feat(ci): 迁移到 hk runner + Release 产物分发，解除对 doc79 runner 的依赖

- 两个工作流 runs-on 改为 hk（在线）；Go/Node 工具链自包含下载+工作区缓存
- 后端产物改为发布 Gitea Release 附件（server-v<版本>），与 runner 位置解耦
- deploy-watch.sh 重写为从 Release 拉取：匿名/令牌 HTTPS 下载、包结构预检、
  按 release id 幂等、失败下轮重试
- 移除对 /ci-artifacts 本机目录的依赖（原设计要求 runner 与生产同机）
- PULL_DEPLOY.md 架构图同步更新

.gitea/docs/PULL_DEPLOY.md

@@ -7,13 +7,18 @@
 ## 架构
 
 ```
-push main → Gitea Actions 构建（runner 与 doc79 同机）→ 产物写入 /ci-artifacts
+push main → Gitea Actions（hk runner 构建）→ 部署包发布为 Gitea Release 附件
                                         ↓
-1Panel 计划任务（每分钟）运行 deploy-watch.sh → 发现新 sha256 → deploy.sh 原子切换 + 重启容器 + 健康检查
+1Panel 计划任务（每分钟）运行 deploy-watch.sh → 发现新 release → HTTPS 拉取 deploy.tar.gz
+                                        ↓
+deploy.sh 原子切换 + 重启容器 + 健康检查（失败自动回滚）
                                         ↓
 EdgeOne CDN (HTTPS 终结) → doc79:80 → 1Panel OpenResty 反代 → 127.0.0.1:8080 lunar-server 容器
 ```
 
+> 产物通过 Gitea Release 分发，与 runner 位置解耦（hk/bt 均可构建）；
+> 服务器侧只出站 HTTPS 拉取，无任何入站 SSH。
+
 ## 一次性安装步骤（按序执行）
 
 ### 1. EdgeOne 回源配置（控制台）
@@ -87,6 +92,8 @@ ADMIN_PASSWORD=<后台登录密码>
 - 脚本内容：
 
 ```bash
+# 可选：若仓库私有或需要令牌拉取，在 .env 中配置 GITEA_DEPLOY_TOKEN
+[ -f /opt/lunar/production/.env ] && set -a && . /opt/lunar/production/.env && set +a
 bash /opt/lunar/scripts/deploy-watch.sh
 ```
 

.gitea/scripts/deploy-watch.sh

@@ -1,47 +1,98 @@
 #!/bin/bash
-# 拉取式部署 watcher - 监听 CI 产物目录，发现新版本自动部署
+# 拉取式部署 watcher - 从 Gitea Release 拉取最新部署包并自动部署
 # 设计原则：
-#   - CI 只负责构建并把产物写入 /ci-artifacts（runner 与本机同宿主）
+#   - CI 在任意 runner（hk 等）构建，产物以 Release 附件发布到 Gitea
-#   - 部署动作只由服务器本地触发（1Panel 计划任务每分钟调用本脚本），
+#   - 本脚本由服务器本地定时任务（1Panel 计划任务）每分钟调用，通过 HTTPS 拉取，
 #     任何 AI/CI 均不通过 SSH 操作服务器
 # 安装方式见 .gitea/docs/PULL_DEPLOY.md（1Panel 原生方式，一次性配置）
+#
+# 可选环境变量（建议写入 /opt/lunar/production/.env 并在计划任务里 source）：
+#   GITEA_DEPLOY_TOKEN  只读令牌（仓库公开时可省略，匿名即可下载）
 
 set -u
 
-ARTIFACT="${ARTIFACT:-/ci-artifacts/server-deploy-latest.tar.gz}"
+GITEA_URL="${GITEA_URL:-https://gitea.neatcn.com}"
-STATE_FILE="${STATE_FILE:-/opt/lunar/production/.last-deployed-sha256}"
+REPO="${REPO:-gouki/lunar-mini}"
+STATE_FILE="${STATE_FILE:-/opt/lunar/production/.last-deployed-release}"
 DEPLOY_SCRIPT="${DEPLOY_SCRIPT:-/opt/lunar/scripts/deploy.sh}"
 LOG_FILE="${LOG_FILE:-/opt/lunar/deploy-watch.log}"
+WORK_DIR="$(mktemp -d)"
+trap 'rm -rf "$WORK_DIR"' EXIT
 
