diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 140f127..89d3885 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -1,58 +1,78 @@
-# 复制到 itfx 仓库: .github/workflows/deploy.yml
-# Secrets: TCR_USERNAME, TCR_PASSWORD, SSH_HOST(42), SSH_USERNAME, SSH_PASSWORD
+# 复制到 itfx: .github/workflows/deploy.yml
+#
+# Secrets: SSH_K3S_HOST / SSH_K3S_USERNAME / SSH_K3S_PASSWORD
+# 集群:
+#   GIT_TOKEN=... TCR_USERNAME=... TCR_PASSWORD=... ./scripts/16-setup-kaniko.sh
+#   ./scripts/17-test-github-access.sh   # 选 GIT_FETCH_MODE / KANIKO_NODE_ROLE
+#
+# 构建全程在集群 Pod 内完成（git + kaniko），Actions 只 SSH 触发并跟日志
+#
 name: Build and Deploy
 
 on:
   push:
     branches: [master]
+  workflow_dispatch:
 
 env:
-  TCR_REGISTRY: ccr.ccs.tencentyun.com
-  TCR_NAMESPACE: ideship
+  GIT_URL: https://github.com/xiaoliutral/itfx.git
+  DOCKERFILE: src/InterfaceForward.Api/Dockerfile
   IMAGE_NAME: interfaceforward_api
   DEPLOY_NAME: interfaceforward-api
   CONTAINER_NAME: interfaceforward-api
-  DOCKERFILE: src/InterfaceForward.Api/Dockerfile
+  TCR_REGISTRY: ccr.ccs.tencentyun.com
+  TCR_NAMESPACE: ideship
+  K3S_DIR: /data/k3s
+  KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+  NAMESPACE: prod
 
 jobs:
-  build-deploy:
+  deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Show image
+        id: info
+        run: |
+          TAG="${{ github.sha }}"
+          IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${TAG}"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "image=${IMG}" >> "$GITHUB_OUTPUT"
+          echo "Will build: ${IMG}"
 
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to TCR
-        uses: docker/login-action@v3
+      - name: Build image (Kaniko logs)
+        uses: appleboy/ssh-action@v1.2.0
         with:
-          registry: ${{ env.TCR_REGISTRY }}
-          username: ${{ secrets.TCR_USERNAME }}
-          password: ${{ secrets.TCR_PASSWORD }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ${{ env.DOCKERFILE }}
-          push: true
-          tags: |
-            ${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
-            ${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:latest
-          # 👇 关键：开启缓存，复用 Docker 各层
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          # 👇 配置镜像加速（国内必选）
-          build-args: |
-            BUILDKIT_DOCKER_REGISTRY_MIRROR=https://mirror.ccs.tencentyun.com
-
-      - name: Deploy to k3s
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.SSH_HOST }}
-          username: ${{ secrets.SSH_USERNAME }}
-          password: ${{ secrets.SSH_PASSWORD }}
+          host: ${{ secrets.SSH_K3S_HOST }}
+          username: ${{ secrets.SSH_K3S_USERNAME }}
+          password: ${{ secrets.SSH_K3S_PASSWORD }}
+          command_timeout: 50m
+          request_pty: true
+          script_stop: true
           script: |
-            export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
-            IMG="${{ env.TCR_REGISTRY }}/${{ env.TCR_NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"
-            kubectl -n prod set image deploy/${{ env.DEPLOY_NAME }} ${{ env.CONTAINER_NAME }}="$IMG"
-            kubectl -n prod rollout status deploy/${{ env.DEPLOY_NAME }} --timeout=180s
+            set -euxo pipefail
+            export KUBECONFIG=${{ env.KUBECONFIG }}
+            cd ${{ env.K3S_DIR }}
+            chmod +x scripts/ci-kaniko-build.sh
+            ./scripts/ci-kaniko-build.sh \
+              "${{ env.GIT_URL }}" \
+              "${{ env.DOCKERFILE }}" \
+              "${{ env.IMAGE_NAME }}" \
+              "${{ steps.info.outputs.tag }}" \
+              "${{ steps.info.outputs.tag }}"
+
+      - name: Deploy
+        uses: appleboy/ssh-action@v1.2.0
+        with:
+          host: ${{ secrets.SSH_K3S_HOST }}
+          username: ${{ secrets.SSH_K3S_USERNAME }}
+          password: ${{ secrets.SSH_K3S_PASSWORD }}
+          command_timeout: 5m
+          script_stop: true
+          script: |
+            set -euxo pipefail
+            export KUBECONFIG=${{ env.KUBECONFIG }}
+            IMG="${{ steps.info.outputs.image }}"
+            kubectl -n ${{ env.NAMESPACE }} set image deploy/${{ env.DEPLOY_NAME }} \
+              ${{ env.CONTAINER_NAME }}=${IMG}
+            kubectl -n ${{ env.NAMESPACE }} rollout status deploy/${{ env.DEPLOY_NAME }} --timeout=180s
+            kubectl -n ${{ env.NAMESPACE }} get pods -l app=${{ env.DEPLOY_NAME }} -o wide