feat: publish click gap 20261014-20261020

.gitignore

@@ -1,6 +1,7 @@
 .DS_Store
 .env
 .env.*
+credentials.env
 *.db
 *.sqlite
 *.sqlite3

README.md

@@ -25,7 +25,7 @@ https://ops.roasbloom.site/af-click-gap/
 /Users/ads-center/ubuntu/Gitea/af-click-gap/scripts/run_pipeline.sh
 ```
 
-流水线脚本必须从 `direct-report-dashboard/.env` 读取 `AGENTSTAGE_USER` 和 `AGENTSTAGE_TOKEN`。默认读取项目 sibling 目录的 `.env`，也可通过 `ENV_FILE` 指定路径；只解析这两个变量，不执行整个 `.env`。凭据只通过临时 `GIT_ASKPASS` 提供给 Git，不写入 remote URL、命令行、日志或仓库。
+流水线脚本从用户目录的 `~/.config/gitea/credentials.env` 读取共享 Gitea 凭证（变量名为 `GITEA_USER` 和 `GITEA_TOKEN`），文件权限必须为 `600`，并要求账号为 `liuji`。凭据只通过临时 `GIT_ASKPASS` 提供给 Git，不写入 remote URL、命令行、日志或仓库。不要把该文件提交到仓库。业务配置仍可使用项目自己的 `.env`。
 
 ## 手动运行
 

data/20261020.json

@@ -0,0 +1 @@
+[]

data/index.json

@@ -1,7 +1,23 @@
 {
   "schema_version": 1,
-  "generated_at": "2026-10-16T17:34:23+08:00",
+  "generated_at": "2026-10-20T18:08:43+08:00",
   "files": [
+    {
+      "date": "20261020",
+      "path": "data/20261020.json"
+    },
+    {
+      "date": "20261019",
+      "path": "data/20261019.json"
+    },
+    {
+      "date": "20261018",
+      "path": "data/20261018.json"
+    },
+    {
+      "date": "20261017",
+      "path": "data/20261017.json"
+    },
     {
       "date": "20261016",
       "path": "data/20261016.json"
@@ -13,302 +29,6 @@
     {
       "date": "20261014",
       "path": "data/20261014.json"
-    },
-    {
-      "date": "20261013",
-      "path": "data/20261013.json"
-    },
-    {
-      "date": "20261012",
-      "path": "data/20261012.json"
-    },
-    {
-      "date": "20261011",
-      "path": "data/20261011.json"
-    },
-    {
-      "date": "20261010",
-      "path": "data/20261010.json"
-    },
-    {
-      "date": "20261009",
-      "path": "data/20261009.json"
-    },
-    {
-      "date": "20261008",
-      "path": "data/20261008.json"
-    },
-    {
-      "date": "20261007",
-      "path": "data/20261007.json"
-    },
-    {
-      "date": "20261006",
-      "path": "data/20261006.json"
-    },
-    {
-      "date": "20261005",
-      "path": "data/20261005.json"
-    },
-    {
-      "date": "20261004",
-      "path": "data/20261004.json"
-    },
-    {
-      "date": "20261003",
-      "path": "data/20261003.json"
-    },
-    {
-      "date": "20261002",
-      "path": "data/20261002.json"
-    },
-    {
-      "date": "20261001",
-      "path": "data/20261001.json"
-    },
-    {
-      "date": "20260930",
-      "path": "data/20260930.json"
-    },
-    {
-      "date": "20260929",
-      "path": "data/20260929.json"
-    },
-    {
-      "date": "20260928",
-      "path": "data/20260928.json"
-    },
-    {
-      "date": "20260927",
-      "path": "data/20260927.json"
-    },
-    {
-      "date": "20260926",
-      "path": "data/20260926.json"
-    },
-    {
-      "date": "20260925",
-      "path": "data/20260925.json"
-    },
-    {
-      "date": "20260924",
-      "path": "data/20260924.json"
-    },
-    {
-      "date": "20260923",
-      "path": "data/20260923.json"
-    },
-    {
-      "date": "20260922",
-      "path": "data/20260922.json"
-    },
-    {
-      "date": "20260921",
-      "path": "data/20260921.json"
-    },
-    {
-      "date": "20260920",
-      "path": "data/20260920.json"
-    },
-    {
-      "date": "20260919",
-      "path": "data/20260919.json"
-    },
-    {
-      "date": "20260918",
-      "path": "data/20260918.json"
-    },
-    {
-      "date": "20260917",
-      "path": "data/20260917.json"
-    },
-    {
-      "date": "20260916",
-      "path": "data/20260916.json"
-    },
-    {
-      "date": "20260915",
-      "path": "data/20260915.json"
-    },
-    {
-      "date": "20260914",
-      "path": "data/20260914.json"
-    },
-    {
-      "date": "20260913",
-      "path": "data/20260913.json"
-    },
-    {
-      "date": "20260912",
-      "path": "data/20260912.json"
-    },
-    {
-      "date": "20260911",
-      "path": "data/20260911.json"
-    },
-    {
-      "date": "20260910",
-      "path": "data/20260910.json"