 log() {
   echo "$(date '+%Y-%m-%d %H:%M:%S') $1" >> "$LOG_FILE"
 }
 
-# 产物不存在时静默等待
+AUTH_ARGS=()
-if [ ! -f "$ARTIFACT" ]; then
+if [ -n "${GITEA_DEPLOY_TOKEN:-}" ]; then
+  AUTH_ARGS=(-H "Authorization: token ${GITEA_DEPLOY_TOKEN}")
+fi
+
+# 查询最新 20 个 release，取 tag 前缀为 server-v 且带 deploy.tar.gz 附件的最新一个
+RELEASE_JSON=$(curl -fsS --connect-timeout 10 --max-time 30 \
+  "${AUTH_ARGS[@]}" \
+  "$GITEA_URL/api/v1/repos/$REPO/releases?limit=20" \
+  -o "$WORK_DIR/releases.json" && cat "$WORK_DIR/releases.json") || {
+  log "查询 release 列表失败，等待下次轮询"
+  exit 1
+}
+
+PARSED=$(python3 - "$WORK_DIR/releases.json" <<'PY'
+import json, sys
+releases = json.load(open(sys.argv[1]))
+for r in releases:
+    if not r.get("tag_name", "").startswith("server-v"):
+        continue
+    if r.get("draft") or r.get("prerelease"):
+        continue
+    for a in r.get("assets", []):
+        if a.get("name") == "deploy.tar.gz":
+            print(r["id"])
+            print(r["tag_name"])
+            print(a["id"])
+            print(a["browser_download_url"])
+            sys.exit(0)
+PY
+) || true
+
+if [ -z "$PARSED" ]; then
+  # 尚无可部署的发布版本，静默等待
   exit 0
 fi
 
-# 计算产物指纹
+RELEASE_ID=$(echo "$PARSED" | sed -n 1p)
-CURRENT_SHA="$(sha256sum "$ARTIFACT" | awk '{print $1}')"
+TAG=$(echo "$PARSED" | sed -n 2p)
-LAST_SHA=""
+ASSET_ID=$(echo "$PARSED" | sed -n 3p)
-if [ -f "$STATE_FILE" ]; then
+DOWNLOAD_URL=$(echo "$PARSED" | sed -n 4p)
-  LAST_SHA="$(cat "$STATE_FILE")"
-fi
 
-# 无变化则跳过
+# 幂等：已部署过该 release 则跳过
-if [ "$CURRENT_SHA" = "$LAST_SHA" ]; then
+LAST="$(cat "$STATE_FILE" 2>/dev/null || true)"
+if [ "$LAST" = "$RELEASE_ID" ]; then
   exit 0
 fi
 
-log "发现新版本产物 sha256=${CURRENT_SHA:0:12}，开始部署"
+log "发现新版本 $TAG (release #$RELEASE_ID)，开始拉取部署"
 
-# 执行部署；成功后才记录指纹（失败时下次轮询会重试）
+# 下载部署包（公开仓库可匿名；-L 跟随重定向）
-if bash "$DEPLOY_SCRIPT" "$ARTIFACT" >> "$LOG_FILE" 2>&1; then
+if ! curl -fsSL --connect-timeout 10 --max-time 300 \
+  "${AUTH_ARGS[@]}" \
+  "$DOWNLOAD_URL" -o "$WORK_DIR/deploy.tar.gz"; then
+  log "下载部署包失败，等待下次轮询重试"
+  exit 1
+fi
+
+# 包结构预检（deploy.sh 内部还会再校验）
+if ! tar -tzf "$WORK_DIR/deploy.tar.gz" | grep -q "^deploy/bin/server$"; then
+  log "部署包结构异常（缺少 deploy/bin/server），中止"
+  exit 1
+fi
+
+# 执行部署；成功后才记录 release id（失败时下次轮询会重试）
+if bash "$DEPLOY_SCRIPT" "$WORK_DIR/deploy.tar.gz" >> "$LOG_FILE" 2>&1; then
   mkdir -p "$(dirname "$STATE_FILE")"
-  printf '%s' "$CURRENT_SHA" > "$STATE_FILE"
+  printf '%s' "$RELEASE_ID" > "$STATE_FILE"
-  log "部署成功"
+  log "部署成功: $TAG"
 else
-  log "部署失败，保留旧指纹，等待下次轮询重试或人工介入"
+  log "部署失败（$TAG），保留旧版本，等待下次轮询重试或人工介入"
   exit 1
 fi

