# 光湖 · Secrets验证+结果写入仓库
name: Secrets验证

on:
  push:
    paths:
      - '.gitea/workflows/verify-secrets.yaml'

jobs:
  verify:
    runs-on: ubuntu
    steps:
      - name: 检查并记录secrets状态
        env:
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
          QIANWEN_API_KEY: ${{ secrets.QIANWEN_API_KEY }}
          ZY_REPO_TOKEN: ${{ secrets.ZY_REPO_TOKEN }}
          COS_SECRET_ID: ${{ secrets.COS_SECRET_ID }}
          COS_SECRET_KEY: ${{ secrets.COS_SECRET_KEY }}
          SG_BRAIN_HOST: ${{ secrets.SG_BRAIN_HOST }}
          SG_BRAIN_USER: ${{ secrets.SG_BRAIN_USER }}
          SG_BRAIN_KEY: ${{ secrets.SG_BRAIN_KEY }}
        run: |
          RESULT_FILE="/data/guanghulab/.runtime/secrets-verify-result.json"
          mkdir -p /data/guanghulab/.runtime

          echo "{" > $RESULT_FILE
          echo "  \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"," >> $RESULT_FILE

          # 逐个检查
          for key in DEEPSEEK_API_KEY QIANWEN_API_KEY ZY_REPO_TOKEN COS_SECRET_ID COS_SECRET_KEY SG_BRAIN_HOST SG_BRAIN_USER SG_BRAIN_KEY; do
            eval val=\$$key
            if [ -z "$val" ]; then
              echo "  \"$key\": \"EMPTY\"," >> $RESULT_FILE
            else
              echo "  \"$key\": \"OK_LEN_${#val}\"," >> $RESULT_FILE
            fi
          done

          echo "  \"deepseek_test\": \"NOT_TESTED\"" >> $RESULT_FILE
          echo "}" >> $RESULT_FILE

          # 测试DeepSeek API
          if [ -n "$DEEPSEEK_API_KEY" ]; then
            RESP=$(curl -s -X POST https://api.deepseek.com/v1/chat/completions \
              -H "Content-Type: application/json" \
              -H "Authorization: Bearer $DEEPSEEK_API_KEY" \
              -d '{"model":"deepseek-chat","messages":[{"role":"user","content":"1+1=?"}],"max_tokens":10}' \
              --connect-timeout 10 2>/dev/null)
            if echo "$RESP" | grep -q '"choices"'; then
              sed -i 's/"deepseek_test": "NOT_TESTED"/"deepseek_test": "SUCCESS"/' $RESULT_FILE
            else
              sed -i 's/"deepseek_test": "NOT_TESTED"/"deepseek_test": "FAILED"/' $RESULT_FILE
            fi
          else
            sed -i 's/"deepseek_test": "NOT_TESTED"/"deepseek_test": "NO_KEY"/' $RESULT_FILE
          fi

          # 测试通义千问API
          if [ -n "$QIANWEN_API_KEY" ]; then
            RESP=$(curl -s -X POST https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions \
              -H "Content-Type: application/json" \
              -H "Authorization: Bearer $QIANWEN_API_KEY" \
              -d '{"model":"qwen-plus","messages":[{"role":"user","content":"1+1=?"}],"max_tokens":10}' \
              --connect-timeout 10 2>/dev/null)
            if echo "$RESP" | grep -q '"choices"'; then
              echo "  \"qianwen_test\": \"SUCCESS\"" >> /tmp/qwen_test
            else
              echo "  \"qianwen_test\": \"FAILED\"" >> /tmp/qwen_test
            fi
          fi

          cat $RESULT_FILE