590 lines
24 KiB
Python
590 lines
24 KiB
Python
#!/usr/bin/env python3
|
||
"""推送到 Gitea 仓库 —— 通用 / 鲁棒版。
|
||
|
||
用法:
|
||
python3 gitea_push.py <repo_name> <description> [paths...] [options]
|
||
|
||
典型场景:
|
||
1. 新目录 → 新仓库
|
||
python3 gitea_push.py remind-me "飞书加急提醒" ./skills/remind-me/
|
||
2. 增量更新已有仓库（同样命令，自动拉远程历史后提交）
|
||
python3 gitea_push.py remind-me "飞书加急提醒" ./skills/remind-me/
|
||
3. 推送一个已有 git 仓库（保留完整提交历史）
|
||
python3 gitea_push.py my-proj "我的项目" --from-git /root/my-proj
|
||
4. 只检查不推送
|
||
python3 gitea_push.py my-proj "我的项目" ./src --dry-run
|
||
|
||
环境变量:
|
||
GITEA_URL 实例地址（默认 https://git.yoresee.cc）
|
||
GITEA_USER 用户名（默认 NightStar）
|
||
GITEA_EMAIL 提交邮箱（默认 nightstar@yoresee.cc）
|
||
GITEA_SSH_HOST SSH 主机（默认 git.yoresee.cc）
|
||
|
||
退出码: 0 成功 / 1 一般错误 / 2 隐私检查未通过 / 3 推送被拒（重试后仍失败）
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import fnmatch
|
||
import json
|
||
import os
|
||
import re
|
||
import shutil
|
||
import subprocess
|
||
import sys
|
||
import tempfile
|
||
from pathlib import Path
|
||
|
||
# ─────────────────────────── 配置 ───────────────────────────
|
||
|
||
GITEA_URL = os.environ.get("GITEA_URL", "https://git.yoresee.cc").rstrip("/")
|
||
GITEA_USER = os.environ.get("GITEA_USER", "NightStar")
|
||
GITEA_EMAIL = os.environ.get("GITEA_EMAIL", "nightstar@yoresee.cc")
|
||
GITEA_SSH_HOST = os.environ.get("GITEA_SSH_HOST", "git.yoresee.cc")
|
||
DEFAULT_BRANCH = "master"
|
||
PUSH_RETRIES = 3
|
||
|
||
# 隐私模式：命中即拦（--allow-leaks 可放行）
|
||
SECRET_PATTERNS = [
|
||
(r"ghp_[A-Za-z0-9]{20,}", "GitHub PAT (ghp_)"),
|
||
(r"github_pat_[A-Za-z0-9_]{20,}", "GitHub fine-grained PAT"),
|
||
(r"sk-[A-Za-z0-9]{20,}", "API key (sk-)"),
|
||
(r"sk-sp-[A-Za-z0-9\-_]{20,}", "Token Plan key (sk-sp-)"),
|
||
(r"AKIA[0-9A-Z]{16}", "AWS Access Key ID"),
|
||
(r"xox[baprs]-[A-Za-z0-9\-]{10,}", "Slack token"),
|
||
(r"cli_[a-zA-Z0-9]{10,}", "飞书 app_id (cli_)"),
|
||
(r"ou_[a-f0-9]{20,}", "飞书 open_id (ou_)"),
|
||
(r"t-[a-zA-Z0-9]{20,}", "token (t-)"),
|
||
(r"Bearer\s+[A-Za-z0-9\-_.]{20,}", "Bearer 凭据"),
|
||
(r"-----BEGIN [A-Z ]*PRIVATE KEY-----", "私钥文件"),
|
||
(r"(?i)\b(password|passwd|secret|api[_-]?key|access[_-]?token)\s*[:=]\s*[\"']?[^\s\"',{}]{12,}", "明文口令/密钥赋值"),
|
||
]
|
||
|
||
# IP：仅拦公网地址（保留 127./10./192.168./172.16-31./0.0.0.0/255. 等常见非敏感写法）
|
||
IP_RE = re.compile(r"\b(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\b")
|
||
|
||
# 扫描的文本类扩展名（旧版漏了 .html/.css/.vue 等，这里补齐）
|
||
SCAN_EXTS = {
|
||
".py", ".pyi", ".md", ".markdown", ".json", ".json5", ".yaml", ".yml",
|
||
".sh", ".bash", ".zsh", ".fish", ".txt", ".toml", ".ini", ".cfg", ".conf", ".properties",
|
||
".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx", ".vue", ".svelte",
|
||
".html", ".htm", ".css", ".scss", ".less", ".xml", ".svg",
|
||
".go", ".rs", ".java", ".kt", ".rb", ".php", ".sql", ".pl", ".lua",
|
||
