ci: use scoped SSH credentials for web version pushes

Jenkinsfile

@@ -148,6 +148,7 @@ print('versions.json updated: ${svcName}=${svcVer}')
 
     stage('Commit Version') {
       steps {
+        sshagent(credentials: ['jenkins-ssh-key']) {
           bat """
             chcp 65001 >nul
             git config user.email "jenkins@xuqm.com"
@@ -159,6 +160,7 @@ print('versions.json updated: ${svcName}=${svcVer}')
         }
       }
     }
+  }
 
   post {
     success { bat "chcp 65001 >nul && echo ✅ ${env.IMAGE_NAME}:${env.SERVICE_VERSION} 构建部署成功" }

Jenkinsfile.ops-web

@@ -110,6 +110,7 @@ print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
 
     stage('Commit Version') {
       steps {
+        sshagent(credentials: ['jenkins-ssh-key']) {
           script {
             bat """
               git config user.email "jenkins@xuqm.com"
@@ -122,6 +123,7 @@ print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
         }
       }
     }
+  }
 
   post {
     success { bat "chcp 65001 >nul && echo ✅ ${env.IMAGE_NAME}:${env.IMAGE_VERSION} 构建部署成功" }

Jenkinsfile.tenant-web

@@ -39,8 +39,8 @@ pipeline {
           branches: [[name: 'main']],
           extensions: [[$class: 'CleanBeforeCheckout']],
           userRemoteConfigs: [[
-            url: 'https://xuqinmin.com/xuqmGroup/XuqmGroup-Web.git',
+            url: 'ssh://git@xuqinmin.com:2222/xuqmGroup/XuqmGroup-Web.git',
-            credentialsId: 'XUQM_GIT_CREDENTIALS'
+            credentialsId: 'jenkins-ssh-key'
           ]]
         ])
       }
@@ -142,6 +142,7 @@ print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
     stage('Commit Version') {
       when { expression { params.DEPLOY_ENV == 'production' } }
       steps {
+        sshagent(credentials: ['jenkins-ssh-key']) {
           script {
             bat """
               git config user.email "jenkins@xuqm.com"
@@ -154,6 +155,7 @@ print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
         }
       }
     }
+  }
 
   post {
     success {

docs/SDK_PLATFORM_V2_HANDOFF.md

@@ -33,3 +33,11 @@ nginx -t -p "$PWD/" -c scripts/nginx-test.conf
 HTML 引用、版本目录、Nginx 缓存头及 Docker 上一版本保留门禁。
 
 Jenkins 和线上部署需由发布流程另行执行；本地构建不能代替生产响应头验收。
+# 2026-07-27 Jenkins SCM 凭据收口
+
+- tenant-web 显式 checkout 已改用 Gitea SSH URL 和 Jenkins
+  `jenkins-ssh-key`，不再引用未配置的 `XUQM_GIT_CREDENTIALS`；其它 Web 作业继续
+  复用各自 Jenkins SCM 配置。三套 Web 流水线的版本文件回写均使用
+  `sshagent(jenkins-ssh-key)`，避免 checkout 结束后 push 缺少凭据。
+- 该修改尚未通过下一次 Web Jenkins 构建验证；缓存策略提交部署前必须先确认
+  checkout 与三套前端构建均成功。