diff --git a/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.i18n.yaml index 2ce9443416..4d52ae67d8 100644 --- a/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.i18n.yaml @@ -18,11 +18,11 @@ en: ce28268021a38b89 zh: 7802540e4ef04752 /agent-note-the-slot-system-standard-single-register-four-props-shares-and-the-framework-store-seat/decision/component-props-four-shares-each-from-its-own-source-of-truth: - en: f3fca569fa0c5168 - zh: 647a82662f6a887d + en: c1892cb7309c0824 + zh: 21983594d0c7f24f /agent-note-the-slot-system-standard-single-register-four-props-shares-and-the-framework-store-seat/decision/the-chain-kind-entries-self-nominate-first-match-renders: - en: 56278be7f3688805 - zh: 16602ffbf4baef85 + en: dad15e2e1309c9a4 + zh: ee2d13b27c92a73b /agent-note-the-slot-system-standard-single-register-four-props-shares-and-the-framework-store-seat/decision/the-store-seat-framework-engine-registrant-schema: en: 2645acc9d29c20ec zh: a8a2fd293ef5da04 diff --git a/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.md b/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.md index b08c0f4be8..2a2cee6b84 100644 --- a/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.md +++ b/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.md @@ -50,12 +50,13 @@ A contributor whose activation order is independent from the declaring entry use | child render | `PropsRenderSlots` | register's `children` keys | `renderSlot(key, owner)`, key statically narrowed to S; chain keys add `renderSlotChain` | | store | `PropsStore` | store factory return type | `useStore` selector hook + `actions.*` (draft-param stripped) | | business | `I` | inject return type | plain data + callbacks; a reserved `hooks` compartment of bare observables arrives bound as `use` selector hooks (`InjectFace`) | +| kind-specific | `MatchedShare` / `HocShare` | SlotMap entry's kind | chain `matched`; hoc `children`, the next inner layer or the owner content | `sessionId` is framework-supplied wherever `scope: 'session'` is declared — owner params do not carry it. The register call site is the double-lock choke point: a component whose renderSlot keys exceed the `children` declaration, or that misses a declared face, or whose store/inject shapes drift, is a compile error on that line. Delegation is ordinary props passing (hand the `renderSlot` function down, optionally behind a narrower signature) — there is no whitelist face object and no minting API. ### The chain kind: entries self-nominate, first match renders -The fourth `SlotKind`, `'chain'`, inverts routing authority relative to `keyed`: a keyed dispatch site picks its occupant by `entryKey`, while a chain entry nominates itself — the owner dispatches one common currency of owner props and never learns who takes over, so a new takeover package registers with zero owner edits. A chain registration carries a `select` pure selector (`ChainSelect`: `(owner) => matched | null`) and an optional `priority` (ascending; ties keep registration = assembly order — the deployment-controllable inject topology — under the same stable sort as list `order`); registering without `select` is one of the loud-at-load cases above. At render, the outlet runs the selectors in chain order: the first non-null return elects its entry and the returned value joins the component's props as `matched` (the component never re-derives its own match), `null` passes the turn to the next entry, and all-null renders the owner's fallback body (`ChainRenderOpts`). +A fifth kind, `'hoc'`, nests entries around owner-supplied `children` and adds a kind-specific `children` prop the same way `chain` adds `matched`; its decision lives in the [hoc slot kind note](2026-11-03-hoc-slot-kind.md). The fourth `SlotKind`, `'chain'`, inverts routing authority relative to `keyed`: a keyed dispatch site picks its occupant by `entryKey`, while a chain entry nominates itself — the owner dispatches one common currency of owner props and never learns who takes over, so a new takeover package registers with zero owner edits. A chain registration carries a `select` pure selector (`ChainSelect`: `(owner) => matched | null`) and an optional `priority` (ascending; ties keep registration = assembly order — the deployment-controllable inject topology — under the same stable sort as list `order`); registering without `select` is one of the loud-at-load cases above. At render, the outlet runs the selectors in chain order: the first non-null return elects its entry and the returned value joins the component's props as `matched` (the component never re-derives its own match), `null` passes the turn to the next entry, and all-null renders the owner's fallback body (`ChainRenderOpts`). The decline decision lives in `select`, never in a mounted component probing its own props: a component that mounts only to render null still runs its hooks and effects for nothing, and the resulting mount/unmount churn breaks memoization and React key semantics, whereas a selector is a pure function — unit-testable, zero mount side effects — the same discipline as "presentation methods are pure functions of `args`". Purity is the selector's contract: it reads no external mutable state and produces no side effects, so the routing decision is entirely a function of the owner props and safe to run on every dispatch. Selectors route; they never mint — per-dispatch object construction would churn identity every render, so wrapping a matched value in a richer face happens inside the elected component (`useMemo` keyed on `matched`). diff --git a/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.zh.md b/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.zh.md index d36cce53b7..a144d51683 100644 --- a/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.zh.md +++ b/.agents/notes/implemented/architecture/2026-07-22-slot-type-chain-implementation.zh.md @@ -50,12 +50,13 @@ ctx.slots.register({ | 子 slot 渲染 | `PropsRenderSlots` | register 的 `children` 键集 | `renderSlot(key, owner)`，键参静态收窄到 S；chain 键另有 `renderSlotChain` | | store | `PropsStore` | store 工厂的返回类型 | `useStore` selector 钩子 + `actions.*`（剥去 draft 形参） | | 业务 | `I` | inject 的返回类型 | 普通数据+回调；保留的 `hooks` 区域内，裸 observable 经绑定后以 `use` 选择器钩子的形式到达（`InjectFace`） | +| 按 kind | `MatchedShare` / `HocShare` | SlotMap entry 的 kind | chain 的 `matched`；hoc 的 `children`，即内一层或宿主内容 | 凡声明 `scope: 'session'` 之处，`sessionId` 一律由框架供给——owner 传参不携带它。register 调用点是双重类型约束的收口：组件的 renderSlot 键集超出 `children` 声明、漏接某个已声明的面、store/inject 形状漂移，任何一条都在那一行上报编译错误。转授就是普通的 props 传递（把 `renderSlot` 函数递下去，可按需包一层更窄的签名）——不存在白名单面对象，也不存在铸面 API。 ### chain kind：entry 自荐，首个匹配项负责渲染 -第四种 `SlotKind`——`'chain'`——把路由权相对 `keyed` 反转：keyed 的分派现场以 `entryKey` 点选占用 slot 的 entry，chain 则由 entry 自荐——owner 只分派一套格式统一的 owner props，永远不知道谁来接管，新的接管包注册进来 owner 零改动。chain 注册携带一个 `select` 纯选择器（`ChainSelect`：`(owner) => matched | null`）与可选的 `priority`（升序；同值保持注册序 = 装配序——部署可控的 inject 拓扑——复用 list `order` 的同一稳定排序）；注册缺 `select` 即上文装载即炸情形之一。渲染时 outlet 按链序依次执行各 select：首个非 null 返回值当选，该值以 `matched` 并入组件 props（组件绝不自行重新推导匹配）；返回 `null` 则轮到下一个 entry；全 null 则渲染 owner 的 fallback 体（`ChainRenderOpts`）。 +第五种 kind `'hoc'` 把 entry 层层嵌套在 owner 提供的 `children` 外面，并像 `chain` 提供 `matched` 那样提供按 kind 的 `children` prop；其决策见 [hoc 插槽类型 Note](2026-11-03-hoc-slot-kind.zh.md)。第四种 `SlotKind`——`'chain'`——把路由权相对 `keyed` 反转：keyed 的分派现场以 `entryKey` 点选占用 slot 的 entry，chain 则由 entry 自荐——owner 只分派一套格式统一的 owner props，永远不知道谁来接管，新的接管包注册进来 owner 零改动。chain 注册携带一个 `select` 纯选择器（`ChainSelect`：`(owner) => matched | null`）与可选的 `priority`（升序；同值保持注册序 = 装配序——部署可控的 inject 拓扑——复用 list `order` 的同一稳定排序）；注册缺 `select` 即上文装载即炸情形之一。渲染时 outlet 按链序依次执行各 select：首个非 null 返回值当选，该值以 `matched` 并入组件 props（组件绝不自行重新推导匹配）；返回 `null` 则轮到下一个 entry；全 null 则渲染 owner 的 fallback 体（`ChainRenderOpts`）。 「不接」的判定住在 `select` 里，绝不在挂载后的组件里自探 props：组件为了渲染 null 也得先挂载，其钩子与 effect 全部白跑，随之而来的挂载/卸载抖动还会破坏 memo 化与 React key 语义；而选择器是纯函数——可单测、零挂载副作用——与「presentation methods are pure functions of `args`」是同一条纪律。纯，就是选择器的约定：不读外部可变状态、不产副作用，路由判定因此完全是 owner props 的函数，每次分派都可安全执行。选择器只做路由，绝不创建新对象——按分派逐次构造对象会让引用每次渲染都换新；把匹配值包成更丰富的面这件事，发生在当选组件内部（以 `matched` 为依赖的 `useMemo`）。 diff --git a/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.i18n.yaml b/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.i18n.yaml new file mode 100644 index 0000000000..8826b372a2 --- /dev/null +++ b/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.i18n.yaml @@ -0,0 +1,25 @@ +# Bilingual-pair consistency record for 2026-11-03-hoc-slot-kind.md (docs/i18n/README.md): per heading +# section, a hash of its English and Chinese blocks outside code blocks and generated regions. +# After editing either side, bring the other along and re-record with: +# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.md +/agent-note-add-the-hoc-slot-kind-so-plugins-can-wrap-owner-content-in-layers: + en: 8292b8f9884b8802 + zh: 3a4f34ca79313c9d +/agent-note-add-the-hoc-slot-kind-so-plugins-can-wrap-owner-content-in-layers/problem: + en: d16c3bfef49e16be + zh: 6714da1c9c984fe9 +/agent-note-add-the-hoc-slot-kind-so-plugins-can-wrap-owner-content-in-layers/decision: + en: 3a4380324cfc1679 + zh: 44db368e091cbd46 +/agent-note-add-the-hoc-slot-kind-so-plugins-can-wrap-owner-content-in-layers/decision/implementation: + en: 01189e457c91deeb + zh: 94f7e8865b332a07 +/agent-note-add-the-hoc-slot-kind-so-plugins-can-wrap-owner-content-in-layers/decision/first-consumer: + en: 1afdf4ceeef7a3b3 + zh: be01cf39850db0ca +/agent-note-add-the-hoc-slot-kind-so-plugins-can-wrap-owner-content-in-layers/alternatives-considered: + en: b4824619c502b422 + zh: 610364f2dc8cb2b7 +/agent-note-add-the-hoc-slot-kind-so-plugins-can-wrap-owner-content-in-layers/consequences: + en: 7542ee2bc2c70258 + zh: bc0dd1dc6e50de66 diff --git a/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.md b/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.md new file mode 100644 index 0000000000..ccfb0d11f9 --- /dev/null +++ b/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.md @@ -0,0 +1,72 @@ +# Agent Note: Add the `hoc` slot kind so plugins can wrap owner content in layers + +Status: implemented + +English | [中文](2026-11-03-hoc-slot-kind.zh.md) + +## Problem + +The home whale plays when blank space is clicked. Its canvas must paint below the content, and `.scrollBody` fills the whole body, so the canvas itself never receives clicks; only an ancestor of the content does. + +No existing slot kind lets a plugin become an ancestor of the content: + +| Kind | Behavior | Why it is not enough | +|---|---|---| +| `single` / `list` / `keyed` | Render the occupant at an owner-chosen position | The occupant is a sibling of the content | +| `chain` | The elected entry replaces the fallback; with `overlay` it renders beside the fallback | It does not wrap | +| Factory local slot | The caller replaces a local Component per occurrence | Only the caller chooses; plugins cannot stack | + +The previous approach had the Conversation classify blank clicks on its body and notify the background plugin through `onBlankClick(listener) => dispose`. The Conversation thereby maintained click classification and subscription forwarding that served only a decorative plugin. + +## Decision + +Add a fifth kind: `hoc`. + +| Item | Contract | +|---|---| +| Declaration | The parent entry's `children` lists `{ kind: 'hoc', scope }`; `SlotMap` declares `kind: 'hoc'` | +| Rendering | `renderSlot(key, owner, { children })`; `entryKey` / `only` / `fallback` / `hookContext` are unavailable; omitted `children` renders the layers around nothing | +| Registration | Same as `list`: required `id`, optional `order` and `priority`; the same `id` at the same `priority` throws, a different `priority` shadows | +| Nesting order | Ascending `order`, then `priority`, then registration order; lowest outermost | +| Layer props | Every layer receives the same owner props plus the framework-supplied `children` (the next inner layer; the innermost is the owner content); `children` is not an owner prop, `HocShare` types it, and owner props must not use that name | +| Layer obligation | Render `children` exactly once without creating a box of its own; do not change the props passed inward | +| No entry | `children` renders unchanged | +| Layer crash | Each layer has its own error boundary; a crashed layer renders its `children` and abdicates, so the next render omits it | +| Content error | An error thrown by the wrapped content passes every layer as its original error and is reported against no layer | +| Remounting | Adding or removing a layer remounts the content inside it; a `session` or `session-maybe` layer also remounts it when its Session binding changes | + +### Implementation + +| Package | Realization | +|---|---| +| `ui-slots` | `SlotKind` includes `'hoc'`; `HocRenderOpts`, `HocKeysOf`, `HocShare`; `RenderSlotFn` has a hoc-key overload taking optional `{ children }`; `KindOptions` has a hoc branch; `SlotCore.register` / `entriesOfSlot` key hoc cells by `id` | +| `ui-renderer` | `HocOutlet` calls `composeHocLayers` when the slot's ledger version or declaration changes (`useMemo` on the outlet instance) and nests the layers into one render function. Each layer is one Component that fixes its scope-specific Entry (`StrictSessionEntry` / `SessionMaybeEntry` / `RootEntry`), entry, slot inject, and crash reporting at composition, and receives only `owner` and the next inner layer when rendering. With no layer the outlet returns the owner content directly. `HocContentBoundary` wraps each layer's inner content and rethrows its errors as `HocContentError`, which layer boundaries pass through and `HocOutletBoundary` unwraps to the original error. The Entry chain passes `children` to the registered Component as JSX children; non-hoc entries receive `undefined`. `SlotErrorBoundary` takes a `crashed` replacement node | +| `scripts/gen-client-catalog.ts` | Register options, a `children`-rendering example, and the `wraps-owner-content` replace risk for hoc slots | + +### First consumer + +| Location | Realization | +|---|---| +| `ui-conversation` | `conversation.hero.frame` (hoc, root) with owner props `{ hero: boolean }` wraps `.scrollBody` in every phase, so the composer does not remount when the home ends. On the home (`.root[data-phase='hero']`), the Conversation root, which paints the background, sets `isolation: isolate` as part of the frame contract, so layer decorations at negative `z-index` paint above that background and below all Conversation content. The Conversation performs no click classification for its layers | +| `ui-brand-official` | `PixelWhale` is a frame layer: a React `onClick` on a `display: contents` frame plays the whale for primary clicks on blank space, excluding portaled overlays (`currentTarget.contains(target)`), controls (a selector), and clicks that end a text selection inside the frame. While `hero` is true it paints a canvas at negative `z-index`. The frame atlas loads through the package asset route; the renderer returns `{ play, dispose }` | + +## Alternatives considered + +- `onBlankClick` subscription forwarding: the Conversation owns click classification that serves only a decorative plugin. +- Canvas below with `pointer-events: none` on `.scrollBody`: blank space cannot scroll when the home overflows. +- A canvas with no `z-index`: it needs no stacking context, but it paints over every unpositioned Conversation content outside the `z-index: 1` home composer stack, such as composer takeovers, and depends on that unrelated rule. +- A layer box that establishes the stacking context itself: the layer has to mirror the body's flex column layout. +- A separate `renderNestedSlot` or a JSX `` component: one more set of bindings; `hookContext` already shows that `renderSlot` can constrain its third argument per key. +- Precompiling every slot kind per ledger version: no measurable end-to-end time difference, see #7838. + +## Consequences + +- Adding or removing a layer remounts everything inside it, including the composer on the home. +- Every non-hoc registered Component receives `children: undefined`, which overrides any owner prop of that name. +- Each layer adds one Component and two error boundaries to the tree; each hoc slot with layers adds one outlet boundary. +- The outlet's `[data-slot]` element sits between the owner and its content, so owner selectors cannot assume the content is a direct child. +- React 18 recollects the component stack where an error is rethrown, so a content error reaching boundaries above a hoc slot with layers carries a component stack that starts at `HocOutletBoundary`. +- A layer that wraps its `children` in its own error boundary catches the internal `HocContentError` rather than the original content error. +- The frame contract holds only on the home: other phases leave the Conversation root out of the stacking order, so unportaled Conversation popovers still rise above AppFrame chrome that floats over the column, while on the home they stack only within the root. +- `HocOutlet` keeps its layer Components through `useMemo`, as Factory local Components keep theirs; if React ever discards memoized values, both need an explicit cache, because these Components are the remount boundary of the content inside them. +- [The slot system standard](2026-07-22-slot-type-chain-implementation.md) remains authoritative for the other kinds; this note adds the fifth. diff --git a/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.zh.md b/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.zh.md new file mode 100644 index 0000000000..f09a37fede --- /dev/null +++ b/.agents/notes/implemented/architecture/2026-11-03-hoc-slot-kind.zh.md @@ -0,0 +1,72 @@ +# Agent Note: 新增 `hoc` 插槽类型，让插件层层包裹宿主内容 + +Status: implemented + +[English](2026-11-03-hoc-slot-kind.md) | 中文 + +## 问题 + +首页鲸鱼需要在空白处被点击时播放。