".env", ".envrc", ".tf", ".tfvars", ".gradle", ".cmake",
|
||
}
|
||
SCAN_NAMES = {
|
||
"Dockerfile", "Makefile", "Rakefile", "Gemfile", "Procfile",
|
||
".env", ".env.local", ".env.production", ".npmrc", ".pypirc", ".netrc",
|
||
}
|
||
|
||
ALWAYS_EXCLUDE_DIRS = {".git", "node_modules", "__pycache__", ".venv", "venv", ".mypy_cache",
|
||
".pytest_cache", ".ruff_cache", "dist", "build", ".next", ".nuxt",
|
||
"target", ".idea", ".vscode", "vendor"}
|
||
ALWAYS_EXCLUDE_FILES = {".DS_Store", "Thumbs.db"}
|
||
MAX_WARN_BYTES = 5 * 1024 * 1024 # 单文件超 5MB 提醒
|
||
|
||
|
||
class PushError(Exception):
|
||
def __init__(self, msg: str, code: int = 1):
|
||
super().__init__(msg)
|
||
self.code = code
|
||
|
||
|
||
# ─────────────────────────── 日志 ───────────────────────────
|
||
|
||
QUIET = False
|
||
|
||
|
||
def log(msg: str = "", *, err: bool = True) -> None:
|
||
if not QUIET:
|
||
print(msg, file=sys.stderr if err else sys.stdout)
|
||
|
||
|
||
def step(n: int, total: int, msg: str) -> None:
|
||
log(f"[{n}/{total}] {msg}")
|
||
|
||
|
||
# ─────────────────────────── 子进程 ───────────────────────────
|
||
|
||
def _ssh_env() -> dict:
|
||
env = dict(os.environ)
|
||
env["GIT_SSH_COMMAND"] = env.get(
|
||
"GIT_SSH_COMMAND", "ssh -o StrictHostKeyChecking=accept-new"
|
||
)
|
||
return env
|
||
|
||
|
||
def run(cmd: list[str], cwd: Path | None = None, *, check: bool = True,
|
||
env: dict | None = None) -> subprocess.CompletedProcess:
|
||
res = subprocess.run(cmd, cwd=str(cwd) if cwd else None, capture_output=True,
|
||
text=True, env=env)
|
||
if check and res.returncode != 0:
|
||
raise PushError(f"命令失败: {' '.join(cmd)}\n{res.stderr.strip()}")
|
||
return res
|
||
|
||
|
||
def git(args: list[str], cwd: Path, *, check: bool = True) -> subprocess.CompletedProcess:
|
||
return run(["git", *args], cwd=cwd, check=check, env=_ssh_env())
|
||
|
||
|
||
def tea(args: list[str], *, check: bool = True) -> subprocess.CompletedProcess:
|
||
return run(["tea", *args], check=check)
|
||
|
||
|
||
def has_commits(cwd: Path) -> bool:
|
||
return git(["rev-parse", "--verify", "HEAD"], cwd, check=False).returncode == 0
|
||
|
||
|
||
def remote_branch_exists(cwd: Path, branch: str) -> bool:
|
||
return git(["rev-parse", "--verify", f"origin/{branch}"], cwd,
|
||
check=False).returncode == 0
|
||
|
||
|
||
# ─────────────────────────── 隐私检查 ───────────────────────────
|
||
|
||
def _is_scannable(p: Path) -> bool:
|
||
if p.name in SCAN_NAMES:
|
||
return True
|
||
return p.suffix.lower() in SCAN_EXTS
|
||
|
||
|
||
# 跳过不算敏感的四类：本机/私网/保留段、以及 RFC 5737 文档专用网段
|
||
_DOC_RANGES = ((192, 0, 2), (198, 51, 100), (203, 0, 113))
|
||
|
||
|
||
def _public_ip(match: re.Match) -> bool:
|
||
"""判定是否公网 IP（跳过本机/私网/环回/广播/文档专用段等无害写法）。"""
|
||
a, b, c = int(match.group(1)), int(match.group(2)), int(match.group(3))
|
||
if a == 0 or a == 127 or a == 255:
|
||
return False
|
||
