feat: 增加了自动部署 CI

.cnb.yml

@@ -9,7 +9,7 @@ $:
       imports:
         - https://cnb.cool/maikebuke/Tools/Huggingface/AccessToken/-/blob/main/key.yml
       env: 
-        HF_SPACE_URL: "https://huggingface.co/spaces/ServiceX/Sublink"
+        HF_SPACE_URL: "https://huggingface.co/spaces/ServiceX/PDF"
       services:
         - vscode
         - docker
@@ -24,16 +24,34 @@ main:
       imports:
           - https://cnb.cool/maikebuke/Tools/Huggingface/AccessToken/-/blob/main/key.yml
       env: 
-        HF_SPACE_URL: "https://huggingface.co/spaces/ServiceX/Sublink"
+        HF_SPACE_URL: "https://huggingface.co/spaces/ServiceX/PDF"
+        HF_SPACE_SECRET_KEY: "BASIC_AUTH_USERS"
+        BASIC_AUTH_FILE: "basic_auth_users.txt"
+        HF_EXCLUDE_FILES: ".cnb.yml basic_auth_users.txt scripts"
       stages:
-        - name: Force Push To Huggingface Spaces
+        - name: Update HF Space Secret
           script: |
+            set -euo pipefail
+
+            HF_TOKEN="${HF_TOKEN_FULL}" uvx --from huggingface_hub hf auth whoami >/dev/null
+            HF_TOKEN_FULL="${HF_TOKEN_FULL}" \
+            HF_SPACE_URL="${HF_SPACE_URL}" \
+            HF_SPACE_SECRET_KEY="${HF_SPACE_SECRET_KEY}" \
+            BASIC_AUTH_FILE="${BASIC_AUTH_FILE}" \
+            uvx --from huggingface_hub python scripts/update_space_secret.py
+
+        - name: Push Git To Huggingface Spaces
+          script: |
+            set -euo pipefail
+
             # 从 HF_SPACE_URL 提取 owner/repo 路径用于构造带认证的 git remote
             HF_REPO_PATH=$(echo "$HF_SPACE_URL" | sed 's|https://huggingface.co/spaces/||')
             HF_REMOTE="https://user:${HF_TOKEN_FULL}@huggingface.co/spaces/${HF_REPO_PATH}"
 
-            # 删除 CI 文件，避免推送到目标仓库
-            rm -f .cnb.yml
+            # 删除不应同步到 Spaces 的文件（空格分隔）
+            for exclude in ${HF_EXCLUDE_FILES}; do
+              rm -rf "$exclude"
+            done
 
             git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
             git config user.name "github-actions[bot]"

.dockerignore

@@ -0,0 +1,5 @@
+# 避免把仓库元数据和敏感文件打进镜像
+.git
+.cnb.yml
+basic_auth_users.txt
+scripts/

README.md

@@ -32,6 +32,19 @@ bob:your_password_2
 - 空行和 `#` 开头行会被忽略
 - 容器启动时会把明文密码转换为 bcrypt 哈希，仓库不保存真实密码
 
+### CI 同步到 Spaces 的排除策略
+
+- 本仓库可本地维护密码文件：`basic_auth_users.txt`
+- CNB `push` 分两个阶段：
+  - 阶段 1：读取 `basic_auth_users.txt`，自动更新 Space Secret `BASIC_AUTH_USERS`
+  - 阶段 2：删除排除文件后，强制推送代码到 HuggingFace Spaces
+- 推送前会删除以下文件：
+  - `.cnb.yml`
+  - `basic_auth_users.txt`
+  - `scripts/`
+- 排除列表在 `.cnb.yml` 的 `HF_EXCLUDE_FILES` 中配置（空格分隔）
+- 密钥更新脚本：`scripts/update_space_secret.py`
+
 ### 健康检查
 
 `/healthz` 无需认证，返回 `200 ok`。

basic_auth_users.txt

@@ -0,0 +1,3 @@
+# 每行一个账号，格式：username:password
+alice:change_me_please
+bob:change_me_too

scripts/update_space_secret.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""Update Hugging Face Space secret from a local credential file."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from urllib.parse import urlparse
+
+from huggingface_hub import HfApi
+
+
+def _require_env(name: str) -> str:
+    value = os.environ.get(name, "").strip()
+    if not value:
+        raise SystemExit(f"[ERROR] Missing required environment variable: {name}")
+    return value
+
+
+def _parse_space_repo_id(space_url: str) -> str:
+    prefix = "https://huggingface.co/spaces/"
+    if space_url.startswith(prefix):
+        repo_id = space_url[len(prefix) :].strip("/")
+    else:
+        parsed = urlparse(space_url)
+        parts = [part for part in parsed.path.split("/") if part]
+        # 期望路径格式: /spaces/{owner}/{repo}
+        if len(parts) >= 3 and parts[0] == "spaces":
+            repo_id = f"{parts[1]}/{parts[2]}"
+        else:
+            raise SystemExit(f"[ERROR] Invalid HF_SPACE_URL: {space_url}")
+
+    if "/" not in repo_id:
+        raise SystemExit(f"[ERROR] Invalid Space repo id: {repo_id}")
+    return repo_id
+
+
+def main() -> None:
+    token = _require_env("HF_TOKEN_FULL")
+    space_url = _require_env("HF_SPACE_URL")
+    secret_key = os.environ.get("HF_SPACE_SECRET_KEY", "BASIC_AUTH_USERS").strip()
+    auth_file = os.environ.get("BASIC_AUTH_FILE", "basic_auth_users.txt").strip()
+
+    auth_path = Path(auth_file)
+    if not auth_path.is_file():
+        raise SystemExit(f"[ERROR] Auth file not found: {auth_file}")
+
+    secret_value = auth_path.read_text(encoding="utf-8").strip()
+    if not secret_value:
+        raise SystemExit(f"[ERROR] Auth file is empty: {auth_file}")
+
+    repo_id = _parse_space_repo_id(space_url)
+    HfApi(token=token).add_space_secret(repo_id=repo_id, key=secret_key, value=secret_value)
+    print(f"[INFO] Updated Space secret '{secret_key}' for '{repo_id}'.")
+
+
+if __name__ == "__main__":
+    main()