fix(backup): 完善备份/恢复数据链路，修复逻辑缺陷 #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to Cloudflare Workers | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| name: "Deploy to Cloudflare Workers" | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Check Required Secrets | |
| env: | |
| NODEAUTH_LICENSE: ${{ secrets.NODEAUTH_LICENSE }} | |
| JWT_SECRET: ${{ secrets.JWT_SECRET }} | |
| ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }} | |
| OAUTH_ALLOWED_USERS: ${{ secrets.OAUTH_ALLOWED_USERS }} | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| CLOUDFLARE_D1_DATABASE_ID: ${{ secrets.CLOUDFLARE_D1_DATABASE_ID }} | |
| run: | | |
| REQUIRED_VARS=( | |
| "NODEAUTH_LICENSE" | |
| "JWT_SECRET" | |
| "ENCRYPTION_KEY" | |
| "OAUTH_ALLOWED_USERS" | |
| "CLOUDFLARE_API_TOKEN" | |
| "CLOUDFLARE_ACCOUNT_ID" | |
| "CLOUDFLARE_D1_DATABASE_ID" | |
| ) | |
| MISSING_VARS=() | |
| for VAR in "${REQUIRED_VARS[@]}"; do | |
| if [ -z "${!VAR}" ]; then | |
| MISSING_VARS+=("$VAR") | |
| fi | |
| done | |
| if [ ${#MISSING_VARS[@]} -ne 0 ]; then | |
| echo "❌ Error: The following required secrets are missing or empty:" | |
| for VAR in "${MISSING_VARS[@]}"; do | |
| echo " - $VAR" | |
| done | |
| echo "Please configure them in your repository's Settings > Secrets and variables > Actions." | |
| exit 1 | |
| fi | |
| echo "✅ All required secrets are present." | |
| - name: Prepare Wrangler Config | |
| env: | |
| CONFIG_FILE: ${{ env.WRANGLER_CONFIG || 'wrangler.toml' }} | |
| run: | | |
| cp wrangler.toml wrangler.toml.bak | |
| if [ "$CONFIG_FILE" != "wrangler.toml" ]; then | |
| cp "$CONFIG_FILE" wrangler.toml | |
| fi | |
| - name: Install TOML Parser | |
| run: npm install @iarna/toml --no-save | |
| - name: Inject Configurations via AST Parser | |
| env: | |
| CONFIG_FILE: ${{ env.WRANGLER_CONFIG || 'wrangler.toml' }} | |
| CLOUDFLARE_WORKERS_NAME: ${{ secrets.CLOUDFLARE_WORKERS_NAME || 'nodeauth-worker' }} | |
| CLOUDFLARE_WORKERS_DEV: ${{ secrets.CLOUDFLARE_WORKERS_DEV }} | |
| CLOUDFLARE_WORKERS_PREVIEW_URLS: ${{ secrets.CLOUDFLARE_WORKERS_PREVIEW_URLS }} | |
| CLOUDFLARE_WORKERS_ROUTES: ${{ secrets.CLOUDFLARE_WORKERS_ROUTES }} | |
| CLOUDFLARE_D1_DATABASE_ID: ${{ secrets.CLOUDFLARE_D1_DATABASE_ID }} | |
| CLOUDFLARE_D1_DATABASE_NAME: ${{ secrets.CLOUDFLARE_D1_DATABASE_NAME || 'nodeauth-db' }} | |
| run: node scripts/update_wrangler.js | |
| - name: Sync Database Schema | |
| uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| wranglerVersion: '4.75.0' | |
| command: d1 execute ${{ secrets.CLOUDFLARE_D1_DATABASE_NAME || 'nodeauth-db' }} --remote --file=backend/schema.sql | |
| - name: Inject Commit Hash & Platform | |
| run: node scripts/inject_vars.js --platform=cloudflare | |
| - name: Generate Secret List | |
| id: secret_list | |
| env: | |
| OAUTH_GITHUB_CLIENT_ID: ${{ secrets.OAUTH_GITHUB_CLIENT_ID }} | |
| OAUTH_GITHUB_CLIENT_SECRET: ${{ secrets.OAUTH_GITHUB_CLIENT_SECRET }} | |
| OAUTH_GITHUB_REDIRECT_URI: ${{ secrets.OAUTH_GITHUB_REDIRECT_URI }} | |