if a == 10 or (a == 192 and b == 168) or (a == 172 and 16 <= b <= 31):
|
||
return False
|
||
if a == 169 and b == 254:
|
||
return False
|
||
if (a, b, c) in _DOC_RANGES:
|
||
return False
|
||
# 其余一律报出，交人工判断（版本号式写法也宁可多报）
|
||
return True
|
||
|
||
|
||
def scan_paths(paths: list[Path]) -> list[dict]:
|
||
"""扫描文件中的疑似隐私。返回命中列表。"""
|
||
findings: list[dict] = []
|
||
for root in paths:
|
||
files = [root] if root.is_file() else [f for f in root.rglob("*") if f.is_file()]
|
||
for f in files:
|
||
if any(part in ALWAYS_EXCLUDE_DIRS for part in f.parts):
|
||
continue
|
||
if not _is_scannable(f):
|
||
continue
|
||
try:
|
||
text = f.read_text(encoding="utf-8", errors="ignore")
|
||
except OSError:
|
||
continue
|
||
hits: list[str] = []
|
||
for pattern, label in SECRET_PATTERNS:
|
||
n = len(re.findall(pattern, text))
|
||
if n:
|
||
hits.append(f"{label} × {n}")
|
||
pub_ips = [m.group(0) for m in IP_RE.finditer(text) if _public_ip(m)]
|
||
if pub_ips:
|
||
uniq = sorted(set(pub_ips))
|
||
hits.append(f"公网 IP × {len(uniq)}: {', '.join(uniq[:3])}"
|
||
+ (" …" if len(uniq) > 3 else ""))
|
||
if hits:
|
||
findings.append({"file": str(f), "hits": hits})
|
||
return findings
|
||
|
||
|
||
# ─────────────────────────── 文件收集 ───────────────────────────
|
||
|
||
def _fnmatch_fallback(patterns: list[str], rel: str) -> bool:
|
||
"""pathspec 不可用时的兜底匹配（够用即可）。"""
|
||
for pat in patterns:
|
||
pat = pat.rstrip("/")
|
||
if fnmatch.fnmatch(rel, pat) or fnmatch.fnmatch(rel, f"{pat}/*"):
|
||
return True
|
||
if pat.startswith("**/") and fnmatch.fnmatch(rel, pat[3:]):
|
||
return True
|
||
return False
|
||
|
||
|
||
def load_ignore_spec(sources: list[Path]):
|
||
"""收集各源目录向上查找的 .gitignore 规则。"""
|
||
patterns: list[str] = []
|
||
seen: set[str] = set()
|
||
for src in sources:
|
||
p = src.resolve()
|
||
if p.is_file():
|
||
p = p.parent
|
||
while True:
|
||
gi = p / ".gitignore"
|
||
if str(gi) not in seen and gi.is_file():
|
||
seen.add(str(gi))
|
||
try:
|
||
for line in gi.read_text(encoding="utf-8", errors="ignore").splitlines():
|
||
line = line.strip()
|
||
if line and not line.startswith("#") and line != ".gitignore":
|
||
patterns.append(line)
|
||
except OSError:
|
||
pass
|
||
if p.parent == p:
|
||
break
|
||
p = p.parent
|
||
try:
|
||
import pathspec # type: ignore
|
||
return pathspec.PathSpec.from_lines("gitwildmatch", patterns)
|
||
except ImportError:
|
||
log(" (pathspec 未安装，使用 fnmatch 兜底匹配)")
|
||
return patterns
|
||
|
||
|
||
def is_ignored(spec, rel: str) -> bool:
|
||
if isinstance(spec, list):
|
||
return _fnmatch_fallback(spec, rel)
|
||
try:
|
||
return spec.match_file(rel)
|
||
except Exception:
|
||
return False
|
||
|
||
|
||
def collect_files(sources: list[Path], work_dir: Path, spec, extra_excludes: list[str]) -> int:
|
||
"""把源文件复制进工作区（保持相对结构）。返回文件数。"""
|
||
count = 0
|
||
for src in sources:
|
||
src = src.resolve()
|
||
