From 3625f037d0e6cfbe781e9ecb762e4db6f312857e Mon Sep 17 00:00:00 2001
From: jacy-dukang <moonjie444@163.com>
Date: Mon, 6 Jul 2026 17:01:05 +0800
Subject: [PATCH] fix(deploy): harden webhook auto-release for CRLF, git reset,
 and prisma order

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 deploy/auto-release.sh   | 20 ++++++++++++++++++--
 deploy/remote-release.sh | 19 ++++++++++---------
 deploy/setup-webhook.sh  |  1 +
 3 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/deploy/auto-release.sh b/deploy/auto-release.sh
index 7510abe..00544a6 100644
--- a/deploy/auto-release.sh
+++ b/deploy/auto-release.sh
@@ -13,7 +13,7 @@ LOG_FILE="${DEPLOY_LOG_FILE:-/var/log/dukang/deploy.log}"
 
 if [[ -f "$ENV_FILE" ]]; then
   # shellcheck disable=SC1090
-  source "$ENV_FILE"
+  source <(sed 's/\r$//' "$ENV_FILE")
 fi
 
 mkdir -p "$(dirname "$LOG_FILE")"
@@ -49,7 +49,23 @@ if [[ "$LOCAL_SHA" == "$REMOTE_SHA" ]]; then
 fi
 
 log "PULL $LOCAL_SHA -> $REMOTE_SHA"
-git pull --ff-only "$GIT_REMOTE" "$GIT_BRANCH"
+
+# 保留生产密钥，避免 reset 覆盖
+ENV_BACKUP="$(mktemp)"
+API_ENV_BACKUP="$(mktemp)"
+API_ENV_PROD_BACKUP="$(mktemp)"
+cp "$ENV_FILE" "$ENV_BACKUP" 2>/dev/null || true
+cp "$APP_ROOT/server/dukang-api/.env" "$API_ENV_BACKUP" 2>/dev/null || true
+cp "$APP_ROOT/server/dukang-api/.env.production" "$API_ENV_PROD_BACKUP" 2>/dev/null || true
+
+git checkout "$GIT_BRANCH"
+git reset --hard "$GIT_REMOTE/$GIT_BRANCH"
+
+cp "$ENV_BACKUP" "$ENV_FILE" 2>/dev/null || true
+cp "$API_ENV_BACKUP" "$APP_ROOT/server/dukang-api/.env" 2>/dev/null || true
+cp "$API_ENV_PROD_BACKUP" "$APP_ROOT/server/dukang-api/.env.production" 2>/dev/null || true
+rm -f "$ENV_BACKUP" "$API_ENV_BACKUP" "$API_ENV_PROD_BACKUP"
+sed -i 's/\r$//' "$ENV_FILE" 2>/dev/null || true
 
 # 修复 Windows 换行
 find "$APP_ROOT/deploy" -maxdepth 1 -name '*.sh' -exec sed -i 's/\r$//' {} + 2>/dev/null || true
diff --git a/deploy/remote-release.sh b/deploy/remote-release.sh
index f11de2a..6d6c2b0 100644
--- a/deploy/remote-release.sh
+++ b/deploy/remote-release.sh
@@ -45,15 +45,8 @@ export NODE_OPTIONS="${NODE_OPTIONS:---max-old-space-size=2048}"
 pnpm approve-builds --all 2>/dev/null || true
 pnpm install --frozen-lockfile 2>/dev/null || pnpm install
 
-if [[ "$SKIP_BUILD" == false ]]; then
-  echo "==> 3. 构建"
-  pnpm build
-else
-  echo "==> 3. 跳过构建"
-fi
-
 if [[ "$SKIP_DB" == false ]]; then
-  echo "==> 4. 数据库 schema 同步"
+  echo "==> 3. 数据库 schema 同步（构建前）"
   cd "$APP_ROOT/server/dukang-api"
   pnpm prisma:generate
   if [[ "$DB_PUSH_ACCEPT_DATA_LOSS" == true ]]; then
@@ -65,8 +58,16 @@ if [[ "$SKIP_DB" == false ]]; then
     echo "==> 执行 seed"
     pnpm prisma:seed
   fi
+  cd "$APP_ROOT"
 else
-  echo "==> 4. 跳过数据库"
+  echo "==> 3. 跳过数据库"
+fi
+
+if [[ "$SKIP_BUILD" == false ]]; then
+  echo "==> 4. 构建"
+  pnpm build
+else
+  echo "==> 4. 跳过构建"
 fi
 
 echo "==> 5. 重启 PM2"
diff --git a/deploy/setup-webhook.sh b/deploy/setup-webhook.sh
index f62065b..16d2ad9 100644
--- a/deploy/setup-webhook.sh
+++ b/deploy/setup-webhook.sh
@@ -22,6 +22,7 @@ if [[ ! -f "$ENV_FILE" ]]; then
 else
   echo "    保留已有 $ENV_FILE"
 fi
+sed -i 's/\r$//' "$ENV_FILE" 2>/dev/null || true
 
 echo "==> 3. Nginx webhook 路由"
 HOOK_CONF="$DEPLOY_DIR/nginx-deploy-webhook.conf"