canvas 必须画在内容下面，`.scrollBody` 铺满整个 body，所以 canvas 自己收不到点击；能收到点击的只有内容的祖先节点。 + +现有插槽类型都不能让插件成为内容的祖先： + +| 类型 | 行为 | 为什么不够 | +|---|---|---| +| `single` / `list` / `keyed` | 在宿主指定位置渲染 occupant | occupant 和内容是兄弟节点 | +| `chain` | 选中的 entry 替换 fallback；`overlay` 时与 fallback 并排 | 不包裹 | +| Factory 局部 slot | 调用方按次替换局部组件 | 只有调用方能选，插件无法叠加 | + +此前的做法是由 Conversation 在 body 上判定空白点击，再通过 `onBlankClick(listener) => dispose` 通知背景插件。这让 Conversation 维护一套只服务于装饰插件的点击分类和订阅转发。 + +## Decision + +新增第五种 kind：`hoc`。 + +| 项 | 约定 | +|---|---| +| 声明 | 父 entry 的 `children` 写 `{ kind: 'hoc', scope }`；`SlotMap` 中 `kind: 'hoc'` | +| 渲染 | `renderSlot(key, owner, { children })`；`entryKey` / `only` / `fallback` / `hookContext` 不可用；省略 `children` 时各层包裹空内容 | +| 注册 | 与 `list` 相同：必填 `id`，可选 `order`、`priority`；同 `id` 同 `priority` 抛错，不同 `priority` 遮蔽 | +| 嵌套顺序 | 依次按 `order`、`priority`、注册顺序升序，最小者在最外层 | +| 层的 props | 每层收到同一份 owner props，加上框架注入的 `children`（内一层，最内层是宿主内容）；`children` 不属于 owner props，类型由 `HocShare` 提供，owner props 不得使用这个名字 | +| 层的义务 | 恰好渲染一次 `children`，自身不产生盒子；不能修改传给内层的 props | +| 无 entry | 原样渲染 `children` | +| 层崩溃 | 每层有独立 error boundary；崩溃时该层渲染自己的 `children` 并 abdicate，下一次渲染不再包含该层 | +| 内容出错 | 被包裹内容抛出的错误以原始错误穿过所有层，不记到任何层名下 | +| 重新挂载 | 增减一层会让其内部内容重新挂载；`session` 或 `session-maybe` 作用域的层在 Session binding 变化时也会让内部内容重新挂载 | + +### 实现 + +| 包 | 实现 | +|---|---| +| `ui-slots` | `SlotKind` 包含 `'hoc'`；`HocRenderOpts`、`HocKeysOf`、`HocShare`；`RenderSlotFn` 为 hoc key 提供接受可选 `{ children }` 的重载；`KindOptions` 有 hoc 分支；`SlotCore.register` / `entriesOfSlot` 按 `id` 划分 hoc cell | +| `ui-renderer` | `HocOutlet` 在插槽 ledger 版本或声明变化时调用 `composeHocLayers`（`useMemo` 缓存在 outlet 实例上），把各层组合成一个嵌套渲染函数。每层是一个组件，在组合时固定按 scope 选定的 Entry（`StrictSessionEntry` / `SessionMaybeEntry` / `RootEntry`）、entry、slot inject 与崩溃上报，渲染时只接收 `owner` 与内一层。没有层时 outlet 直接返回宿主内容。`HocContentBoundary` 包住每层的内层内容，把其中的错误包装为 `HocContentError` 重新抛出；层的边界放行这种错误，`HocOutletBoundary` 再解开为原始错误。Entry 链以 JSX children 把 `children` 交给注册组件；非 hoc entry 收到 `undefined`。`SlotErrorBoundary` 接受 `crashed` 替换节点 | +| `scripts/gen-client-catalog.ts` | hoc 插槽的注册选项、渲染 `children` 的示例，以及 `wraps-owner-content` 替换风险 | + +### 首个使用者 + +| 位置 | 实现 | +|---|---| +| `ui-conversation` | `conversation.hero.frame`（hoc，root），owner props 为 `{ hero: boolean }`，在所有阶段包裹 `.scrollBody`，首页结束时输入框不重新挂载。首页阶段（`.root[data-phase='hero']`），绘制背景的 Conversation 根元素设置 `isolation: isolate`，这是 frame 契约的一部分：层中负 `z-index` 的装饰画在该背景之上、所有 Conversation 内容之下。Conversation 不为层做任何点击判定 | +| `ui-brand-official` | `PixelWhale` 是 frame 层：`display: contents` 外框上的 React `onClick` 在主按钮点击留白时播放，排除 portal 浮层（`currentTarget.contains(target)`）、控件（选择器）和结束外框内文字选择的点击。`hero` 为 true 时以负 `z-index` 绘制 canvas。帧图经包 asset 路由加载；渲染器返回 `{ play, dispose }` | + +## Alternatives considered + +- `onBlankClick` 订阅转发：Conversation 承担只为装饰插件服务的点击分类。 +- canvas 放底下、`.scrollBody` 设 `pointer-events: none`：首页溢出时空白处无法滚动。 +- 不设 `z-index` 的 canvas：不需要层叠上下文，但会画在 `z-index: 1` 的首页输入区以外的所有非定位 Conversation 内容之上（例如输入区接管面板），并依赖那条无关的规则。 +- 由层自己的盒子建立层叠上下文：层必须复刻 body 的 flex 列布局。 +- 单独的 `renderNestedSlot` / JSX 组件 ``：多一套绑定；`hookContext` 已证明可以按 key 约束 `renderSlot` 的第三个参数。 +- 按 ledger 版本预编译所有插槽类型：端到端测不出耗时差异，见 #7838。 + +## Consequences + +- 增减一层会让其内部所有内容重新挂载，包括首页的输入框。 +- 所有非 hoc 的注册组件都会收到 `children: undefined`，会覆盖同名的 owner prop。 +- 每层在组件树中多一个组件和两个 error boundary；有层的 hoc 插槽另多一个 outlet 边界。 +- outlet 的 `[data-slot]` 元素位于 owner 与内容之间，owner 侧选择器不能假定内容是直接子元素。 +- React 18 会在错误被重新抛出的位置重新采集组件栈，因此有层的 hoc 插槽之上的边界收到的内容错误，组件栈从 `HocOutletBoundary` 开始。 +- 层如果自己在 `children` 外包错误边界，捕获到的是内部的 `HocContentError`，而不是原始的内容错误。 +- frame 契约只在首页阶段成立：其他阶段根元素不参与层叠隔离，未经 portal 的 Conversation 浮层仍能盖住悬浮在中栏上方的 AppFrame 元素；首页阶段它们只在根元素内部比较层级。 +- `HocOutlet` 与 Factory 局部组件一样用 `useMemo` 保持层组件身份；如果 React 将来会丢弃 memo 缓存，两处都需要改成显式缓存，因为这些组件是其内部内容的重新挂载边界。 +- 其他 kind 仍以 [slot 体系标准](2026-07-22-slot-type-chain-implementation.zh.md) 为准；本 Note 新增第五种。 diff --git a/.github/AGENTS.md b/.github/AGENTS.md index 27823aed50..c69f322610 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -6,4 +6,4 @@ The manual [Windows packaging workflow](workflows/windows-package.yml) uses the The merge checks run from three workflows named `Policy`, which run on `pull_request_target` and cover pull requests into master or a `release/dsh-x.y.z` branch, so their definitions come from the base branch, and call the `deepseek-harness-check` action directly: `pr-check-on-head-branch.yml` on pull-request updates gives `Policy / Master Change` and `Policy / Pre-Merge Check`, `pr-check-after-approve.yml` on pull-request updates and submitted or dismissed reviews gives `Policy / Approve Check`, which also publishes the review verdict as the check run `Policy / Reviewer Check`, and `pr-check-on-base-branch.yml` on pushes to master or a release branch re-runs the head-branch checks as `Policy / Recheck`. Branch rules require those check names, so keep the job names and the workflow name. Each job reads its mode from a repository variable: `MERGE_POLICY_MASTER_DIFF`, `MERGE_POLICY_PRE_MERGE`, and `MERGE_POLICY_HEAD_DIFF`, each `off` (skip), `report` (run without failing the job), or `block` (fail the job); a missing value or an unknown one counts as `report`. `MERGE_POLICY_HEAD_DIFF` decides whether `Policy / Approve Check` runs and fails; while it runs, `Policy / Reviewer Check` is published whatever that mode says, with `success` when every file that needs review has one and `action_required` with the reviewers to ask otherwise. `Policy / Pre-Merge Check` merges the commit `Policy / Master Change` reports, so it runs only after that job and stays off while `MERGE_POLICY_MASTER_DIFF` is `off`; a merge it cannot do and a build that fails both follow its own mode, so `report` warns and skips the build while `block` fails the job. `Policy / Pre-Merge Check` runs `scripts/pre-merge-check.ts` under plain Node and knows nothing else about the merged tree: that script checks the released manifests against the root version, installs, and builds the Host and Client contracts, so change it in one pull request together with the build it orchestrates. -The manual Desktop publication workflow selects a successful package run and attempt, then routes each retained build through `DESKTOP_PUBLISH_RUNNERS` to its original machine's unique label. Keep Windows run steps on native PowerShell and Mac run steps on the default POSIX shell; shared entrypoints are Node scripts. Test and production jobs use separate `desktop-test` and `desktop-production` approval Environments after a credential-free preparation job. +The manual Desktop publication workflow selects the original successful `package` job attempt independently of `upload-artifact` archival status, then routes each retained build through `DESKTOP_PUBLISH_RUNNERS` to its original machine's unique label. Keep Windows run steps on native PowerShell and Mac run steps on the default POSIX shell; shared entrypoints are Node scripts. Test and production jobs use separate `desktop-test` and `desktop-production` approval Environments after a credential-free preparation job. diff --git a/.github/workflows/cua-helper-package.yml b/.github/workflows/cua-helper-package.yml index 20ecb7526f..650138cd37 100644 --- a/.github/workflows/cua-helper-package.yml +++ b/.github/workflows/cua-helper-package.yml @@ -3,11 +3,6 @@ name: Package CUA helper · macOS on: workflow_dispatch: inputs: - source_ref: - description: '同仓库可信源码分支或 dsh-v* tag' - type: string - default: master - required: true preset: description: '机器上的签名配置' type: choice @@ -16,19 +11,29 @@ on: required: true workflow_call: inputs: - source_ref: + reuse: + type: boolean + default: false + cua_run_id: type: string - required: true + default: '' preset: type: string default: production outputs: - artifact: - description: '包含两个架构的已签名、公证 helper 归档' - value: ${{ jobs.package.outputs.artifact }} + artifact-id: + description: '包含两个架构的已签名、公证 helper 的产物编号' + value: ${{ jobs.package.outputs.artifact-id }} + run-id: + description: '产物所属的构建运行编号' + value: ${{ jobs.package.outputs.run-id }} + build-key: + description: '源码和构建配置的摘要' + value: ${{ jobs.package.outputs.build-key }} permissions: contents: read + actions: read # Desktop uses the same keychain search list and optional system proxy transaction. concurrency: @@ -40,44 +45,65 @@ jobs: runs-on: [self-hosted, macOS, ARM64, dsh-mac-package-trial] timeout-minutes: 60 outputs: - artifact: ${{ steps.artifact.outputs.name }} + artifact-id: ${{ steps.retained.outputs.artifact-id || steps.upload.outputs.artifact-id }} + run-id: ${{ steps.retained.outputs.run-id || github.run_id }} + build-key: ${{ steps.build-inputs.outputs.build-key }} env: DSH_PACKAGING_PRESET: ${{ inputs.preset }} DSH_TELEMETRY_DISABLED: '1' - PACKAGE_SOURCE_REF: ${{ inputs.source_ref }} steps: - uses: actions/checkout@v7.0.1 with: - ref: ${{ inputs.source_ref }} persist-credentials: false clean: true - - name: Validate source selection + - name: Validate run ref and preset run: | - node -e 'const cp=require("node:child_process"); const fs=require("node:fs"); const ref=process.env.PACKAGE_SOURCE_REF; - if(ref.startsWith("refs/pull/") || /^[a-f0-9]{40}$/i.test(ref)) throw Error("Select a trusted repository branch or release tag"); + node -e 'const fs=require("node:fs"); const ref=process.env.GITHUB_REF; + if(!ref || (!ref.startsWith("refs/heads/") && !ref.startsWith("refs/tags/"))) throw Error("Select a trusted repository branch or release tag"); const tag=ref.replace(/^refs\/tags\//, ""); if(tag.startsWith("dsh-v") && tag!=="dsh-v"+JSON.parse(fs.readFileSync("package.json","utf8")).version) throw Error("Release tag must match product version"); if(!["test","production"].includes(process.env.DSH_PACKAGING_PRESET)) throw Error("Invalid preset");' - - uses: pnpm/action-setup@v5.0.0 - with: - dest: ${{ runner.temp }}/setup-pnpm-cua-${{ github.run_id }}-${{ github.run_attempt }} - uses: actions/setup-node@v7.0.0 with: node-version: '24' package-manager-cache: false + - name: Record CUA helper build inputs + id: build-inputs + run: node scripts/cua-helper/build-inputs.ts + - name: Find reusable CUA helper + if: inputs.reuse + id: retained + env: + GH_TOKEN: ${{ github.token }} + CUA_RUN_ID: ${{ inputs.cua_run_id }} + CUA_BUILD_KEY: ${{ steps.build-inputs.outputs.build-key }} + run: node scripts/cua-helper/select-artifact.ts + - uses: pnpm/action-setup@v5.0.0 + if: steps.retained.outputs.artifact-id == '' + with: + dest: ${{ runner.temp }}/setup-pnpm-cua-${{ github.run_id }}-${{ github.run_attempt }} - name: Install locked dependencies - run: pnpm install --frozen-lockfile + if: steps.retained.outputs.artifact-id == '' + run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile - name: Build and verify notarized applications + if: steps.retained.outputs.artifact-id == '' + env: + CUA_EXPECTED_BUILD_KEY: ${{ steps.build-inputs.outputs.build-key }} run: | mkdir -p dist - pnpm exec tsx scripts/cua-helper/package.ts --out dist/cua-helper - - name: Name retained artifact - id: artifact - run: echo "name=cua-helper-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT" + node --import tsx/esm scripts/cua-helper/package.ts --out dist/cua-helper - uses: actions/upload-artifact@v7.0.1 + if: steps.retained.outputs.artifact-id == '' + id: upload with: - name: ${{ steps.artifact.outputs.name }} + name: cua-helper-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.build-inputs.outputs.build-key }} path: dist/cua-helper/* if-no-files-found: error compression-level: 0 retention-days: 14 + - name: Record newly built artifact + if: steps.retained.outputs.artifact-id == '' + env: + CUA_ARTIFACT_ID: ${{ steps.upload.outputs.artifact-id }} + run: | + printf '已构建 CUA helper，run ID `%s`，artifact ID `%s`。\n' "$GITHUB_RUN_ID" "$CUA_ARTIFACT_ID" >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/desktop-publish.yml b/.github/workflows/desktop-publish.yml index 3e5c006d7b..ff756d1b95 100644 --- a/.github/workflows/desktop-publish.yml +++ b/.github/workflows/desktop-publish.yml @@ -9,6 +9,11 @@ on: description: '打包运行 ID：填写成功的 Package Desktop run ID；发布环境和 release ID 沿用原包' type: string required: true + upload_website: + description: '同时上传官网安装包并刷新缓存（仅 production）；取消后仅执行版本与自动更新发布' + type: boolean + default: true + required: true package_run_attempt: description: '打包尝试次数：留空选择最新一次，且必须成功；失败时不会回退到旧包' type: string @@ -57,9 +62,13 @@ jobs: route: ${{ steps.local.outputs.route }} preset: ${{ steps.local.outputs.preset }} approval: ${{ steps.check.outputs.approval }} + website-approval: ${{ steps.check.outputs.website-approval }} + website-destination: ${{ steps.check.outputs.website-destination }} label: ${{ steps.check.outputs.label }} env: DESKTOP_PACKAGE_SELECTION: ${{ needs.route.outputs.selection }} + DESKTOP_UPLOAD_WEBSITE: ${{ inputs.upload_website }} + DOWNLOAD_PROD_EO_ZONE_ID: ${{ vars.DOWNLOAD_PROD_EO_ZONE_ID }} DSH_TELEMETRY_DISABLED: '1' steps: - uses: actions/checkout@v7.0.1 @@ -151,6 +160,7 @@ jobs: DESKTOP_TAG_TOKEN: ${{ steps.app.outputs.token }} run: node --import tsx apps/desktop/scripts/publish-desktop-ci.ts --publish - name: Retain publication audit + continue-on-error: true if: always() && steps.publish.outputs.record != '' uses: actions/upload-artifact@v7.0.1 with: @@ -158,3 +168,93 @@ jobs: path: ${{ steps.publish.outputs.record }}/ if-no-files-found: error retention-days: 30 + + upload-website-installer: + needs: [route, prepare, publish] + if: inputs.upload_website && needs.prepare.outputs.preset != 'test' + runs-on: [self-hosted, '${{ needs.route.outputs.runner }}'] + environment: desktop-production + timeout-minutes: 60 + concurrency: + group: desktop-website-upload-${{ needs.prepare.outputs.website-destination }} + cancel-in-progress: false + env: + DESKTOP_PUBLISH_ROUTE: ${{ needs.prepare.outputs.route }} + DESKTOP_WEBSITE_APPROVAL: ${{ needs.prepare.outputs.website-approval }} + DOWNLOAD_PROD_EO_ZONE_ID: ${{ vars.DOWNLOAD_PROD_EO_ZONE_ID }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + clean: false + path: website-publisher + - uses: pnpm/action-setup@v5.0.0 + with: + package_json_file: website-publisher/package.json + dest: ${{ runner.temp }}/website-pnpm-${{ github.run_id }}-${{ github.run_attempt }} + - uses: actions/setup-node@v7.0.0 + with: + node-version: '24' + - name: Check local publication configuration + working-directory: website-publisher + run: node apps/desktop/scripts/preflight-desktop-publish-local.mjs + - run: pnpm install --frozen-lockfile + working-directory: website-publisher + - name: Upload website installer + id: website + working-directory: website-publisher + run: node --import tsx apps/desktop/scripts/publish-website-ci.ts upload + - name: Archive website publication diagnostics + if: always() && steps.website.outputs.record != '' + continue-on-error: true + uses: actions/upload-artifact@v7.0.1 + with: + name: website-upload-${{ github.run_id }}-${{ github.run_attempt }} + path: ${{ steps.website.outputs.record }}/ + if-no-files-found: warn + retention-days: 30 + + purge-website-installer: + needs: [route, prepare, upload-website-installer] + if: inputs.upload_website && needs.prepare.outputs.preset != 'test' + runs-on: [self-hosted, '${{ needs.route.outputs.runner }}'] + environment: desktop-production + timeout-minutes: 60 + concurrency: + group: desktop-website-purge-${{ needs.prepare.outputs.website-destination }} + cancel-in-progress: false + env: + DESKTOP_PUBLISH_ROUTE: ${{ needs.prepare.outputs.route }} + DESKTOP_WEBSITE_APPROVAL: ${{ needs.prepare.outputs.website-approval }} + DOWNLOAD_PROD_EO_ZONE_ID: ${{ vars.DOWNLOAD_PROD_EO_ZONE_ID }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + clean: false + path: website-publisher + - uses: pnpm/action-setup@v5.0.0 + with: + package_json_file: website-publisher/package.json + dest: ${{ runner.temp }}/website-pnpm-${{ github.run_id }}-${{ github.run_attempt }} + - uses: actions/setup-node@v7.0.0 + with: + node-version: '24' + - name: Check local publication configuration + working-directory: website-publisher + run: node apps/desktop/scripts/preflight-desktop-publish-local.mjs + - run: pnpm install --frozen-lockfile + working-directory: website-publisher + - name: Recover and observe website cache purge + id: website + working-directory: website-publisher + run: node --import tsx apps/desktop/scripts/publish-website-ci.ts purge + - name: Archive website publication diagnostics + if: always() && steps.website.outputs.record != '' + continue-on-error: true + uses: actions/upload-artifact@v7.0.1 + with: + name: website-purge-${{ github.run_id }}-${{ github.run_attempt }} + path: ${{ steps.website.outputs.record }}/ + if-no-files-found: warn + retention-days: 30 diff --git a/.github/workflows/macos-intel-package.yml b/.github/workflows/macos-intel-package.yml index 32f0a34e4b..3fdb193807 100644 --- a/.github/workflows/macos-intel-package.yml +++ b/.github/workflows/macos-intel-package.yml @@ -57,6 +57,13 @@ concurrency: jobs: package: + outputs: + directory: ${{ steps.retained.outputs.directory }} + runner: ${{ steps.retained.outputs.runner }} + runner-name: ${{ steps.retained.outputs.runner-name }} + attempt: ${{ steps.retained.outputs.attempt }} + version: ${{ steps.settings.outputs.version }} + mode: ${{ steps.settings.outputs.mode }} runs-on: [self-hosted, macOS, ARM64, dsh-mac-package-trial] timeout-minutes: 180 defaults: @@ -98,6 +105,7 @@ jobs: if(branch==='HEAD' || branch!==ref || ref.startsWith('refs/')) throw Error('Select a branch in this repository, not a SHA or PR ref'); } if(!fs.readFileSync('apps/desktop/scripts/prepare-macos-ci.mjs','utf8').includes('resolveDesktopBuildTarget')) throw Error('Source lacks Intel macOS CI support; select a newer source'); + if(!fs.readFileSync('apps/desktop/scripts/retain-desktop-ci.ts','utf8').includes('--check-runner')) throw Error('Source lacks independent Desktop artifact archival support; select a newer source'); if(!fs.readFileSync('apps/desktop/scripts/desktop-ci-version.mjs','utf8').includes('PACKAGE_VERSION_MODE')) throw Error('Source lacks Desktop channel/version CI support; select a newer release');" - uses: pnpm/action-setup@v5.0.0 with: @@ -115,6 +123,10 @@ jobs: run: arch -x86_64 /usr/bin/true - name: Install locked dependencies run: pnpm install --frozen-lockfile + - name: Check original machine archival route + env: + DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }} + run: node --import tsx apps/desktop/scripts/retain-desktop-ci.ts --check-runner - name: Validate preset and resolve build version id: settings env: @@ -154,10 +166,12 @@ jobs: - name: Retain complete package outside the checkout id: retained env: + DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }} PACKAGE_SOURCE_SHA: ${{ steps.checkout.outputs.commit }} PACKAGE_VERSION: ${{ steps.settings.outputs.version }} run: node --import tsx apps/desktop/scripts/retain-desktop-ci.ts - name: Retain packaging diagnostics + continue-on-error: true if: always() && steps.checkout.outcome == 'success' uses: actions/upload-artifact@v7.0.1 with: @@ -166,13 +180,46 @@ jobs: path: apps/desktop/.desktop-build/packaging-runs/ if-no-files-found: warn retention-days: 14 + + upload-artifact: + needs: package + runs-on: [self-hosted, '${{ needs.package.outputs.runner }}'] + timeout-minutes: 30 + env: + DESKTOP_RETAINED_DIRECTORY: ${{ needs.package.outputs.directory }} + DESKTOP_PACKAGE_ATTEMPT: ${{ needs.package.outputs.attempt }} + DESKTOP_PACKAGE_RUNNER: ${{ needs.package.outputs.runner-name }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + path: artifact-archiver + - uses: pnpm/action-setup@v5.0.0 + with: + package_json_file: artifact-archiver/package.json + dest: ${{ runner.temp }}/archive-pnpm-${{ github.run_id }}-${{ github.run_attempt }} + - uses: actions/setup-node@v7.0.0 + with: + node-version: '24' + - name: Configure persistent package caches + env: + DSH_DESKTOP_PACKAGE_CACHE_DIR: ${{ runner.tool_cache }}/dsh-desktop-package-cache + run: | + echo "DSH_DESKTOP_PACKAGE_CACHE_DIR=$DSH_DESKTOP_PACKAGE_CACHE_DIR" >> "$GITHUB_ENV" + echo "PNPM_CONFIG_STORE_DIR=$DSH_DESKTOP_PACKAGE_CACHE_DIR/workspace-pnpm-store" >> "$GITHUB_ENV" + - run: pnpm install --frozen-lockfile + working-directory: artifact-archiver + - name: Verify original retained build before GitHub archival + working-directory: artifact-archiver + run: node --import tsx apps/desktop/scripts/archive-desktop-ci.ts - name: Retain installers for the selected mode if: success() uses: actions/upload-artifact@v7.0.1 with: - name: macos-x64-${{ steps.settings.outputs.mode }}-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }} + name: macos-x64-${{ needs.package.outputs.mode }}-${{ needs.package.outputs.version }}-${{ github.run_id }}-${{ needs.package.outputs.attempt }} include-hidden-files: true - path: ${{ steps.retained.outputs.directory }}/* + path: ${{ needs.package.outputs.directory }}/* compression-level: 0 if-no-files-found: error retention-days: 14 + overwrite: true diff --git a/.github/workflows/macos-package.yml b/.github/workflows/macos-package.yml index 9a525d318a..f6f9f97401 100644 --- a/.github/workflows/macos-package.yml +++ b/.github/workflows/macos-package.yml @@ -57,6 +57,13 @@ concurrency: jobs: package: + outputs: + directory: ${{ steps.retained.outputs.directory }} + runner: ${{ steps.retained.outputs.runner }} + runner-name: ${{ steps.retained.outputs.runner-name }} + attempt: ${{ steps.retained.outputs.attempt }} + version: ${{ steps.settings.outputs.version }} + mode: ${{ steps.settings.outputs.mode }} runs-on: [self-hosted, macOS, ARM64, dsh-mac-package-trial] timeout-minutes: 180 defaults: @@ -97,6 +104,7 @@ jobs: const branch=cp.execFileSync('git',['rev-parse','--abbrev-ref','HEAD'],{encoding:'utf8'}).trim(); if(branch==='HEAD' || branch!==ref || ref.startsWith('refs/')) throw Error('Select a branch in this repository, not a SHA or PR ref'); } + if(!fs.readFileSync('apps/desktop/scripts/retain-desktop-ci.ts','utf8').includes('--check-runner')) throw Error('Source lacks independent Desktop artifact archival support; select a newer source'); if(!fs.readFileSync('apps/desktop/scripts/desktop-ci-version.mjs','utf8').includes('PACKAGE_VERSION_MODE')) throw Error('Source lacks Desktop channel/version CI support; select a newer release');" - uses: pnpm/action-setup@v5.0.0 with: @@ -112,6 +120,10 @@ jobs: echo "PNPM_CONFIG_STORE_DIR=$DSH_DESKTOP_PACKAGE_CACHE_DIR/workspace-pnpm-store" >> "$GITHUB_ENV" - name: Install locked dependencies run: pnpm install --frozen-lockfile + - name: Check original machine archival route + env: + DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }} + run: node --import tsx apps/desktop/scripts/retain-desktop-ci.ts --check-runner - name: Validate preset and resolve build version id: settings env: @@ -151,10 +163,12 @@ jobs: - name: Retain complete package outside the checkout id: retained env: + DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }} PACKAGE_SOURCE_SHA: ${{ steps.checkout.outputs.commit }} PACKAGE_VERSION: ${{ steps.settings.outputs.version }} run: node --import tsx apps/desktop/scripts/retain-desktop-ci.ts - name: Retain packaging diagnostics + continue-on-error: true if: always() && steps.checkout.outcome == 'success' uses: actions/upload-artifact@v7.0.1 with: @@ -163,13 +177,46 @@ jobs: path: apps/desktop/.desktop-build/packaging-runs/ if-no-files-found: warn retention-days: 14 + + upload-artifact: + needs: package + runs-on: [self-hosted, '${{ needs.package.outputs.runner }}'] + timeout-minutes: 30 + env: + DESKTOP_RETAINED_DIRECTORY: ${{ needs.package.outputs.directory }} + DESKTOP_PACKAGE_ATTEMPT: ${{ needs.package.outputs.attempt }} + DESKTOP_PACKAGE_RUNNER: ${{ needs.package.outputs.runner-name }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + path: artifact-archiver + - uses: pnpm/action-setup@v5.0.0 + with: + package_json_file: artifact-archiver/package.json + dest: ${{ runner.temp }}/archive-pnpm-${{ github.run_id }}-${{ github.run_attempt }} + - uses: actions/setup-node@v7.0.0 + with: + node-version: '24' + - name: Configure persistent package caches + env: + DSH_DESKTOP_PACKAGE_CACHE_DIR: ${{ runner.tool_cache }}/dsh-desktop-package-cache + run: | + echo "DSH_DESKTOP_PACKAGE_CACHE_DIR=$DSH_DESKTOP_PACKAGE_CACHE_DIR" >> "$GITHUB_ENV" + echo "PNPM_CONFIG_STORE_DIR=$DSH_DESKTOP_PACKAGE_CACHE_DIR/workspace-pnpm-store" >> "$GITHUB_ENV" + - run: pnpm install --frozen-lockfile + working-directory: artifact-archiver + - name: Verify original retained build before GitHub archival + working-directory: artifact-archiver + run: node --import tsx apps/desktop/scripts/archive-desktop-ci.ts - name: Retain installers for the selected mode if: success() uses: actions/upload-artifact@v7.0.1 with: - name: macos-arm64-${{ steps.settings.outputs.mode }}-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }} + name: macos-arm64-${{ needs.package.outputs.mode }}-${{ needs.package.outputs.version }}-${{ github.run_id }}-${{ needs.package.outputs.attempt }} include-hidden-files: true - path: ${{ steps.retained.outputs.directory }}/* + path: ${{ needs.package.outputs.directory }}/* compression-level: 0 if-no-files-found: error retention-days: 14 + overwrite: true diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index eb7e3a5eef..27a5a52916 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -9,12 +9,7 @@ on: workflow_dispatch: inputs: cua_run_id: - description: '已有 CUA 打包 run ID：留空重新打包；填写时复用同一源码和版本的已验证产物' - type: string - required: false - default: '' - cua_run_attempt: - description: 'CUA 打包 attempt：仅与 run ID 一起使用；留空选择最新一次，不回退到更早的成功构建' + description: 'CUA helper run ID，留空复用源码逐字节一致的产物，无匹配则构建' type: string required: false default: '' @@ -26,6 +21,7 @@ on: permissions: contents: read + actions: read env: PRIMARY_NODE_VERSION: '24' @@ -33,18 +29,16 @@ env: jobs: cua-helper: - if: (startsWith(github.ref, 'refs/tags/dsh-v') || inputs.skip-tag-check) && inputs.cua_run_id == '' && inputs.cua_run_attempt == '' + if: startsWith(github.ref, 'refs/tags/dsh-v') || inputs.skip-tag-check uses: ./.github/workflows/cua-helper-package.yml with: - source_ref: ${{ github.ref }} + reuse: true preset: production + cua_run_id: ${{ inputs.cua_run_id }} pack: name: Pack npm tarballs needs: cua-helper - if: >- - ${{ !cancelled() && (needs.cua-helper.result == 'success' - || (needs.cua-helper.result == 'skipped' && (inputs.cua_run_id != '' || inputs.cua_run_attempt != ''))) }} runs-on: ubuntu-24.04 permissions: contents: read @@ -87,33 +81,20 @@ jobs: RELEASE_PUBLISH: 'true' run: pnpm run release:verify --family dsh ${{ inputs.skip-tag-check && '--skip-tag-check' || '' }} - - name: Select retained CUA helper - if: inputs.cua_run_id != '' || inputs.cua_run_attempt != '' - id: retained-cua - env: - GH_TOKEN: ${{ github.token }} - run: pnpm exec tsx scripts/cua-helper/select-artifact.ts - - - name: Download retained CUA helper - if: inputs.cua_run_id != '' || inputs.cua_run_attempt != '' + - name: Download selected CUA helper uses: actions/download-artifact@v8.0.1 with: - artifact-ids: ${{ steps.retained-cua.outputs.artifact-id }} - run-id: ${{ inputs.cua_run_id }} + artifact-ids: ${{ needs.cua-helper.outputs.artifact-id }} + run-id: ${{ needs.cua-helper.outputs.run-id }} github-token: ${{ github.token }} path: dist/cua-helper - name: Build run: pnpm run build:official --serial - - name: Download freshly built CUA helper - if: inputs.cua_run_id == '' && inputs.cua_run_attempt == '' - uses: actions/download-artifact@v8.0.1 - with: - name: ${{ needs.cua-helper.outputs.artifact }} - path: dist/cua-helper - - name: Stage verified native helper applications + env: + CUA_EXPECTED_BUILD_KEY: ${{ needs.cua-helper.outputs.build-key }} run: | mkdir dist/cua-helper/extracted tar -xzf dist/cua-helper/cua-helper.tgz -C dist/cua-helper/extracted @@ -121,13 +102,13 @@ jobs: - name: Record CUA source and publication retry instructions env: - CUA_RUN_ID: ${{ inputs.cua_run_id || github.run_id }} - CUA_RUN_ATTEMPT: ${{ steps.retained-cua.outputs.attempt || github.run_attempt }} + CUA_RUN_ID: ${{ needs.cua-helper.outputs.run-id }} + CUA_ARTIFACT_ID: ${{ needs.cua-helper.outputs.artifact-id }} run: | { - printf 'CUA helper: run `%s`, attempt `%s`.\n\n' "$CUA_RUN_ID" "$CUA_RUN_ATTEMPT" + printf '采用 CUA helper 构建 run ID `%s`，artifact ID `%s`。\n\n' "$CUA_RUN_ID" "$CUA_ARTIFACT_ID" printf '%s\n\n' 'npm 部分发布失败时，只重跑 Publish to npm job，复用原 dsh-npm-tarballs；不要重跑全部 job。' - printf '若需新建发布运行，填写 `cua_run_id=%s`、`cua_run_attempt=%s`，并使用相同源码 commit 和版本。\n' "$CUA_RUN_ID" "$CUA_RUN_ATTEMPT" + printf '需要重新打包时，可留空自动查找，或填写 `cua_run_id=%s` 指定该 helper；源码和构建配置必须匹配。\n' "$CUA_RUN_ID" } >> "$GITHUB_STEP_SUMMARY" - name: Pack release tarballs diff --git a/.github/workflows/windows-package.yml b/.github/workflows/windows-package.yml index 76a4b68f10..0b137fc3b2 100644 --- a/.github/workflows/windows-package.yml +++ b/.github/workflows/windows-package.yml @@ -63,6 +63,13 @@ concurrency: jobs: package: + outputs: + directory: ${{ steps.retained.outputs.directory }} + runner: ${{ steps.retained.outputs.runner }} + runner-name: ${{ steps.retained.outputs.runner-name }} + attempt: ${{ steps.retained.outputs.attempt }} + version: ${{ steps.settings.outputs.version }} + mode: ${{ steps.settings.outputs.mode }} runs-on: dsh-win-package-trial timeout-minutes: 120 defaults: @@ -127,6 +134,7 @@ jobs: const branch=cp.execFileSync('git',['rev-parse','--abbrev-ref','HEAD'],{encoding:'utf8'}).trim(); if(branch==='HEAD' || branch!