From 93a6ff0d034622c69ddbcfcf39433af525d720b2 Mon Sep 17 00:00:00 2001
From: Your Name <aa@bb.com>
Date: Tue, 20 Oct 2026 17:56:31 +0800
Subject: [PATCH] fix(ci): keep im deploy scoped to service

---
 .gitea/workflows/deploy.yml    | 28 ----------------------------
 tests/test_actions_workflow.py |  6 ++++++
 2 files changed, 6 insertions(+), 28 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4c55cca..ec34326 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -67,31 +67,3 @@ jobs:
             "docker login git.olns.shop -u admin --password-stdin"
           ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
             "cd /opt/olns && docker compose pull im-server && docker compose up -d --no-deps --wait im-server"
-
-      - name: Ensure production IM CORS routing
-        env:
-          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
-        run: |
-          set -euo pipefail
-          install -d -m 700 "$HOME/.ssh"
-          KEY_FILE="$(mktemp "$HOME/.ssh/olns-cors.XXXXXX")"
-          cleanup() {
-            shred -u "$KEY_FILE" 2>/dev/null || true
-          }
-          trap cleanup EXIT
-          printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
-          chmod 600 "$KEY_FILE"
-          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
-          chmod 600 "$HOME/.ssh/known_hosts"
-          SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
-          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
-            set -euo pipefail
-            cd /opt/olns
-            cp Caddyfile "config-backups/Caddyfile.$(date -u +%Y%m%dT%H%M%SZ).before-im-cors"
-            perl -0pi -e '"'"'s/\n[ \t]*header \{\n[ \t]*Access-Control-Allow-Origin "https:\/\/im\.yuexuan\.shop"\n[ \t]*Vary "Origin"\n[ \t]*\}\n/\n/'"'"' Caddyfile
-            count="$(grep -A20 -F "im-api.yuexuan.shop {" Caddyfile | grep -Fc '"'"'Access-Control-Allow-Origin "https://im.yuexuan.shop"'"'"' || true)"
-            test "$count" -eq 1
-            docker compose up -d --no-deps --force-recreate caddy
-            docker compose exec -T caddy caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
-          '
diff --git a/tests/test_actions_workflow.py b/tests/test_actions_workflow.py
index 749e535..64a161c 100644
--- a/tests/test_actions_workflow.py
+++ b/tests/test_actions_workflow.py
@@ -34,6 +34,12 @@ class DeployWorkflowContractTest(unittest.TestCase):
         self.assertNotIn("KUBECONFIG", self.workflow)
         self.assertNotIn("git.118im.com", self.workflow)
 
+    def test_deploy_does_not_mutate_shared_caddy_configuration(self):
+        self.assertNotIn("Ensure production IM CORS routing", self.workflow)
+        self.assertNotIn("Caddyfile", self.workflow)
+        self.assertNotIn("perl -0pi", self.workflow)
+        self.assertNotIn("force-recreate caddy", self.workflow)
+
 if __name__ == "__main__":
     unittest.main()