RUN_ATTEMPT="${{ github.run_attempt }}"
-          JOB_NAME="${{ github.job }}"
-          SERVER_HOST="${GITHUB_SERVER_URL#http://}"
-          SERVER_HOST="${SERVER_HOST#https://}"
-          REMOTE_URL="https://oauth2:${{ env.ACCESS_TOKEN }}@${SERVER_HOST}/${REPO_SLUG}.git"
-          BOOTSTRAP_SCRIPT="/tmp/bootstrap_workspace.sh"
-          BOOTSTRAP_URL="${GITHUB_SERVER_URL}/api/v1/repos/${REPO_SLUG}/media/.gitea/ci/bootstrap_workspace.sh?ref=${GITHUB_SHA}"
-          PREPARED_ENV=$(mktemp)
+          WORKSPACE_DIR="${{ env.WORKSPACE_DIR }}"
+          WORKSPACE_SLOT="${{ env.WORKSPACE_SLOT }}"
+          REPO_DIR="${WORKSPACE_DIR}/${REPO_NAME}/${WORKSPACE_SLOT}"
+          REMOTE_URL="${GITHUB_SERVER_URL}/${REPO_SLUG}.git"
+          REMOTE_REF="refs/remotes/origin/${MAIN_BRANCH}"
 
-          if [ -z "$RUN_ATTEMPT" ]; then
-            RUN_ATTEMPT="1"
+          if [ -z "$MAIN_BRANCH" ]; then
+            echo "❌ 错误: 未配置主分支"
+            exit 1
           fi
-
-          if [ -z "$JOB_NAME" ]; then
-            JOB_NAME="job"
+          case "$REMOTE_URL" in
+            https://*) ;;
+            *)
+              echo "❌ 拒绝通过非 HTTPS remote 使用 WORKFLOW token" >&2
+              exit 1
+              ;;
+          esac
+          if [ -e "$REPO_DIR" ] && [ ! -d "$REPO_DIR/.git" ]; then
+            echo "❌ Slot 已存在但不是 Git 仓库: $REPO_DIR" >&2
+            exit 1
           fi
 
           echo "📁 仓库名称: $REPO_NAME"
-          echo "🪞 Mirror 根目录: ${{ env.MIRROR_ROOT }}"
-          echo "📦 Job 工作区根目录: ${{ env.JOB_WORKSPACE_ROOT }}"
+          echo "📦 工作区根目录: $WORKSPACE_DIR"
+          echo "🎯 Workflow 职责: $WORKSPACE_SLOT"
           echo "🌐 服务器: ${GITHUB_SERVER_URL}"
           echo ""
 
-          curl -fsSL \
-            -H "Authorization: token ${{ env.ACCESS_TOKEN }}" \
-            "$BOOTSTRAP_URL" \
-            -o "$BOOTSTRAP_SCRIPT"
-          chmod +x "$BOOTSTRAP_SCRIPT"
+          if [ ! -d "$REPO_DIR/.git" ]; then
+            mkdir -p "$(dirname "$REPO_DIR")"
+            git clone --no-checkout "$REMOTE_URL" "$REPO_DIR"
+          else
+            git -C "$REPO_DIR" remote set-url origin "$REMOTE_URL"
+          fi
+          git -C "$REPO_DIR" fetch \
+            --prune --prune-tags --tags --force origin \
+            '+refs/heads/*:refs/remotes/origin/*'
+          if ! git -C "$REPO_DIR" show-ref --verify --quiet "$REMOTE_REF"; then
+            echo "❌ 配置的远程分支不存在: $MAIN_BRANCH" >&2
+            exit 1
+          fi
+          git -C "$REPO_DIR" checkout --force -B "$MAIN_BRANCH" "$REMOTE_REF"
+          git -C "$REPO_DIR" reset --hard "$REMOTE_REF"
+          git -C "$REPO_DIR" clean -ffdx
 
-          bash "$BOOTSTRAP_SCRIPT" prepare-job-workspace \
-            "$REPO_SLUG" \
-            "$REMOTE_URL" \
-            "${{ env.MIRROR_ROOT }}" \
-            "${{ env.JOB_WORKSPACE_ROOT }}" \
-            "${{ github.run_id }}" \
-            "$RUN_ATTEMPT" \
-            "$JOB_NAME" > "$PREPARED_ENV"
-
-          # shellcheck source=/dev/null
-          source "$PREPARED_ENV"
-          rm -f "$PREPARED_ENV"
-
-          echo "✓ Mirror 路径: $MIRROR_PATH"
-          echo "✓ Job 工作区: $JOB_WORKSPACE"
           echo "✓ 仓库目录: $REPO_DIR"
           echo ""
 
           cd "$REPO_DIR"
-
-          echo ""
-          echo "🔍 验证主分支配置..."
-
-          # 检查是否配置了主分支
-          if [ -z "${{ env.MAIN_BRANCH }}" ]; then
-            echo "❌ 错误: 未配置主分支"
-            echo ""
-            echo "请在 workflow 配置文件的 env 区域设置 MAIN_BRANCH:"
-            echo ""
-            echo "env:"
-            echo "  MAIN_BRANCH: \"main\"    # 或 \"master\""
-            echo ""
-            exit 1
-          fi
-
-          echo "✓ 使用配置的主分支: $MAIN_BRANCH"
-
-          # 验证分支是否存在
-          if ! git show-ref --verify --quiet refs/remotes/origin/$MAIN_BRANCH; then
-            echo "❌ 错误: 配置的分支 '$MAIN_BRANCH' 不存在"
-            echo ""
-            echo "可用的远程分支："
-            git branch -r | grep -v HEAD
-            echo ""
-            echo "请在 workflow 配置文件中修改 MAIN_BRANCH 为正确的分支名"
-            exit 1
-          fi
-
-          echo "✓ 分支 '$MAIN_BRANCH' 已验证存在"
-
-          # 切换到主分支
-          echo ""
-          echo "🌿 切换到主分支: $MAIN_BRANCH"
-          git checkout $MAIN_BRANCH
-          git pull origin $MAIN_BRANCH
-          echo "✓ 已切换到主分支并更新到最新"
+          echo "✓ 主分支 '$MAIN_BRANCH' 已准备并清理"
 