| OAUTH_CLOUDFLARE_CLIENT_ID: ${{ secrets.OAUTH_CLOUDFLARE_CLIENT_ID }} | |
| OAUTH_CLOUDFLARE_CLIENT_SECRET: ${{ secrets.OAUTH_CLOUDFLARE_CLIENT_SECRET }} | |
| OAUTH_CLOUDFLARE_ORG_DOMAIN: ${{ secrets.OAUTH_CLOUDFLARE_ORG_DOMAIN }} | |
| OAUTH_CLOUDFLARE_REDIRECT_URI: ${{ secrets.OAUTH_CLOUDFLARE_REDIRECT_URI }} | |
| OAUTH_NODELOC_CLIENT_ID: ${{ secrets.OAUTH_NODELOC_CLIENT_ID }} | |
| OAUTH_NODELOC_CLIENT_SECRET: ${{ secrets.OAUTH_NODELOC_CLIENT_SECRET }} | |
| OAUTH_NODELOC_REDIRECT_URI: ${{ secrets.OAUTH_NODELOC_REDIRECT_URI }} | |
| OAUTH_GITEE_CLIENT_ID: ${{ secrets.OAUTH_GITEE_CLIENT_ID }} | |
| OAUTH_GITEE_CLIENT_SECRET: ${{ secrets.OAUTH_GITEE_CLIENT_SECRET }} | |
| OAUTH_GITEE_REDIRECT_URI: ${{ secrets.OAUTH_GITEE_REDIRECT_URI }} | |
| OAUTH_TELEGRAM_BOT_NAME: ${{ secrets.OAUTH_TELEGRAM_BOT_NAME }} | |
| OAUTH_TELEGRAM_BOT_TOKEN: ${{ secrets.OAUTH_TELEGRAM_BOT_TOKEN }} | |
| OAUTH_TELEGRAM_WEBHOOK_SECRET: ${{ secrets.OAUTH_TELEGRAM_WEBHOOK_SECRET }} | |
| OAUTH_GOOGLE_CLIENT_ID: ${{ secrets.OAUTH_GOOGLE_CLIENT_ID }} | |
| OAUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.OAUTH_GOOGLE_CLIENT_SECRET }} | |
| OAUTH_GOOGLE_REDIRECT_URI: ${{ secrets.OAUTH_GOOGLE_REDIRECT_URI }} | |
| OAUTH_MICROSOFT_CLIENT_ID: ${{ secrets.OAUTH_MICROSOFT_CLIENT_ID }} | |
| OAUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.OAUTH_MICROSOFT_CLIENT_SECRET }} | |
| OAUTH_BAIDU_CLIENT_ID: ${{ secrets.OAUTH_BAIDU_CLIENT_ID }} | |
| OAUTH_BAIDU_CLIENT_SECRET: ${{ secrets.OAUTH_BAIDU_CLIENT_SECRET }} | |
| OAUTH_DROPBOX_CLIENT_ID: ${{ secrets.OAUTH_DROPBOX_CLIENT_ID }} | |
| OAUTH_DROPBOX_CLIENT_SECRET: ${{ secrets.OAUTH_DROPBOX_CLIENT_SECRET }} | |
| OAUTH_WALLETCONNECT_PROJECT_ID: ${{ secrets.OAUTH_WALLETCONNECT_PROJECT_ID }} | |
| OAUTH_WALLETCONNECT_SELF_PROXY: ${{ secrets.OAUTH_WALLETCONNECT_SELF_PROXY }} | |
| run: | | |
| SECRETS="NODEAUTH_LICENSE | |
| JWT_SECRET | |
| ENCRYPTION_KEY | |
| OAUTH_ALLOW_ALL | |
| OAUTH_ALLOWED_USERS" | |
| OPTIONAL_VARS=( | |
| "OAUTH_GITHUB_CLIENT_ID" "OAUTH_GITHUB_CLIENT_SECRET" "OAUTH_GITHUB_REDIRECT_URI" | |
| "OAUTH_CLOUDFLARE_CLIENT_ID" "OAUTH_CLOUDFLARE_CLIENT_SECRET" "OAUTH_CLOUDFLARE_ORG_DOMAIN" "OAUTH_CLOUDFLARE_REDIRECT_URI" | |
| "OAUTH_NODELOC_CLIENT_ID" "OAUTH_NODELOC_CLIENT_SECRET" "OAUTH_NODELOC_REDIRECT_URI" | |
| "OAUTH_GITEE_CLIENT_ID" "OAUTH_GITEE_CLIENT_SECRET" "OAUTH_GITEE_REDIRECT_URI" | |
| "OAUTH_TELEGRAM_BOT_NAME" "OAUTH_TELEGRAM_BOT_TOKEN" "OAUTH_TELEGRAM_WEBHOOK_SECRET" | |
| "OAUTH_GOOGLE_CLIENT_ID" "OAUTH_GOOGLE_CLIENT_SECRET" "OAUTH_GOOGLE_REDIRECT_URI" | |
| "OAUTH_MICROSOFT_CLIENT_ID" "OAUTH_MICROSOFT_CLIENT_SECRET" | |
| "OAUTH_BAIDU_CLIENT_ID" "OAUTH_BAIDU_CLIENT_SECRET" | |
| "OAUTH_DROPBOX_CLIENT_ID" "OAUTH_DROPBOX_CLIENT_SECRET" | |
| "OAUTH_WALLETCONNECT_PROJECT_ID" "OAUTH_WALLETCONNECT_SELF_PROXY" | |
| ) | |
| for VAR in "${OPTIONAL_VARS[@]}"; do | |
| if [ -n "${!VAR}" ]; then SECRETS="$SECRETS | |
| $VAR"; fi | |
| done | |
| echo "secrets<<EOF" >> $GITHUB_OUTPUT | |