.gitea/workflows/miniapp-preview.yml

@@ -11,21 +11,45 @@ on:
 
 jobs:
   publish:
-    # 专属运行器 lunar-node: docker://node:22-bookworm（注册于 doc79）
+    # hk runner（海外，宿主机直接执行；可直连微信与 Telegram/Discord）
-    runs-on: lunar-node
+    runs-on: hk
     steps:
       - uses: https://gitea.neatcn.com/gouki/action-checkout@v4
         with:
           # Need recent commit subjects for the WeChat upload remark.
           fetch-depth: 20
+
+      - name: Prepare Node toolchain
+        run: |
+          # 优先复用 runner 宿主机缓存的工具链（工作目录持久化）
+          TOOLDIR="$RUNNER_WORKSPACE/.lunar-toolchain"
+          mkdir -p "$TOOLDIR"
+          if [ -x "$TOOLDIR/node/bin/node" ]; then
+            echo "复用缓存 Node 工具链"
+          else
+            wget -q --tries=2 --timeout=60 -O "$TOOLDIR/node.tgz" \
+              "https://nodejs.org/dist/v22.12.0/node-v22.12.0-linux-x64.tar.xz" \
+              || wget -q --tries=2 --timeout=60 -O "$TOOLDIR/node.tgz" \
+              "https://mirrors.aliyun.com/nodejs-release/v22.12.0/node-v22.12.0-linux-x64.tar.xz"
+            rm -rf "$TOOLDIR/node-v22.12.0-linux-x64"
+            tar -C "$TOOLDIR" -xJf "$TOOLDIR/node.tgz"
+            mv "$TOOLDIR/node-v22.12.0-linux-x64" "$TOOLDIR/node"
+            rm -f "$TOOLDIR/node.tgz"
+          fi
+          "$TOOLDIR/node/bin/node" --version
+          echo "PATH=$TOOLDIR/node/bin:$PATH" >> "$GITEA_ENV"
+
       - name: Verify Node runtime
         run: node --version
+
       - name: Install dependencies
         working-directory: mini
         run: npm ci
+
       - name: Run tests
         working-directory: mini
         run: npm test
+
       - name: Configure production API and app version
         working-directory: mini
         env:
@@ -58,6 +82,7 @@ jobs:
           EOF
           echo "Version info injected into utils/version.js:"
           cat utils/version.js
+
       - name: Materialize the upload key
         env:
           WECHAT_CI_PRIVATE_KEY: ${{ secrets.WECHAT_CI_PRIVATE_KEY }}
@@ -65,6 +90,7 @@ jobs:
           test -n "$WECHAT_CI_PRIVATE_KEY"
           umask 077
           printf '%s' "$WECHAT_CI_PRIVATE_KEY" > "$RUNNER_TEMP/wechat-ci.key"
+
       - name: Upload WeChat development version
         working-directory: mini
         env:
@@ -106,14 +132,6 @@ jobs:
           node ci/upload-ci.cjs
           test -s ci-artifacts/upload-result.json
           cat ci-artifacts/upload-result.json
-      - name: Persist upload result on runner host
-        run: |
-          test -s mini/ci-artifacts/upload-result.json
-          test -d /ci-artifacts
-          cp mini/ci-artifacts/upload-result.json "/ci-artifacts/miniapp-upload-${{ gitea.sha }}.json"
-          cp mini/ci-artifacts/upload-result.json /ci-artifacts/miniapp-upload-latest.json
-          ls -la /ci-artifacts/miniapp-upload-latest.json
-          echo "Upload result saved on runner host: /opt/lunar/ci-artifacts/miniapp-upload-latest.json"
 
