{
  "_sovereign": "TCS-0002∞ · ICE-GL∞ · 国作登字-2026-A-00037559",
  "_守护": "铸渊 · ICE-GL-ZY001",
  "_说明": "这是『启动前最小密钥校验』的真相源。每个 workflow 启动时会读这一份，把 GitHub Secrets 的实际配置情况打成中文报告。required=缺了直接终止；required_on_stage=只在某个 stage 缺了才终止；optional=缺了就跳过/降级。",
  "version": "1.1.0",
  "updated_at": "2026-05-09",

  "workflows": {
    "cn-domain-deploy": {
      "_describe": "广州 2C2G 域名机 (GH-CVM-DOMAIN-PROD-01) 单线运行部署 · 挂 guanghulab.com",
      "_主体": "ZY-SVR-CN01 · 广州轻量 2核2G · 重装系统 · 唯一对外服务器",
      "_min_total_required": 4,
      "_隔离": "本工作流已加入 cn-isolation-allowlist.json, 是唯一可触碰这台机器的部署流",
      "secrets": [
        {
          "name": "ZY_CN_SERVER_HOST",
          "level": "required",
          "用途": "广州 2C2G 公网 IP",
          "where": "腾讯云轻量应用服务器实例详情 → 公网 IP",
          "如何配置": "GitHub 仓库 Settings → Secrets and variables → Actions → New repository secret"
        },
        {
          "name": "ZY_CN_SERVER_USER",
          "level": "required",
          "用途": "SSH 登录用户名 (腾讯云轻量默认 ubuntu)",
          "default_hint": "ubuntu"
        },
        {
          "name": "ZY_CN_SERVER_KEY",
          "level": "required",
          "用途": "SSH 私钥 (-----BEGIN OPENSSH PRIVATE KEY----- 整段)",
          "如何配置": "整段贴进 secret 值, 不要 base64 不要去换行"
        },
        {
          "name": "ZY_CN_SERVER_PATH",
          "level": "required",
          "用途": "服务器部署根路径 (推荐 /data/guanghulab)",
          "default_hint": "/data/guanghulab"
        },
        {
          "name": "ZY_CN_SSH_PORT",
          "level": "optional",
          "default": "22",
          "用途": "SSH 端口"
        },
        {
          "name": "ZY_COS_SECRET_ID",
          "level": "required_on_stage",
          "stages": ["restore", "fetch-models"],
          "用途": "腾讯云 COS 桶 SecretId (从 sy-finetune-corpus-1317346199 拉模型/搬家包)"
        },
        {
          "name": "ZY_COS_SECRET_KEY",
          "level": "required_on_stage",
          "stages": ["restore", "fetch-models"],
          "用途": "腾讯云 COS SecretKey"
        }
      ]
    },
    "autodl-inference": {
      "_describe": "AutoDL GPU 推理机 (GH-AUTODL-INFER-01) · 跑母模型/编程模型 · 端口动态漂移",
      "_主体": "ZY-SVR-GPU01 · AutoDL 共享 GPU · 关机即释放, 开机重抢, 配置每次都不同",
      "_注意": "PASS 不是 KEY · AutoDL 是密码登录, 不是 ssh-key",
      "secrets": [
        {
          "name": "ZY_AUTODL_HOST",
          "level": "required",
          "用途": "AutoDL 给的连接地址 (例: connect.westa.seetacloud.com)",
          "where": "AutoDL 实例详情 → SSH 登录指令 → @ 后面那段"
        },
        {
          "name": "ZY_AUTODL_PORT",
          "level": "required",
          "用途": "AutoDL 给的端口 (每次开机都变)",
          "where": "AutoDL 实例详情 → SSH 登录指令 → -p 后面那段",
          "更新方式": "AutoDL 重开机后端口会变, 在『密钥管理页』(PR-5) 改这个就行, 不需要 GitHub Secrets"
        },
        {
          "name": "ZY_AUTODL_USER",
          "level": "required",
          "default_hint": "root",
          "用途": "SSH 用户名 (AutoDL 默认 root)"
        },
        {
          "name": "ZY_AUTODL_PASS",
          "level": "required",
          "用途": "SSH 密码 (AutoDL 是密码登录, 不是密钥)"
        }
      ]
    },
    "lighthouse-cn-deploy": {
      "_describe": "国内灯塔主服务器部署 (bootstrap / update / rollback)",
      "_min_total_required": 7,
      "secrets": [
        {
          "name": "ZY_LIGHTHOUSE_HOST",
          "level": "required",
          "用途": "灯塔主服务器公网 IP",
          "where": "腾讯云 CVM 实例详情 → 公网 IP",