if src.is_file():
|
||
(work_dir / src.name).write_bytes(src.read_bytes())
|
||
count += 1
|
||
continue
|
||
if not src.is_dir():
|
||
log(f" ⚠️ 跳过不存在的路径: {src}")
|
||
continue
|
||
for f in sorted(src.rglob("*")):
|
||
if not f.is_file():
|
||
continue
|
||
if any(part in ALWAYS_EXCLUDE_DIRS for part in f.parts):
|
||
continue
|
||
if f.name in ALWAYS_EXCLUDE_FILES or f.name.endswith((".pyc", ".pyo")):
|
||
continue
|
||
rel = str(f.relative_to(src))
|
||
if is_ignored(spec, rel):
|
||
continue
|
||
if any(fnmatch.fnmatch(rel, pat) for pat in extra_excludes):
|
||
continue
|
||
dest = work_dir / rel
|
||
dest.parent.mkdir(parents=True, exist_ok=True)
|
||
shutil.copy2(f, dest)
|
||
size = f.stat().st_size
|
||
if size > MAX_WARN_BYTES:
|
||
log(f" ⚠️ 大文件 {rel} ({size // 1024 // 1024} MB)")
|
||
count += 1
|
||
return count
|
||
|
||
|
||
# ─────────────────────────── 仓库准备 ───────────────────────────
|
||
|
||
def login_user() -> str:
|
||
"""取 tea 当前登录用户名（失败回退到 GITEA_USER）。"""
|
||
res = tea(["login", "list", "--output", "json"], check=False)
|
||
if res.returncode == 0:
|
||
try:
|
||
entries = json.loads(res.stdout or "[]")
|
||
for e in entries:
|
||
if e.get("user"):
|
||
return str(e["user"])
|
||
except (json.JSONDecodeError, TypeError):
|
||
pass
|
||
return GITEA_USER
|
||
|
||
|
||
def ensure_repo(repo: str, description: str, owner: str, branch: str,
|
||
private: bool, dry_run: bool) -> bool:
|
||
"""确保仓库存在。返回是否新建。
|
||
|
||
⚠️ tea 0.15.0 的坑：给自己命名空间建仓时传 `--owner <自己>` 会报
|
||
`Error: not found`；必须省略 --owner。只有 owner ≠ 登录用户（建到
|
||
组织/他人命名空间）时才传。
|
||
"""
|
||
if dry_run:
|
||
log(" (dry-run：跳过建仓)")
|
||
return False
|
||
existed = False
|
||
self_owner = login_user().lower()
|
||
cmd = ["repos", "create", "--name", repo, "--description", description,
|
||
"--branch", branch, "--init"]
|
||
if owner.lower() != self_owner:
|
||
cmd += ["--owner", owner]
|
||
if private:
|
||
cmd.append("--private")
|
||
res = tea(cmd, check=False)
|
||
if res.returncode == 0:
|
||
out = (res.stdout or "") + (res.stderr or "")
|
||
if "not found" in out.lower():
|
||
raise PushError(
|
||
f"创建仓库返回 not found（owner={owner} 可能不存在或无权访问）:\n{out.strip()[:300]}")
|
||
return True
|
||
err = (res.stderr + res.stdout).lower()
|
||
if "already exists" in err or "409" in err:
|
||
existed = True
|
||
else:
|
||
# 二次确认：列一下 owner 的仓库
|
||
listing = tea(["repos", "list", "--owner", owner, "--output", "json",
|
||
"--limit", "200"], check=False)
|
||
if listing.returncode == 0:
|
||
try:
|
||
names = {r.get("name") for r in json.loads(listing.stdout or "[]")}
|
||
if repo in names:
|
||
existed = True
|
||
except json.JSONDecodeError:
|
||
pass
|
||
if not existed:
|
||
raise PushError(f"创建仓库失败: {res.stderr.strip() or res.stdout.strip()}")
|
||
log(f" 仓库 {owner}/{repo} 已存在，走增量提交（不 force）")
|
||
return False
|
||
|
||
|
||
def prepare_worktree(sources: list[Path], repo: str, owner: str, branch: str,
