ai-workspace-lab/xworkspace-console
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: honor AI_WORKSPACE_AUTH_TOKEN from input/Vault, pass through to host (#11)

Browse Source 
Restore the Vault kv/CICD/AI_WORKSPACE_AUTH_TOKEN read in the deploy job
(the key now exists) and resolve the bootstrap token with a clear
precedence: workflow_dispatch input overrides, else Vault value, else
the on-host installer's resolve_unified_auth_token reuses the persisted
~/.ai_workspace_auth_token or generates a new one.

Also fix run-on-host-bootstrap.sh which silently dropped
AI_WORKSPACE_AUTH_TOKEN: it is now written to the remote env payload and
exported, so an input/Vault-provided token is actually honored on the
host instead of being regenerated. Empty stays empty so the no-arg
curl|bash install path still self-generates.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Haitao Pan 2026-06-28 17:02:33 +08:00
parent 6d934be2cb
commit e1797ef18f
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
.github/workflows/deploy-ai-workspace-iac.yaml vendored
View File

@ -43,11 +43,14 @@ name: Deploy AI Workspace (IaC + Ansible + Cloudflare)
# ai-workspace-infra/vultr-vps/config/resources/ai-workspace-hosts.yaml # ai-workspace-infra/vultr-vps/config/resources/ai-workspace-hosts.yaml
# 的 ssh_keys[].public，否则 Terraform 创机后 runner 无法 SSH 登录。 # 的 ssh_keys[].public，否则 Terraform 创机后 runner 无法 SSH 登录。
# #
# 7. AI_WORKSPACE_AUTH_TOKEN（LiteLLM 认证 token，存储在 Vault） # 7. AI_WORKSPACE_AUTH_TOKEN（统一服务 token：LiteLLM master key / bridge / vault 等）
# - 用于 OpenCode ACP adapter 的 LITELLM_MASTER_KEY # - 三级优先级（on-host installer resolve_unified_auth_token 统一解析）：
# 1) workflow_dispatch 输入 ai_workspace_auth_token（非空时覆盖）
# 2) Vault kv/CICD/AI_WORKSPACE_AUTH_TOKEN（输入留空时回退）
# 3) 两者皆空：installer 复用 ~/.ai_workspace_auth_token 或自动生成并持久化
# - 存储位置：vault kv patch kv/CICD AI_WORKSPACE_AUTH_TOKEN=<your-token> # - 存储位置：vault kv patch kv/CICD AI_WORKSPACE_AUTH_TOKEN=<your-token>
# - TLDR 生成：python3 -c 'import uuid; print(uuid.uuid4())' # - TLDR 生成：python3 -c 'import uuid; print(uuid.uuid4())'
# - 部署时自动从 Vault 读取，注入 ansible role 的 acp_opencode_auth_token # - 经 run-on-host-bootstrap.sh 透传到主机 env，注入 all-in-one 各 role
# #
# ── 流水线结构 ─────────────────────────────────────────────────────────────── # ── 流水线结构 ───────────────────────────────────────────────────────────────
# #
@ -327,7 +330,8 @@ jobs:
${{ env.VAULT_KV }} SSH_PRIVATE_DEPLOY_KEY_B64 | ANSIBLE_SSH_KEY_B64 ; ${{ env.VAULT_KV }} SSH_PRIVATE_DEPLOY_KEY_B64 | ANSIBLE_SSH_KEY_B64 ;
${{ env.VAULT_KV_OPENCLAW }} DEEPSEEK_API_KEY | DEEPSEEK_API_KEY ; ${{ env.VAULT_KV_OPENCLAW }} DEEPSEEK_API_KEY | DEEPSEEK_API_KEY ;
${{ env.VAULT_KV_OPENCLAW }} NVIDIA_API_KEY | NVIDIA_API_KEY ; ${{ env.VAULT_KV_OPENCLAW }} NVIDIA_API_KEY | NVIDIA_API_KEY ;
${{ env.VAULT_KV_OPENCLAW }} OLLAMA_API_KEY | OLLAMA_API_KEY ${{ env.VAULT_KV_OPENCLAW }} OLLAMA_API_KEY | OLLAMA_API_KEY ;
${{ env.VAULT_KV }} AI_WORKSPACE_AUTH_TOKEN | AI_WORKSPACE_AUTH_TOKEN
- name: Report provider key wiring - name: Report provider key wiring
run: | run: |
@ -414,7 +418,9 @@ jobs:
# 离线包重新发布后可设为 auto 恢复离线加速。 # 离线包重新发布后可设为 auto 恢复离线加速。
AI_WORKSPACE_OFFLINE_MODE: ${{ github.event.inputs.offline_mode || 'off' }} AI_WORKSPACE_OFFLINE_MODE: ${{ github.event.inputs.offline_mode || 'off' }}
XWORKMATE_BRIDGE_DOMAIN: ${{ github.event.inputs.bridge_domain }} XWORKMATE_BRIDGE_DOMAIN: ${{ github.event.inputs.bridge_domain }}
AI_WORKSPACE_AUTH_TOKEN: ${{ github.event.inputs.ai_workspace_auth_token }} # input 非空则覆盖；否则取 Vault kv/CICD/AI_WORKSPACE_AUTH_TOKEN；
# 两者皆空时由 on-host installer (resolve_unified_auth_token) 自动生成并持久化。
AI_WORKSPACE_AUTH_TOKEN: ${{ github.event.inputs.ai_workspace_auth_token != '' && github.event.inputs.ai_workspace_auth_token || steps.vault.outputs.AI_WORKSPACE_AUTH_TOKEN }}
DEEPSEEK_API_KEY: ${{ github.event.inputs.use_deepseek == 'false' && '' || steps.vault.outputs.DEEPSEEK_API_KEY }} DEEPSEEK_API_KEY: ${{ github.event.inputs.use_deepseek == 'false' && '' || steps.vault.outputs.DEEPSEEK_API_KEY }}
NVIDIA_API_KEY: ${{ github.event.inputs.use_nvidia == 'false' && '' || steps.vault.outputs.NVIDIA_API_KEY }} NVIDIA_API_KEY: ${{ github.event.inputs.use_nvidia == 'false' && '' || steps.vault.outputs.NVIDIA_API_KEY }}
OLLAMA_API_KEY: ${{ github.event.inputs.use_ollama == 'false' && '' || steps.vault.outputs.OLLAMA_API_KEY }} OLLAMA_API_KEY: ${{ github.event.inputs.use_ollama == 'false' && '' || steps.vault.outputs.OLLAMA_API_KEY }}

