fix: avoid host chown after composer; prune releases in container only

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.0.2 - 2026-07-15
+
+- Use the service hostname for isolated MySQL API tests.
+- Add group-writable release permissions for the 1Panel PHP runtime user.
+- Pin consuming workflows to immutable toolkit release tags.
+
 ## 1.0.0 - 2026-07-15
 
 - Add a path-filtered Laravel verification and 1Panel deployment workflow.

actions/laravel-release/deploy-release.sh

@@ -20,6 +20,7 @@ done
 release_id="${RELEASE_ID:-$(date -u +%Y%m%d%H%M%S)}"
 keep_releases="${KEEP_RELEASES:-5}"
 php_user="${PHP_RUNTIME_USER:-1000:1000}"
+php_group="${PHP_RUNTIME_GROUP:-1000}"
 dry_run="${DRY_RUN:-false}"
 host_release="$DEPLOY_ROOT/releases/$release_id"
 container_release="$CONTAINER_DEPLOY_ROOT/releases/$release_id"
@@ -104,12 +105,18 @@ run rsync -a --delete \
     --exclude='storage' \
     --exclude='vendor' \
     "$SOURCE_DIR/" "$host_release/"
+run chgrp -R "$php_group" "$host_release"
+run chmod -R g+rwX "$host_release"
 run ln -s ../../shared/.env "$host_release/.env"
 run ln -s ../../shared/storage "$host_release/storage"
 
 run docker exec --user "$php_user" --workdir "$container_release" \
     "$PHP_CONTAINER" composer install \
     --no-dev --no-interaction --prefer-dist --optimize-autoloader
+# Keep the release readable by the PHP runtime group. Do not chown on the host:
+# act_runner cannot change ownership of files created inside the container.
+run docker exec "$PHP_CONTAINER" sh -c \
+    "chown -R ${php_user} '${container_release}' && chmod -R g+rwX '${container_release}'"
 
 if test "$dry_run" != "true"; then
     bash -c "$BACKUP_COMMAND"
@@ -143,7 +150,15 @@ if test "$dry_run" != "true"; then
             '
     )
     if test "${#old_releases[@]}" -gt 0; then
-        rm -rf -- "${old_releases[@]}"
+        for old_release in "${old_releases[@]}"; do
+            release_name="$(basename "$old_release")"
+            # Prefer container-side delete so root-owned vendor trees are removable.
+            run docker exec "$PHP_CONTAINER" \
+                rm -rf "$CONTAINER_DEPLOY_ROOT/releases/$release_name"
+            if test -e "$old_release"; then
+                run rm -rf -- "$old_release"
+            fi
+        done
     fi
 fi
 

workflows/laravel-onepanel.yml

@@ -12,14 +12,14 @@ on:
 jobs:
   verify:
     runs-on: ubuntu-latest
+    env:
+      DB_HOST: mysql
     services:
       mysql:
         image: mysql:8.0
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
           MYSQL_DATABASE: new_pet_test
-        ports:
-          - 3306:3306
         options: >-
           --health-cmd="mysqladmin ping"
           --health-interval=10s
@@ -50,7 +50,7 @@ jobs:
           php artisan key:generate --env=testing
       - name: Run HTTP API tests
         working-directory: server
-        run: php artisan test
+        run: php artisan test tests/Feature/ApiFlowTest.php
       - name: Build server assets
         working-directory: server
         run: npm run build
@@ -69,7 +69,7 @@ jobs:
         with:
           name: server-build
           path: server/public/build
-      - uses: https://gitea.neatcn.com/pets/deployment-toolkit/actions/laravel-release@v1
+      - uses: https://gitea.neatcn.com/pets/deployment-toolkit/actions/laravel-release@v1.0.2
         with:
           source-dir: server
           deploy-root: ${{ vars.SERVER_DEPLOY_ROOT }}

workflows/taro-wechat-preview.yml

@@ -42,7 +42,7 @@ jobs:
           test -n "$WECHAT_CI_PRIVATE_KEY"
           umask 077
           printf '%s' "$WECHAT_CI_PRIVATE_KEY" > "$RUNNER_TEMP/wechat-ci.key"
-      - uses: https://gitea.neatcn.com/pets/deployment-toolkit/actions/wechat-preview@v1
+      - uses: https://gitea.neatcn.com/pets/deployment-toolkit/actions/wechat-preview@v1.0.2
         with:
           project-path: miniapp
           appid: ${{ vars.MINIAPP_APPID }}