From 090e9fdf2521a8d1a0027914c7fa332faf7232ab Mon Sep 17 00:00:00 2001
From: root <root@DESKTOP-AN2DE37.localdomain>
Date: Tue, 1 Sep 2026 17:41:35 +0900
Subject: [PATCH] Run remote deployment script through bash

---
 .gitea/workflows/deploy-staging.yml | 76 ++++++++++++++++++++---------
 1 file changed, 53 insertions(+), 23 deletions(-)

diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml
index 0720683..8f97c01 100644
--- a/.gitea/workflows/deploy-staging.yml
+++ b/.gitea/workflows/deploy-staging.yml
@@ -136,32 +136,62 @@ jobs:
             --exclude='apps/docs/static' \
             -czf - . | ssh "${ssh_args[@]}" "$remote" "tar -xzf - -C $remote_app_dir"
 
-          remote_compose_file="$(shell_quote "docker/docker-compose.prod.yml")"
-          remote_port="$(shell_quote "$web_port")"
-          remote_console_url="$(shell_quote "$support_console_api_base_url")"
-          remote_sso_issuer="$(shell_quote "$sso_issuer")"
-          remote_sso_authorization_endpoint="$(shell_quote "$sso_authorization_endpoint")"
-          remote_sso_token_endpoint="$(shell_quote "$sso_token_endpoint")"
-          remote_sso_userinfo_endpoint="$(shell_quote "$sso_userinfo_endpoint")"
-          remote_sso_scope="$(shell_quote "$sso_scope")"
-          remote_sso_client_id="$(shell_quote "$sso_client_id")"
-          remote_sso_client_secret="$(shell_quote "$sso_client_secret")"
-          remote_jwt_secret="$(shell_quote "$jwt_secret")"
-          remote_support_tenant_id="$(shell_quote "$support_tenant_id")"
-          remote_command="set -eu
-          cd $remote_app_dir
-          WEB_PORT=$remote_port SUPPORT_CONSOLE_API_BASE_URL=$remote_console_url SSO_ISSUER=$remote_sso_issuer SSO_AUTHORIZATION_ENDPOINT=$remote_sso_authorization_endpoint SSO_TOKEN_ENDPOINT=$remote_sso_token_endpoint SSO_USERINFO_ENDPOINT=$remote_sso_userinfo_endpoint SSO_SCOPE=$remote_sso_scope SSO_CLIENT_ID=$remote_sso_client_id SSO_CLIENT_SECRET=$remote_sso_client_secret JWT_SECRET=$remote_jwt_secret SUPPORT_TENANT_ID=$remote_support_tenant_id docker compose -f $remote_compose_file config --quiet
-          WEB_PORT=$remote_port SUPPORT_CONSOLE_API_BASE_URL=$remote_console_url SSO_ISSUER=$remote_sso_issuer SSO_AUTHORIZATION_ENDPOINT=$remote_sso_authorization_endpoint SSO_TOKEN_ENDPOINT=$remote_sso_token_endpoint SSO_USERINFO_ENDPOINT=$remote_sso_userinfo_endpoint SSO_SCOPE=$remote_sso_scope SSO_CLIENT_ID=$remote_sso_client_id SSO_CLIENT_SECRET=$remote_sso_client_secret JWT_SECRET=$remote_jwt_secret SUPPORT_TENANT_ID=$remote_support_tenant_id docker compose -f $remote_compose_file up -d --build
-          for attempt in $(seq 1 60); do
-            if curl -fsS http://127.0.0.1:$web_port/api/health >/dev/null; then
-              docker compose -f $remote_compose_file ps
+          base64_value() {
+            printf '%s' "$1" | base64 -w 0
+          }
+
+          app_dir_b64="$(base64_value "$staging_app_dir")"
+          web_port_b64="$(base64_value "$web_port")"
+          console_url_b64="$(base64_value "$support_console_api_base_url")"
+          sso_issuer_b64="$(base64_value "$sso_issuer")"
+          sso_authorization_endpoint_b64="$(base64_value "$sso_authorization_endpoint")"
+          sso_token_endpoint_b64="$(base64_value "$sso_token_endpoint")"
+          sso_userinfo_endpoint_b64="$(base64_value "$sso_userinfo_endpoint")"
+          sso_scope_b64="$(base64_value "$sso_scope")"
+          sso_client_id_b64="$(base64_value "$sso_client_id")"
+          sso_client_secret_b64="$(base64_value "$sso_client_secret")"
+          jwt_secret_b64="$(base64_value "$jwt_secret")"
+          support_tenant_id_b64="$(base64_value "$support_tenant_id")"
+
+          # Run an explicit Bash script on the server. The server user's login
+          # shell may be zsh; sending one large command string through it makes
+          # nested quotes and loop syntax unreliable.
+          ssh "${ssh_args[@]}" "$remote" bash -s <<REMOTE_SCRIPT
+          set -eu
+
+          decode_value() {
+            printf '%s' "\$1" | base64 -d
+          }
+
+          staging_app_dir="\$(printf '%s' '$app_dir_b64' | base64 -d)"
+          web_port="\$(printf '%s' '$web_port_b64' | base64 -d)"
+          export WEB_PORT="\$web_port"
+          export SUPPORT_CONSOLE_API_BASE_URL="\$(printf '%s' '$console_url_b64' | base64 -d)"
+          export SSO_ISSUER="\$(printf '%s' '$sso_issuer_b64' | base64 -d)"
+          export SSO_AUTHORIZATION_ENDPOINT="\$(printf '%s' '$sso_authorization_endpoint_b64' | base64 -d)"
+          export SSO_TOKEN_ENDPOINT="\$(printf '%s' '$sso_token_endpoint_b64' | base64 -d)"
+          export SSO_USERINFO_ENDPOINT="\$(printf '%s' '$sso_userinfo_endpoint_b64' | base64 -d)"
+          export SSO_SCOPE="\$(printf '%s' '$sso_scope_b64' | base64 -d)"
+          export SSO_CLIENT_ID="\$(printf '%s' '$sso_client_id_b64' | base64 -d)"
+          export SSO_CLIENT_SECRET="\$(printf '%s' '$sso_client_secret_b64' | base64 -d)"
+          export JWT_SECRET="\$(printf '%s' '$jwt_secret_b64' | base64 -d)"
+          export SUPPORT_TENANT_ID="\$(printf '%s' '$support_tenant_id_b64' | base64 -d)"
+
+          cd "\$staging_app_dir"
+          compose_file='docker/docker-compose.prod.yml'
+          docker compose -f "\$compose_file" config --quiet
+          docker compose -f "\$compose_file" up -d --build
+
+          for attempt in \$(seq 1 60); do
+            if curl -fsS "http://127.0.0.1:\$web_port/api/health" >/dev/null; then
+              docker compose -f "\$compose_file" ps
               echo 'Feedback demo deployment and health check passed.'
               exit 0
             fi
             sleep 2
           done
-          docker compose -f $remote_compose_file ps
-          docker compose -f $remote_compose_file logs --tail=100 web
-          exit 1"
 
-          ssh "${ssh_args[@]}" "$remote" "$remote_command"
+          docker compose -f "\$compose_file" ps
+          docker compose -f "\$compose_file" logs --tail=100 web
+          exit 1
+          REMOTE_SCRIPT