4
scripts/run-on-host-bootstrap.sh
View File

@ -46,6 +46,8 @@ trap 'rm -f "$remote_payload"' EXIT
{ {
printf 'AI_WORKSPACE_OFFLINE_MODE=%q\n' "${AI_WORKSPACE_OFFLINE_MODE:-off}" printf 'AI_WORKSPACE_OFFLINE_MODE=%q\n' "${AI_WORKSPACE_OFFLINE_MODE:-off}"
printf 'XWORKMATE_BRIDGE_DOMAIN=%q\n' "$domain" printf 'XWORKMATE_BRIDGE_DOMAIN=%q\n' "$domain"
# 空则不写，让 on-host installer 的 resolve_unified_auth_token 走"复用持久化/自动生成"分支。
printf 'AI_WORKSPACE_AUTH_TOKEN=%q\n' "${AI_WORKSPACE_AUTH_TOKEN:-}"
printf 'DEEPSEEK_API_KEY=%q\n' "${DEEPSEEK_API_KEY:-}" printf 'DEEPSEEK_API_KEY=%q\n' "${DEEPSEEK_API_KEY:-}"
printf 'NVIDIA_API_KEY=%q\n' "${NVIDIA_API_KEY:-}" printf 'NVIDIA_API_KEY=%q\n' "${NVIDIA_API_KEY:-}"
printf 'OLLAMA_API_KEY=%q\n' "${OLLAMA_API_KEY:-}" printf 'OLLAMA_API_KEY=%q\n' "${OLLAMA_API_KEY:-}"
@ -67,7 +69,7 @@ fi
( (
set +e set +e
source "$remote_env" source "$remote_env"
export AI_WORKSPACE_OFFLINE_MODE XWORKMATE_BRIDGE_DOMAIN DEEPSEEK_API_KEY NVIDIA_API_KEY OLLAMA_API_KEY export AI_WORKSPACE_OFFLINE_MODE XWORKMATE_BRIDGE_DOMAIN AI_WORKSPACE_AUTH_TOKEN DEEPSEEK_API_KEY NVIDIA_API_KEY OLLAMA_API_KEY
bash -lc 'curl -sfL https://install.svc.plus/ai-workspace | bash -' bash -lc 'curl -sfL https://install.svc.plus/ai-workspace | bash -'
rc=$? rc=$?
printf '%s\n' "$rc" > "$remote_rc" printf '%s\n' "$rc" > "$remote_rc"