kb: expand authorized lab coverage and intel automation

scripts/sync-gitea.sh

@@ -7,15 +7,17 @@
 #   ./sync-gitea.sh --commit     # 仅提交
 #   ./sync-gitea.sh --push       # 仅推送
 
-set -e
+set -euo pipefail
 
 # 配置
 REPO_DIR="/Users/x/websafe"
 GITEA_URL="https://git.hk.hao.work"
-REPO_NAME="websafe-kb"
-GITEA_TOKEN="267bc2e8b189b8fb6daf56e41a9e5ad47d543968"
-GIT_USER="hao"
-GIT_EMAIL="hao@users.noreply.git.hk.hao.work"
+GITEA_API="${GITEA_URL}/api/v1"
+REPO_NAME="${REPO_NAME:-websafe-kb}"
+REPO_DESC="${REPO_DESC:-授权攻防实验与研究知识库}"
+GITEA_TOKEN="${GITEA_TOKEN:-}"
+GIT_USER="${GIT_USER:-hao}"
+GIT_EMAIL="${GIT_EMAIL:-hao@users.noreply.git.hk.hao.work}"
 
 cd "$REPO_DIR"
 
@@ -42,6 +44,39 @@ log_error() {
     echo -e "${RED}[ERROR]${END} $1"
 }
 
+repo_api_url() {
+    echo "${GITEA_API}/repos/${GIT_USER}/${REPO_NAME}"
+}
+
+repo_git_url() {
+    echo "${GITEA_URL}/${GIT_USER}/${REPO_NAME}.git"
+}
+
+ensure_remote_repo() {
+    if curl -fsS ${GITEA_TOKEN:+-H} ${GITEA_TOKEN:+"Authorization: token ${GITEA_TOKEN}"} "$(repo_api_url)" >/dev/null 2>&1; then
+        log_info "远程仓库已存在: ${GIT_USER}/${REPO_NAME}"
+        return 0
+    fi
+
+    if [ -z "$GITEA_TOKEN" ]; then
+        log_error "远程仓库不存在，且未提供 GITEA_TOKEN，无法自动创建"
+        return 1
+    fi
+
+    log_info "创建远程仓库: ${GIT_USER}/${REPO_NAME}"
+    local payload
+    payload=$(cat <<EOF
+{"name":"${REPO_NAME}","description":"${REPO_DESC}","private":false,"auto_init":false}
+EOF
+)
+    curl -fsS -X POST \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        -d "$payload" \
+        "${GITEA_API}/user/repos" >/dev/null
+    log_success "远程仓库创建完成"
+}
+
 # 初始化仓库
 init_repo() {
     log_info "初始化 Git 仓库..."
@@ -57,17 +92,24 @@ init_repo() {
     
     # 添加远程仓库
     if git remote | grep -q "origin"; then
-        git remote set-url origin "${GITEA_URL}/${GIT_USER}/${REPO_NAME}.git"
+        git remote set-url origin "$(repo_git_url)"
         log_info "远程仓库 URL 已更新"
     else
-        git remote add origin "${GITEA_URL}/${GIT_USER}/${REPO_NAME}.git"
+        git remote add origin "$(repo_git_url)"
         log_success "远程仓库已添加"
     fi
+
+    ensure_remote_repo
     
-    # 配置凭证
-    git config credential.helper store
-    echo "https://${GIT_USER}:${GITEA_TOKEN}@git.hk.hao.work" > ~/.git-credentials 2>/dev/null || true
-    chmod 600 ~/.git-credentials 2>/dev/null || true
+    # 凭证处理:
+    # 默认不在仓库脚本中写入真实凭证。
+    # 如需使用 token，请在运行时通过环境变量 GITEA_TOKEN 注入，
+    # 推送时通过临时 HTTP Header 使用，不写入仓库或全局凭证文件。
+    if [ -n "$GITEA_TOKEN" ]; then
+        log_info "检测到 GITEA_TOKEN 环境变量，将在推送时临时注入 HTTP Header"
+    else
+        log_warning "未提供 GITEA_TOKEN；推送时将使用本机已有认证方式"
+    fi
     
     log_success "初始化完成"
 }
@@ -111,8 +153,15 @@ push_changes() {
         branch="main"
     fi
     
+    ensure_remote_repo
+
     # 推送
-    if git push -u origin "$branch" 2>&1; then
+    if [ -n "$GITEA_TOKEN" ]; then
+        git -c http.extraHeader="Authorization: token ${GITEA_TOKEN}" push -u origin "$branch"
+    else
+        git push -u origin "$branch"
+    fi
+    if [ $? -eq 0 ]; then
         log_success "推送完成: $branch"
     else
         log_error "推送失败"
@@ -122,6 +171,7 @@ push_changes() {
 
 # 完整同步
 full_sync() {
+    init_repo
     commit_changes
     push_changes
 }
@@ -134,9 +184,17 @@ show_help() {
     echo "  --init      初始化 Git 仓库"
     echo "  --commit    仅提交更改"
     echo "  --push      仅推送到远程"
+    echo "  --ensure    检查远程仓库；不存在则创建"
     echo "  --status    显示仓库状态"
     echo "  --help      显示此帮助"
     echo ""
+    echo "环境变量:"
+    echo "  GITEA_TOKEN 可选；脚本不会自动写入 ~/.git-credentials"
+    echo "  GIT_USER    可选；默认 hao"
+    echo "  GIT_EMAIL   可选；默认 hao@users.noreply.git.hk.hao.work"
+    echo "  REPO_NAME   可选；默认 websafe-kb"
+    echo "  REPO_DESC   可选；默认 授权攻防实验与研究知识库"
+    echo ""
     echo "无参数运行时执行完整同步 (提交 + 推送)"
 }
 
@@ -164,6 +222,9 @@ case "${1:-}" in
     --push)
         push_changes
         ;;
+    --ensure)
+        init_repo
+        ;;
     --status)
         show_status
         ;;
@@ -173,4 +234,4 @@ case "${1:-}" in
     *)
         full_sync
         ;;
-esac
+esac