-    },
-    {
-      "date": "20260909",
-      "path": "data/20260909.json"
-    },
-    {
-      "date": "20260908",
-      "path": "data/20260908.json"
-    },
-    {
-      "date": "20260907",
-      "path": "data/20260907.json"
-    },
-    {
-      "date": "20260906",
-      "path": "data/20260906.json"
-    },
-    {
-      "date": "20260905",
-      "path": "data/20260905.json"
-    },
-    {
-      "date": "20260904",
-      "path": "data/20260904.json"
-    },
-    {
-      "date": "20260903",
-      "path": "data/20260903.json"
-    },
-    {
-      "date": "20260902",
-      "path": "data/20260902.json"
-    },
-    {
-      "date": "20260901",
-      "path": "data/20260901.json"
-    },
-    {
-      "date": "20260831",
-      "path": "data/20260831.json"
-    },
-    {
-      "date": "20260830",
-      "path": "data/20260830.json"
-    },
-    {
-      "date": "20260829",
-      "path": "data/20260829.json"
-    },
-    {
-      "date": "20260828",
-      "path": "data/20260828.json"
-    },
-    {
-      "date": "20260827",
-      "path": "data/20260827.json"
-    },
-    {
-      "date": "20260826",
-      "path": "data/20260826.json"
-    },
-    {
-      "date": "20260825",
-      "path": "data/20260825.json"
-    },
-    {
-      "date": "20260824",
-      "path": "data/20260824.json"
-    },
-    {
-      "date": "20260823",
-      "path": "data/20260823.json"
-    },
-    {
-      "date": "20260822",
-      "path": "data/20260822.json"
-    },
-    {
-      "date": "20260821",
-      "path": "data/20260821.json"
-    },
-    {
-      "date": "20260820",
-      "path": "data/20260820.json"
-    },
-    {
-      "date": "20260819",
-      "path": "data/20260819.json"
-    },
-    {
-      "date": "20260818",
-      "path": "data/20260818.json"
-    },
-    {
-      "date": "20260817",
-      "path": "data/20260817.json"
-    },
-    {
-      "date": "20260816",
-      "path": "data/20260816.json"
-    },
-    {
-      "date": "20260815",
-      "path": "data/20260815.json"
-    },
-    {
-      "date": "20260814",
-      "path": "data/20260814.json"
-    },
-    {
-      "date": "20260813",
-      "path": "data/20260813.json"
-    },
-    {
-      "date": "20260812",
-      "path": "data/20260812.json"
-    },
-    {
-      "date": "20260811",
-      "path": "data/20260811.json"
-    },
-    {
-      "date": "20260810",
-      "path": "data/20260810.json"
-    },
-    {
-      "date": "20260809",
-      "path": "data/20260809.json"
-    },
-    {
-      "date": "20260808",
-      "path": "data/20260808.json"
-    },
-    {
-      "date": "20260807",
-      "path": "data/20260807.json"
-    },
-    {
-      "date": "20260806",
-      "path": "data/20260806.json"
-    },
-    {
-      "date": "20260805",
-      "path": "data/20260805.json"
-    },
-    {
-      "date": "20260804",
-      "path": "data/20260804.json"
-    },
-    {
-      "date": "20260803",
-      "path": "data/20260803.json"
-    },
-    {
-      "date": "20260802",
-      "path": "data/20260802.json"
-    },
-    {
-      "date": "20260801",
-      "path": "data/20260801.json"
     }
   ]
 }

scripts/run_pipeline.sh

@@ -3,39 +3,59 @@
 set -eu
 
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-PROJECT_ROOT=${PROJECT_ROOT:-$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)}
+PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
-ENV_FILE=${ENV_FILE:-$(CDPATH= cd -- "$PROJECT_ROOT/../direct-report-dashboard" && pwd)/.env}
 PYTHON_BIN=${PYTHON_BIN:-python3}
+CREDENTIALS_FILE=${HOME:?}/.config/gitea/credentials.env
 
-if [ ! -r "$ENV_FILE" ]; then
+if [ ! -r "$CREDENTIALS_FILE" ]; then
-    printf '%s\n' "Credential file is not readable: $ENV_FILE" >&2
+    printf '%s\n' "Credential file is not readable: $CREDENTIALS_FILE" >&2
+    exit 1
+fi
+if [ "$(stat -f '%Lp' "$CREDENTIALS_FILE")" != 600 ]; then
+    printf '%s\n' "Credential file must have mode 600: $CREDENTIALS_FILE" >&2
     exit 1
 fi
 
-# Read only the two Git credential variables; do not source the .env file.
