From c61c8292aa0588d0be5e06abfa760f7e5555df0a Mon Sep 17 00:00:00 2001
From: voson <voson.wang.s@aliyun.com>
Date: Wed, 18 Mar 2026 15:50:10 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20CI=20=E6=97=A0=20DB=20=E4=B8=8B=20clippy?=
 =?UTF-8?q?=20=E9=80=9A=E8=BF=87=20+=20=E5=A4=B1=E8=B4=A5=E6=97=B6?=
 =?UTF-8?q?=E4=B9=9F=E5=8F=91=E9=A3=9E=E4=B9=A6=E9=80=9A=E7=9F=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- update.rs: sqlx::query! 改为 query/query_as，不依赖编译期 DB
- workflow: build job 加 always() 且 check.result==success，失败时 notify 能执行

Made-with: Cursor
---
 .gitea/workflows/secrets.yml |  6 +++---
 src/commands/update.rs       | 29 +++++++++++++++++++----------
 2 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/.gitea/workflows/secrets.yml b/.gitea/workflows/secrets.yml
index 149b204..1d79698 100644
--- a/.gitea/workflows/secrets.yml
+++ b/.gitea/workflows/secrets.yml
@@ -228,7 +228,7 @@ jobs:
   build-linux:
     name: Build (x86_64-unknown-linux-musl)
     needs: [version, probe-runners, check]
-    if: needs.probe-runners.outputs.has_linux == 'true'
+    if: always() && needs.check.result == 'success' && needs.probe-runners.outputs.has_linux == 'true'
     runs-on: debian
     timeout-minutes: 1
     steps:
@@ -277,7 +277,7 @@ jobs:
   build-macos:
     name: Build (aarch64-apple-darwin)
     needs: [version, probe-runners, check]
-    if: needs.probe-runners.outputs.has_macos == 'true'
+    if: always() && needs.check.result == 'success' && needs.probe-runners.outputs.has_macos == 'true'
     runs-on: darwin-arm64
     timeout-minutes: 1
     steps:
@@ -324,7 +324,7 @@ jobs:
   build-windows:
     name: Build (x86_64-pc-windows-msvc)
     needs: [version, probe-runners, check]
-    if: needs.probe-runners.outputs.has_windows == 'true'
+    if: always() && needs.check.result == 'success' && needs.probe-runners.outputs.has_windows == 'true'
     runs-on: windows
     timeout-minutes: 1
     steps:
diff --git a/src/commands/update.rs b/src/commands/update.rs
index e55d8f1..94c02d6 100644
--- a/src/commands/update.rs
+++ b/src/commands/update.rs
@@ -1,9 +1,18 @@
 use anyhow::Result;
 use serde_json::{Map, Value};
-use sqlx::PgPool;
+use sqlx::{FromRow, PgPool};
+use uuid::Uuid;
 
 use super::add::parse_kv;
 
+#[derive(FromRow)]
+struct UpdateRow {
+    id: Uuid,
+    tags: Vec<String>,
+    metadata: Value,
+    encrypted: Value,
+}
+
 pub struct UpdateArgs<'a> {
     pub namespace: &'a str,
     pub kind: &'a str,
@@ -17,16 +26,16 @@ pub struct UpdateArgs<'a> {
 }
 
 pub async fn run(pool: &PgPool, args: UpdateArgs<'_>) -> Result<()> {
-    let row = sqlx::query!(
+    let row: Option<UpdateRow> = sqlx::query_as(
         r#"
         SELECT id, tags, metadata, encrypted
         FROM secrets
         WHERE namespace = $1 AND kind = $2 AND name = $3
         "#,
-        args.namespace,
-        args.kind,
-        args.name,
     )
+    .bind(args.namespace)
+    .bind(args.kind)
+    .bind(args.name)
     .fetch_optional(pool)
     .await?;
 
@@ -76,17 +85,17 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>) -> Result<()> {
     }
     let encrypted = Value::Object(enc_map);
 
-    sqlx::query!(
+    sqlx::query(
         r#"
         UPDATE secrets
         SET tags = $1, metadata = $2, encrypted = $3, updated_at = NOW()
         WHERE id = $4
         "#,
-        &tags,
-        metadata,
-        encrypted,
-        row.id,
     )
+    .bind(&tags)
+    .bind(metadata)
+    .bind(encrypted)
+    .bind(row.id)
     .execute(pool)
     .await?;