|
||
from_git: Path | None, extra_excludes: list[str]) -> tuple[Path, bool]:
|
||
"""准备工作区。返回 (路径, 是否为临时目录)。"""
|
||
if from_git:
|
||
work = from_git.resolve()
|
||
if not (work / ".git").exists():
|
||
raise PushError(f"{work} 不是 git 仓库（--from-git 需要已有 .git）")
|
||
remotes = git(["remote"], work, check=False).stdout.split()
|
||
url = f"git@{GITEA_SSH_HOST}:{owner}/{repo}.git"
|
||
if "origin" in remotes:
|
||
git(["remote", "set-url", "origin", url], work)
|
||
else:
|
||
git(["remote", "add", "origin", url], work)
|
||
return work, False
|
||
|
||
work = Path(tempfile.mkdtemp(prefix=f"gitea_{repo}_"))
|
||
run(["git", "init", "-b", branch], work)
|
||
git(["config", "user.name", GITEA_USER], work)
|
||
git(["config", "user.email", GITEA_EMAIL], work)
|
||
git(["remote", "add", "origin", f"git@{GITEA_SSH_HOST}:{owner}/{repo}.git"], work)
|
||
spec = load_ignore_spec(sources)
|
||
n = collect_files(sources, work, spec, extra_excludes)
|
||
log(f" 共收集 {n} 个文件")
|
||
return work, True
|
||
|
||
|
||
def align_with_remote(work: Path, branch: str, *, from_git: bool) -> str:
|
||
"""把本地分支对齐到远程历史，避免 'fetch first' 拒绝。
|
||
|
||
非 --from-git 场景用 `reset --mixed`（而非 --hard）：只移动 HEAD、
|
||
不碰工作区，避免覆盖同名文件的用户内容。
|
||
"""
|
||
git(["fetch", "origin", branch], work, check=False)
|
||
if not remote_branch_exists(work, branch):
|
||
return "no-remote-branch"
|
||
if not has_commits(work):
|
||
# 未出生分支：继承远程历史，但保留工作区文件（--mixed 不碰文件）
|
||
git(["reset", "--mixed", f"origin/{branch}"], work)
|
||
return "adopted-remote"
|
||
if from_git:
|
||
res = git(["rebase", f"origin/{branch}"], work, check=False)
|
||
if res.returncode != 0:
|
||
git(["rebase", "--abort"], work, check=False)
|
||
raise PushError(
|
||
"rebase 冲突，请手动解决后重试：\n" + res.stderr.strip()[:500], code=3)
|
||
return "rebased"
|
||
return "kept-local"
|
||
|
||
|
||
# ─────────────────────────── 提交 & 推送 ───────────────────────────
|
||
|
||
def commit_if_changed(work: Path, message: str, *, add_all: bool = True) -> bool:
|
||
if add_all:
|
||
git(["add", "-A"], work)
|
||
if git(["diff", "--cached", "--quiet"], work, check=False).returncode == 0:
|
||
log(" 无内容变更，跳过 commit")
|
||
return False
|
||
res = git(["commit", "-m", message], work, check=False)
|
||
if res.returncode != 0:
|
||
raise PushError(f"commit 失败:\n{res.stderr.strip() or res.stdout.strip()}")
|
||
log(f" ✓ {git(['log', '--oneline', '-1'], work).stdout.strip()}")
|
||
return True
|
||
|
||
|
||
def push_with_retry(work: Path, branch: str) -> None:
|
||
last = ""
|
||
for attempt in range(1, PUSH_RETRIES + 1):
|
||
res = git(["push", "-u", "origin", branch], work, check=False)
|
||
if res.returncode == 0:
|
||
log(" ✓ 推送成功")
|
||
return
|
||
err = res.stderr.strip()
|
||
last = err
|
||
if any(k in err.lower() for k in ("rejected", "fetch first", "non-fast-forward", "behind")):
|
||
