From b96bf9694c575ce3c4c60a2531bf9cae2424d23c Mon Sep 17 00:00:00 2001
From: randypanding <randypanding@users.noreply.github.com>
Date: Mon, 24 Aug 2026 12:21:00 +0800
Subject: [PATCH] =?UTF-8?q?fix(drift):=20org=20secret=20=E6=9C=9F=E6=9C=9B?=
 =?UTF-8?q?=E6=8D=A2=20LLM=5FAPI=5FKEY1=EF=BC=88=E6=97=A7=20key=20?=
 =?UTF-8?q?=E5=B7=B2=E9=9A=8F=E4=BE=9B=E5=BA=94=E5=95=86=E5=88=87=E6=8D=A2?=
 =?UTF-8?q?=E5=88=A0=E9=99=A4=EF=BC=89+=20=C2=A710=20archive=20=E6=AD=A3?=
 =?UTF-8?q?=E6=9C=AC=E6=8B=89=E5=8F=96=E5=8A=A0=E9=87=8D=E8=AF=95=E4=B8=8E?=
 =?UTF-8?q?=20contents=20API=20=E5=9B=9E=E9=80=80=EF=BC=88runner=20?=
 =?UTF-8?q?=E4=B8=8A=20raw=20=E7=9E=AC=E6=97=B6=E6=8B=92=E8=BF=9E=E5=AE=9E?=
 =?UTF-8?q?=E6=B5=8B=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 governance/drift-check.sh      | 10 ++++++++--
 governance/expected-state.json |  2 +-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/governance/drift-check.sh b/governance/drift-check.sh
index db1cfb2..352f6b1 100644
--- a/governance/drift-check.sh
+++ b/governance/drift-check.sh
@@ -324,8 +324,14 @@ adr_substantive() { # $1=四位编号 → stdout: missing|ok|shell|unreadable
     while IFS= read -r apath; do
       [[ -n "$apath" ]] || continue
       if [[ -n "${ADR_INDEX_MODE:-}" ]]; then
-        # 索引世界：archive raw 正本（公开仓，字节保真原件）；拉取失败留空→按不可判定处理
-        decoded=$(curl -sSf --max-time 20 "https://raw.githubusercontent.com/$ORG/archive/main/${apath}" 2>/dev/null || true)
+        # 索引世界：archive raw 正本（公开仓，字节保真原件）。raw 在 runner 上有
+        # 瞬时拒连抖动（2026-08-24 实测整批 unreadable）——重试 3 次后回退
+        # contents API（api.github.com 通道稳定），双通道皆失败才按不可判定处理。
+        decoded=$(curl -sSf --retry 3 --retry-delay 2 --max-time 20                     "https://raw.githubusercontent.com/$ORG/archive/main/${apath}" 2>/dev/null || true)
+        if [[ -z "$decoded" ]]; then
+          _c=$(api "https://api.github.com/repos/$ORG/archive/contents/${apath}" 2>/dev/null | jq -r '.content // empty' 2>/dev/null || true)
+          [[ -n "$_c" ]] && decoded=$(base64 -d <<<"$_c" 2>/dev/null || true)
+        fi
       else
         content=$(api "https://api.github.com/repos/$ORG/agent-registry/contents/$apath" | jq -r '.content // empty')
         [[ -z "$content" ]] && continue
diff --git a/governance/expected-state.json b/governance/expected-state.json
index 2bb32c0..a5a765c 100644
--- a/governance/expected-state.json
+++ b/governance/expected-state.json
@@ -101,7 +101,7 @@
     "CB_APP_ID",
     "AGENT_APP_SECRET",
     "GOVERNANCE_TOKEN",
-    "LLM_API_KEY"
+    "LLM_API_KEY1"
   ],
   "github_app": {
     "name": "cloudbrid-agent",