ci(sync-uuid): SSH 进自建服务器跑 DB 脚本（替代 Neon 直连）#304
Merged
longsizhuo merged 3 commits intomainfrom Apr 17, 2026
Merged
Conversation
DB 从 Neon 迁到自建后只绑 127.0.0.1:5432，GH runner 直连不通。最干净的 方案是 SSH 进服务器跑——服务器上有完整 repo clone + 本机能到 PG + 已有 github ssh key 可以 push 回来。 - 用 appleboy/ssh-action@v1.2.0，三件套 secrets：SERVER_HOST / SERVER_USER / SERVER_SSH_KEY - 脚本流程：fetch + reset --hard 到触发 commit → pnpm install + prisma generate → uuid.mjs → backfill-contributors.mjs → 只有 diff 时 commit [skip ci] + push - set -euo pipefail 保证任何一步失败整个 action 失败 - command_timeout 15m 给 backfill 足够余量 配套一次性准备（已完成，不在 CI 里）： - 服务器 ~/.ssh/authorized_keys 加 gh-actions-leaderboard 公钥 - ~/involution-hell-project/frontend/.env 的 DATABASE_URL 改指 127.0.0.1 注：scripts/generate-leaderboard.mjs 还在 package.json 的 prebuild 钩子里， Vercel 部署时仍会尝试跑。该问题独立处理：要么挪到本 workflow，要么让 Vercel build 时优雅降级（失败跳过用上次提交的 JSON）。
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the docs backfill automation to run database-dependent scripts on the self-hosted server (via SSH) instead of having the GitHub-hosted runner directly connect to Postgres, aligning CI with the new “DB only bound to 127.0.0.1” deployment model.
Changes:
- Replaces the multi-step GitHub runner workflow with a single
appleboy/ssh-actionstep to run the backfill pipeline on the server. - Adds a remote script sequence: hard reset to the triggering branch → install deps →
prisma generate→ runuuid.mjsandbackfill-contributors.mjs→ commit/push only when outputs changed. - Adds stricter shell failure behavior (
set -euo pipefail) and extends command timeout for the backfill run.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+52
to
+57
| cd /home/ubuntu/involution-hell-project/frontend | ||
|
|
||
| # Verify pnpm version matches package.json packageManager field | ||
| - name: Check pnpm version | ||
| run: node scripts/check-pnpm-version.mjs | ||
| # 1. 同步仓库到触发本次 workflow 的 commit | ||
| git fetch --prune origin | ||
| git checkout "$BRANCH" | ||
| git reset --hard "origin/$BRANCH" |
Comment on lines
+44
to
+49
| # 超时 15 分钟：backfill-contributors 要遍历所有 docs + 拉 GitHub API， | ||
| # 大改动一次跑 3-5 分钟，留足余量 | ||
| command_timeout: 15m | ||
| # set -euo pipefail + BRANCH 透传，脚本内任何一步失败都让整个 action fail | ||
| envs: GITHUB_REF_NAME | ||
| script: | |
| - name: Install deps | ||
| run: pnpm install --frozen-lockfile | ||
| # 2. 依赖和 Prisma client（frontend .env 里 DATABASE_URL 已指本地 PG） | ||
| set -a && . ./.env && set +a |
审计后发现原 workflow 有 3 处边缘风险可能让 uuid.mjs/backfill 产出错数据： 1. 脏工作树被 git reset --hard 抹掉 → 可能浪费 docId 或抹掉手工改动 2. DATABASE_URL 缺失时 backfill 隐性降级成本轮快照 → JSON 被覆盖呈现错误累计 3. DB 行数异常低（被意外清库）→ 增量累计从 0 起算，GH API 单文件最多 N 页外的老 commits 永远丢 加三道闸： - git status --porcelain 非空 → fail loud 强制人工介入 - DATABASE_URL 空 → fail（GITHUB_TOKEN 只 warn） - doc_contributors < 200 行 → fail（迁移完成时 ~295 行，保守下限） 附长注释说明每项保护对应脚本里哪个不变量。以后有人看 workflow 能立刻知道每段为啥不能删。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
DB 从 Neon 迁到自建 Docker PG（backend#12）以后，PG 端口只绑 `127.0.0.1:5432` 不对公网开。原 workflow 让 GH runner 直连 `DATABASE_URL` 立刻失败。
方案
SSH 进服务器跑脚本。服务器上本来就有：
比 Cloudflare Tunnel / 改脚本走后端 API 改动最小。
变更
需要的 Repo Secrets
（已配好）
验证
合并后第一次触发路径：
相关 deferred work
`scripts/generate-leaderboard.mjs` 还挂在 `package.json` 的 `prebuild`，Vercel 构建时也会跑、也会失败。两种处理方式：
留作后续 PR。