       - name: Send success notification
         if: success()
@@ -123,7 +141,7 @@ jobs:
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
           VERSION="$(tr -d '\n' < mini/ci-artifacts/resolved-version.txt)"
-          bash .gitea/scripts/notify.sh success "小程序开发版上传成功" "版本: ${VERSION} 上传结果已保存到: /opt/lunar/ci-artifacts/miniapp-upload-latest.json"
+          bash .gitea/scripts/notify.sh success "小程序开发版上传成功" "版本: ${VERSION}"
 
       - name: Send failure notification
         if: failure()

.gitea/workflows/server-deploy.yml

@@ -1,4 +1,4 @@
-name: Build and Deploy Server
+name: Build and Publish Server
 
 on:
   push:
@@ -10,23 +10,44 @@ on:
 
 jobs:
   build:
-    # 专属运行器：docker://golang:1.22-bookworm（注册于 doc79）
+    # hk runner（海外，宿主机直接执行，无容器标签映射）
-    runs-on: lunar-ci
+    runs-on: hk
     steps:
       - uses: https://gitea.neatcn.com/gouki/action-checkout@v4
         with:
           fetch-depth: 20
 
-      - name: Verify Go runtime
+      - name: Prepare Go toolchain
-        run: go version
+        run: |
+          # 优先复用 runner 宿主机缓存的工具链（工作目录持久化）
+          TOOLDIR="$RUNNER_WORKSPACE/.lunar-toolchain"
+          mkdir -p "$TOOLDIR"
+          if [ -x "$TOOLDIR/go/bin/go" ]; then
+            echo "复用缓存 Go 工具链"
+          else
+            # 官方源与阿里云镜像双通道，先到先用
+            wget -q --tries=2 --timeout=60 -O "$TOOLDIR/go.tgz" \
+              "https://go.dev/dl/go1.22.10.linux-amd64.tar.gz" \
+              || wget -q --tries=2 --timeout=60 -O "$TOOLDIR/go.tgz" \
+              "https://mirrors.aliyun.com/golang/go1.22.10.linux-amd64.tar.gz"
+            rm -rf "$TOOLDIR/go"
+            tar -C "$TOOLDIR" -xzf "$TOOLDIR/go.tgz"
+            rm -f "$TOOLDIR/go.tgz"
+          fi
+          "$TOOLDIR/go/bin/go" version
+          echo "LUNAR_GO=$TOOLDIR/go/bin/go" >> "$GITEA_ENV"
 
       - name: Install dependencies
         working-directory: server
-        run: go mod download
+        run: |
+          export HOME="$RUNNER_WORKSPACE"
+          "$LUNAR_GO" mod download
 
       - name: Run tests
         working-directory: server
-        run: go test ./...
+        run: |
+          export HOME="$RUNNER_WORKSPACE"
+          "$LUNAR_GO" test ./...
 
       - name: Build application
         working-directory: server
@@ -34,6 +55,7 @@ jobs:
           GITEA_SHA: ${{ gitea.sha }}
           GITEA_RUN_NUMBER: ${{ gitea.run_number }}
         run: |
+          export HOME="$RUNNER_WORKSPACE"
           mkdir -p bin
 
           # 生成版本号（使用构建编号）
@@ -42,25 +64,22 @@ jobs:
           COMMIT_SHORT="${GITEA_SHA:0:7}"
 
           echo "Building server version: $VERSION"
-          echo "Build time: $BUILD_TIME"
-          echo "Commit SHA: $COMMIT_SHORT"
 
-          # 使用 ldflags 注入版本信息
+          # ldflags 注入版本信息；目标平台为 doc79（linux/amd64）
-          go build -ldflags "\
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 "$LUNAR_GO" build -ldflags "\
             -X main.Version=$VERSION \
             -X main.BuildTime=$BUILD_TIME \
             -X main.CommitSha=$COMMIT_SHORT" \
             -o bin/server cmd/main.go
 
