fix(ci): 绕过github action(git fetch Gitea本仓库)+HOME恢复Mac环境+local禁proxy

.gitea/workflows/ci-cd.yml

@@ -1,31 +1,41 @@
 name: CI/CD
-# 三机流水线：push master → Mac runner 单测 → NAS 冒烟(ssh) → [审批] → VPS 部署+冒烟(ssh)
-# Runner: 复用现有 online 的 mac-mini-arm64 (label: macos-arm64)，不另起 NAS runner。
-# Mac runner 作为编排节点，ssh 到 NAS/VPS 执行（~/.ssh/config 已配 sanguo-nas + 49.232.102.198）。
+# 三机流水线：push master → Mac runner 单测 → NAS 冒烟(ssh) → [prod gate] → VPS 部署+冒烟
+# Runner: 复用 online 的 mac-mini-arm64 (label: macos-arm64)，host executor 直接跑 Mac shell。
+# 关键：①不用 actions/checkout(避免从 github 拉 action 国内 EOF)，改 git fetch Gitea 本仓库
+#       ②env HOME=/Users/chufeng 恢复 Mac 全环境(ssh config/key + venv310)，act_runner 默认 HOME 是临时目录
+#       ③git config --local http.proxy "" 禁代理(LAN Gitea 直连，不动全局 .gitconfig)
 on:
   push:
     branches: [master]
-  workflow_dispatch: {}  # 允许 Gitea UI 手动触发(实测/重跑用)
+  workflow_dispatch: {}
 
 jobs:
   # ---------- P2: 验证 ----------
   test:
     runs-on: macos-arm64
+    env:
+      HOME: /Users/chufeng
     steps:
-      - name: 清除 git 代理 (LAN Gitea 不走 ClashX 127.0.0.1:7890)
+      - name: checkout (直连 Gitea, git fetch 绕过 github action)
+        env:
+          TOKEN: ${{ github.token }}
         run: |
-          git config --global --unset http.proxy 2>/dev/null || true
-          git config --global --unset https.proxy 2>/dev/null || true
-      - uses: actions/checkout@v4
-      - name: pytest (Mac venv310, fixture)
+          git init .
+          git config --local http.proxy ""
+          git config --local https.proxy ""
+          git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
+          git fetch --depth 1 origin "${GITHUB_SHA}"
+          git checkout FETCH_HEAD
+      - name: pytest (Mac venv310, fixture, 跑 checkout 代码)
         run: |
-          source ~/.openclaw/sanguo_projects/sanguo_vnpy_v2/venv310/bin/activate
-          pytest tests/ -q
-      # TODO 实测: actions/checkout 能否在 Mac 拉取(Mac 外网)；venv310 依赖是否覆盖 checkout 代码的 import
+          source /Users/chufeng/.openclaw/sanguo_projects/sanguo_vnpy_v2/venv310/bin/activate
+          PYTHONPATH="$GITHUB_WORKSPACE" pytest tests/ -q
 
   nas-smoke:
     needs: test
     runs-on: macos-arm64
+    env:
+      HOME: /Users/chufeng
     steps:
       - name: NAS 冒烟 (ssh NAS 跑容器读 quant_trading.db)
         run: |
@@ -33,21 +43,26 @@ jobs:
             /var/packages/Docker/target/usr/bin/docker run --rm \
             -v /volume1/stock:/volume1/stock -v $(pwd):/app \
             sanguo_vnpy_v2:with-sqlite python /app/scripts/smoke_e2e.py'
-      # TODO 实测: Mac runner job 用户能否 ssh sanguo-nas(ssh key/known_hosts)
 
-  # ---------- P3: VPS CD (带人工 gate) ----------
+  # ---------- P3: VPS CD (prod gate) ----------
   vps:
     needs: nas-smoke
     runs-on: macos-arm64
-    environment: prod  # 人工审批 gate；删除此行 = 验证通过全自动推 VPS
+    env:
+      HOME: /Users/chufeng
+    environment: prod  # 人工审批 gate；删此行 = 验证通过全自动推 VPS
     steps:
-      - name: 清除 git 代理 (LAN Gitea 不走 ClashX 127.0.0.1:7890)
+      - name: checkout
+        env:
+          TOKEN: ${{ github.token }}
         run: |
-          git config --global --unset http.proxy 2>/dev/null || true
-          git config --global --unset https.proxy 2>/dev/null || true
-      - uses: actions/checkout@v4
+          git init .
+          git config --local http.proxy ""
+          git config --local https.proxy ""
+          git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
+          git fetch --depth 1 origin "${GITHUB_SHA}"
+          git checkout FETCH_HEAD
       - name: promote 代码到 NAS+VPS
         run: bash scripts/nas_sync/promote.sh
       - name: VPS 冒烟 (LocalUnifiedProvider 真数据)
         run: ssh 49.232.102.198 'cd C:\sanguo_vnpy_v2 && C:\Python310\python.exe -X utf8 scripts/data_platform/verify_unified_e2e.py'
-      # TODO 实测: prod environment 审批在 Gitea UI(仓库 Settings → Environments → prod 加 reviewer)