name: Diagnose Disk (read-only)

# 只读：根分区 100% 满，定位大占用者，判断哪些可安全清理。不删任何东西。
on:
  workflow_dispatch:

jobs:
  disk:
    runs-on: ubuntu-latest
    steps:
      - name: SSH disk usage (read-only)
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.ECS_HOST }}
          username: ${{ secrets.ECS_USER }}
          password: ${{ secrets.ECS_PASSWORD }}
          command_timeout: 8m
          script: |
            echo "===== df -h ====="; df -h / /boot/efi 2>/dev/null
            echo "===== 根下一级目录占用(du --max-depth=1 /) ====="
            du -xh --max-depth=1 / 2>/dev/null | sort -rh | head -20
            echo "===== 全盘 Top 30 大目录(max-depth=3) ====="
            du -xh --max-depth=3 / 2>/dev/null | sort -rh | head -30
            echo "===== MongoDB 数据目录 ====="
            du -sh /var/lib/mongodb 2>/dev/null || du -sh /data/db 2>/dev/null || echo "(未找到常规 mongo 数据目录)"
            echo "===== pm2 日志目录(常见爆盘元凶) ====="
            du -sh ~/.pm2/logs 2>/dev/null; ls -lhS ~/.pm2/logs 2>/dev/null | head -15
            echo "===== /var/log 占用 ====="; du -sh /var/log 2>/dev/null; du -xh /var/log 2>/dev/null | sort -rh | head -12
            echo "===== journal 占用 ====="; journalctl --disk-usage 2>/dev/null || echo "(无 journalctl)"
            echo "===== npm/缓存 ====="; du -sh ~/.npm 2>/dev/null; du -sh /root/.cache 2>/dev/null; du -sh /tmp 2>/dev/null
            echo "===== docker 占用(如有) ====="; (command -v docker >/dev/null && docker system df 2>/dev/null) || echo "(无 docker)"
            echo "===== /var/www 各站点占用(含媒体上传) ====="
            du -xh --max-depth=2 /var/www 2>/dev/null | sort -rh | head -25
            echo "===== 单个大文件 Top 20(>200M) ====="
            find / -xdev -type f -size +200M 2>/dev/null -printf '%s\t%p\n' | sort -rn | head -20 | awk '{printf "%.1fG\t%s\n",$1/1073741824,$2}'
            echo "===== 完成 ====="