-          # 同时保存版本信息到文件（用于部署时读取）
+          # 版本元数据随包分发，便于服务器侧追溯
           cat > bin/version.env <<EOF
           APP_VERSION=$VERSION
           APP_BUILD_TIME=$BUILD_TIME
           APP_COMMIT_SHA=$COMMIT_SHORT
           EOF
-          
-          echo "Version info saved to bin/version.env:"
           cat bin/version.env
+          echo "SERVER_VERSION=$VERSION" >> "$GITEA_ENV"
 
       - name: Create deployment package
         working-directory: server
@@ -74,15 +93,36 @@ jobs:
             cp -r web/ deploy/web/
           fi
           tar -czf deploy.tar.gz deploy/
+          sha256sum deploy.tar.gz
 
-      - name: Persist deployment package on runner host
+      - name: Publish release with deployment package
+        env:
+          GITEA_SHA: ${{ gitea.sha }}
+          GITEA_RUN_NUMBER: ${{ gitea.run_number }}
         run: |
-          test -f server/deploy.tar.gz
+          set -e
-          test -d /ci-artifacts
+          VERSION="1.0.${GITEA_RUN_NUMBER}"
-          cp server/deploy.tar.gz "/ci-artifacts/server-deploy-${{ gitea.sha }}.tar.gz"
+          TAG="server-v${VERSION}"
-          cp server/deploy.tar.gz /ci-artifacts/server-deploy-latest.tar.gz
+          API="https://gitea.neatcn.com/api/v1/repos/gouki/lunar-mini"
-          ls -la /ci-artifacts/server-deploy-latest.tar.gz
+          # Gitea Actions 内建的 job 令牌（仓库写权限）
-          echo "Deployment package saved on runner host: /opt/lunar/ci-artifacts/server-deploy-latest.tar.gz"
+          AUTH="Authorization: token ${GITEA_TOKEN}"
+
+          # 幂等：同 tag 已存在则先删除（重跑场景）
+          EXISTING=$(curl -sS -H "$AUTH" "$API/releases/tags/$TAG" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('id',''))" 2>/dev/null || true)
+          if [ -n "$EXISTING" ] && [ "$EXISTING" != "None" ]; then
+            curl -sS -X DELETE -H "$AUTH" "$API/releases/$EXISTING" -o /dev/null -w "删除旧 release: HTTP %{http_code}\n"
+          fi
+
+          RELEASE_ID=$(curl -sS -X POST -H "$AUTH" -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$TAG\",\"name\":\"server $VERSION\",\"target_commitish\":\"main\",\"body\":\"CI 自动构建，commit ${GITEA_SHA:0:7}。doc79 由 deploy-watch.sh 拉取本附件完成部署。\"}" \
+            "$API/releases" | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
+          echo "Release created: id=$RELEASE_ID tag=$TAG"
+
+          curl -sS -X POST -H "$AUTH" \
+            -F "attachment=@server/deploy.tar.gz" \
+            "$API/releases/$RELEASE_ID/assets" \
+            -o /dev/null -w "附件上传: HTTP %{http_code}\n"
+          echo "发布地址: https://gitea.neatcn.com/gouki/lunar-mini/releases/tag/$TAG"
 
       - name: Send success notification
         if: success()
@@ -94,8 +134,8 @@ jobs:
         run: |
           VERSION="1.0.${GITEA_RUN_NUMBER}"
           bash .gitea/scripts/notify.sh success \
-            "后端构建成功" \
+            "后端构建发布成功" \
-            "版本: v${VERSION}\n产物: /opt/lunar/ci-artifacts/server-deploy-latest.tar.gz\n部署由服务器侧 watcher 自动拉取完成"
+            "版本: v${VERSION}\n产物: releases/tag/server-v${VERSION}\ndoc79 将自动拉取部署"
 
       - name: Send failure notification
         if: failure()