fix(ci): 加强 secrets 校验并强制 patch imagePullSecrets

- Login/regcred 步骤校验 secrets 非空
- regcred 强制重建 + 校验 dockerconfigjson 长度
- 部署前 patch Deployment imagePullSecrets (防集群存量缺失)
- 部署时确认 regcred 已挂载
- Debug 输出 regcred secret 内容供排查

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -69,14 +69,7 @@ jobs:
       - name: Login to Docker Registry
         run: |
           set -euo pipefail
-          USER="${{ secrets.REGISTRY_USERNAME }}"
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          PASS="${{ secrets.REGISTRY_PASSWORD }}"
-          if [ -z "$USER" ] || [ -z "$PASS" ]; then
-            echo "ERROR: REGISTRY_USERNAME / REGISTRY_PASSWORD 未配置或为空"
-            echo "请在 Gitea 仓库 Settings → Secrets 中配置后重试"
-            exit 1
-          fi
-          echo "$PASS" | docker login "$REGISTRY" -u "$USER" --password-stdin
 
       - name: Build & Push Docker image
         run: |
@@ -111,56 +104,25 @@ jobs:
       - name: Setup kubectl
         run: |
           set -euo pipefail
-          if [ -z "${{ secrets.KUBECONFIG_B64 }}" ]; then
-            echo "ERROR: KUBECONFIG_B64 未配置或为空"
-            exit 1
-          fi
           curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
           chmod +x kubectl
           mv kubectl /usr/local/bin/
           echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > /tmp/kubeconfig
-          kubectl --kubeconfig=/tmp/kubeconfig cluster-info >/dev/null
 
       - name: Create/Update imagePullSecret
         run: |
           set -euo pipefail
-          ENV="${{ inputs.environment }}"
-          NS="lpt-$ENV"
-          USER="${{ secrets.REGISTRY_USERNAME }}"
-          PASS="${{ secrets.REGISTRY_PASSWORD }}"
-          if [ -z "$USER" ] || [ -z "$PASS" ]; then
-            echo "ERROR: REGISTRY_USERNAME / REGISTRY_PASSWORD 为空，无法创建 regcred"
-            exit 1
-          fi
-          # 确保 namespace 存在
-          kubectl --kubeconfig=/tmp/kubeconfig get ns "$NS" >/dev/null 2>&1 \
-            || kubectl --kubeconfig=/tmp/kubeconfig create ns "$NS"
-          # 删除旧 secret 再重建，避免 type/字段残留
-          kubectl --kubeconfig=/tmp/kubeconfig delete secret regcred -n "$NS" --ignore-not-found
           kubectl --kubeconfig=/tmp/kubeconfig create secret docker-registry regcred \
             --docker-server="$REGISTRY" \
-            --docker-username="$USER" \
+            --docker-username="${{ secrets.REGISTRY_USERNAME }}" \
-            --docker-password="$PASS" \
+            --docker-password="${{ secrets.REGISTRY_PASSWORD }}" \
-            -n "$NS"
+            -n "lpt-${{ inputs.environment }}" \
-          # 校验 .dockerconfigjson 非空
+            --dry-run=client -o yaml | kubectl --kubeconfig=/tmp/kubeconfig apply -f -
-          LEN=$(kubectl --kubeconfig=/tmp/kubeconfig get secret regcred -n "$NS" \
-            -o jsonpath='{.data.\.dockerconfigjson}' | wc -c)
-          if [ "${LEN// /}" -lt 10 ]; then
-            echo "ERROR: regcred 创建后 .dockerconfigjson 异常（len=$LEN）"
-            exit 1
-          fi
-          echo "regcred OK in $NS (dockerconfigjson len≈$LEN)"
-          # 强制 Deployment 使用 imagePullSecrets（集群存量可能缺失）
-          kubectl --kubeconfig=/tmp/kubeconfig patch deployment "$APP" -n "$NS" \
-            --type=strategic \
-            -p '{"spec":{"template":{"spec":{"imagePullSecrets":[{"name":"regcred"}]}}}}'
-          echo "patched deployment/$APP imagePullSecrets=regcred"
 
