From d3c0c872a63b308408b6254195451820975e534e Mon Sep 17 00:00:00 2001
From: XuqmGroup <noreply@xuqm.com>
Date: Mon, 27 Jul 2026 12:34:11 +0800
Subject: [PATCH] ci: use scoped SSH credentials for version push

---
 Jenkinsfile                    | 18 ++++++++++--------
 docs/IMPLEMENTATION_HANDOFF.md |  7 +++++++
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 64ceff3..8578258 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -188,14 +188,16 @@ pipeline {
         stage('Commit Version Bump') {
             when { expression { !params.SNAPSHOT } }
             steps {
-                script {
-                    bat """
-                        git config user.email "jenkins@xuqm.com"
-                        git config user.name "Jenkins CI"
-                        git add gradle.properties
-                        git diff --cached --quiet || git commit -m "ci: bump module versions [${env.PUBLISH_MODULES}]"
-                        git push origin HEAD:main
-                    """
+                sshagent(credentials: ['jenkins-ssh-key']) {
+                    script {
+                        bat """
+                            git config user.email "jenkins@xuqm.com"
+                            git config user.name "Jenkins CI"
+                            git add gradle.properties
+                            git diff --cached --quiet || git commit -m "ci: bump module versions [${env.PUBLISH_MODULES}]"
+                            git push origin HEAD:main
+                        """
+                    }
                 }
             }
         }
diff --git a/docs/IMPLEMENTATION_HANDOFF.md b/docs/IMPLEMENTATION_HANDOFF.md
index d0821c5..d7f1f9d 100644
--- a/docs/IMPLEMENTATION_HANDOFF.md
+++ b/docs/IMPLEMENTATION_HANDOFF.md
@@ -187,3 +187,10 @@ Sample 源码编译时只为静态验证跳过真实签发文件的存在性门
   `false/false`；Debug 为 `true/false`，显式开发测试仍受隐私和平台开关约束。
 - Release 未提供 `XUQM_BUILD_ID` 且启用 configuration cache 时按预期失败；提供显式
   buildId 后配置缓存可保存、复用，生成 Manifest 中的值保持不变。
+# 2026-07-27 Jenkins Git 认证收口
+
+- `sdk-android-publish` 的 Jenkins SCM 已改为 Gitea SSH URL 并绑定
+  `jenkins-ssh-key`；正式版本回写 `gradle.properties` 时也通过 `sshagent` 使用同一
+  凭据，不依赖 checkout 临时环境或 URL 内嵌令牌。
+- Jenkins 作业配置二次读取确认无内嵌凭据。该 Jenkinsfile 修改仍需在下一次实际
+  发布中验证版本回写阶段。