From 5842f2c99c9919f0af60a00cb650a5a35bb8723a Mon Sep 17 00:00:00 2001
From: "34047007@qq.com" <34047007@qq.com>
Date: Mon, 10 Aug 2026 16:49:12 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20deploy.sh=20=E2=80=94=20=E5=9B=9E?=
 =?UTF-8?q?=E6=BB=9A=E8=B0=83=E7=94=A8=E6=94=B9=20bash=20=E4=B8=8D?=
 =?UTF-8?q?=E4=BE=9D=E8=B5=96=20+x=EF=BC=9B.env=20=E5=A4=8D=E6=9D=82?=
 =?UTF-8?q?=E7=B1=BB=E5=9E=8B(CORS=5FORIGINS=E7=AD=89)JSON=E9=A2=84?=
 =?UTF-8?q?=E6=A3=80=20fail-fast?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/deploy.sh | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 98e376f..42c6578 100644
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -121,6 +121,22 @@ if [ ! -f "$REPO_ROOT/.env" ]; then
 fi
 set -a; source "$REPO_ROOT/.env"; set +a
 
+# 3. .env 复杂类型预检（fail fast）：pydantic-settings 会把 CORS_ORIGINS 等按 JSON 解析，
+#    写成了普通字符串会在迁移时炸（8-10 事故），这里提前捕获，给出正确写法提示
+json_env_check() {
+  local var="$1"
+  local v="${!var:-}"
+  [ -z "$v" ] && return 0
+  if ! python3 -c "import json,sys; json.loads(sys.argv[1])" "$v" 2>/dev/null; then
+    error "$var 必须是合法 JSON（如 [\"https://a.com\"]），当前值: $v
+  请修改 $REPO_ROOT/.env 后重试。"
+  fi
+}
+json_env_check CORS_ORIGINS
+json_env_check ALLOWED_ORIGINS
+json_env_check REDIS_URL
+json_env_check PUBLIC_ORIGINS
+
 # 3. flock 单实例锁（防两人/两终端并发部署）
 exec 9>/tmp/scilit-deploy.lock
 flock -n 9 || error "已有部署/回滚在进行中（/tmp/scilit-deploy.lock 被锁）。"
@@ -305,7 +321,7 @@ check_single_head
 
 auto_rollback() {
   echo -e "${RED}[✗] 部署部分完成（迁移已跑/容器已切），触发自动回滚${NC}"
-  "$DEPLOY_DIR/rollback.sh" --auto || warn "自动回滚失败，请人工介入（详见 docs/16 §3 回滚 runbook）"
+  bash "$DEPLOY_DIR/rollback.sh" --auto || warn "自动回滚失败，请人工介入（详见 docs/16 §3 回滚 runbook）"
   exit 1
 }