| echo "$SECRETS" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| - name: Mask Sensitive Domain | |
| run: | | |
| if [ -n "${{ secrets.CLOUDFLARE_WORKER_SUBDOMAIN }}" ]; then | |
| echo "::add-mask::${{ secrets.CLOUDFLARE_WORKER_SUBDOMAIN }}" | |
| fi | |
| - name: Deploy to Cloudflare Workers | |
| uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| wranglerVersion: '4.75.0' | |
| command: deploy --minify | |
| secrets: ${{ steps.secret_list.outputs.secrets }} | |
| env: | |
| NODEAUTH_LICENSE: ${{ secrets.NODEAUTH_LICENSE }} | |
| JWT_SECRET: ${{ secrets.JWT_SECRET }} | |
| ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }} | |
| OAUTH_ALLOW_ALL: ${{ secrets.OAUTH_ALLOW_ALL || 'false' }} | |
| OAUTH_ALLOWED_USERS: ${{ secrets.OAUTH_ALLOWED_USERS }} | |
| OAUTH_GITHUB_CLIENT_ID: ${{ secrets.OAUTH_GITHUB_CLIENT_ID }} | |
| OAUTH_GITHUB_CLIENT_SECRET: ${{ secrets.OAUTH_GITHUB_CLIENT_SECRET }} | |
| OAUTH_GITHUB_REDIRECT_URI: ${{ secrets.OAUTH_GITHUB_REDIRECT_URI }} | |
| OAUTH_CLOUDFLARE_CLIENT_ID: ${{ secrets.OAUTH_CLOUDFLARE_CLIENT_ID }} | |
| OAUTH_CLOUDFLARE_CLIENT_SECRET: ${{ secrets.OAUTH_CLOUDFLARE_CLIENT_SECRET }} | |
| OAUTH_CLOUDFLARE_ORG_DOMAIN: ${{ secrets.OAUTH_CLOUDFLARE_ORG_DOMAIN }} | |
| OAUTH_CLOUDFLARE_REDIRECT_URI: ${{ secrets.OAUTH_CLOUDFLARE_REDIRECT_URI }} | |
| OAUTH_NODELOC_CLIENT_ID: ${{ secrets.OAUTH_NODELOC_CLIENT_ID }} | |
| OAUTH_NODELOC_CLIENT_SECRET: ${{ secrets.OAUTH_NODELOC_CLIENT_SECRET }} | |
| OAUTH_NODELOC_REDIRECT_URI: ${{ secrets.OAUTH_NODELOC_REDIRECT_URI }} | |
| OAUTH_GITEE_CLIENT_ID: ${{ secrets.OAUTH_GITEE_CLIENT_ID }} | |
| OAUTH_GITEE_CLIENT_SECRET: ${{ secrets.OAUTH_GITEE_CLIENT_SECRET }} | |
| OAUTH_GITEE_REDIRECT_URI: ${{ secrets.OAUTH_GITEE_REDIRECT_URI }} | |
| OAUTH_TELEGRAM_BOT_NAME: ${{ secrets.OAUTH_TELEGRAM_BOT_NAME }} | |
| OAUTH_TELEGRAM_BOT_TOKEN: ${{ secrets.OAUTH_TELEGRAM_BOT_TOKEN }} | |
| OAUTH_TELEGRAM_WEBHOOK_SECRET: ${{ secrets.OAUTH_TELEGRAM_WEBHOOK_SECRET }} | |
| OAUTH_GOOGLE_CLIENT_ID: ${{ secrets.OAUTH_GOOGLE_CLIENT_ID }} | |
| OAUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.OAUTH_GOOGLE_CLIENT_SECRET }} | |
| OAUTH_GOOGLE_REDIRECT_URI: ${{ secrets.OAUTH_GOOGLE_REDIRECT_URI }} | |
| OAUTH_MICROSOFT_CLIENT_ID: ${{ secrets.OAUTH_MICROSOFT_CLIENT_ID }} | |
| OAUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.OAUTH_MICROSOFT_CLIENT_SECRET }} | |
| OAUTH_BAIDU_CLIENT_ID: ${{ secrets.OAUTH_BAIDU_CLIENT_ID }} | |
| OAUTH_BAIDU_CLIENT_SECRET: ${{ secrets.OAUTH_BAIDU_CLIENT_SECRET }} | |
| OAUTH_DROPBOX_CLIENT_ID: ${{ secrets.OAUTH_DROPBOX_CLIENT_ID }} | |
| OAUTH_DROPBOX_CLIENT_SECRET: ${{ secrets.OAUTH_DROPBOX_CLIENT_SECRET }} | |
| OAUTH_WALLETCONNECT_PROJECT_ID: ${{ secrets.OAUTH_WALLETCONNECT_PROJECT_ID }} | |
| OAUTH_WALLETCONNECT_SELF_PROXY: ${{ secrets.OAUTH_WALLETCONNECT_SELF_PROXY }} | |
| - name: Restore Wrangler Config | |
| if: always() | |
| run: | | |
| if [ -f wrangler.toml.bak ]; then mv wrangler.toml.bak wrangler.toml; fi |