From 5bf2058f8be77fcbf403508a1a9741077dc2a5cb Mon Sep 17 00:00:00 2001
From: Codex <codex@localhost>
Date: Wed, 29 Apr 2026 14:50:21 +0800
Subject: [PATCH] Expose migration bootstrap secret for export job

---
 jenkins/Jenkinsfile.database-export | 4 ++++
 scripts/jenkins-deploy-release.sh   | 1 +
 2 files changed, 5 insertions(+)

diff --git a/jenkins/Jenkinsfile.database-export b/jenkins/Jenkinsfile.database-export
index 6f5830e3..e9f8a653 100644
--- a/jenkins/Jenkinsfile.database-export
+++ b/jenkins/Jenkinsfile.database-export
@@ -15,6 +15,7 @@ pipeline {
     string(name: 'DEPLOY_DIRECTORY', defaultValue: '/var/lib/jenkins/deploy/Genarrative', description: '固定部署目录，ROOT_DIR 为空时使用其 .spacetimedb')
     string(name: 'ROOT_DIR', defaultValue: '', description: 'spacetime CLI root-dir，可选，优先于 DEPLOY_DIRECTORY')
     string(name: 'INCLUDE_TABLES', defaultValue: '', description: '可选，逗号分隔的表名白名单')
+    string(name: 'BOOTSTRAP_SECRET', defaultValue: '', description: '可选，授权临时导出 identity 的迁移引导密钥')
     string(name: 'OUTPUT_DIRECTORY', defaultValue: 'database-exports', description: '导出文件目录，相对源码根目录或绝对路径')
     string(name: 'EXPORT_NAME', defaultValue: '', description: '导出文件名，留空则自动使用构建号')
   }
@@ -72,6 +73,9 @@ pipeline {
               if [[ -n "${params.INCLUDE_TABLES}" ]]; then
                 args+=(--include "${params.INCLUDE_TABLES}")
               fi
+              if [[ -n "${params.BOOTSTRAP_SECRET}" ]]; then
+                args+=(--bootstrap-secret "${params.BOOTSTRAP_SECRET}")
+              fi
               # 复用后端迁移 procedure 导出 JSON，避免 Jenkins 直接拼接表结构和 SQL。
               node "\${args[@]}"
               test -s "\${output_path}"
diff --git a/scripts/jenkins-deploy-release.sh b/scripts/jenkins-deploy-release.sh
index 9fdc7032..b4090107 100644
--- a/scripts/jenkins-deploy-release.sh
+++ b/scripts/jenkins-deploy-release.sh
@@ -112,6 +112,7 @@ DEPLOY_ITEMS=(
   ".env.local"
   "README.md"
   "api-server"
+  "migration-bootstrap-secret.txt"
   "spacetime_module.wasm"
   "start.sh"
   "stop.sh"