==ref || ref.startsWith('refs/')) throw Error('Select a branch in this repository, not a SHA or PR ref'); } + if(!fs.readFileSync('apps/desktop/scripts/retain-desktop-ci.ts','utf8').includes('--check-runner')) throw Error('Source lacks independent Desktop artifact archival support; select a newer source'); if(!fs.readFileSync('apps/desktop/scripts/desktop-ci-version.mjs','utf8').includes('PACKAGE_VERSION_MODE')) throw Error('Source lacks Desktop channel/version CI support; select a newer release');" - uses: pnpm/action-setup@v5.0.0 with: @@ -158,6 +166,10 @@ jobs: if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } pnpm install --frozen-lockfile exit $LASTEXITCODE + - name: Check original machine archival route + env: + DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }} + run: node --import tsx apps/desktop/scripts/retain-desktop-ci.ts --check-runner - name: Validate preset and resolve build version id: settings env: @@ -183,10 +195,12 @@ jobs: - name: Retain complete package outside the checkout id: retained env: + DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }} PACKAGE_SOURCE_SHA: ${{ steps.checkout.outputs.commit }} PACKAGE_VERSION: ${{ steps.settings.outputs.version }} run: node --import tsx apps/desktop/scripts/retain-desktop-ci.ts - name: Retain packaging diagnostics + continue-on-error: true if: always() && steps.checkout.outcome == 'success' uses: actions/upload-artifact@v7.0.1 with: @@ -195,23 +209,70 @@ jobs: path: ${{ github.workspace }}/apps/desktop/.desktop-build/packaging-runs/ if-no-files-found: warn retention-days: 14 + + upload-artifact: + defaults: + run: + shell: pwsh + needs: package + runs-on: [self-hosted, '${{ needs.package.outputs.runner }}'] + timeout-minutes: 30 + env: + PACKAGE_CACHE_NAMESPACE: ${{ inputs.cache_namespace }} + DESKTOP_RETAINED_DIRECTORY: ${{ needs.package.outputs.directory }} + DESKTOP_PACKAGE_ATTEMPT: ${{ needs.package.outputs.attempt }} + DESKTOP_PACKAGE_RUNNER: ${{ needs.package.outputs.runner-name }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + path: artifact-archiver + - uses: pnpm/action-setup@v5.0.0 + with: + package_json_file: artifact-archiver/package.json + dest: ${{ runner.temp }}/archive-pnpm-${{ github.run_id }}-${{ github.run_attempt }} + - uses: actions/setup-node@v7.0.0 + with: + node-version: '24' + - name: Configure persistent pnpm store + # PNPM_HOME belongs to this run; keep downloaded packages outside its temporary directory. + env: + DSH_DESKTOP_PACKAGE_CACHE_DIR: ${{ runner.tool_cache }}/dsh-desktop-package-cache + run: | + $storeRoot = Join-Path ([IO.Path]::GetPathRoot($env:GITHUB_WORKSPACE)) '.pnpm-store' + $namespace = $env:PACKAGE_CACHE_NAMESPACE + if ($namespace) { + if ($namespace -cnotmatch '^[a-z0-9][a-z0-9-]{0,63}\z') { throw 'Cache namespace must contain 1-64 lowercase letters, digits or hyphens' } + if ($namespace -match '^(con|prn|aux|nul|com[1-9]|lpt[1-9])$') { throw 'Cache namespace cannot be a Windows device name' } + $storeRoot = Join-Path $storeRoot $namespace + $env:DSH_DESKTOP_PACKAGE_CACHE_DIR = Join-Path $env:DSH_DESKTOP_PACKAGE_CACHE_DIR $namespace + } + "DSH_DESKTOP_PACKAGE_CACHE_DIR=$env:DSH_DESKTOP_PACKAGE_CACHE_DIR" >> $env:GITHUB_ENV + "PNPM_CONFIG_STORE_DIR=$storeRoot" >> $env:GITHUB_ENV + - run: pnpm install --frozen-lockfile + working-directory: artifact-archiver + - name: Verify original retained build before GitHub archival + working-directory: artifact-archiver + run: node --import tsx apps/desktop/scripts/archive-desktop-ci.ts - name: Retain verified unsigned installer if: success() && inputs.signing == 'unsigned' uses: actions/upload-artifact@v7.0.1 with: - name: windows-x64-unsigned-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }} + name: windows-x64-unsigned-${{ needs.package.outputs.version }}-${{ github.run_id }}-${{ needs.package.outputs.attempt }} compression-level: 0 include-hidden-files: true - path: ${{ steps.retained.outputs.directory }}/* + path: ${{ needs.package.outputs.directory }}/* if-no-files-found: error retention-days: 14 + overwrite: true - name: Retain verified signed installer if: success() && inputs.signing == 'signed' uses: actions/upload-artifact@v7.0.1 with: - name: windows-x64-signed-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }} + name: windows-x64-signed-${{ needs.package.outputs.version }}-${{ github.run_id }}-${{ needs.package.outputs.attempt }} compression-level: 0 include-hidden-files: true - path: ${{ steps.retained.outputs.directory }}/* + path: ${{ needs.package.outputs.directory }}/* if-no-files-found: error retention-days: 14 + overwrite: true diff --git a/apps/desktop/packaging/README.i18n.yaml b/apps/desktop/packaging/README.i18n.yaml index 40f26fd202..5015126b05 100644 --- a/apps/desktop/packaging/README.i18n.yaml +++ b/apps/desktop/packaging/README.i18n.yaml @@ -24,11 +24,11 @@ en: 5b4f0f80a117f202 zh: ff05be196c181087 /desktop-packaging/windows-actions-packaging: - en: 253e17998951931c - zh: b582b377391d2ec2 + en: e0a852fdda949c40 + zh: b96c613022f6189e /desktop-packaging/macos-self-hosted-packaging: - en: b7e03e2e9807a62c - zh: e5b0c43910e085d8 + en: 239d5ab433020745 + zh: e8916ba0f4682ae1 /desktop-packaging/unsigned-windows-test-installer: en: f429bc0c280e2dfa zh: 4adbcc9e906bdf80 diff --git a/apps/desktop/packaging/README.md b/apps/desktop/packaging/README.md index 54cb16cb29..b5875363ae 100644 --- a/apps/desktop/packaging/README.md +++ b/apps/desktop/packaging/README.md @@ -113,7 +113,9 @@ The `Package Desktop · Windows · x64` [manual workflow](../../../.github/workf Select the workflow in Actions, choose the source branch, preset, signing mode and version, then click Run workflow. Before merging input changes, test the pushed branch with `gh workflow run windows-package.yml --ref -f preset=test -f signing=unsigned -f build_version=auto`; verify the web form after merging. There is no push or PR trigger. Logs and successful EXEs are retained for 14 days. Inspect the retained logs and installer before relying on packaging; installation is separate. Before checkout, Node removes the runner-owned source directory without following dependency junctions; the workflow validates its location and rejects linked ancestors. Never point it at a development checkout. Runs share one concurrency group without cancelling an active build; only one run remains pending, and a newer dispatch replaces it. Diagnostics upload requires a successful clean checkout. Machine settings stay outside the checkout and are never uploaded as artifacts. -Open the completed run in Actions and download its Artifacts. `windows-x64-signed---` and `windows-x64-unsigned---` contain the corresponding EXE; `windows-package-logs--` contains packaging diagnostics. The upload steps are `Retain verified signed installer`, `Retain verified unsigned installer`, and `Retain packaging diagnostics`; their step durations and timestamped logs show upload time. These artifacts are not a Release or download-site publication. +All Windows packaging modes, including test and unsigned, require the repository variable `DESKTOP_PUBLISH_RUNNERS`; configure the [original-machine route](../publishing/ci/README.md#machine-setup) before dispatch. + +Open the completed run in Actions and download its Artifacts from the independent `upload-artifact` job. Installer names use the original `package_run_attempt`; diagnostic names use the current `run_attempt`. If archival fails after packaging succeeds, rerun only `upload-artifact` to reuse the retained installers. `windows-x64-signed---` and `windows-x64-unsigned---` contain the corresponding EXE; `windows-package-logs--` contains packaging diagnostics. The upload steps are `Retain verified signed installer`, `Retain verified unsigned installer`, and `Retain packaging diagnostics`; their step durations and timestamped logs show upload time. These artifacts are not a Release or download-site publication. For cache measurements, `cache_namespace` selects a retained subdirectory for both dependency stores and upstream downloads; leave it empty for normal shared caches. Use a new name for a cold sample and repeat that name for warm samples. Names contain 1–64 lowercase letters, digits or hyphens, start with a letter or digit, and cannot be Windows device names. This does not reset the separate signature cache or OS file cache; report those states and Job start-to-completion time alongside phase timings and artifact size. Before dependency installation, the workflow records the Node version, available CPU parallelism, logical CPU count, and total/free memory. @@ -127,6 +129,8 @@ Installer uploads store the already-compressed release files without ZIP recompr The [Apple Silicon workflow](../../../.github/workflows/macos-package.yml) and [Intel workflow](../../../.github/workflows/macos-intel-package.yml) produce separate arm64 and x64 packages on the Apple Silicon runner labeled `dsh-mac-package-trial`. Both share one concurrency group. The Intel workflow checks Rosetta execution before dependency installation; its selected source must include the target-aware macOS CI adapter. Both select `test` or `production` and use the existing signing, notarization and packaged-runtime checks. When the selected source's dsh ships the Computer Use bundle, each workflow builds, notarizes and stages the helper for both architectures with `scripts/cua-helper/package.ts` and `stage.ts` after the configuration check, the steps npm publication uses; `skip_notarization` does not skip the helper's notarization. A source that predates helper packaging only emits a warning, and Computer Use cannot prepare its helper in that package. Successful DMG/ZIP files and diagnostic logs are retained for 14 days without publishing a release. Installer uploads disable redundant ZIP compression. The operator must verify a complete Actions run and installation on the target architecture before release qualification. The `compression_level` dropdown defaults to `3` and also offers `7`; it overrides the machine preset for this run and affects only ZIP and automatic-update downloads, not DMG. +Both macOS workflows require the repository variable `DESKTOP_PUBLISH_RUNNERS`, including test and unnotarized modes. Their independent `upload-artifact` job retains installer names with the original build attempt; if archival fails after packaging succeeds, rerun only that job. See [original-machine routing and recovery](../publishing/ci/README.md#recovery-and-records). + All three platform forms put source, environment, update channel, version mode, manual version, test release ID and compression level first, with matching defaults. macOS notarization and Windows signing and cache measurement options follow these common fields. Run `node apps/desktop/scripts/setup-macos-packaging.mjs "$HOME/dsh-ci"` to prepare private `runner/`, `packaging/{presets,secrets,certificates}` and `cache/macos-signatures` directories without overwriting existing files; append `--check` to inspect them. Fill the [preset](../config/macos-packaging/test.env.example) and [signing](../config/macos-packaging/macos-signing.env.example) templates outside the checkout. Set secret and certificate files to mode `0600`. `DSH_PACKAGING_CONFIG_DIR` selects the absolute `packaging` directory and `DSH_PACKAGING_PRESET` selects its preset; missing files fail without falling back to `.env.macos`. Signed and preparation-only Mac builds read `secrets/macos-signing.env`; relative credential paths resolve beside that file. Public presets reject signing credentials, and signing files cannot override public settings. Local unsigned Mac builds retain their configuration-free behavior. diff --git a/apps/desktop/packaging/README.zh.md b/apps/desktop/packaging/README.zh.md index 7c76afdb50..eac441d256 100644 --- a/apps/desktop/packaging/README.zh.md +++ b/apps/desktop/packaging/README.zh.md @@ -113,7 +113,9 @@ runner 的受监督启动和恢复见 [Windows runner 机器准备](../windows-s 在 Actions 选择工作流、源码分支、preset、签名模式和版本，再点击 Run workflow。输入变更合并前，用 `gh workflow run windows-package.yml --ref -f preset=test -f signing=unsigned -f build_version=auto` 测试已推送分支；合并后验证网页表单。它不监听 push 或 PR。日志和成功生成的 EXE 保留 14 天。依赖打包流程前检查日志和安装包；安装是独立操作。检出前，Node 删除 runner 专用源码目录，不跟随依赖 junction；工作流校验目标位置并拒绝链接祖先目录。不得指向日常开发目录。运行共享一个并发组，不取消正在进行的构建；最多保留一个待运行任务，新触发会替换它。仅在成功完成干净检出后上传诊断。机器配置位于 checkout 之外，不作为产物上传。 -在 Actions 打开完成的运行并下载 Artifacts。`windows-x64-signed---` 与 `windows-x64-unsigned---` 包含对应 EXE；`windows-package-logs--` 包含打包诊断。上传步骤名为 `Retain verified signed installer`、`Retain verified unsigned installer` 和 `Retain packaging diagnostics`；步骤耗时与带时间戳的日志显示上传用时。这些产物不等于发布 Release 或下载站内容。 +所有 Windows 打包模式（含 test 和 unsigned）都要求仓库变量 `DESKTOP_PUBLISH_RUNNERS`；触发前配置[原机器路由](../publishing/ci/README.zh.md#machine-setup)。 + +在 Actions 打开完成的运行，下载独立 `upload-artifact` job 生成的 Artifacts。安装包名称使用原构建的 `package_run_attempt`，诊断名称使用当前 `run_attempt`。打包成功但归档失败时，仅重跑 `upload-artifact` 以复用保留的安装包。`windows-x64-signed---` 与 `windows-x64-unsigned---` 包含对应 EXE；`windows-package-logs--` 包含打包诊断。上传步骤名为 `Retain verified signed installer`、`Retain verified unsigned installer` 和 `Retain packaging diagnostics`；步骤耗时与带时间戳的日志显示上传用时。这些产物不等于发布 Release 或下载站内容。 测量缓存时，`cache_namespace` 为两个依赖 store 和上游下载选择保留的子目录；留空使用正常共享缓存。新名称用于冷缓存采样，再次使用同名用于热缓存采样。名称由 1–64 个小写字母、数字或连字符组成，以字母或数字开头，且不能为 Windows 设备名。这不会重置独立的签名缓存或操作系统文件缓存；应将其状态、Job 开始至完成的总耗时与阶段耗时和产物体积一并报告。workflow 在依赖安装前记录 Node 版本、可用 CPU 并行数、逻辑 CPU 数及总内存和空闲内存。 @@ -127,6 +129,8 @@ runner 的受监督启动和恢复见 [Windows runner 机器准备](../windows-s [Apple Silicon 工作流](../../../.github/workflows/macos-package.yml)与 [Intel 工作流](../../../.github/workflows/macos-intel-package.yml)在带有 `dsh-mac-package-trial` 标签的 Apple Silicon runner 上分别生成 arm64 和 x64 安装包，两者共用一个并发组。Intel 工作流在安装依赖前检查 Rosetta 能否执行；所选源码必须包含按目标架构校验的 macOS CI 适配脚本。两者均选择 `test` 或 `production`，并复用现有签名、公证和打包运行时检查。所选源码的 dsh 随附 Computer Use 组合包时，两者都在配置检查之后用 `scripts/cua-helper/package.ts` 和 `stage.ts` 构建、公证并放入两种架构的 helper，与 npm 发布的步骤相同；`skip_notarization` 不会跳过 helper 的公证。源码早于 helper 打包支持时只输出警告，该安装包中的 Computer Use 无法准备 helper。成功的 DMG／ZIP 与诊断日志保留 14 天，不发布 release；安装包上传关闭重复 ZIP 压缩。操作人员须验收完整 Actions 运行及目标架构上的安装，才能确认可交付。`compression_level` 下拉选项默认为 `3`，也可选择 `7`；本次运行以该选项覆盖机器预设，只影响 ZIP 和自动升级下载，不影响 DMG。 +两个 macOS 工作流都要求仓库变量 `DESKTOP_PUBLISH_RUNNERS`，包括 test 和未公证模式。独立 `upload-artifact` job 的安装包名称保留原构建 attempt；打包成功但归档失败时，仅重跑该 job。参见[原机器路由与恢复](../publishing/ci/README.zh.md#recovery-and-records)。 + 三个平台的表单均依次展示源码、环境、升级通道、版本模式、手动版本号、测试 release ID 和压缩等级，默认值一致。macOS 公证选项和 Windows 签名、缓存测量选项位于公共字段之后。 运行 `node apps/desktop/scripts/setup-macos-packaging.mjs "$HOME/dsh-ci"` 创建私有 `runner/`、`packaging/{presets,secrets,certificates}` 和 `cache/macos-signatures` 目录，不覆盖已有文件；追加 `--check` 仅检查。在 checkout 外填写 [preset](../config/macos-packaging/test.env.example) 和[签名](../config/macos-packaging/macos-signing.env.example)模板，将秘密和证书文件权限设为 `0600`。`DSH_PACKAGING_CONFIG_DIR` 指定 `packaging` 的绝对目录，`DSH_PACKAGING_PRESET` 选择其中的 preset；缺少文件立即失败，不回退到 `.env.macos`。Mac 签名和仅准备构建读取 `secrets/macos-signing.env`，相对凭据路径以该文件所在目录为基准。公开 preset 拒绝签名凭据，签名文件不能覆盖公开配置。本地未签名 Mac 构建保留无需配置的行为。 diff --git a/apps/desktop/publishing/README.i18n.yaml b/apps/desktop/publishing/README.i18n.yaml index e74d7c1ff0..fb30359d5f 100644 --- a/apps/desktop/publishing/README.i18n.yaml +++ b/apps/desktop/publishing/README.i18n.yaml @@ -24,8 +24,8 @@ en: 4723059d6f16b25b zh: 54e5afad8fff8eb6 /desktop-publication/fixed-installer-downloads: - en: ce8296f8f1ee881e - zh: 749ab63bd6ed4248 + en: ed4dcced7bd4e7ba + zh: a9e7f5da9e39454f /desktop-publication/upload-credentials: en: 47442fb912fa4d5d zh: a21a0d67cd01724b diff --git a/apps/desktop/publishing/README.md b/apps/desktop/publishing/README.md index 1584a106e8..085833b746 100644 --- a/apps/desktop/publishing/README.md +++ b/apps/desktop/publishing/README.md @@ -69,11 +69,13 @@ Windows NSIS uploads require the generated, nonempty `.exe.blockmap` beside the ## Fixed installer downloads +Uploads set `Content-Disposition: attachment` with the verified installer basename as `filename`, preserving the complete version, platform and architecture. The fixed `dsh-latest-*` URL remains independent of nightly/stable update channels; no additional naming suffix is added. Verify CDN header forwarding and the browser save name after publication. + Fixed installer downloads use `pnpm run upload:latest:mac:arm64`, `pnpm run upload:latest:mac:x64`, or `pnpm run upload:latest:win:x64` from the repository root. They upload the completed target's DMG or EXE to `desktop/dsh-latest-macos-arm64.dmg`, `desktop/dsh-latest-macos-x64.dmg`, or `desktop/dsh-latest-windows-x64.exe`. Production URLs start with `https://download.deepseek.com/`; test URLs use `DOWNLOAD_TEST_ORIGIN`. Both deployments reuse the target dotenv's deployment, bucket, and credentials, all normal release validation, and the upload audit below. Each command replaces one fixed object without publishing feeds, blockmaps, or release tags. Test fixed downloads are shared across release IDs in the test bucket; the packaged update URL still requires its original release ID. Publication is explicit, including prerelease versions. Production commands then submit one EdgeOne URL purge and report its task ID; they do not query or wait for cache completion. Test uploads retain deployment-managed cache policy. Local loopback tests cover the upload; release operators own real COS and CDN acceptance. Production fixed downloads require `DOWNLOAD_PROD_EO_ZONE_ID` in the target dotenv and `teo:CreatePurgeTask` permission for that zone on the existing `DOWNLOAD_PROD_COS_SECRET_ID` / `DOWNLOAD_PROD_COS_SECRET_KEY` identity. The release operator must confirm that permission before use; no additional CI Secret is required. Required settings are resolved before uploading. The submission has a 30-second request timeout and is never retried automatically. -The command reports submission acceptance, not completed cache invalidation. EO results go to the console without separate purge record files; the existing upload audit records only COS writes. A rejected or unconfirmed submission exits unsuccessfully; the uploaded installer stays published. Check EO task history before submitting again after a connection loss or missing response. To submit a purge without uploading, use `pnpm run purge:latest ` with production settings and credentials; no local installer is needed. DPAPI users reuse the original credential launcher and add `-PurgeOnly` to their `-Upload -Latest` invocation. Serialize uploads and cache-only submissions per target. The CI publisher does not publish fixed downloads or run this refresh. +The command reports submission acceptance, not completed cache invalidation. EO results go to the console without separate purge record files; the existing upload audit records only COS writes. A rejected or unconfirmed submission exits unsuccessfully; the uploaded installer stays published. Check EO task history before submitting again after a connection loss or missing response. To submit a purge without uploading, use `pnpm run purge:latest ` with production settings and credentials; no local installer is needed. DPAPI users reuse the original credential launcher and add `-PurgeOnly` to their `-Upload -Latest` invocation. Serialize uploads and cache-only submissions per target. The [CI publication workflow](ci/README.md#recovery-and-records) has separate website upload and observed-purge jobs. diff --git a/apps/desktop/publishing/README.zh.md b/apps/desktop/publishing/README.zh.md index b19afbb68f..4c306678b9 100644 --- a/apps/desktop/publishing/README.zh.md +++ b/apps/desktop/publishing/README.zh.md @@ -69,11 +69,13 @@ Windows NSIS 上传要求安装包旁存在生成的非空 `.exe.blockmap`。