fix(ci): 兼容精简 runner（Alpine）环境

- checkout 改为原生 git 浅克隆（action-checkout 依赖 node，Alpine runner 无）
- 发布 release 改用 grep/sed 解析 JSON（不依赖 python3）
- 小程序密钥 PEM 规整改用 node 实现
- 通知步骤增加容错（失败不阻断主流程）

.gitea/workflows/miniapp-preview.yml

@@ -14,10 +14,14 @@ jobs:
     # 标准标签：hk / bt-runner 均带 ubuntu-latest，任一空闲 runner 接单
     runs-on: ubuntu-latest
     steps:
-      - uses: https://gitea.neatcn.com/gouki/action-checkout@v4
+      # 精简 runner（Alpine）无 node，无法跑 action-checkout；直接用 git 浅克隆
-        with:
+      - name: Checkout
-          # Need recent commit subjects for the WeChat upload remark.
+        run: |
-          fetch-depth: 20
+          git init -q .
+          git remote add origin "$GITEA_SERVER_URL/$GITEA_REPOSITORY"
+          git fetch -q --depth 20 origin "$GITEA_REF_NAME"
+          git checkout -q FETCH_HEAD
+          git log --oneline -3
 
       - name: Prepare Node toolchain
         run: |
@@ -116,19 +120,17 @@ jobs:
           node -e 'const {resolveVersion}=require("./ci/resolve-version.cjs"); console.log("Resolved Mini Program version:", resolveVersion(process.cwd()))'
           node -e 'const {resolveUploadDesc}=require("./ci/resolve-upload-desc.cjs"); console.log("Resolved upload remark:", resolveUploadDesc({repoRoot:require("path").resolve(".."), versionLabel:process.env.MINIAPP_VERSION_LABEL}))'
           # Normalize PEM newlines that may be flattened when stored in Secrets.
-          python3 - <<'PY'
+          # 用 node 处理（部分 runner 无 python3）
-          from pathlib import Path
+          node - <<'JS'
-          import os
+          const fs = require("fs");
-          key_path = Path(os.environ["WECHAT_CI_PRIVATE_KEY_PATH"])
+          const p = process.env.WECHAT_CI_PRIVATE_KEY_PATH;
-          text = key_path.read_text()
+          let t = fs.readFileSync(p, "utf8");
-          if "\\n" in text and "BEGIN" in text:
+          if (t.includes("\\n") && t.includes("BEGIN")) t = t.split("\\n").join("\n");
-              text = text.replace("\\n", "\n")
+          t = t.split("\r\n").join("\n").trim() + "\n";
-          text = text.replace("\r\n", "\n").strip() + "\n"
+          fs.writeFileSync(p, t);
-          key_path.write_text(text)
+          if (!/PRIVATE KEY/.test(t)) { console.error("WECHAT_CI_PRIVATE_KEY is not a PEM private key"); process.exit(1); }
-          content = key_path.read_text()
+          console.log("private_key_lines=", t.split("\n").length);
-          assert "BEGIN" in content and "PRIVATE KEY" in content, "WECHAT_CI_PRIVATE_KEY is not a PEM private key"
+          JS
-          print("private_key_lines=", len(content.splitlines()))
-          PY
           node ci/upload-ci.cjs
           test -s ci-artifacts/upload-result.json
           cat ci-artifacts/upload-result.json
@@ -141,7 +143,7 @@ jobs:
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
           VERSION="$(tr -d '\n' < mini/ci-artifacts/resolved-version.txt)"
-          bash .gitea/scripts/notify.sh success "小程序开发版上传成功" "版本: ${VERSION}"
+          bash .gitea/scripts/notify.sh success "小程序开发版上传成功" "版本: ${VERSION}" || echo "通知发送失败，不影响主流程"
 
       - name: Send failure notification
         if: failure()
@@ -152,7 +154,7 @@ jobs:
         run: |
           bash .gitea/scripts/notify.sh failure \
             "小程序开发版上传失败" \
-            "请检查 Actions 日志了解失败原因"
+            "请检查 Actions 日志了解失败原因" || echo "通知发送失败"
 
       - name: Remove temporary credentials
         if: always()

.gitea/workflows/server-deploy.yml

@@ -13,9 +13,14 @@ jobs:
     # 标准标签：hk / bt-runner 均带 ubuntu-latest，任一空闲 runner 接单
     runs-on: ubuntu-latest
     steps:
-      - uses: https://gitea.neatcn.com/gouki/action-checkout@v4
+      # hk 等精简 runner（Alpine）无 node，无法跑 action-checkout；直接用 git 浅克隆
-        with:
+      - name: Checkout
-          fetch-depth: 20
+        run: |
+          git init -q .
+          git remote add origin "$GITEA_SERVER_URL/$GITEA_REPOSITORY"
+          git fetch -q --depth 20 origin "$GITEA_REF_NAME"
+          git checkout -q FETCH_HEAD
+          git log --oneline -3
 
       - name: Prepare Go toolchain
         run: |
@@ -107,15 +112,16 @@ jobs:
           # Gitea Actions 内建的 job 令牌（仓库写权限）
           AUTH="Authorization: token ${GITEA_TOKEN}"
 
-          # 幂等：同 tag 已存在则先删除（重跑场景）
+          # 幂等：同 tag 已存在则先删除（重跑场景）；不依赖 python3，纯 grep/sed 解析
-          EXISTING=$(curl -sS -H "$AUTH" "$API/releases/tags/$TAG" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('id',''))" 2>/dev/null || true)
+          EXISTING=$(curl -sS -H "$AUTH" "$API/releases/tags/$TAG" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
-          if [ -n "$EXISTING" ] && [ "$EXISTING" != "None" ]; then
+          if [ -n "$EXISTING" ]; then
             curl -sS -X DELETE -H "$AUTH" "$API/releases/$EXISTING" -o /dev/null -w "删除旧 release: HTTP %{http_code}\n"
           fi
 
           RELEASE_ID=$(curl -sS -X POST -H "$AUTH" -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"$TAG\",\"name\":\"server $VERSION\",\"target_commitish\":\"main\",\"body\":\"CI 自动构建，commit ${GITEA_SHA:0:7}。doc79 由 deploy-watch.sh 拉取本附件完成部署。\"}" \
-            "$API/releases" | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
+            "$API/releases" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+          test -n "$RELEASE_ID"
           echo "Release created: id=$RELEASE_ID tag=$TAG"
 
           curl -sS -X POST -H "$AUTH" \
@@ -135,7 +141,7 @@ jobs:
           VERSION="1.0.${GITEA_RUN_NUMBER}"
           bash .gitea/scripts/notify.sh success \
             "后端构建发布成功" \
-            "版本: v${VERSION}\n产物: releases/tag/server-v${VERSION}\ndoc79 将自动拉取部署"
+            "版本: v${VERSION}\n产物: releases/tag/server-v${VERSION}\ndoc79 将自动拉取部署" || echo "通知发送失败，不影响主流程"
 
       - name: Send failure notification
         if: failure()
@@ -146,7 +152,7 @@ jobs:
         run: |
           bash .gitea/scripts/notify.sh failure \
             "后端构建失败" \
-            "请检查 Actions 日志了解失败原因"
+            "请检查 Actions 日志了解失败原因" || echo "通知发送失败"
 
       - name: Cleanup
         if: always()