From 94a37011f0f0815883d2d86b4676495e0c1cc6fa Mon Sep 17 00:00:00 2001
From: snowy-yang <102860110+snowy-yang@users.noreply.github.com>
Date: Thu, 24 Sep 2026 20:34:07 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20CI=20=E5=9B=9E=E5=BD=92=E7=9B=B4?=
 =?UTF-8?q?=E8=BF=9E=20pypi=EF=BC=88=E6=8E=A2=E6=B5=8B=E8=AF=81=E5=AE=9E?=
 =?UTF-8?q?=20runner=20=E5=9C=A8=E6=B5=B7=E5=A4=96=E3=80=81github/pypi/npm?=
 =?UTF-8?q?=20=E5=85=A8=E9=80=9A=EF=BC=89=EF=BC=8C=E9=83=A8=E7=BD=B2?=
 =?UTF-8?q?=E5=8A=A0=20secrets=20=E5=9C=A8=E5=9C=BA=E6=8E=A2=E6=B5=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

probe.yml 结果：github/uv-release/pypi/npm/npmmirror 全部 200、CF API
可达（404 为根路径正常返回），仅 tuna 403——tuna 只服务大陆 IP，说明
runner 在海外，上一轮的镜像化是误诊且 pip 走 tuna 被 403 直接打断。
ci.yml 回归最简形态：pip install uv + uv sync，零镜像零 github 依赖。

部署工作流两轮均死于下载完 wrangler 之后、网络与 wrangler 均无嫌疑，
指向 secrets 配置问题；加一步把 CLOUDFLARE_API_TOKEN/ACCOUNT_ID 的
set/MISSING 写进 commit status（不泄露值），下次运行即可确诊。
---
 .gitea/workflows/ci.yml          | 11 +++--------
 .gitea/workflows/deploy-docs.yml | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6bbefb9..3598a08 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -14,18 +14,13 @@ jobs:
       - name: 检出代码
         uses: actions/checkout@v4
 
-      # 不用 setup-uv：它要从 github.com 拉 uv 二进制与 CPython——runner
-      # 主机对 github 的连通性不可靠（见 probe.yml 探测）。改走 pip/tuna
-      # 装 uv，CPython 走 npmmirror 的 python-build-standalone 镜像，
-      # 包索引走 tuna。
+      # runner 出网探测显示 github/pypi 均可达（见 probe.yml），无需镜像：
+      # pip 从 pypi 装 uv，uv sync 自取 CPython 与依赖
       - name: 安装 uv
-        run: pip install -i https://pypi.tuna.tsinghua.edu.cn/simple uv
+        run: pip install uv
 
       - name: 同步依赖（含 dev 组）
         run: uv sync
-        env:
-          UV_DEFAULT_INDEX: https://pypi.tuna.tsinghua.edu.cn/simple
-          UV_PYTHON_INSTALL_MIRROR: https://registry.npmmirror.com/-/binary/python-build-standalone
 
       - name: ruff 静态检查
         run: uv run ruff check src tests examples
diff --git a/.gitea/workflows/deploy-docs.yml b/.gitea/workflows/deploy-docs.yml
index dba2a9b..f23a3bf 100644
--- a/.gitea/workflows/deploy-docs.yml
+++ b/.gitea/workflows/deploy-docs.yml
@@ -22,6 +22,22 @@ jobs:
       - name: 检出代码
         uses: actions/checkout@v4
 
+      # 日志匿名不可读：把 secrets 在场情况写进 commit status 便于远程
+      # 排查（只报 set/MISSING，不泄露值）
+      - name: 探测 secrets 是否配置
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          CF_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CF_ACCOUNT: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          SERVER="${GITHUB_SERVER_URL:-https://gitea.4i.hk}"
+          s() { [ -n "$2" ] && echo set || echo MISSING; }
+          curl -s -m 10 -X POST \
+            -H "Authorization: token $TOKEN" \
+            -H 'Content-Type: application/json' \
+            -d "{\"state\":\"success\",\"context\":\"deploy/secrets\",\"description\":\"CLOUDFLARE_API_TOKEN=$(s x "$CF_TOKEN") CLOUDFLARE_ACCOUNT_ID=$(s x "$CF_ACCOUNT")\"}" \
+            "$SERVER/api/v1/repos/$GITHUB_REPOSITORY/statuses/$GITHUB_SHA" -o /dev/null
+
       - name: 组装并部署（wrangler Direct Upload）
         run: bash scripts/deploy_docs.sh
         env: