fix(deploy): AUTH_URL 透传 + 强制重建容器（生产 SignIn / /api/events 全都失效的根因） - #11
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
该 PR 旨在修复生产环境部署与 OAuth 回调配置的两个问题：确保 AUTH_URL 能稳定进入容器环境，并通过强制重建容器让最新构建的镜像实际生效，从而恢复生产 SignIn 与 /api/events 的正常访问。
Changes:
- 在
docker-compose.yml中显式设置AUTH_URL（带默认值），避免容器内回调前缀取到错误值 - 在部署 workflow 中对 backend 增加
docker compose up --force-recreate，确保容器绑定到最新镜像 sha
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| docker-compose.yml | 显式注入 AUTH_URL 到 backend 容器环境，减少 OAuth 回调前缀错误风险 |
| .github/workflows/deploy.yml | 部署时强制重建 backend 容器，避免 :latest 标签更新但容器不更新 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+44
to
+48
| # 用新镜像重启服务。 | ||
| # --force-recreate 是必须的：compose 看 image 名（始终是 :latest）没变就不会重建容器， | ||
| # 结果 CI 的 docker build 虽然把 :latest 标签指向新 sha，但运行中容器仍绑死老 sha， | ||
| # 部署一直 "success" 但实际 JAR 没换。用 --force-recreate backend 强制销毁重建。 | ||
| docker compose up -d --remove-orphans --force-recreate backend |
There was a problem hiding this comment.
既然这里明确说明 --force-recreate 是必须的（否则容器会继续绑定旧 sha），回滚分支里把 rollback tag 回 latest 后同样会遇到“image 名没变 → 不重建容器”的问题。建议回滚路径的 docker compose up 也对 backend 使用同样的 --force-recreate（必要时加 --no-deps 以避免影响依赖服务）。
修两条独立但叠加的生产部署 bug：
1) docker-compose.yml 的 environment 缺 AUTH_URL 透传。
application.properties 里 justauth redirect-uri 是
${AUTH_URL:http://localhost:3000}/api/auth/callback/github，
compose 不显式透传时 .env 的 AUTH_URL=https://involutionhell.com
进不到容器，生产 /oauth/render/github 302 的 redirect_uri
变成 localhost，跳 GitHub 必报 redirect_uri_mismatch。
docker inspect 查到运行中容器 AUTH_URL=http://localhost:3010
是老容器手工 docker run 遗留。
2) deploy.yml 的 docker compose up -d 没加 --force-recreate。
CI 的 docker build 会把 :latest 标签指向新 sha，但 compose 看
image 名没变就不重建容器，:latest 指向新 sha 而运行中容器仍
绑死老 sha —— PR #9 / #10 的 SaToken /api/events 白名单、
events controller 全都躺在新镜像里没生效，/api/events 一直 401。
合起来就是"部署全 success 但生产没变化"的伪成功。
后续 merge 这个 PR 触发 deploy workflow 后，验证：
curl -I https://api.involutionhell.com/oauth/render/github | grep -i location
# → redirect_uri=https%3A%2F%2Finvolutionhell.com%2Fapi%2Fauth%2Fcallback%2Fgithub
curl https://api.involutionhell.com/api/events
# → {"success":true,"data":[...]}
⚠️ GitHub OAuth App 的 Authorization callback URLs 需要手动加
https://involutionhell.com/api/auth/callback/github（若还没加）。
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
CR 指出：回滚分支把 rollback tag 覆盖回 latest 后 image 名依旧是 :latest， compose 同样会判断"无需重建"，导致回滚等于没回（容器还绑着失败那版的 sha）。 - --force-recreate 保证 rollback tag 切换后容器真的重建 - --no-deps 限定只重建 backend 服务，不碰 postgres 等依赖， 避免部署失败同时顺带重启 DB 扩大爆炸半径
longsizhuo
force-pushed
the
fix/prod-deploy-env
branch
from
April 17, 2026 17:34
575ae6e to
a2b02e9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
生产两个叠加 bug，导致：
根因
Bug 1 — AUTH_URL 漏透传
`application.properties`：
```
justauth.type.github.redirect-uri=${AUTH_URL:http://localhost:3000}/api/auth/callback/github
```
`.env` 里有 `AUTH_URL=https://involutionhell.com\` 但 `docker-compose.yml` 的 `environment:` 块没显式把它透传给容器。`docker inspect` 当前运行容器查到 `AUTH_URL=http://localhost:3010\` 是老容器某次手工 `docker run -e` 留下的历史值。
Bug 2 — compose up 没 --force-recreate
```yaml
image: involutionhell-backend:latest
pull_policy: never
```
CI 的 `docker build -t involutionhell-backend:latest .` 把 `:latest` 指向新 sha，然后 `docker compose up -d --remove-orphans` —— compose 看 image 字段没变就不重建容器。
实测：
```
involutionhell-backend:latest → sha256:8ce20703ba01 (4/17 04:14 PR #10 后 ✅)
运行中容器绑定的 image → sha256:dc09d2bcb7ff (4/16 14:14 ❌ 老的)
```
修法
合并后验证（workflow 跑完自己做）
```
curl -I https://api.involutionhell.com/oauth/render/github | grep -i location
→ redirect_uri=https%3A%2F%2Finvolutionhell.com%2Fapi%2Fauth%2Fcallback%2Fgithub
curl https://api.involutionhell.com/api/events
→ {"success":true,"data":[{"title":"Mock Interview",...}]}
```
GitHub OAuth App 的 Authorization callback URLs 里必须有：
`https://involutionhell.com/api/auth/callback/github\`
没加的话合并完跳 GitHub 会直接报 `redirect_uri_mismatch`。