          "如何配置": "GitHub 仓库 Settings → Secrets and variables → Actions → New repository secret"
        },
        {
          "name": "ZY_LIGHTHOUSE_USER",
          "level": "required",
          "用途": "SSH 登录用户名 (一般是 ubuntu)",
          "default_hint": "ubuntu",
          "如何配置": "同上"
        },
        {
          "name": "ZY_LIGHTHOUSE_KEY",
          "level": "required",
          "用途": "SSH 私钥 (-----BEGIN OPENSSH PRIVATE KEY----- 整段)",
          "where": "/data/secrets 或本地生成 ed25519 私钥, 把公钥放进服务器 ~/.ssh/authorized_keys",
          "如何配置": "整段贴进 secret 值, 不要 base64 不要去换行"
        },
        {
          "name": "ZY_LIGHTHOUSE_PORT",
          "level": "optional",
          "default": "22",
          "用途": "SSH 端口 (默认 22)"
        },
        {
          "name": "ZY_LIGHTHOUSE_DOMAIN",
          "level": "optional",
          "用途": "灯塔对外域名 (备案后才配)"
        },
        {
          "name": "ZY_GITEA_ADMIN_USER",
          "level": "required_on_stage",
          "stages": ["bootstrap"],
          "用途": "Gitea 初始管理员账号"
        },
        {
          "name": "ZY_GITEA_ADMIN_PASS",
          "level": "required_on_stage",
          "stages": ["bootstrap"],
          "用途": "Gitea 初始管理员密码 (≥24 位, 含大小写 + 数字 + 符号)",
          "强校验": "length>=24"
        },
        {
          "name": "ZY_GITEA_ADMIN_EMAIL",
          "level": "required_on_stage",
          "stages": ["bootstrap"],
          "用途": "Gitea 管理员邮箱"
        },
        {
          "name": "ZY_GITEA_DB_PASS",
          "level": "required_on_stage",
          "stages": ["bootstrap"],
          "用途": "PostgreSQL gitea 用户密码"
        },
        {
          "name": "ZY_GITEA_RUNNER_TOKEN",
          "level": "required_on_stage",
          "stages": ["update"],
          "用途": "Gitea Actions Runner 注册 token (Site Admin → Runners → Create new Runner)"
        },
        {
          "name": "ZY_LIGHTHOUSE_BACKUP_HOST",
          "level": "required_on_target",
          "targets": ["backup"],
          "用途": "备用机公网 IP",
          "实情备注": "2026-05-08 已变更: 计划的 4C4G 广州缺货, 实际购买广州4区 2C8G. 这一项可能会随地区/规格漂移, bootstrap 现在不再硬假设规格"
        },
        {
          "name": "ZY_LIGHTHOUSE_BACKUP_USER",
          "level": "required_on_target",
          "targets": ["backup"],
          "用途": "备用机 SSH 用户名"
        },
        {
          "name": "ZY_LIGHTHOUSE_BACKUP_KEY",
          "level": "required_on_target",
          "targets": ["backup"],
          "用途": "备用机 SSH 私钥"
        },
        {
          "name": "ZY_COS_SECRET_ID",
          "level": "optional",
          "用途": "腾讯云 COS 搬家中转的 SecretId (restore-from-cos.sh 用)"
        },
        {
          "name": "ZY_COS_SECRET_KEY",
          "level": "optional",
          "用途": "腾讯云 COS SecretKey"
        },
        {
          "name": "ZY_COS_BUCKET",
          "level": "optional",
          "default_hint": "guanghulab-migration-xxx-1317346199",
          "用途": "搬家快照 COS 桶"
        },
        {
          "name": "ZY_COS_REGION",
          "level": "optional",
          "default": "ap-guangzhou",
          "用途": "COS 桶地域"
        },
        {
          "name": "ZY_DISPATCH_TOKEN",
          "level": "optional",
          "用途": "服务器侧 progress-reporter.sh 回调 GitHub repository_dispatch 用的 PAT (repo scope)"
        },
        {
          "name": "ZY_FEISHU_WEBHOOK",
          "level": "optional",
          "用途": "失败时往飞书群发告警 (没配就不发)"
        }
      ]
    }
  }
}