bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

代码审查修复·CN工作流路径统一·server.js存在检查·SSH加固增强 

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/36c879f1-286c-4166-aeee-13297073467f

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-03-30 13:46:36 +00:00 committed by GitHub
parent a1478aa74c
commit 708ffb90ad
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
.github/workflows/deploy-to-cn-server.yml vendored
View File

@ -26,6 +26,9 @@ on:
- init - init
- health-check - health-check
env:
CN_DEFAULT_PATH: /opt/zhuyuan-cn
concurrency: concurrency:
group: cn-server-deploy group: cn-server-deploy
cancel-in-progress: false cancel-in-progress: false
@ -76,7 +79,8 @@ jobs:
- name: 📦 同步应用代码 - name: 📦 同步应用代码
run: | run: |
CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}" CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
echo "📦 部署目标: ${CN_PATH}" echo "📦 部署目标: ${CN_PATH}"
# 确保目标目录存在 # 确保目标目录存在
@ -91,7 +95,8 @@ jobs:
- name: 📦 同步大脑文件 - name: 📦 同步大脑文件
run: | run: |
CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}" CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
# 同步大脑核心文件到备用服务器 # 同步大脑核心文件到备用服务器
rsync -avz \ rsync -avz \
@ -101,7 +106,8 @@ jobs:
- name: 📥 安装依赖 & 重启 - name: 📥 安装依赖 & 重启
run: | run: |
CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}" CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
COMMIT_SHA="${{ github.sha }}" COMMIT_SHA="${{ github.sha }}"
ssh -i ~/.ssh/zy_cn_key \ ssh -i ~/.ssh/zy_cn_key \
${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} << DEPLOY_CMD ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} << DEPLOY_CMD
@ -109,6 +115,12 @@ jobs:
set -e set -e
cd ${CN_PATH}/app cd ${CN_PATH}/app
# 验证入口文件存在
if [ ! -f server.js ]; then
echo "❌ 错误: server.js 不存在"
exit 1
fi
# 安装依赖 # 安装依赖
npm install --production 2>&1 npm install --production 2>&1

10
server/setup/cn-server-init.sh
View File

@ -200,13 +200,9 @@ log " 自动安全更新已启用"
# ═══ §9 SSH安全加固 ═══ # ═══ §9 SSH安全加固 ═══
log "§9 SSH安全加固..." log "§9 SSH安全加固..."
if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config 2>/dev/null; then sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config systemctl restart sshd
systemctl restart sshd log " 密码登录已禁用，仅允许密钥认证"
log " 密码登录已禁用，仅允许密钥认证"
else
log " SSH配置已安全，跳过"
fi
# ═══ §10 完成报告 ═══ # ═══ §10 完成报告 ═══
log "§10 生成初始化报告..." log "§10 生成初始化报告..."