From 26dbe8f1de224171483ddeb7eb303ce376164930 Mon Sep 17 00:00:00 2001
From: XuqmGroup <noreply@xuqm.com>
Date: Mon, 27 Jul 2026 12:58:29 +0800
Subject: [PATCH] ci: support Windows SSH credential binding

---
 Jenkinsfile | 21 ++++++++++++++-------
 README.md   |  5 +++++
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index bac130d..754bd23 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -220,13 +220,20 @@ print('versions.json updated, platformVersion=' + d.get('platformVersion', ''))
             git diff --cached --quiet || git commit -m "ci: bump versions [${summary}] [skip ci]"
           """
           // push 加 retry + rebase，应对多 job 并发推送冲突
-          sshagent(credentials: ['jenkins-ssh-key']) {
-            retry(3) {
-              bat """
-                chcp 65001 >nul
-                git pull --rebase origin main
-                git push origin HEAD:main
-              """
+          withCredentials([sshUserPrivateKey(credentialsId: 'jenkins-ssh-key', keyFileVariable: 'GIT_SSH_KEY')]) {
+            writeFile file: 'git-ssh.cmd', text: '@echo off\r\nssh -i "%GIT_SSH_KEY%" -o IdentitiesOnly=yes %*\r\n', encoding: 'UTF-8'
+            try {
+              withEnv(["GIT_SSH=${pwd()}\\git-ssh.cmd"]) {
+                retry(3) {
+                  bat """
+                    chcp 65001 >nul
+                    git pull --rebase origin main
+                    git push origin HEAD:main
+                  """
+                }
+              }
+            } finally {
+              bat 'if exist git-ssh.cmd del /f /q git-ssh.cmd'
             }
           }
         }
diff --git a/README.md b/README.md
index d0f91b7..bc88d17 100644
--- a/README.md
+++ b/README.md
@@ -541,3 +541,8 @@ update:
 tenant-service 与 update-service 必须由部署平台注入同一份非空
 `SDK_INTERNAL_TOKEN`。缺失或仍为历史占位值时，应用归属校验和发布清单签名会在请求前
 关闭；令牌不得写入仓库、构建日志或安装包。
+
+### Jenkins SSH
+
+Windows Jenkins 节点通过 `jenkins-ssh-key` 私钥凭据生成构建期临时
+`git-ssh.cmd` 执行版本拉取与推送，作用域结束后立即删除该脚本。