name: set admin password (manual)

# 已于 2026-08-02 执行一次:把生产超管口令从默认 admin123 改成强口令(堵公网默认口令洞)。
# ★口令已抹除、只保留手动触发(不再随推送自动跑,避免误改回)。要再改口令:
#   把下面 PW='...' 填成新口令,在 Actions 页手动 Run 一次,跑完再抹掉。
on:
  workflow_dispatch: {}

jobs:
  setpw:
    runs-on: ubuntu-latest
    steps:
      - name: Write ADMIN_PASS/ADMIN_USER to prod .env + restart
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.ECS_HOST }}
          username: ${{ secrets.ECS_USER }}
          password: ${{ secrets.ECS_PASSWORD }}
          command_timeout: 5m
          script: |
            set -e
            cd /var/www/digitalme-api.invoratec.cn
            [ -f .env ] || { echo "❌ 生产 .env 缺失"; exit 1; }
            PW='__FILL_NEW_PASSWORD__'
            [ "$PW" = '__FILL_NEW_PASSWORD__' ] && { echo "未填新口令,退出(避免误改)"; exit 0; }
            if grep -q '^ADMIN_PASS=' .env; then sed -i "s#^ADMIN_PASS=.*#ADMIN_PASS=$PW#" .env; else echo "ADMIN_PASS=$PW" >> .env; fi
            grep -q '^ADMIN_USER=' .env || echo "ADMIN_USER=admin" >> .env
            pm2 restart digitalme-api --update-env
            sleep 5
            H=$(curl -sf http://localhost:3603/health || true); echo "$H" | grep -q '"ok":true' && echo "✓ 已带新口令重启" || { echo "❌ 后端没起来"; exit 1; }