blo ## 固定安装包下载 +上传设置 `Content-Disposition: attachment`，`filename` 沿用经校验安装包的 basename，保留完整版本、平台和架构。固定 `dsh-latest-*` URL 与 nightly/stable 升级通道独立，不另加命名后缀。发布后需验证 CDN 响应头透传及浏览器保存文件名。 + 固定安装包下载在仓库根目录使用 `pnpm run upload:latest:mac:arm64`、`pnpm run upload:latest:mac:x64` 或 `pnpm run upload:latest:win:x64`。它们把已完成目标的 DMG 或 EXE 上传到 `desktop/dsh-latest-macos-arm64.dmg`、`desktop/dsh-latest-macos-x64.dmg` 或 `desktop/dsh-latest-windows-x64.exe`。生产 URL 以 `https://download.deepseek.com/` 开头；测试 URL 使用 `DOWNLOAD_TEST_ORIGIN`。两个部署环境均复用目标 dotenv 中的部署、bucket 和凭据、全部常规发布校验以及下述上传审计。每个命令覆盖一个固定对象，不发布更新清单、blockmap 或发布标签。测试固定下载在测试 bucket 中跨发布 ID 共享；包内更新 URL 仍要求原有发布 ID。发布由操作人员显式执行，也允许预发布版本。生产命令随后提交一次 EdgeOne URL 缓存清除任务并报告任务 ID，不查询或等待缓存清除完成。测试上传仍由部署基础设施管理缓存策略。本地回环测试覆盖上传行为；真实 COS 和 CDN 验收由发布操作人员负责。 生产固定下载要求在目标 dotenv 中配置 `DOWNLOAD_PROD_EO_ZONE_ID`，且既有 `DOWNLOAD_PROD_COS_SECRET_ID` / `DOWNLOAD_PROD_COS_SECRET_KEY` 身份具备对应站点的 `teo:CreatePurgeTask` 权限。发布操作人员须在使用前确认该权限；无需新增 CI Secret。上传前解析必需配置。提交请求超时为 30 秒，不自动重试。 -命令报告提交已接受，不代表缓存清除已完成。EO 结果输出到控制台，不另建刷新记录文件；既有上传审计仅记录 COS 写入。提交被拒绝或未确认时，命令以失败状态退出，已上传安装包保持发布。连接中断或未收到响应时，先检查 EO 任务历史再重新提交。使用 `pnpm run purge:latest ` 可只提交刷新，无需上传；需要生产配置和凭据，无需本地安装包。DPAPI 用户复用原凭据启动器，在 `-Upload -Latest` 命令上添加 `-PurgeOnly`。按目标串行执行上传和单独刷新。CI 发布器不发布固定下载，也不执行此刷新。 +命令报告提交已接受，不代表缓存清除已完成。EO 结果输出到控制台，不另建刷新记录文件；既有上传审计仅记录 COS 写入。提交被拒绝或未确认时，命令以失败状态退出，已上传安装包保持发布。连接中断或未收到响应时，先检查 EO 任务历史再重新提交。使用 `pnpm run purge:latest ` 可只提交刷新，无需上传；需要生产配置和凭据，无需本地安装包。DPAPI 用户复用原凭据启动器，在 `-Upload -Latest` 命令上添加 `-PurgeOnly`。按目标串行执行上传和单独刷新。[CI 发布工作流](ci/README.zh.md#recovery-and-records)使用独立的官网上传和刷新观察 job。 diff --git a/apps/desktop/publishing/ci/README.i18n.yaml b/apps/desktop/publishing/ci/README.i18n.yaml index e01a4e7c0c..6764ae324f 100644 --- a/apps/desktop/publishing/ci/README.i18n.yaml +++ b/apps/desktop/publishing/ci/README.i18n.yaml @@ -24,11 +24,11 @@ en: 0f43f2e193e95043 zh: 1c1efb062c06f7b8 /desktop-ci-publication/package-and-publish: - en: ee8d79ac75482502 - zh: 1d986a76860ed262 + en: 3f58698708671202 + zh: be0ba215a67168d6 /desktop-ci-publication/recovery-and-records: - en: 4ff6f0673d057ca8 - zh: 7171d060dd86db9a + en: 266afba2adeeadef + zh: 063114103585dae8 /desktop-ci-publication/restore-a-channel: en: d82e2ccf70cce397 zh: d93dcb77cc4b463e diff --git a/apps/desktop/publishing/ci/README.md b/apps/desktop/publishing/ci/README.md index 4c224d2a7b..2232ea39c7 100644 --- a/apps/desktop/publishing/ci/README.md +++ b/apps/desktop/publishing/ci/README.md @@ -68,11 +68,11 @@ Environment approval gates this workflow, not arbitrary code running under the s ## Package and publish -For publication to either test or production, choose Windows `signing=signed` or leave macOS **Skip notarization** unchecked. Unsigned and unnotarized packages are only for internal debugging; they cannot publish or provide automatic updates. Before installing dependencies, the hosted routing job rejects debugging artifacts identified by the selected run and attempt. Missing artifact metadata does not establish eligibility: the original machine still validates its retained manifest and signatures. A debugging-package rejection requires a new signed/notarized package and its run ID / attempt; retrying publication cannot qualify the existing bytes. +For publication to either test or production, choose Windows `signing=signed` or leave macOS **Skip notarization** unchecked. Unsigned and unnotarized packages are only for internal debugging; they cannot publish or provide automatic updates. Before installing dependencies, the hosted routing job rejects debugging artifacts identified by the selected run and attempt. An archive-only rerun retains the original build attempt in artifact names, so this early check can miss it; local manifest qualification still rejects debugging builds before publication. Missing artifact metadata does not establish eligibility: the original machine still validates its retained manifest and signatures. A debugging-package rejection requires a new signed/notarized package and its run ID / attempt; retrying publication cannot qualify the existing bytes. Select the platform's `Package Desktop` workflow, preset, source, channel and version mode. `source_ref` accepts repository branch names (for example `feature/desktop-update`) or `dsh-v*` tags for test; production accepts only `master` or `dsh-v*` tags. Names matching `dsh-v` followed by a digit and letters, digits, dots or hyphens are treated as tags, even if a branch has that name. Tags must match the selected product version. We recommend dispatching the packaging workflow from `master` and enter the source separately; raw commit SHAs, PR refs and fork repositories are not supported. The selected source must contain the CI adapters, so older sources fail before dependency installation. Only select trusted branches: their build code runs on the signing machine. This is an operating convention, not enforced workflow-origin or credential isolation. Publication uses the recorded commit and requires it to remain in the selected branch history; normal branch advances are allowed, deletion or a diverging force-push rejects. Tag publication requires the tag to still resolve to the recorded commit. Dispatch the publisher from `master`; its hosted routing job rejects other refs before scheduling the original machine. The packaged source commit is recorded separately. `version_mode=default` selects product for production and auto for test; product preserves the selected checkout version, auto appends date/run/attempt, and manual requires `build_version`. A stable-channel package requires a stable version, so test/stable needs product or a stable manual version. The optional `test_release_id` is the test URL prefix: blank retains the machine default, successive upgrade tests on that platform need the same value, and defaults should be rotated periodically. It is not a GitHub run ID. See [packaging configuration](../../packaging/README.md#configuration-and-local-builds) for its validation and rotation limits. -Packaging only retains files. After success, open **Publish Desktop · COS → Run workflow** on `master`, enter `package_run_id` from the packaging run URL, and optionally enter `package_run_attempt`. Blank selects the latest attempt, which must have succeeded; it never falls back to an older success. An explicit attempt selects that exact successful build. Windows must be signed; macOS must finish notarization and stapling. GitHub job evidence selects the original runner; its local manifest supplies the preset, version, source and channel before approval. No installer or request artifact is downloaded. Retained packages with the old `publishRequested=false` flag remain eligible; missing or changed local files stop publication. +Packaging only retains files. After success, open **Publish Desktop · COS → Run workflow** on `master`, enter `package_run_id` from the packaging run URL, and optionally enter `package_run_attempt`. Blank selects the latest attempt and its successful package job. An archival-only retry retains the original build attempt; a failed newer package job never falls back to an older success. An explicit attempt selects that build even when its separate GitHub archival failed. Windows must be signed; macOS must finish notarization and stapling. GitHub job evidence selects the original runner; its local manifest supplies the preset, version, source and channel before approval. No installer or request artifact is downloaded. Retained packages with the old `publishRequested=false` flag remain eligible; missing or changed local files stop publication. Before installing dependencies on the original runner, preparation and the approved publish job check that the selected `publishing/.json` is readable JSON. Missing configuration reports its path; restore it and retry publication with the same package. Full configuration and signature validation still run afterward. Before uploading, the publisher hashes all retained files, checks version and destination metadata, and rechecks the platform signatures. macOS verifies the DMG and extracts the ZIP to verify the app's ticket; Windows checks Authenticode, the configured signer thumbprint and the timestamp. Preparation writes a Chinese approval summary with separate version, channel, platform and deployment fields, the retained test release ID, full installer/feed URLs, a link to the original packaging attempt, source ref/SHA, platform verification results and proposed tag. Folded details include the COS bucket and file sizes/SHA-256 of the upload bytes, including rewritten YAML. Public-repository summaries expose the test prefix and download URLs; the prefix is not authentication. Both publishing jobs wait for **Review deployments → Approve and deploy**, then recheck the approved manifest and upload plan digest. Changed bytes or destinations reject. Approval cannot edit a version; reject and rebuild instead. Both deployments upload missing binaries, verify remote bytes, then update YAML. There is no files-only mode in this workflow. Production finally creates `desktop-v` at the recorded packaging commit; an existing tag must name the same commit. @@ -80,7 +80,17 @@ Before installing dependencies on the original runner, preparation and the appro ## Recovery and records -After resolving a failure, re-run the failed publishing job to keep its prepared package attempt, or start a new publication with the explicit original package run and attempt. Re-running all jobs with a blank attempt resolves the latest package attempt again and requires a new approval. Do not rebuild solely to retry an upload. Missing objects are uploaded, identical objects are skipped, and conflicting same-name bytes stop the operation. Unknown write outcomes are reconciled by reading remote bytes. A newer channel version prevents a stale upload from replacing it. Each package updates only its embedded channel: nightly writes `nightly.yml` / `nightly-mac.yml`, stable writes `stable.yml` / `stable-mac.yml`. Stable-channel binaries use a `stable/` subdirectory under the target binary prefix, separate from existing nightly objects. Publishing the same source/version to both channels requires two packages; an existing release tag is reused only for the same source commit. +The packaging workflows separate `package` from `upload-artifact` (GitHub artifact archival). All packaging modes, including test and unsigned builds, require `DESKTOP_PUBLISH_RUNNERS` before packaging; it routes archival to the original machine. Rerun only `upload-artifact` after an archival failure; it verifies the original manifest and hashes without rebuilding, signing or notarizing. Packaging diagnostics are best effort and do not change package success. If an archival retry stays queued without a runner, inspect the resolved runner label and upstream package outputs before treating the runner as offline. Missing outputs require operator recovery of the original retained directory and manifest; rerunning the whole workflow rebuilds the package and is not archival-only recovery. Verify output reuse in the Actions acceptance test. + +Production COS publication enables website installer upload and cache refresh by default (`upload_website=true`). Clear it to publish only versioned resources and automatic-update feeds; test publication never changes the production website. `upload-website-installer` uploads the fixed installer and `purge-website-installer` refreshes its URL. The website installer validator needs only the final DMG/EXE and retained manifest. It matches production qualification, build identity and target, hashes the installer once and uploads through the same open file handle. Both production nightly and stable packages can replace the fixed website installer. Operators select the intended version; the fixed object has no downgrade protection, so rerunning an older publication can replace a newer installer. The pre-approval summary names the fixed website URL, selected version and lack of downgrade protection when website upload is selected. The existing version/update publication retains its own checks. + +Set the repository variable `DOWNLOAD_PROD_EO_ZONE_ID` to the production EdgeOne zone. The production COS credential pair also needs `teo:CreatePurgeTask` and `teo:DescribePurgeTasks`. Website uploads serialize by bucket/target in Actions and by bucket/object on the original machine. Cache observation runs separately. Version publication, website upload and cache refresh each use the production approval Environment; later jobs and reruns may require another approval. GitHub concurrency retains at most one pending job per group, so a newer pending job can cancel an older pending job; inspect canceled jobs before rerunning them. + +Website state lives in `upload-records/website--/state.json`, beside the retained releases root. macOS and Windows use the same record format on separate local disks. Website URLs and download filenames follow the [fixed-download rules](../README.md#fixed-downloads). Upload retries reconcile both bytes and `Content-Disposition`; identical bytes with a missing or different header receive one upload and readback. A completed journal with different remote bytes stops recovery and requires a newly approved publication. Completion evidence survives failed metadata repairs. Each new upload intent clears the previous purge record, so repaired metadata requires a new cache refresh; inspect EdgeOne history for the previous task ID and diagnostics. Unknown writes are read before any retry; CDN header forwarding requires real-environment validation. Rerun only the purge job to inspect its saved task when the original routing and preparation outputs remain available. With website upload enabled, website jobs skip only an explicitly selected test deployment. Each job requires its injected `route` or `selection` output for local preflight. Missing or changed website approval fails before upload or purge submission. Missing `website-destination` broadens both website concurrency groups. Missing `runner` output can prevent scheduling before preflight. Stop partial retries when outputs are missing; the workflow does not reconstruct them. Before restarting the publication workflow, inspect current remote state and obtain approval for its upload scope; this is not cache-only recovery. Do not rerun packaging to recover