log(f" 推送被拒（第 {attempt} 次），拉取远程后重试…")
|
||
git(["fetch", "origin", branch], work, check=False)
|
||
if remote_branch_exists(work, branch):
|
||
rb = git(["rebase", f"origin/{branch}"], work, check=False)
|
||
if rb.returncode != 0:
|
||
git(["rebase", "--abort"], work, check=False)
|
||
raise PushError("rebase 冲突，无法自动重试：\n" + rb.stderr.strip()[:500],
|
||
code=3)
|
||
continue
|
||
raise PushError(f"推送失败:\n{err[:500]}", code=3)
|
||
raise PushError(f"推送失败（已重试 {PUSH_RETRIES} 次）:\n{last[:500]}", code=3)
|
||
|
||
|
||
# ─────────────────────────── 主流程 ───────────────────────────
|
||
|
||
def build_parser() -> argparse.ArgumentParser:
|
||
p = argparse.ArgumentParser(
|
||
prog="gitea_push.py",
|
||
description="推送到 Gitea 仓库（通用鲁棒版）",
|
||
formatter_class=argparse.RawDescriptionHelpFormatter,
|
||
epilog="""示例:
|
||
gitea_push.py remind-me "飞书加急提醒" ./skills/remind-me/
|
||
gitea_push.py my-proj "我的项目" --from-git /root/my-proj
|
||
gitea_push.py my-proj "我的项目" ./src --dry-run
|
||
""")
|
||
p.add_argument("repo_name", help="仓库名（kebab-case）")
|
||
p.add_argument("description", help="仓库描述 / 提交信息")
|
||
p.add_argument("paths", nargs="*", help="要推送的文件或目录（--from-git 时可省）")
|
||
p.add_argument("--from-git", metavar="DIR", default=None,
|
||
help="推送一个已有 git 仓库（保留提交历史）")
|
||
p.add_argument("--owner", default=GITEA_USER, help=f"仓库所有者（默认 {GITEA_USER}）")
|
||
p.add_argument("--branch", default=DEFAULT_BRANCH, help=f"分支（默认 {DEFAULT_BRANCH}）")
|
||
p.add_argument("--message", default=None, help="自定义提交信息（默认用 description）")
|
||
p.add_argument("--private", action="store_true", help="建私有仓库（默认公开）")
|
||
p.add_argument("--exclude", action="append", default=[], metavar="PATTERN",
|
||
help="额外排除（glob，可重复）")
|
||
p.add_argument("--allow-leaks", action="store_true", help="隐私检查命中时仍继续")
|
||
p.add_argument("--no-scan", action="store_true", help="跳过隐私检查")
|
||
p.add_argument("--dry-run", action="store_true", help="只检查与暂存，不建仓不推送")
|
||
p.add_argument("--quiet", action="store_true", help="静默（只输出结果 JSON）")
|
||
return p
|
||
|
||
|
||
def main(argv: list[str] | None = None) -> int:
|
||
global QUIET
|
||
args = build_parser().parse_args(argv)
|
||
QUIET = args.quiet
|
||
|
||
branch = args.branch
|
||
message = args.message or f"feat: {args.description}"
|
||
dry = args.dry_run
|
||
total_steps = 4
|
||
|
||
try:
|
||
if shutil.which("git") is None:
|
||
raise PushError("找不到 git")
|
||
if shutil.which("tea") is None and not dry:
|
||
raise PushError("找不到 tea CLI（Gitea 命令行）")
|
||
|
||
# 源路径
|
||
if args.from_git:
|
||
sources = [Path(args.from_git)]
|
||
else:
|
||
if not args.paths:
|
||
raise PushError("请至少指定一个路径，或用 --from-git 指定仓库目录")
|
||
sources = [Path(p) for p in args.paths]
|
||
missing = [str(s) for s in sources if not s.exists()]
|
||
if missing:
|
||
raise PushError("路径不存在: " + ", ".join(missing))
|
||
|
||
# 1. 隐私检查
|
||
step(1, total_steps, "隐私检查…")
|
||
if args.no_scan:
