fix(deploy): 明确提示初始管理员密码

.github/workflows/test-deployment-public-url.yml

@@ -12,6 +12,7 @@ on:
       - 'scripts/test-public-api-base-url.sh'
       - 'scripts/init-server-http-bind-ip.sh'
       - 'scripts/test-server-http-bind-ip.sh'
+      - 'scripts/init-security-env.sh'
       - 'scripts/test-deployment-public-url.sh'
       - '.github/workflows/test-deployment-public-url.yml'
   pull_request:
@@ -25,6 +26,7 @@ on:
       - 'scripts/test-public-api-base-url.sh'
       - 'scripts/init-server-http-bind-ip.sh'
       - 'scripts/test-server-http-bind-ip.sh'
+      - 'scripts/init-security-env.sh'
       - 'scripts/test-deployment-public-url.sh'
       - '.github/workflows/test-deployment-public-url.yml'
   workflow_dispatch:
@@ -37,7 +39,7 @@ jobs:
 
       - name: Check shell syntax
         run: |
-          bash -n start.sh update.sh scripts/init-public-api-base-url.sh scripts/init-server-http-bind-ip.sh scripts/test-public-api-base-url.sh scripts/test-server-http-bind-ip.sh scripts/test-deployment-public-url.sh
+          bash -n start.sh update.sh scripts/init-security-env.sh scripts/init-public-api-base-url.sh scripts/init-server-http-bind-ip.sh scripts/test-public-api-base-url.sh scripts/test-server-http-bind-ip.sh scripts/test-deployment-public-url.sh
 
       - name: Test migration helper
         run: bash scripts/test-public-api-base-url.sh

.github/workflows/test-start-ps1.yml

@@ -36,7 +36,17 @@ jobs:
           DEPLOY_IP: "192.168.1.100"
         run: |
           (Get-Content .env.sample) -replace '^SERVER_HTTP_PORT=.*$', 'SERVER_HTTP_PORT=4100' | Set-Content .env.sample -Encoding UTF8
-          powershell -ExecutionPolicy Bypass -File .\start.ps1
+          $output = powershell -ExecutionPolicy Bypass -File .\start.ps1 2>&1 | Out-String
+          if ($LASTEXITCODE -ne 0) { Write-Host $output; exit $LASTEXITCODE }
+          $adminPassword = (Select-String -Path .env -Pattern '^CONFIG_INITIAL_ADMIN_PASSWORD=' | ForEach-Object { $_.Line.Substring('CONFIG_INITIAL_ADMIN_PASSWORD='.Length) })
+          if ([string]::IsNullOrWhiteSpace($adminPassword)) { throw 'Initial admin password was not generated' }
+          if (-not $output.Contains('登录账号: admin')) { throw 'Deployment output does not show the admin username' }
+          if (-not $output.Contains("登录密码: $adminPassword")) { throw 'Deployment output does not show the generated admin password' }
+          if (-not $output.Contains('初始密码没有独立过期时间')) { throw 'Deployment output does not explain the initial password lifetime' }
+          $existingOutput = powershell -ExecutionPolicy Bypass -File .\start.ps1 2>&1 | Out-String
+          if ($LASTEXITCODE -ne 0) { Write-Host $existingOutput; exit $LASTEXITCODE }
+          if (-not $existingOutput.Contains('本次部署不会生成或重置已有密码')) { throw 'Existing-env output does not explain password preservation' }
+          if ($existingOutput.Contains("登录密码: $adminPassword")) { throw 'Existing-env output must not report the env value as the current password' }
 
       - name: Verify .env
         run: |