publication outputs. A manually rerun purge may submit once after confirming the previous task failed. A lost submission response queries matching history instead of resubmitting. An unknown result with a task ID means submission was confirmed; without an ID it may never have been submitted. Inspect EdgeOne history before manual recovery, and a fresh publication run is one recovery option. Operators may instead use the documented [fixed-download purge command](../README.md#fixed-downloads); Windows operators use the existing DPAPI credential launcher described there. This submits only a fixed-URL purge: it does not observe completion or update this Actions run’s journal. Inspect the returned task in EdgeOne before considering recovery complete. + +Purge observation waits up to five minutes at ten-second intervals, with one additional query after an unknown result or observation deadline. Confirmed failed, timeout or canceled tasks fail the job. An unresolved result exits successfully with an Actions warning and a prominent summary; its durable state remains unknown, not completed. Diagnostic artifact archival is best effort; local records remain the recovery source. Simulated-provider tests cover these paths; release operators must verify production COS/EdgeOne permissions, job-id filtering, time-range queries, task type and timestamp formats, cross-attempt Actions recovery, and actual CDN behavior before relying on recovery in production. + +After resolving a failure, re-run the failed publishing job only when the upstream outputs required above remain available, keeping its prepared package attempt; otherwise stop partial retries. A new publication can explicitly select the original package run and attempt. Re-running all jobs with a blank attempt resolves the latest package attempt again and requires a new approval. Do not rebuild solely to retry an upload. Missing objects are uploaded, identical objects are skipped, and conflicting same-name bytes stop the operation. Unknown write outcomes are reconciled by reading remote bytes. A newer channel version prevents a stale upload from replacing it. Each package updates only its embedded channel: nightly writes `nightly.yml` / `nightly-mac.yml`, stable writes `stable.yml` / `stable-mac.yml`. Stable-channel binaries use a `stable/` subdirectory under the target binary prefix, separate from existing nightly objects. Publishing the same source/version to both channels requires two packages; an existing release tag is reused only for the same source commit. The sibling `upload-records/` directory retains an operation identity, newline-delimited events and terminal result. Feed-write intents retain both previous and requested YAML. Failures record their stage, safe error classification and diagnostic; COS failures also identify `GetObject` or `PutObject`, plus a validated HTTP status and request ID when available. Access-denied reports name the permission to inspect. Raw provider responses and credentials are excluded. Audit initialization becomes visible only after its files are complete; abandoned `.initializing-*` directories are not scanned for completed publication. Writes and readback are recorded before proceeding; missing terminal results mean interruption, not success. Actions also keeps its operation record as a diagnostic artifact for 30 days. These local records are not tamper-proof. COS readback verifies storage bytes, not public CDN behavior; public download acceptance is separate. diff --git a/apps/desktop/publishing/ci/README.zh.md b/apps/desktop/publishing/ci/README.zh.md index ae61bde4e9..99d245bf1a 100644 --- a/apps/desktop/publishing/ci/README.zh.md +++ b/apps/desktop/publishing/ci/README.zh.md @@ -68,11 +68,11 @@ Environment 审批限制此工作流，不限制同一机器账户运行的任 ## 打包与发布 -发布到 test 或 production 都必须在 Windows 选择 `signing=signed`，或在 macOS 不勾选**跳过公证**。无签名、无公证的包仅限内部调试，不能发布或用于自动更新。托管路由 job 会在安装依赖前，依据所选 run 和 attempt 对应的 artifact 名称拒绝已标明的调试包。缺少 artifact 元数据不代表允许发布：原机器仍会验证留存清单和签名。遇到调试包拒绝提示时，需重新完成签名或公证，再使用新包的 run ID / attempt 发布；重跑发布不能使现有产物获得发布资格。 +发布到 test 或 production 都必须在 Windows 选择 `signing=signed`，或在 macOS 不勾选**跳过公证**。无签名、无公证的包仅限内部调试，不能发布或用于自动更新。托管路由 job 会在安装依赖前，依据所选 run 和 attempt 对应的 artifact 名称拒绝已标明的调试包。仅重跑归档时，artifact 名称保留原构建 attempt，早期检查可能未识别该包；本地清单资格校验仍会在发布前拒绝调试包。缺少 artifact 元数据不代表允许发布：原机器仍会验证留存清单和签名。遇到调试包拒绝提示时，需重新完成签名或公证，再使用新包的 run ID / attempt 发布；重跑发布不能使现有产物获得发布资格。 选择对应平台的 `Package Desktop` 工作流、preset、源码、通道和版本模式。test 的 `source_ref` 接受仓库内分支名（如 `feature/desktop-update`）或 `dsh-v*` tag；production 仅接受 `master` 或 `dsh-v*` tag。符合 `dsh-v` 后接数字、其余为字母、数字、点或连字符的名称按 tag 处理，即使存在同名分支。tag 必须与所选产品版本一致。建议从 `master` 启动打包工作流，再单独填写打包源码；不支持直接填写 commit SHA、PR ref 或 fork 仓库。源码必须包含 CI 适配脚本，旧源码会在安装依赖前失败。仅选择可信分支：其构建代码将在签名机器上执行。这是操作约定，不提供工作流来源强制限制或凭据隔离。发布使用记录的 commit，并要求该提交仍在所选分支历史中；正常追加提交不影响发布，删除分支或导致历史分叉的强推会拒绝。tag 发布要求 tag 仍指向记录的提交。从 `master` 发起发布；托管路由 job 会在派发到原机器前拒绝其他 ref。实际打包源码提交单独记录。`version_mode=default` 对 production 选择 product，对 test 选择 auto；product 保留所选源码版本，auto 追加日期/run/attempt，manual 要求填写 `build_version`。stable 包要求稳定版本，因此 test/stable 需选择 product 或稳定的手填版本。可选 `test_release_id` 是测试 URL 前缀：留空沿用机器默认值，同一平台连续升级测试需保持相同值，并应定期轮换默认值。它不是 GitHub run ID。格式校验和轮换限制见[打包配置](../../packaging/README.zh.md#configuration-and-local-builds)。 -打包只保留文件。成功后，在 `master` 上打开 **Publish Desktop · COS → Run workflow**，填写打包运行 URL 中的 `package_run_id`，并可填写 `package_run_attempt`。留空选择最新尝试，且该尝试必须成功，不会回退到较早的成功尝试；显式填写则选择对应的成功构建。Windows 必须完成签名，macOS 必须完成公证和 stapling。GitHub job 证据确定原 runner，本机清单在审批前提供 preset、版本、源码和通道。不会下载安装包或请求 artifact。旧清单的 `publishRequested=false` 不影响发布资格；本机文件缺失或变化会停止发布。 +打包只保留文件。成功后，在 `master` 上打开 **Publish Desktop · COS → Run workflow**，填写打包运行 URL 中的 `package_run_id`，并可填写 `package_run_attempt`。留空选择最新尝试及其成功的 package job；归档重跑继续使用原始构建 attempt，新的构建失败时不回退到较早成功构建。显式填写则选择对应构建，独立的 GitHub 归档失败不取消其资格。Windows 必须完成签名，macOS 必须完成公证和 stapling。GitHub job 证据确定原 runner，本机清单在审批前提供 preset、版本、源码和通道。不会下载安装包或请求 artifact。旧清单的 `publishRequested=false` 不影响发布资格；本机文件缺失或变化会停止发布。 在原 runner 安装依赖前，准备阶段和审批后的发布 job 都会检查所选 `publishing/.json` 是否为可读取的 JSON。配置缺失时会报告路径；补齐后可使用同一个包重试发布。之后仍会执行完整配置与签名校验。上传前，发布器校验全部留存文件的哈希、版本及目标信息，再复核平台签名。macOS 校验 DMG，并解压 ZIP 校验 app 票据；Windows 校验 Authenticode、配置的签名证书指纹及时间戳。准备阶段生成中文审批摘要，分别展示版本、通道、平台和环境，以及留存的 test release ID、安装包与升级 YAML 的完整 URL、原打包尝试链接、源码 ref/SHA、平台校验结果及拟创建的 tag。折叠详情包含 COS 存储桶，以及实际上传字节的大小和 SHA-256（包括改写后的 YAML）。公开仓库的摘要会公开测试前缀和下载 URL；前缀不提供访问鉴权。两种发布 job 均等待 **Review deployments → Approve and deploy**，随后重新核对已批准的 manifest 与上传计划摘要。文件或目标变化会被拒绝。审批不能修改版本；应拒绝并重新打包。两种环境都上传缺失文件、校验远端字节，再更新 YAML。此工作流没有只上传文件的模式。production 最后为记录的打包提交创建 `desktop-v`；已有 tag 必须指向同一提交。 @@ -80,7 +80,17 @@ Environment 审批限制此工作流，不限制同一机器账户运行的任 ## 恢复与记录 -解决故障后重跑失败的发布 job，以保持准备阶段选定的打包尝试；也可显式填写原打包运行和尝试，发起新的发布。尝试留空时重跑所有 job 会重新解析最新打包尝试，并需要重新审批。不要仅为重试上传而重新打包。缺失对象会上传，相同对象跳过，同名但字节不同的对象会停止操作。写入结果不明时通过读取远端字节核对。频道已有更高版本时，旧上传不能替换它。每个包只更新自身内置通道：nightly 写入 `nightly.yml` / `nightly-mac.yml`，stable 写入 `stable.yml` / `stable-mac.yml`。stable 二进制位于目标二进制前缀下的 `stable/` 子目录，与已有 nightly 对象分离。同一源码和版本发布到两个通道需要分别打包；已有发布 tag 仅在源码提交相同时复用。 +打包 workflow 将 `package` 与 `upload-artifact`（GitHub 产物归档）分开。所有打包模式（包括 test 和 unsigned）都要求在打包前配置 `DESKTOP_PUBLISH_RUNNERS`，用于将归档路由到原机器。归档失败后仅重跑 `upload-artifact`；它校验原始 manifest 和 hash，不重新构建、签名或公证。打包诊断归档尽力执行，不改变构建成功状态。归档重跑若一直排队且未分配 runner，应先检查解析出的 runner 标签和上游 package 输出，不能直接认定机器离线。输出缺失时需由操作者从原留存目录和 manifest 恢复文件；重跑整个 workflow 会重新构建，不属于仅归档恢复。Actions 验收须验证输出复用。 + +生产 COS 发布默认启用官网安装包上传和缓存刷新（`upload_website=true`）。取消后仅发布版本化资源及自动更新清单；test 发布不修改生产官网。`upload-website-installer` 上传固定安装包，`purge-website-installer` 刷新该 URL。官网安装包校验器只需要最终 DMG/EXE 和保留的 manifest，匹配生产资格、构建身份及平台，只计算一次安装包 hash，并通过同一打开的文件句柄上传。production nightly 和 stable 包都可以替换官网固定安装包。操作者负责选择预期版本；固定对象没有防降级保护，重跑旧发布可能覆盖新安装包。勾选官网上传时，审批前摘要展示固定官网 URL、选定版本和无防降级保护的说明。原有版本与自动更新发布保留自身校验。 + +将仓库变量 `DOWNLOAD_PROD_EO_ZONE_ID` 配置为生产 EdgeOne 站点。生产 COS 凭据还需要 `teo:CreatePurgeTask` 和 `teo:DescribePurgeTasks` 权限。官网上传在 Actions 中按 bucket/平台互斥，在原机器上按 bucket/对象互斥；缓存观察单独运行。版本发布、官网上传和缓存刷新分别使用生产审批 Environment，后续 job 和重跑可能需要再次审批。GitHub 每个并发组最多保留一个排队 job，新排队 job 可能取消旧排队 job；重跑前应检查取消记录。 + +官网状态保存在 releases 根目录同级的 `upload-records/website-<发布 run ID>-/state.json`。macOS 和 Windows 在各自本地磁盘使用相同记录格式。官网 URL 和保存文件名遵循[固定下载规则](../README.zh.md#fixed-downloads)。上传重跑同时核对字节和 `Content-Disposition`；字节相同但响应头缺失或错误时，上传一次并读回验证。记录已完成但远端字节改变时停止恢复，需要重新审批发布。完成标记在元数据修复失败后仍保留。每次新的上传意图清除旧刷新记录，因此修复元数据后需重新刷新缓存；上一次任务 ID 和诊断需查 EdgeOne 历史。未知写入先读取再决定重试；CDN 响应头透传仍需实测。原机器路由和准备阶段输出完整时，仅重跑刷新 job 即可查询已保存任务。启用官网上传时，官网 job 仅跳过明确选择的 test 环境。各 job 的本地预检要求其注入的 `route` 或 `selection` 输出存在。官网审批缺失或变化时，在上传或提交刷新任务前失败。`website-destination` 缺失会扩大两个官网并发组的互斥范围。`runner` 输出缺失可能导致无法调度，尚未进入预检。输出缺失时停止局部重试，workflow 不重建这些输出。重新启动发布 workflow 前，先检查当前远端状态并确认上传范围的审批；这不属于仅缓存恢复。不要为恢复发布输出重跑打包。人工重跑确认旧任务失败后可提交一次。提交响应丢失时查询匹配的历史记录，不重新提交。unknown 带任务 ID 表示提交已确认；没有 ID 则可能从未提交。人工恢复前应检查 EdgeOne 历史，重新发起发布运行是恢复方式之一。操作者也可使用已有的[固定下载刷新命令](../README.zh.md#fixed-downloads)；Windows 操作者使用该处说明的 DPAPI 凭据启动器。该命令只提交固定 URL 刷新，不观察完成状态，也不更新本次 Actions 运行的 journal。确认恢复完成前应在 EdgeOne 检查返回的任务。 + +刷新观察每十秒查询一次，最长五分钟；结果未知或观察超时后额外查询一次。明确的 failed、timeout、canceled 结果使 job 失败。仍无法确认时成功退出，并输出 Actions warning 和醒目摘要；持久化状态保持 unknown，不标为完成。诊断 artifact 尽力归档，本地记录仍是恢复依据。模拟服务测试覆盖这些路径；发布操作者必须在生产依赖恢复能力前验证 COS/EdgeOne 权限、job-id 筛选、时间范围查询、任务类型和时间戳格式、Actions 跨 attempt 恢复及实际 CDN 行为。 + +解决故障后，仅在上文要求的上游输出完整时重跑失败的发布 job，以保持准备阶段选定的打包尝试；否则停止局部重试。新发布可显式选择原打包运行和尝试。尝试留空时重跑所有 job 会重新解析最新打包尝试，并需要重新审批。不要仅为重试上传而重新打包。缺失对象会上传，相同对象跳过，同名但字节不同的对象会停止操作。写入结果不明时通过读取远端字节核对。频道已有更高版本时，旧上传不能替换它。每个包只更新自身内置通道：nightly 写入 `nightly.yml` / `nightly-mac.yml`，stable 写入 `stable.yml` / `stable-mac.yml`。stable 二进制位于目标二进制前缀下的 `stable/` 子目录，与已有 nightly 对象分离。同一源码和版本发布到两个通道需要分别打包；已有发布 tag 仅在源码提交相同时复用。 同级 `upload-records/` 目录保留操作标识、逐行事件和最终结果。频道写入意图同时记录先前和目标 YAML。失败记录阶段、安全错误分类与诊断；COS 失败还标明 `GetObject` 或 `PutObject`，并在可用时记录经过校验的 HTTP 状态码和 request ID。访问拒绝提示会指出需检查的权限。不保存原始服务响应或凭据。审计初始化在文件完整后才可见；遗留的 `.initializing-*` 目录不参与已完成发布的扫描。写入和回读在继续操作前落盘；没有最终结果代表中断，不代表成功。Actions 还将操作记录保存为诊断 artifact，保留 30 天。这些本地记录不防篡改。COS 回读验证存储字节，不代表公开 CDN 行为；公开下载需单独验收。 diff --git a/apps/desktop/scripts/archive-desktop-ci.ts b/apps/desktop/scripts/archive-desktop-ci.ts new file mode 100644 index 0000000000..849433b698 --- /dev/null +++ b/apps/desktop/scripts/archive-desktop-ci.ts @@ -0,0 +1,31 @@ +/** Validate the original machine and immutable inventory before GitHub artifact archival. */ +import { resolve } from 'node:path' +import { desktopPublicationFailure } from './desktop-publication-failure.ts' +import { desktopReleasesRoot } from './retain-desktop-ci.ts' +import { retainedDesktopPath, verifyRetainedDesktopRelease } from './desktop-release-store.ts' + +/** + * Verify an original build without interpreting the archive job's attempt as a new build. + * @param env Original build outputs and current Actions machine identity. + * @returns Resolves after the retained inventory passes all digest checks. + */ +export async function verifyDesktopArchive(env: NodeJS.ProcessEnv): Promise { + if (!env.RUNNER_NAME || env.RUNNER_NAME !== env.DESKTOP_PACKAGE_RUNNER) throw new Error('desktop archival: wrong original machine') + const root = desktopReleasesRoot(env) + const runId = env.GITHUB_RUN_ID || '' + const attempt = env.DESKTOP_PACKAGE_ATTEMPT || '' + const expected = retainedDesktopPath(root, runId, attempt) + if (env.DESKTOP_RETAINED_DIRECTORY !== expected) throw new Error('desktop archival: retained directory differs from original build') + const manifest = await verifyRetainedDesktopRelease(root, runId, attempt) + if (manifest.source.repository !== env.GITHUB_REPOSITORY || manifest.source.runnerName !== env.RUNNER_NAME) { + throw new Error('desktop archival: retained source does not match repository or machine') + } +} + +if (process.argv[1] !== undefined && resolve(process.argv[1]) === import.meta.filename) { + try { await verifyDesktopArchive(process.env) } + catch (error) { + process.stderr.write(`${JSON.stringify(desktopPublicationFailure(error, 'artifact archival'))}\n`) + process.exitCode = 1 + } +} diff --git a/apps/desktop/scripts/desktop-auto-update-environment.d.mts b/apps/desktop/scripts/desktop-auto-update-environment.d.mts index 98a6309d14..c58df5a048 100644 --- a/apps/desktop/scripts/desktop-auto-update-environment.d.mts +++ b/apps/desktop/scripts/desktop-auto-update-environment.d.mts @@ -14,6 +14,13 @@ export type DesktopAutoUpdateTarget = 'mac-arm64' | 'mac-x64' | 'win-x64' */ export function desktopLatestInstallerFilename(target: DesktopAutoUpdateTarget): string +/** + * Resolve the production website installer URL shared by approval, upload and purge. + * @param target Supported Desktop target. + * @returns Fixed production download URL. + */ +export function desktopWebsiteInstallerUrl(target: DesktopAutoUpdateTarget): string + /** Public updater URL and object prefixes for one release target. */ export interface DesktopAutoUpdateConfig { readonly environment: DesktopAutoUpdateEnvironment diff --git a/apps/desktop/scripts/desktop-auto-update-environment.mjs b/apps/desktop/scripts/desktop-auto-update-environment.mjs index 33cff177a2..24aaa0ea2c 100644 --- a/apps/desktop/scripts/desktop-auto-update-environment.mjs +++ b/apps/desktop/scripts/desktop-auto-update-environment.mjs @@ -46,6 +46,15 @@ export function desktopLatestInstallerFilename(target) { return `dsh-latest-${windows ? 'windows' : 'macos'}-${target === 'mac-arm64' ? 'arm64' : 'x64'}.${windows ? 'exe' : 'dmg'}` } +/** + * Resolve the production website installer URL shared by approval, upload and purge. + * @param {'mac-arm64' | 'mac-x64' | 'win-x64'} target Supported Desktop target. + * @returns {string} Fixed production download URL. + */ +export function desktopWebsiteInstallerUrl(target) { + return `${UPDATE_ENVIRONMENTS.production.fixedOrigin}/desktop/${desktopLatestInstallerFilename(target)}` +} + /** * Resolve the update deployment, defaulting local release work to test. * @param {NodeJS.ProcessEnv} env - Packaging or upload environment. diff --git a/apps/desktop/scripts/desktop-file-settings.d.mts b/apps/desktop/scripts/desktop-file-settings.d.mts new file mode 100644 index 0000000000..5b2597341c --- /dev/null +++ b/apps/desktop/scripts/desktop-file-settings.d.mts @@ -0,0 +1,9 @@ +/** Read file-owned packaging settings without loading packaging dependencies. */ + +/** + * Read an explicitly selected dotenv without exposing credential-bearing parser errors. + * @param path - Selected file; relative file settings resolve beside it. + * @param accepts - Whether this file may declare a setting. + * @returns Validated file settings. + */ +export function readDesktopPackageSettings(path: string, accepts: (name: string) => boolean): Record diff --git a/apps/desktop/scripts/desktop-file-settings.mjs b/apps/desktop/scripts/desktop-file-settings.mjs new file mode 100644 index 0000000000..8c48f9e3f0 --- /dev/null +++ b/apps/desktop/scripts/desktop-file-settings.mjs @@ -0,0 +1,40 @@ +/** Read file-owned packaging settings without loading packaging dependencies. */ +import { readFileSync } from 'node:fs' +import { dirname, resolve } from 'node:path' +import { parseEnv } from 'node:util' + +const FILE_SETTINGS = ['DSH_DESKTOP_WINDOWS_CER_FILE', 'DSH_DESKTOP_WINDOWS_SIGNTOOL', 'APPLE_API_KEY', 'APPLE_KEYCHAIN', 'CSC_LINK'] + +/** + * Read an explicitly selected dotenv without exposing credential-bearing parser errors. + * @param {string} path Selected file; relative file settings resolve beside it. + * @param {(name: string) => boolean} accepts Whether this file may declare a setting. + * @returns {Record} Validated file settings. + */ +export function readDesktopPackageSettings(path, accepts) { + let contents + try { + contents = readFileSync(path, 'utf8') + } + catch { + throw new Error(`desktop package: cannot read ${path}; copy ${path}.example and fill in the local settings`) + } + let settings + try { + settings = parseEnv(contents.replace(/^\uFEFF/u, '')) + } + catch { + // Parser diagnostics can contain credential-bearing input. + throw new Error(`desktop package: invalid dotenv syntax in ${path}`) + } + for (const name of Object.keys(settings)) { + if (!accepts(name)) { + throw new Error(`desktop package: unsupported setting ${name} in ${path}; use the platform template`) + } + if (settings[name].includes('\0')) throw new Error(`desktop package: ${name} cannot contain a NUL character`) + } + for (const name of FILE_SETTINGS) { + if (settings[name]?.trim()) settings[name] = resolve(dirname(path), settings[name].trim()) + } + return settings +} diff --git a/apps/desktop/scripts/desktop-package-environment.mjs b/apps/desktop/scripts/desktop-package-environment.mjs index 27a7f92c7f..83e9dbbc0f 100644 --- a/apps/desktop/scripts/desktop-package-environment.mjs +++ b/apps/desktop/scripts/desktop-package-environment.mjs @@ -1,9 +1,9 @@ /** Select local test defaults or platform release settings without changing the caller's environment. */ -import { accessSync, constants, readFileSync, statSync } from 'node:fs' -import { dirname, isAbsolute, join, resolve } from 'node:path' +import { accessSync, constants, statSync } from 'node:fs' +import { dirname, isAbsolute, join } from 'node:path' import { fileURLToPath } from 'node:url' -import { parseEnv } from 'node:util' +import { readDesktopPackageSettings as readSettings } from './desktop-file-settings.mjs' import { resolveDesktopAppId, resolveMacOSNotarizationEnvironment, resolveMacOSSigningEnvironment, resolveNpmRegistry } from './desktop-release-environment.mjs' import { resolveDesktopAutoUpdateConfig } from './desktop-auto-update-environment.mjs' import { createWindowsTokenSigner } from './windows-sign.mjs' @@ -19,7 +19,6 @@ const SHARED_SETTING = /^(?:DSH_DESKTOP_(?:APP_ID|AUTO_UPDATE_ENV|NPM_REGISTRY|M const WINDOWS_SETTING = /^DSH_DESKTOP_WINDOWS_(?:CER_FILE|SIGNTOOL|KEY_CONTAINER|TOKEN_PIN|SIGNATURE_CACHE_DIR|SIGNATURE_CACHE_CONCURRENCY|PACK_CONCURRENCY|COMPRESSION_LEVEL)$/u const MACOS_SETTING = /^(?:DSH_DESKTOP_MACOS_(?:SIGNING_IDENTITY|TEAM_ID|SIGNATURE_CACHE_DIR|PACK_CONCURRENCY|ZIP_COMPRESSION_LEVEL|DOWNLOAD_PROXY|NOTARIZATION_PROXY)|APPLE_(?:API_KEY|API_KEY_ID|API_ISSUER|ID|APP_SPECIFIC_PASSWORD|TEAM_ID|KEYCHAIN|KEYCHAIN_PROFILE)|CSC_(?:LINK|KEY_PASSWORD))$/u const AMBIENT_RELEASE_SETTING = /^(?:DSH_DESKTOP_(?:APP_ID|AUTO_UPDATE_ENV|MANDATORY_UPDATE_.