From 8c8486f9af89b7aeb835034b32678ed607d52c12 Mon Sep 17 00:00:00 2001
From: wangjia <809946525@qq.com>
Date: Mon, 6 Jul 2026 22:22:00 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20deploy-client=20=E7=94=A8=20env=20?=
 =?UTF-8?q?=E4=BC=A0=20REF=5FNAME(=E9=98=B2=20Actions=20=E6=B3=A8=E5=85=A5?=
 =?UTF-8?q?)+=20job.status=20=E5=90=8C=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

安全审查:run: 里内联 ${{ gitea.ref_name }} 有注入风险(恶意 tag 名);改经 env REF_NAME
+ 引用 "$REF_NAME"(同 deploy-server.yml 的 TAG 做法)。notify 的 job.status 同法。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u
---
 .gitea/workflows/deploy-client.yml | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/deploy-client.yml b/.gitea/workflows/deploy-client.yml
index 610db94..ddff978 100644
--- a/.gitea/workflows/deploy-client.yml
+++ b/.gitea/workflows/deploy-client.yml
@@ -45,7 +45,8 @@ jobs:
         env:
           RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-        run: bash scripts/ci/compile-android.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-android.sh "$REF_NAME"
 
       - name: Upload android artifact
         uses: actions/upload-artifact@v3
@@ -65,7 +66,9 @@ jobs:
 
       - name: Compile (Windows installer)
         shell: bash
-        run: bash scripts/ci/compile-windows.sh "${{ gitea.ref_name }}"
+        env:
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-windows.sh "$REF_NAME"
 
       - name: Upload windows artifact
         uses: actions/upload-artifact@v3
@@ -96,22 +99,26 @@ jobs:
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
-        run: bash scripts/ci/release-client.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/release-client.sh "$REF_NAME"
 
       - name: Deploy → pangolin1 (downloads/)
         env:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: bash scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/deploy-client.sh "$REF_NAME"
 
       - name: Notify
         if: always()
         env:
           TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REF_NAME: ${{ gitea.ref_name }}
+          JOB_STATUS: ${{ job.status }}
         run: |
           . scripts/ci/notify.sh
-          if [ "${{ job.status }}" = "success" ]; then
-            notify_ok "client ${{ gitea.ref_name }} released + deployed"
+          if [ "$JOB_STATUS" = "success" ]; then
+            notify_ok "client $REF_NAME released + deployed"
           else
-            notify_fail "client ${{ gitea.ref_name }} pipeline failed"
+            notify_fail "client $REF_NAME pipeline failed"
           fi