|
||
log(" (已跳过)")
|
||
else:
|
||
if args.from_git:
|
||
scan_targets = [p for p in Path(args.from_git).iterdir()
|
||
if p.name != ".git"]
|
||
else:
|
||
scan_targets = sources
|
||
findings = scan_paths(scan_targets)
|
||
if findings:
|
||
log("")
|
||
for item in findings:
|
||
log(f" ⚠️ {item['file']}")
|
||
for h in item["hits"]:
|
||
log(f" - {h}")
|
||
log("")
|
||
if not args.allow_leaks:
|
||
raise PushError(
|
||
f"发现 {len(findings)} 个文件含疑似隐私，已中止。"
|
||
"确认无误可加 --allow-leaks 继续。", code=2)
|
||
log(" --allow-leaks 已指定，继续推送")
|
||
else:
|
||
log(" ✓ 未发现敏感内容")
|
||
|
||
# 2. 仓库准备
|
||
step(2, total_steps, f"确保仓库 {args.owner}/{args.repo_name}…")
|
||
is_new = ensure_repo(args.repo_name, args.description, args.owner,
|
||
branch, args.private, dry)
|
||
log(" ✓ 新建仓库" if is_new else " ✓ 复用现有仓库")
|
||
|
||
# 3. 工作区 + 对齐远程
|
||
step(3, total_steps, "准备工作区并对齐远程历史…")
|
||
work, is_temp = prepare_worktree(sources, args.repo_name, args.owner,
|
||
branch, Path(args.from_git) if args.from_git else None,
|
||
args.exclude)
|
||
if not args.from_git:
|
||
git(["config", "user.name", GITEA_USER], work)
|
||
git(["config", "user.email", GITEA_EMAIL], work)
|
||
mode = align_with_remote(work, branch, from_git=bool(args.from_git))
|
||
log(f" 远程对齐方式: {mode}")
|
||
|
||
if args.from_git:
|
||
# --from-git：推送仓库已有的提交，不自动提交未完成的工作区改动
|
||
dirty = git(["status", "--porcelain"], work, check=False).stdout.strip()
|
||
if dirty:
|
||
log(" ⚠️ 工作区有未提交改动，不会被推送（请先自行 commit）")
|
||
changed = False
|
||
else:
|
||
# 普通目录推送：全部纳入暂存区（含新增/修改/删除）
|
||
changed = commit_if_changed(work, message, add_all=True)
|
||
|
||
# 4. 推送
|
||
if dry:
|
||
step(4, total_steps, "dry-run：跳过推送")
|
||
log(f" 工作区: {work}")
|
||
else:
|
||
step(4, total_steps, f"推送到 {args.owner}/{args.repo_name} ({branch})…")
|
||
if args.from_git:
|
||
ahead = git(["rev-list", "--count", f"origin/{branch}..HEAD"],
|
||
work, check=False).stdout.strip()
|
||
if ahead in ("", "0"):
|
||
log(" 本地无新提交，远程已是最新")
|
||
else:
|
||
log(f" 本地领先远程 {ahead} 个提交")
|
||
push_with_retry(work, branch)
|
||
else:
|
||
push_with_retry(work, branch)
|
||
|
||
browse = f"{GITEA_URL}/{args.owner}/{args.repo_name}"
|
||
log("")
|
||
log(f"✅ 完成！浏览: {browse}")
|
||
print(json.dumps({
|
||
"ok": True,
|
||
"repo": args.repo_name,
|
||
"owner": args.owner,
|
||
"url": browse,
|
||
"clone": f"git@{GITEA_SSH_HOST}:{args.owner}/{args.repo_name}.git",
|
||
"branch": branch,
|
||
"new_repo": is_new,
|
||
"dry_run": dry,
|
||
"work_dir": str(work) if is_temp else None,
|
||
"from_git": bool(args.from_git),
|
||
}, ensure_ascii=False))
|
||
return 0
|
||
|
||
except PushError as exc:
|
||
log(f"\n❌ {exc}")
|
||
print(json.dumps({"ok": False, "error": str(exc)}, ensure_ascii=False))
|
||
return exc.code
|
||
except KeyboardInterrupt:
|
||
log("\n已中断")
|
||
return 1
|
||
|
||
|
||
if __name__ == "__main__":
|
||
sys.exit(main())
|