*|WINDOWS_.*|MACOS_.*)|APPLE_.*|(?:WIN_)?CSC_.*|DOWNLOAD_(?:TEST|PROD)_.*)$/iu -const FILE_SETTINGS = ['DSH_DESKTOP_WINDOWS_CER_FILE', 'DSH_DESKTOP_WINDOWS_SIGNTOOL', 'APPLE_API_KEY', 'APPLE_KEYCHAIN', 'CSC_LINK'] /** * Select local macOS test defaults without reading dotenv files or inheriting release settings. @@ -101,40 +100,6 @@ export function loadDesktopPackageEnvironment(platform, environment = process.en } } -/** - * Read an explicitly selected dotenv without exposing credential-bearing parser errors. - * @param {string} path Selected file; relative file settings resolve beside it. - * @param {(name: string) => boolean} accepts Whether this file may declare a setting. - * @returns {NodeJS.ProcessEnv} Validated file settings. - */ -function readSettings(path, accepts) { - let contents - try { - contents = readFileSync(path, 'utf8') - } - catch { - throw new Error(`desktop package: cannot read ${path}; copy ${path}.example and fill in the local settings`) - } - let settings - try { - settings = parseEnv(contents.replace(/^\uFEFF/u, '')) - } - catch { - // Parser diagnostics can contain credential-bearing input. - throw new Error(`desktop package: invalid dotenv syntax in ${path}`) - } - for (const name of Object.keys(settings)) { - if (!accepts(name)) { - throw new Error(`desktop package: unsupported setting ${name} in ${path}; use the platform template`) - } - if (settings[name].includes('\0')) throw new Error(`desktop package: ${name} cannot contain a NUL character`) - } - for (const name of FILE_SETTINGS) { - if (settings[name]?.trim()) settings[name] = resolve(dirname(path), settings[name].trim()) - } - return settings -} - function requireReadableFile(environment, name) { try { if (!statSync(environment[name]).isFile()) throw new Error('not a file') diff --git a/apps/desktop/scripts/desktop-publication-failure.ts b/apps/desktop/scripts/desktop-publication-failure.ts index 930c23da2d..3772fb0b67 100644 --- a/apps/desktop/scripts/desktop-publication-failure.ts +++ b/apps/desktop/scripts/desktop-publication-failure.ts @@ -1,5 +1,6 @@ /** Safe failure details shared by publication diagnostics and durable journals. */ import { ZodError } from 'zod' +import { DesktopPurgeExecutionError } from './desktop-purge-recovery.ts' import { DesktopPublishError } from './desktop-publish.ts' const publicCodes = new Set(['AccessDenied', 'InternalError', 'NoSuchBucket', 'BadDigest', 'SignatureDoesNotMatch', @@ -39,12 +40,15 @@ export function desktopPublicationFailure(error: unknown, phase: string): { ...(typeof requestId === 'string' && /^[\w+/=.-]{1,256}$/u.test(requestId) ? { requestId } : {}), ...(typeof status === 'number' && Number.isInteger(status) && status >= 100 && status <= 599 ? { httpStatus: status } : {}) } } + if (error instanceof DesktopPurgeExecutionError) return { phase, code: `purge-${error.status}`, message: error.message } if (error instanceof DesktopPublishError) return { phase, code: error.code, message: error.message } if (error instanceof ZodError) return { phase, code: 'invalid-data', message: `Invalid fields: ${error.issues.map(issue => `${issue.path.join('.') || '(root)'} (${issue.code})`).join(', ')}` } if (error instanceof SyntaxError) return { phase, code: 'invalid-json', message: 'Invalid JSON; check the configuration or retained record for this stage.' } - const ownedMessage = /^(desktop (?:publish|release store|retention|rollback|tag|upload|auto-update|macOS signing|build)[^\n]*:|Usage:)/u - if (error instanceof Error && ownedMessage.test(error.message)) { + const ownedMessage = + /^(desktop (?:publish|archival|release store|retention|rollback|tag|upload|auto-update|macOS signing|build)[^\n]*:|Usage:)/u + const websiteMessage = /^website (?:publication|installer|cache purge):/u + if (error instanceof Error && (ownedMessage.test(error.message) || websiteMessage.test(error.message))) { return { phase, code: 'validation', message: error.message } } const record = typeof error === 'object' && error !== null ? error : {} diff --git a/apps/desktop/scripts/desktop-publication-summary.ts b/apps/desktop/scripts/desktop-publication-summary.ts index 4d2d437dd3..49d438aaf2 100644 --- a/apps/desktop/scripts/desktop-publication-summary.ts +++ b/apps/desktop/scripts/desktop-publication-summary.ts @@ -1,6 +1,7 @@ /** Render the verified publication plan for GitHub's native deployment reviewers. */ import { createHash } from 'node:crypto' import { createReadStream } from 'node:fs' +import { desktopWebsiteInstallerUrl } from './desktop-auto-update-environment.mjs' import type { DesktopRetainedSource } from './desktop-release-store.ts' import type { DesktopUploadPlan } from './desktop-upload-plan.ts' @@ -18,10 +19,11 @@ function link(url: string, label = url): string { return ` { const origin = new URL(plan.publicUrl).origin const url = (key: string) => `${origin}/${key.split('/').map(encodeURIComponent).join('/')}` @@ -52,6 +54,8 @@ export async function desktopPublicationSummary( row('升级 YAML', `${feeds.map(file => link(url(file.key))).join('
')}
本次发布将更新此文件；审批前可能不存在或仍指向旧版本。`), row('打包来源', `${link(runUrl, `查看打包运行 #${source.runId} · 第 ${source.attempt} 次尝试`)}
源码：${code(`${source.sourceRef} @ ${source.commit}`)}
打包机器：${code(source.runnerName)}`), row('签名与公证', plan.target === 'win-x64' ? 'EXE 签名校验通过' : 'DMG 校验通过
ZIP 内应用校验通过'), + ...(uploadWebsite && plan.environment === 'production' ? [row('官网固定安装包', + `${link(desktopWebsiteInstallerUrl(plan.target))}
替换为版本 ${code(plan.version)}；已有安装包会被替换，无防降级保护；官网上传与刷新在后续 job 中执行，可能需另行审批。`)] : []), row('Git tag', tag), '', '### 批准后将执行', '', '1. 重新校验产物与发布目标；若与审批摘要不一致则停止。', '2. 上传缺少的文件，跳过内容一致的已有文件；发现内容冲突则停止。', diff --git a/apps/desktop/scripts/desktop-publish-cos.ts b/apps/desktop/scripts/desktop-publish-cos.ts index 00a6f108d1..086303238e 100644 --- a/apps/desktop/scripts/desktop-publish-cos.ts +++ b/apps/desktop/scripts/desktop-publish-cos.ts @@ -49,8 +49,9 @@ export function desktopPublishCos( }) try { const cos = client() - await cosOperation(cos, 900_000, () => cos.getObject({ ...address, Output: output })) - return { size, sha512: sha512.digest('base64'), ...(channel ? { contents: Buffer.concat(chunks).toString('utf8') } : {}) } + const response = await cosOperation(cos, 900_000, () => cos.getObject({ ...address, Output: output })) + return { size, sha512: sha512.digest('base64'), + ...(typeof response.headers?.['content-disposition'] === 'string' ? { contentDisposition: response.headers['content-disposition'] } : {}), ...(channel ? { contents: Buffer.concat(chunks).toString('utf8') } : {}) } } catch (error) { if (missing(error)) return null throw new DesktopCosOperationError('GetObject', error) @@ -71,7 +72,8 @@ export function desktopPublishCos( try { await cosOperation(cos, 900_000, () => cos.putObject({ ...address, Body: body, ContentLength: digest.size, ContentType: artifact.contentType, - Headers: { 'Content-MD5': md5.digest('base64'), ...(forbidOverwrite ? { 'x-cos-forbid-overwrite': 'true' } : {}) }, + Headers: { 'Content-MD5': md5.digest('base64'), + ...(artifact.contentDisposition ? { 'Content-Disposition': artifact.contentDisposition } : {}), ...(forbidOverwrite ? { 'x-cos-forbid-overwrite': 'true' } : {}) }, })) } catch (error) { throw new DesktopCosOperationError('PutObject', error) diff --git a/apps/desktop/scripts/desktop-publish-route.ts b/apps/desktop/scripts/desktop-publish-route.ts index 5c8d7a9ef3..dfd480842c 100644 --- a/apps/desktop/scripts/desktop-publish-route.ts +++ b/apps/desktop/scripts/desktop-publish-route.ts @@ -1,4 +1,4 @@ -/** Validate a completed packaging attempt and route publication back to its original runner. */ +/** Validate package-job success and route publication; attempt selection enforces run completion. */ import { z } from 'zod' import { desktopPublishRunnersSchema, desktopPackageWorkflows } from './desktop-publish-targets.ts' import { desktopPublishQualificationError } from './desktop-publish-qualification.mjs' @@ -6,7 +6,7 @@ import { desktopPublishQualificationError } from './desktop-publish-qualificatio const positive = z.number().int().positive() const runSchema = z.object({ id: positive, run_attempt: positive, head_sha: z.string().regex(/^[a-f0-9]{40}$/u), - path: z.string(), conclusion: z.literal('success'), event: z.literal('workflow_dispatch'), + path: z.string(), event: z.literal('workflow_dispatch'), repository: z.object({ full_name: z.string() }), }) const requestSchema = z.object({ source: z.object({ diff --git a/apps/desktop/scripts/desktop-publish.ts b/apps/desktop/scripts/desktop-publish.ts index 1270f7229e..d11e2bd098 100644 --- a/apps/desktop/scripts/desktop-publish.ts +++ b/apps/desktop/scripts/desktop-publish.ts @@ -8,8 +8,8 @@ import type { DesktopUploadArtifact, DesktopUploadPlan } from './desktop-upload- /** File identity computed from bytes, never inferred from COS ETags. */ export interface DesktopObjectDigest { readonly size: number; readonly sha512: string } -/** Remote object observation; channel objects additionally carry their exact YAML. */ -export interface DesktopRemoteObject extends DesktopObjectDigest { readonly contents?: string } +/** Remote bytes, optional download filename header, and exact YAML for channel objects. */ +export interface DesktopRemoteObject extends DesktopObjectDigest { readonly contents?: string; readonly contentDisposition?: string } /** Transport owned by the caller holding the destination channel lock. */ export interface DesktopPublishTransport { /** Read and hash remote bytes; only a confirmed missing object returns null. */ diff --git a/apps/desktop/scripts/desktop-purge-recovery.ts b/apps/desktop/scripts/desktop-purge-recovery.ts new file mode 100644 index 0000000000..890ea003ba --- /dev/null +++ b/apps/desktop/scripts/desktop-purge-recovery.ts @@ -0,0 +1,149 @@ +/** Resume a fixed-URL purge without repeating ambiguous submissions. */ +import type { teo } from 'tencentcloud-sdk-nodejs-teo' +import type { DesktopPurgeConfig } from './desktop-edgeone.ts' + +/** Non-secret evidence saved before submission and after every observation. */ +export interface DesktopPurgeRecord { + readonly zoneId: string + readonly publicUrl: string + readonly submittedAt: string + readonly jobId?: string | undefined + readonly status: 'pending' | 'processing' | 'success' | 'failed' | 'timeout' | 'canceled' | 'unknown' + readonly observedAt?: string | undefined + readonly diagnostic?: string | undefined +} + +/** SDK requests used by the recovery owner. */ +export type DesktopPurgeRecoveryClient = Pick, 'CreatePurgeTask' | 'DescribePurgeTasks'> + +/** Explicit bounded observation policy; writes are never automatically retried. */ +export interface DesktopPurgeRecoveryOptions { + readonly intervalMs: number + readonly waitMs: number + readonly allowResubmit: boolean + readonly now: () => number + readonly sleep: (milliseconds: number) => Promise + readonly save: (record: DesktopPurgeRecord) => Promise +} + +/** A confirmed remote failure, distinct from an unconfirmed observation. */ +export class DesktopPurgeExecutionError extends Error { + constructor(readonly status: 'failed' | 'timeout' | 'canceled') { + super(`website cache purge: ${status}; inspect the task before manually rerunning`) + } +} + +function failed(status: DesktopPurgeRecord['status']): status is 'failed' | 'timeout' | 'canceled' { + return status === 'failed' || status === 'timeout' || status === 'canceled' +} + +async function observe(record: DesktopPurgeRecord, client: DesktopPurgeRecoveryClient, + now: number, config: DesktopPurgeConfig): Promise { + const observedAt = new Date(now).toISOString() + const unknown = (diagnostic: string): DesktopPurgeRecord => ({ ...record, status: 'unknown', observedAt, diagnostic }) + const matches = [] + try { + let offset = 0 + do { + const response = await client.DescribePurgeTasks({ + ZoneId: record.zoneId, Limit: 1000, Offset: offset, + ...(record.jobId ? { Filters: [{ Name: 'job-id', Values: [record.jobId] }] } : { + StartTime: record.submittedAt, + EndTime: new Date(Math.min(now, Date.parse(record.submittedAt) + 120_000)).toISOString(), + }), + }) + if (!Array.isArray(response.Tasks) || typeof response.TotalCount !== 'number') return unknown('invalid query response') + for (const task of response.Tasks) { + if (task.Target !== record.publicUrl || task.Type !== 'purge_url') continue + if (record.jobId ? task.JobId !== record.jobId + : !task.CreateTime || !Number.isFinite(Date.parse(task.CreateTime)) + || Date.parse(task.CreateTime) < Date.parse(record.submittedAt) + || Date.parse(task.CreateTime) > Date.parse(record.submittedAt) + 120_000) continue + matches.push(task) + } + offset += response.Tasks.length + if (offset >= response.TotalCount) break + if (response.Tasks.length === 0 || offset >= 10_000) return unknown('task history could not be fully inspected') + } while (true) + } catch (error) { return unknown('task query failed; check EdgeOne history and DescribePurgeTasks permission') } + if (matches.length === 0) return unknown(record.jobId + ? 'accepted task not found in query history; execution result unconfirmed' + : 'no matching submission found; purge may not have been submitted; inspect EdgeOne history before manual recovery') + if (matches.length !== 1) return unknown('multiple matching submissions found; cannot identify this submission') + const task = matches[0]! + if (!task.JobId || !/^[\w.-]{1,128}$/u.test(task.JobId) + || task.JobId.includes(config.secretId) || task.JobId.includes(config.secretKey)) return unknown('query returned no usable task ID') + const status = task.Status + if (status !== 'processing' && status !== 'success' && status !== 'failed' && status !== 'timeout' && status !