+credential_value() {
-dotenv_value() {
+    awk -F= -v wanted="$1" '$1 ~ "^[[:space:]]*" wanted "[[:space:]]*$" { sub(/^[[:space:]]*/, "", $2); sub(/[[:space:]]*$/, "", $2); print $2; exit }' "$CREDENTIALS_FILE"
-    awk -v wanted="$1" '
-        $0 ~ "^[[:space:]]*" wanted "[[:space:]]*=" {
-            sub("^[[:space:]]*" wanted "[[:space:]]*=", "")
-            if ($0 ~ /^".*"[[:space:]]*$/) {
-                sub(/^"/, ""); sub(/"[[:space:]]*$/, "")
-            } else if ($0 ~ /^'"'"'.*'"'"'[[:space:]]*$/) {
-                sub(/^'"'"'/, ""); sub(/'"'"'[[:space:]]*$/, "")
-            }
-            print
-            exit
-        }
-    ' "$ENV_FILE"
 }
 
-AGENTSTAGE_USER=$(dotenv_value AGENTSTAGE_USER)
+AGENTSTAGE_USER=$(credential_value GITEA_USER)
-AGENTSTAGE_TOKEN=$(dotenv_value AGENTSTAGE_TOKEN)
+AGENTSTAGE_TOKEN=$(credential_value GITEA_TOKEN)
-if [ -z "$AGENTSTAGE_USER" ] || [ -z "$AGENTSTAGE_TOKEN" ]; then
+missing=''
-    printf '%s\n' "AGENTSTAGE_USER and AGENTSTAGE_TOKEN are required in $ENV_FILE" >&2
+[ -n "$AGENTSTAGE_USER" ] || missing="$missing AGENTSTAGE_USER"
+[ -n "$AGENTSTAGE_TOKEN" ] || missing="$missing AGENTSTAGE_TOKEN"
+if [ -n "$missing" ]; then
+    printf 'Missing required .env variable(s):%s\n' "$missing" >&2
+    exit 1
+fi
+if [ "$AGENTSTAGE_USER" != "liuji" ]; then
+    printf '%s\n' "AGENTSTAGE_USER must be liuji" >&2
     exit 1
 fi
 export AGENTSTAGE_USER AGENTSTAGE_TOKEN
 
+# Override Git only for this process tree: never read osxkeychain and never alter .git/config.
+REMOTE_URL=$(git -C "$PROJECT_ROOT" config --get remote.origin.url || true)
+case "$REMOTE_URL" in
+    https://*)
+        REMOTE_TARGET=${REMOTE_URL#https://}
+        REMOTE_TARGET=${REMOTE_TARGET#*@}
+        REMOTE_URL="https://liuji@$REMOTE_TARGET"
+        ;;
+    *)
+        printf '%s\n' "remote.origin.url must use HTTPS" >&2
+        exit 1
+        ;;
+esac
+export GIT_CONFIG_COUNT=3
+export GIT_CONFIG_KEY_0=credential.helper
+export GIT_CONFIG_VALUE_0=
+export GIT_CONFIG_KEY_1=remote.origin.url
+export GIT_CONFIG_VALUE_1="$REMOTE_URL"
+export GIT_CONFIG_KEY_2=remote.origin.pushurl
+export GIT_CONFIG_VALUE_2="$REMOTE_URL"
+
 umask 077
 ASKPASS=$(mktemp "${TMPDIR:-/tmp}/af-click-gap-askpass.XXXXXX")
 cleanup() {