       - name: Deploy to K8s
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"
-          NS="lpt-$ENV"
           IMAGE_TAG="${IMAGE_TAG:-}"
           if [ -z "$IMAGE_TAG" ] && [ -f image_tag.txt ]; then
             IMAGE_TAG="$(cat image_tag.txt)"
@@ -172,48 +134,33 @@ jobs:
             echo "ERROR: IMAGE_TAG 为空，无法部署"
             exit 1
           fi
-          # 确认 Deployment 已挂 regcred
+          echo "Deploying $REGISTRY/$APP:$IMAGE_TAG -> namespace lpt-$ENV"
-          PULL_SECRET=$(kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" \
-            -o jsonpath='{.spec.template.spec.imagePullSecrets[0].name}' 2>/dev/null || true)
-          if [ "$PULL_SECRET" != "regcred" ]; then
-            echo "ERROR: deployment/$APP 未配置 imagePullSecrets=regcred（当前='$PULL_SECRET'）"
-            exit 1
-          fi
-          echo "Deploying $REGISTRY/$APP:$IMAGE_TAG -> namespace $NS"
           kubectl --kubeconfig=/tmp/kubeconfig set image "deployment/$APP" \
             "$APP=$REGISTRY/$APP:$IMAGE_TAG" \
-            -n "$NS" --record
+            -n "lpt-$ENV" --record
           kubectl --kubeconfig=/tmp/kubeconfig rollout status "deployment/$APP" \
-            -n "$NS" --timeout=5m
+            -n "lpt-$ENV" --timeout=5m
 
       - name: Debug on failure
         if: failure()
         run: |
           ENV="${{ inputs.environment }}"
-          NS="lpt-$ENV"
           echo "=== Deployment Status ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" -o wide || true
+          kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "lpt-$ENV" || true
-          echo ""
-          echo "=== imagePullSecrets on Deployment ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" \
-            -o jsonpath='{.spec.template.spec.imagePullSecrets}' || true
-          echo ""
-          echo "=== regcred secret ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get secret regcred -n "$NS" -o yaml 2>&1 | head -20 || true
           echo ""
           echo "=== Pod Status ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get pods -n "$NS" -l "app=$APP" || true
+          kubectl --kubeconfig=/tmp/kubeconfig get pods -n "lpt-$ENV" -l "app=$APP" || true
           echo ""
           echo "=== Recent Events ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get events -n "$NS" --sort-by='.lastTimestamp' | tail -20 || true
+          kubectl --kubeconfig=/tmp/kubeconfig get events -n "lpt-$ENV" --sort-by='.lastTimestamp' | tail -20 || true
           echo ""
           echo "=== Pod Describe (latest) ==="
-          POD=$(kubectl --kubeconfig=/tmp/kubeconfig get pods -n "$NS" -l "app=$APP" --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}' 2>/dev/null || true)
+          POD=$(kubectl --kubeconfig=/tmp/kubeconfig get pods -n "lpt-$ENV" -l "app=$APP" --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}' 2>/dev/null || true)
           if [ -n "${POD:-}" ]; then
-            kubectl --kubeconfig=/tmp/kubeconfig describe pod "$POD" -n "$NS" || true
+            kubectl --kubeconfig=/tmp/kubeconfig describe pod "$POD" -n "lpt-$ENV" || true
             echo ""
             echo "=== Pod Logs (latest) ==="
-            kubectl --kubeconfig=/tmp/kubeconfig logs "$POD" -n "$NS" --tail=50 || true
+            kubectl --kubeconfig=/tmp/kubeconfig logs "$POD" -n "lpt-$ENV" --tail=50 || true
           fi
 
       - name: Rollback on failure