From e05a581a58fac90385763a9c1a51c5a651a9c5de Mon Sep 17 00:00:00 2001
From: seaHi <me@seahi.me>
Date: Fri, 7 Aug 2026 13:45:16 +0800
Subject: [PATCH] =?UTF-8?q?refactor:=20=E7=A7=BB=E9=99=A4=20Gitea=20Action?=
 =?UTF-8?q?s=20=E4=B8=AD=E7=9A=84=20Cloudflare=20Access=20=E5=AF=86?=
 =?UTF-8?q?=E9=92=A5=E5=90=8C=E6=AD=A5=E6=AD=A5=E9=AA=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy.yml | 40 ++++++-------------------------------
 1 file changed, 6 insertions(+), 34 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 0b33c48..b601de3 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -51,43 +51,15 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: pnpm exec wrangler d1 migrations apply blogflare-db --remote
 
-      # 8. 将后台认证配置同步到 Pages Production；缺失时阻止发布锁死后台
-      - name: 8. 同步 Cloudflare Access 生产环境配置
-        env:
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CF_ACCESS_TEAM_DOMAIN: ${{ secrets.CF_ACCESS_TEAM_DOMAIN }}
-          CF_ACCESS_AUD: ${{ secrets.CF_ACCESS_AUD }}
-        run: |
-          if [[ -z "$CF_ACCESS_TEAM_DOMAIN" || -z "$CF_ACCESS_AUD" ]]; then
-            echo "::error::缺少 Gitea Secrets：CF_ACCESS_TEAM_DOMAIN 或 CF_ACCESS_AUD"
-            exit 1
-          fi
-
-          case "$CF_ACCESS_TEAM_DOMAIN" in
-            https://*.cloudflareaccess.com) ;;
-            *)
-              echo "::error::CF_ACCESS_TEAM_DOMAIN 必须是 https://<team>.cloudflareaccess.com"
-              exit 1
-              ;;
-          esac
-
-          access_secret_file="$(mktemp)"
-          trap 'rm -f "$access_secret_file"' EXIT
-          chmod 600 "$access_secret_file"
-          printf 'CF_ACCESS_TEAM_DOMAIN=%s\nCF_ACCESS_AUD=%s\n' \
-            "$CF_ACCESS_TEAM_DOMAIN" "$CF_ACCESS_AUD" > "$access_secret_file"
-          pnpm exec wrangler pages secret bulk "$access_secret_file" --project-name=blogflare
-
-      # 9. 使用本地安装好的 wrangler 直接推送部署
-      - name: 9. 自动化推送到 Cloudflare Pages (主分支为生产发布)
+      # 8. Wrangler 会将 wrangler.jsonc 中的 Access 环境变量与 Pages 配置一起发布
+      - name: 8. 自动化推送到 Cloudflare Pages (主分支为生产发布)
         env:
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: pnpm exec wrangler pages deploy .svelte-kit/cloudflare --project-name=blogflare --branch=main
 
-      # 10. 构建与发布成功时，用 curl 直联调用 Telegram 官方发送通知接口
-      - name: 10. 发送 Telegram 部署成功通知
+      # 9. 构建与发布成功时，用 curl 直联调用 Telegram 官方发送通知接口
+      - name: 9. 发送 Telegram 部署成功通知
         if: success()
         env:
           TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
@@ -100,8 +72,8 @@ jobs:
             -d "parse_mode=HTML" \
             --data-urlencode "text=${MSG}"
 
-      # 11. 一旦任意步骤发生阻挠或错误，立即发警报知音
-      - name: 11. 发送 Telegram 部署失败告警
+      # 10. 一旦任意步骤发生阻挠或错误，立即发警报知音
+      - name: 10. 发送 Telegram 部署失败告警
         if: failure()
         env:
           TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}