From 26560afa5c073c85dd7028344afbefff9f40bf43 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Mon, 1 Jun 2026 10:02:13 +0800
Subject: [PATCH] fix: align bridge review token deployment

---
 internal/acp/web_contract_test.go              | 17 +++++++++++++++++
 scripts/github-actions/deploy-native-binary.sh |  2 +-
 scripts/github-actions/deploy.sh               |  1 +
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/internal/acp/web_contract_test.go b/internal/acp/web_contract_test.go
index 8f78f9d..36ddf23 100644
--- a/internal/acp/web_contract_test.go
+++ b/internal/acp/web_contract_test.go
@@ -783,6 +783,23 @@ func TestHTTPHandlerPingRequiresBearerAuthorizationWhenBridgeAuthTokenConfigured
 	}
 }
 
+func TestHTTPHandlerPingAllowsReviewBearerAuthorizationWhenConfigured(t *testing.T) {
+	t.Setenv("BRIDGE_AUTH_TOKEN", "bridge-test-token")
+	t.Setenv("BRIDGE_REVIEW_AUTH_TOKEN", "review-bridge-test-token")
+	t.Setenv("BRIDGE_CONFIG_PATH", "../../example/config.yaml")
+	server := NewServer()
+	handler := server.Handler()
+
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodGet, "http://127.0.0.1/api/ping", nil)
+	request.Header.Set("Authorization", "Bearer review-bridge-test-token")
+	handler.ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected 200 for configured review token, got %d", recorder.Code)
+	}
+}
+
 func TestParseImageVersionInfoHandlesTaggedImageRef(t *testing.T) {
 	info := ParseImageVersionInfo("ghcr.io/x-evor/xworkmate-bridge:main-2026-04-12")
 
diff --git a/scripts/github-actions/deploy-native-binary.sh b/scripts/github-actions/deploy-native-binary.sh
index 565c653..226bd45 100755
--- a/scripts/github-actions/deploy-native-binary.sh
+++ b/scripts/github-actions/deploy-native-binary.sh
@@ -5,7 +5,7 @@ TARGET_HOST="${1:?target host is required}"
 BINARY_PATH="${2:?binary path is required}"
 EXPECTED_COMMIT="${3:?expected short commit is required}"
 REMOTE_TMP="/tmp/xworkmate-bridge-${EXPECTED_COMMIT}"
-REMOTE_BINARY="/usr/local/bin/xworkmate-go-core"
+REMOTE_BINARY="${REMOTE_BINARY:-/usr/local/bin/xworkmate-go-core}"
 STALE_DROPIN="/etc/systemd/system/xworkmate-bridge.service.d/10-hotfix-openclaw-artifacts.conf"
 SERVICE_NAME="xworkmate-bridge.service"
 
diff --git a/scripts/github-actions/deploy.sh b/scripts/github-actions/deploy.sh
index 1d3768e..b337855 100644
--- a/scripts/github-actions/deploy.sh
+++ b/scripts/github-actions/deploy.sh
@@ -43,4 +43,5 @@ SERVICE_COMPOSE_IMAGE="${SERVICE_COMPOSE_IMAGE}" \
 GHCR_USERNAME="${GHCR_USERNAME:-}" \
 GHCR_PASSWORD="${GHCR_PASSWORD:-}" \
 BRIDGE_AUTH_TOKEN="${INTERNAL_SERVICE_TOKEN:-}" \
+BRIDGE_REVIEW_AUTH_TOKEN="${BRIDGE_REVIEW_AUTH_TOKEN:-}" \
 "${args[@]}"