修复SSH密钥写入安全性·使用env变量+完整格式验证·修复deploy YAML结构

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/fe52b677-fd2b-4179-bb74-be570d9e15ba

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>

.github/workflows/deploy-to-cn-server.yml

@@ -46,12 +46,14 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: 🔐 配置SSH
+        env:
+          SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.ZY_CN_SERVER_KEY }}" > ~/.ssh/zy_cn_key
+          echo "$SSH_KEY" > ~/.ssh/zy_cn_key
           chmod 600 ~/.ssh/zy_cn_key
-          if head -1 ~/.ssh/zy_cn_key | grep -q "BEGIN"; then
-            echo "✅ SSH私钥格式正确"
+          if head -1 ~/.ssh/zy_cn_key | grep -q "BEGIN" && tail -1 ~/.ssh/zy_cn_key | grep -q "END"; then
+            echo "✅ SSH私钥格式正确（BEGIN/END标记完整）"
           else
             echo "❌ SSH私钥格式异常 — 请检查 GitHub Secrets 中 ZY_CN_SERVER_KEY 的内容"
             exit 1
@@ -91,9 +93,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: 🔐 配置SSH
+        env:
+          SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.ZY_CN_SERVER_KEY }}" > ~/.ssh/zy_cn_key
+          echo "$SSH_KEY" > ~/.ssh/zy_cn_key
           chmod 600 ~/.ssh/zy_cn_key
           ssh-keyscan -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
 
@@ -164,9 +168,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: 🔐 配置SSH
+        env:
+          SSH_KEY: ${{ secrets.ZY_CN_SERVER_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.ZY_CN_SERVER_KEY }}" > ~/.ssh/zy_cn_key
+          echo "$SSH_KEY" > ~/.ssh/zy_cn_key
           chmod 600 ~/.ssh/zy_cn_key
           ssh-keyscan -H ${{ secrets.ZY_CN_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
 

.github/workflows/deploy-to-zhuyuan-server.yml

@@ -50,14 +50,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: 🔐 配置SSH
+        env:
+          SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
         run: |
           mkdir -p ~/.ssh
-          # 写入私钥（支持多种格式）
-          printf '%s\n' "${{ secrets.ZY_SERVER_KEY }}" > ~/.ssh/zy_key
+          echo "$SSH_KEY" > ~/.ssh/zy_key
           chmod 600 ~/.ssh/zy_key
-          # 验证私钥格式
-          if head -1 ~/.ssh/zy_key | grep -q "BEGIN"; then
-            echo "✅ SSH私钥格式正确"
+          # 验证私钥格式完整性
+          if head -1 ~/.ssh/zy_key | grep -q "BEGIN" && tail -1 ~/.ssh/zy_key | grep -q "END"; then
+            echo "✅ SSH私钥格式正确（BEGIN/END标记完整）"
           else
             echo "❌ SSH私钥格式异常 — 请检查 GitHub Secrets 中 ZY_SERVER_KEY 的内容"
             echo "   应以 '-----BEGIN' 开头，以 '-----END' 结尾"
@@ -116,11 +117,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: 🔐 配置SSH
+        env:
+          SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.ZY_SERVER_KEY }}" > ~/.ssh/zy_key
+          echo "$SSH_KEY" > ~/.ssh/zy_key
           chmod 600 ~/.ssh/zy_key
           ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: 📦 同步应用代码
         run: |
           # 确定部署目标: preview (默认) 或 production
           TARGET="${{ github.event.inputs.deploy_target || 'preview' }}"
@@ -198,9 +203,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: 🔐 配置SSH
+        env:
+          SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.ZY_SERVER_KEY }}" > ~/.ssh/zy_key
+          echo "$SSH_KEY" > ~/.ssh/zy_key
           chmod 600 ~/.ssh/zy_key
           ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
 
@@ -254,9 +261,11 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: 🔐 配置SSH
+        env:
+          SSH_KEY: ${{ secrets.ZY_SERVER_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.ZY_SERVER_KEY }}" > ~/.ssh/zy_key
+          echo "$SSH_KEY" > ~/.ssh/zy_key
           chmod 600 ~/.ssh/zy_key
           ssh-keyscan -H ${{ secrets.ZY_SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null