From 2fd8027a4150c719a1988ee432125cbe7c17970b Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Mon, 1 Jun 2026 14:44:53 +0800
Subject: [PATCH] Fix deploy stdin token handling

---
 .github/workflows/ci.yml                | 2 +-
 deploy.sh                               | 6 +++++-
 tests/test_deployment_runtime_config.py | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 37599827..5a6635f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -137,6 +137,6 @@ jobs:
           echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
           scp -o StrictHostKeyChecking=accept-new deploy.sh ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }}:/tmp/deploy.sh
-          printf '%s' "$GHCR_PAT" | ssh -o StrictHostKeyChecking=accept-new ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }} "
+          printf '%s\n' "$GHCR_PAT" | ssh -o StrictHostKeyChecking=accept-new ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }} "
             bash /tmp/deploy.sh '${{ github.sha }}'
           "
diff --git a/deploy.sh b/deploy.sh
index 59a70255..df5f0547 100644
--- a/deploy.sh
+++ b/deploy.sh
@@ -7,7 +7,11 @@ COMPOSE_DIR="/root/PolyWeather"
 LOCK_FILE="${POLYWEATHER_DEPLOY_LOCK_FILE:-/var/lock/polyweather-deploy.lock}"
 
 GHCR_PAT=""
-if ! IFS= read -r GHCR_PAT || [ -z "$GHCR_PAT" ]; then
+if ! IFS= read -r GHCR_PAT && [ -z "$GHCR_PAT" ]; then
+    echo "❌ GHCR token must be provided on stdin"
+    exit 1
+fi
+if [ -z "$GHCR_PAT" ]; then
     echo "❌ GHCR token must be provided on stdin"
     exit 1
 fi
diff --git a/tests/test_deployment_runtime_config.py b/tests/test_deployment_runtime_config.py
index f3825dd4..ffb55254 100644
--- a/tests/test_deployment_runtime_config.py
+++ b/tests/test_deployment_runtime_config.py
@@ -135,7 +135,7 @@ def test_deploy_token_is_passed_over_stdin_not_process_args():
     assert 'printf \'%s\' "$GHCR_PAT" | docker login' in script
 
     assert "GHCR_PAT: ${{ secrets.GHCR_PAT }}" in workflow
-    assert 'printf \'%s\' "$GHCR_PAT" | ssh' in workflow
+    assert 'printf \'%s\\n\' "$GHCR_PAT" | ssh' in workflow
     assert "bash /tmp/deploy.sh '${{ github.sha }}'" in workflow
     assert "bash /tmp/deploy.sh '${{ secrets.GHCR_PAT }}'" not in workflow