           # 导出到环境变量供后续步骤使用
-          echo "REPO_DIR=$REPO_DIR" >> $GITHUB_ENV
-          echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV
-          echo "JOB_WORKSPACE=$JOB_WORKSPACE" >> $GITHUB_ENV
-          echo "MIRROR_PATH=$MIRROR_PATH" >> $GITHUB_ENV
-          echo "MAIN_BRANCH=$MAIN_BRANCH" >> $GITHUB_ENV
-          echo "BOOTSTRAP_SCRIPT=$BOOTSTRAP_SCRIPT" >> $GITHUB_ENV
+          echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"
+          echo "REPO_NAME=$REPO_NAME" >> "$GITHUB_ENV"
+          echo "WORKSPACE_SLOT=$WORKSPACE_SLOT" >> "$GITHUB_ENV"
+          echo "MAIN_BRANCH=$MAIN_BRANCH" >> "$GITHUB_ENV"
 
           echo ""
           echo "✅ 仓库准备完成"
           echo "======================================"
           echo ""
 
-      - name: 🔍 检查 Bot 提交
+      - name: 🤖 检查 Bot 提交
         id: check_bot
         run: |
           echo "======================================"
@@ -829,9 +798,7 @@ jobs:
             git commit -m "${{ env.COMMIT_MSG }}"
 
             echo "📤 推送到远程 ${{ env.MAIN_BRANCH }} 分支..."
-            git push https://oauth2:${{ env.ACCESS_TOKEN }}@${GITHUB_SERVER_URL#https://}/${{ github.repository }}.git ${{ env.MAIN_BRANCH }}
-
-            if [ $? -eq 0 ]; then
+            if git -C "${{ env.REPO_DIR }}" push origin "${{ env.MAIN_BRANCH }}"; then
               echo "✅ 推送成功"
             else
               echo "❌ 推送失败"
@@ -853,7 +820,7 @@ jobs:
           cd ${{ env.REPO_DIR }}
 
           # 确保使用最新的 CHANGELOG
-          git pull origin ${{ env.MAIN_BRANCH }}
+          git -C "${{ env.REPO_DIR }}" pull --ff-only origin "${{ env.MAIN_BRANCH }}"
 
           python3 << 'PYSCRIPT'
           import re
@@ -1029,11 +996,11 @@ jobs:
           echo "======================================"
           echo ""
 
-      - name: 📊 生成 Workflow Summary
+      - name: 📋 生成 Workflow Summary
         if: always()
         run: |
           echo "======================================"
-          echo "📊 生成 Workflow Summary"
+          echo "📋 生成 Workflow Summary"
           echo "======================================"
 
           cat >> $GITHUB_STEP_SUMMARY << 'EOFSUMMARY'
@@ -1071,7 +1038,6 @@ jobs:
           - ✅ CHANGELOG.md 已更新
           - ✅ 更改已推送到主分支 (`${{ env.MAIN_BRANCH }}`)
           - ✅ Release 已创建
-          - ✅ CHANGELOG.md 已作为附件上传
           EOFSUCCESS
             else
               cat >> $GITHUB_STEP_SUMMARY << 'EOFREBUILD'
@@ -1083,7 +1049,6 @@ jobs:
 
           - ℹ️  CHANGELOG.md 无需更新（内容已存在）
           - ✅ Release 已创建
-          - ✅ CHANGELOG.md 已作为附件上传
 
           💡 **说明**: 检测到这是重建已删除的 tag，CHANGELOG 中已包含所有提交内容，因此直接从现有内容创建 Release。
           EOFREBUILD
@@ -1159,11 +1124,9 @@ jobs:
               echo "✅ 已完成的操作:"
               echo "  - CHANGELOG.md 已更新并推送到 ${{ env.MAIN_BRANCH }} 分支"
               echo "  - Release 已创建"
-              echo "  - CHANGELOG.md 已上传为附件"
             else
               echo "✅ 已完成的操作:"
               echo "  - Release 已创建（从现有 CHANGELOG 内容）"
-              echo "  - CHANGELOG.md 已上传为附件"
               echo ""
               echo "💡 说明: 检测到这是重建已删除的 tag，CHANGELOG 中已包含"
               echo "   所有提交内容，因此直接从现有内容创建 Release。"
@@ -1191,8 +1154,4 @@ jobs:
         run: |
           echo "🧹 清理临时文件..."
           rm -rf /tmp/commits.txt /tmp/changelog_updated.txt /tmp/content_changed.txt /tmp/release-body.txt /tmp/payload.json /tmp/release_response.json /tmp/upload_response_*.json
-          if [ -n "${{ env.JOB_WORKSPACE }}" ] && [ "${{ env.JOB_WORKSPACE }}" != "/" ]; then
-            echo "🧹 清理 Job 工作区: ${{ env.JOB_WORKSPACE }}"
-            rm -rf "${{ env.JOB_WORKSPACE }}"
-          fi
           echo "✅ 清理完成"