== 'canceled') { + return unknown('query returned an unknown task status') + } + return { zoneId: record.zoneId, publicUrl: record.publicUrl, submittedAt: record.submittedAt, + jobId: task.JobId, status, observedAt } +} + +/** + * Submit at most once, or reconcile an earlier submission, then observe bounded completion. + * Unknown results receive one additional query and return unknown for warning-only Actions completion. + * @param config Validated destination and credentials; credentials never enter records. + * @param previous Durable record, or undefined for a new publication. + * @param client SDK client with bounded requests and no submission retry policy. + * @param options Clock, persistence, timing and explicit manual-resubmission authorization. + * @returns Successful or unconfirmed result; confirmed failures throw after durable recording. + */ +export async function recoverDesktopPurge(config: DesktopPurgeConfig, previous: DesktopPurgeRecord | undefined, + client: DesktopPurgeRecoveryClient, options: DesktopPurgeRecoveryOptions): Promise { + if (options.intervalMs <= 0 || options.waitMs < 0) throw new Error('website cache purge: invalid observation budget') + if (previous && (previous.zoneId !== config.zoneId || previous.publicUrl !== config.publicUrl)) { + throw new Error('website cache purge: saved destination differs from selected publication') + } + let record = previous + let observedPrevious = false + if (record) { + record = await observe(record, client, options.now(), config) + observedPrevious = true + await options.save(record) + if (record.status === 'success') return record + if (failed(record.status)) { + if (!options.allowResubmit) throw new DesktopPurgeExecutionError(record.status) + record = undefined + observedPrevious = false + } + } + if (!record) { + record = { zoneId: config.zoneId, publicUrl: config.publicUrl, + submittedAt: new Date(Math.floor(options.now() / 1000) * 1000).toISOString(), status: 'pending' } + await options.save(record) + let response: Awaited> | undefined + try { response = await client.CreatePurgeTask({ ZoneId: config.zoneId, Type: 'purge_url', Targets: [config.publicUrl] }) } + catch (error) { /* Submission may have reached EdgeOne; reconcile history without repeating the request. */ } + const jobId = response?.JobId + if (response?.FailedList?.length) { + record = { ...record, status: 'failed' } + } else if (typeof jobId === 'string' && /^[\w.-]{1,128}$/u.test(jobId) + && !jobId.includes(config.secretId) && !jobId.includes(config.secretKey)) { + record = { ...record, status: 'processing', jobId } + } else { + record = { ...record, status: 'unknown', diagnostic: 'submission acceptance unconfirmed; checking task history' } + } + await options.save(record) + if (failed(record.status)) throw new DesktopPurgeExecutionError(record.status) + } + let current: DesktopPurgeRecord = record + const deadline = options.now() + options.waitMs + let extraQuery = false + while (true) { + const observed: DesktopPurgeRecord = observedPrevious ? current : await observe(current, client, options.now(), config) + observedPrevious = false + current = observed + await options.save(current) + if (current.status === 'success') return current + if (failed(current.status)) throw new DesktopPurgeExecutionError(current.status) + if (extraQuery) { + current = { ...current, status: 'unknown', diagnostic: current.diagnostic ?? (options.now() >= deadline ? 'observation deadline exceeded' : 'task still processing after an additional query') } + await options.save(current) + return current + } + if (current.status === 'unknown' || options.now() >= deadline) extraQuery = true + await options.sleep(options.intervalMs) + } +} diff --git a/apps/desktop/scripts/desktop-release-store.ts b/apps/desktop/scripts/desktop-release-store.ts index bb3345aa74..eb9d5457ff 100644 --- a/apps/desktop/scripts/desktop-release-store.ts +++ b/apps/desktop/scripts/desktop-release-store.ts @@ -121,13 +121,13 @@ export async function retainDesktopRelease(root: string, source: DesktopRetained } /** - * Read an attempt and rehash every retained file before a consumer uses it. + * Read and validate manifest identity without requiring unrelated retained files. * @param root Persistent releases root. * @param runId Expected source run ID. * @param attempt Expected source attempt. - * @returns Parsed inventory; missing, linked, changed or mismatched files reject. + * @returns Parsed inventory; consumers must verify the files they use against their recorded digests. */ -export async function verifyRetainedDesktopRelease(root: string, runId: string, attempt: string): Promise { +export async function readRetainedDesktopManifest(root: string, runId: string, attempt: string): Promise { const path = retainedDesktopPath(root, runId, attempt) await directory(root) await directory(join(root, runId)) @@ -137,6 +137,19 @@ export async function verifyRetainedDesktopRelease(root: string, runId: string, const manifest = manifestSchema.parse(JSON.parse(await readFile(manifestPath, 'utf8'))) if (manifest.source.runId !== runId || manifest.source.attempt !== attempt) throw new Error('desktop release store: attempt identity mismatch') if (new Set(manifest.files.map(file => file.name)).size !== manifest.files.length) throw new Error('desktop release store: duplicate file inventory') + return manifest +} + +/** + * Verify every retained file against its immutable build manifest. + * @param root Persistent releases directory. + * @param runId Original packaging run. + * @param attempt Original packaging attempt, unchanged by archival reruns. + * @returns Manifest after all retained files pass size and hash verification. + */ +export async function verifyRetainedDesktopRelease(root: string, runId: string, attempt: string): Promise { + const manifest = await readRetainedDesktopManifest(root, runId, attempt) + const path = retainedDesktopPath(root, runId, attempt) for (const file of manifest.files) { const current = await fingerprint(join(path, file.name)) if (current.size !== file.size || current.sha512 !== file.sha512) throw new Error(`desktop release store: changed file ${file.name}`) diff --git a/apps/desktop/scripts/desktop-upload-plan.ts b/apps/desktop/scripts/desktop-upload-plan.ts index 1299dfdae8..e6a8d4c7f0 100644 --- a/apps/desktop/scripts/desktop-upload-plan.ts +++ b/apps/desktop/scripts/desktop-upload-plan.ts @@ -33,6 +33,8 @@ export interface DesktopUploadArtifact { readonly filename: string readonly key: string readonly contentType: string + /** Browser save name for fixed website downloads, preserving the validated installer basename. */ + readonly contentDisposition?: string readonly channelMetadata: boolean /** Published YAML with normalized artifact URLs; binary bytes remain file-backed. */ readonly contents?: string @@ -288,7 +290,8 @@ export async function createDesktopUploadPlan( bucket: update.bucket, secretIdEnvName: update.secretIdEnvName, secretKeyEnvName: update.secretKeyEnvName, - artifacts: options.latest ? [{ ...installerArtifact, filename: latestFilename, key: latestKey }] : artifacts, + artifacts: options.latest ? [{ ...installerArtifact, filename: latestFilename, key: latestKey, + contentDisposition: `attachment; filename="${installerArtifact.filename}"` }] : artifacts, ...typeof buildRecord.commit === 'string' ? { commit: buildRecord.commit } : {}, ...typeof buildRecord.dirty === 'boolean' ? { dirty: buildRecord.dirty } : {}, } diff --git a/apps/desktop/scripts/desktop-upload-run.ts b/apps/desktop/scripts/desktop-upload-run.ts index aa3cd49aa5..3bb305afde 100644 --- a/apps/desktop/scripts/desktop-upload-run.ts +++ b/apps/desktop/scripts/desktop-upload-run.ts @@ -101,7 +101,7 @@ export async function uploadDesktopRelease(plan: DesktopUploadPlan, cos: COS, re try { const response = await cos.putObject({ Bucket: plan.bucket, Region: DESKTOP_COS_REGION, Key: key, Body: body, ContentLength: artifact.size, ContentType: artifact.contentType, - Headers: { 'Content-MD5': artifact.md5 } }) + Headers: { 'Content-MD5': artifact.md5, ...(artifact.contentDisposition ? { 'Content-Disposition': artifact.contentDisposition } : {}) } }) confirmedPuts++ stage = 'record-response' recordPackagingEvent(directory, { type: 'put-confirmed', key, attempts: 1, ...receipt(response) }) diff --git a/apps/desktop/scripts/desktop-website-installer.ts b/apps/desktop/scripts/desktop-website-installer.ts new file mode 100644 index 0000000000..8e3838481f --- /dev/null +++ b/apps/desktop/scripts/desktop-website-installer.ts @@ -0,0 +1,116 @@ +/** Validate one production installer and hold its file handle through COS publication. */ +import { createHash } from 'node:crypto' +import { open, lstat, type FileHandle } from 'node:fs/promises' +import { join } from 'node:path' +import type { DesktopRetainedManifest } from './desktop-release-store.ts' +import type { DesktopPublishRoute } from './desktop-publish-route.ts' +import { desktopLatestInstallerFilename, desktopWebsiteInstallerUrl } from './desktop-auto-update-environment.mjs' +import { createDesktopCos, DESKTOP_COS_REGION, type DesktopCosCredentials } from './desktop-cos.ts' +import { cosOperation } from './cos-operation.ts' +import type { DesktopObjectDigest, DesktopPublishTransport } from './desktop-publish.ts' +import { DesktopCosOperationError } from './desktop-publication-failure.ts' +import type { DesktopUploadPlan } from './desktop-upload-plan.ts' + +/** Verified file and destination; the caller closes the handle after publication. */ +export interface DesktopWebsiteInstaller { + readonly plan: DesktopUploadPlan + readonly digest: DesktopObjectDigest + readonly md5: string + readonly contentDisposition: string + readonly handle: FileHandle +} + +/** + * Check production build identity and hash only the selected installer once. + * @param directory Retained build directory on the original runner. + * @param manifest Trusted retained build inventory matched against GitHub evidence. + * @param route Pinned build identity from the credential-free routing job. + * @param repository Repository expected by the workflow. + * @param bucket Approved production COS bucket. + * @returns An open verified installer; callers must close its handle in finally. + */ +export async function prepareWebsiteInstaller(directory: string, manifest: DesktopRetainedManifest, + route: DesktopPublishRoute, repository: string, bucket: string): Promise { + const source = manifest.source + if (route.preset !== 'production' || source.preset !== 'production' + || source.repository !== repository || source.runId !== route.runId || source.attempt !== route.attempt + || source.commit !== route.commit || source.runnerName !== route.runnerName || source.target !== route.target + || source.sourceRef !== route.sourceRef || source.channel !== route.channel + || source.qualification !== (route.target === 'win-x64' ? 'signed' : 'notarized') + || !/^(?:master|dsh-v[0-9][0-9A-Za-z.-]*)$/u.test(source.sourceRef)) { + throw new Error('website installer: build identity or production qualification mismatch') + } + const windows = route.target === 'win-x64' + const filename = `deepseek-harness-${source.version}-${route.target}.${windows ? 'exe' : 'dmg'}` + const file = manifest.files.find(item => item.name === filename) + if (!file) throw new Error('website installer: selected installer is absent from build manifest') + const path = join(directory, file.name) + const info = await lstat(path) + if (!info.isFile() || info.isSymbolicLink()) throw new Error('website installer: expected a regular installer file') + const handle = await open(path, 'r') + try { + const sha512 = createHash('sha512') + const md5 = createHash('md5') + let size = 0 + for await (const bytes of handle.createReadStream({ autoClose: false, start: 0 })) { + size += bytes.length + sha512.update(bytes) + md5.update(bytes) + } + const digest = { size, sha512: sha512.digest('base64') } + if (size !== file.size || digest.sha512 !== file.sha512) throw new Error('website installer: SHA-512 or size differs from build manifest') + const key = `desktop/${desktopLatestInstallerFilename(route.target)}` + const contentDisposition = `attachment; filename="${file.name}"` + return { handle, digest, contentDisposition, md5: md5.digest('base64'), plan: { + environment: 'production', target: route.target, version: source.version, commit: source.commit, dirty: false, + bucket, publicUrl: desktopWebsiteInstallerUrl(route.target), + secretIdEnvName: 'DOWNLOAD_PROD_COS_SECRET_ID', secretKeyEnvName: 'DOWNLOAD_PROD_COS_SECRET_KEY', + artifacts: [{ path, filename: file.name, key, channelMetadata: false, + contentDisposition, + contentType: windows ? 'application/vnd.microsoft.portable-executable' : 'application/x-apple-diskimage' }], + } } + } catch (error) { + await handle.close() + throw error + } +} + +/** + * Reconcile an earlier upload or replace the fixed object once using the already verified handle. + * @param installer Open installer verified against the selected build. + * @param credentials Production upload credentials, never logged. + * @param transport Read-only reconciliation adapter using the same destination. + * @param record Durable event writer; intent must persist before the remote write. + * @param options Optional COS factory and durable completion evidence; completed uploads cannot replace different remote bytes. + * @returns Whether bytes were uploaded or an existing identical object was reused. + */ +export async function uploadWebsiteInstaller(installer: DesktopWebsiteInstaller, credentials: DesktopCosCredentials, + transport: Pick, + record: (event: 'upload-intent' | 'uploaded') => Promise, + options: { createClient?: typeof createDesktopCos; previouslyUploaded?: boolean } = {}, +): Promise<'uploaded' | 'present'> { + const artifact = installer.plan.artifacts[0]! + const matches = (remote: DesktopObjectDigest | null) => + remote?.size === installer.digest.size && remote.sha512 === installer.digest.sha512 + const remote = await transport.read(artifact.key, false) + if (options.previouslyUploaded && !matches(remote)) throw new Error(`website installer: recorded upload no longer matches remote bytes (${remote === null ? 'object missing' : 'bytes changed'}); select and approve a new publication`) + if (matches(remote) && remote?.contentDisposition === installer.contentDisposition) { + await record('uploaded') + return 'present' + } + await record('upload-intent') + const body = installer.handle.createReadStream({ autoClose: false, start: 0 }) + const cos = (options.createClient ?? createDesktopCos)(credentials) + try { + await cosOperation(cos, 900_000, () => cos.putObject({ Bucket: installer.plan.bucket, Region: DESKTOP_COS_REGION, + Key: artifact.key, Body: body, ContentLength: installer.digest.size, ContentType: artifact.contentType, + Headers: { 'Content-MD5': installer.md5, 'Content-Disposition': installer.contentDisposition }, + })) + } catch (error) { throw new DesktopCosOperationError('PutObject', error) } + finally { body.destroy() } + const confirmed = await transport.read(artifact.key, false) + if (!matches(confirmed)) throw new Error(`website installer: remote bytes unconfirmed; expected ${JSON.stringify(installer.digest)}, observed ${JSON.stringify(confirmed)}; reconcile before retrying`) + if (confirmed?.contentDisposition !== installer.contentDisposition) throw new Error(`website installer: remote download filename unconfirmed; expected ${JSON.stringify(installer.contentDisposition)}, observed ${JSON.stringify(confirmed?.contentDisposition ?? null)}; inspect COS metadata before retrying`) + await record('uploaded') + return 'uploaded' +} diff --git a/apps/desktop/scripts/publish-desktop-ci.ts b/apps/desktop/scripts/publish-desktop-ci.ts index 19dcea3f58..f881e0d48a 100644 --- a/apps/desktop/scripts/publish-desktop-ci.ts +++ b/apps/desktop/scripts/publish-desktop-ci.ts @@ -14,6 +14,7 @@ import { publishDesktopRelease } from './desktop-publish.ts' import { desktopPublicationFailure } from './desktop-publication-failure.ts' import { desktopPublicationSummary } from './desktop-publication-summary.ts' import { publishDesktopTag } from './desktop-publish-tag.ts' +import { websiteApproval } from './publish-website-ci.ts' import { desktopPublishQualificationError } from './desktop-publish-qualification.mjs' const routeSchema = z.object({ runId: z.string(), attempt: z.string(), commit: z.string(), runnerName: z.string(), @@ -63,10 +64,14 @@ if (process.argv[1] !== undefined && resolve(process.argv[1]) === import.meta.fi const env = process.env const { route, manifest, config, plan, root, approval } = await prepareDesktopPublication(env) if (mode === '--publish' && !env.DESKTOP_APPROVED_PACKAGE) throw new Error('desktop publish: approved package digest is required') + if (env.DESKTOP_UPLOAD_WEBSITE === 'true' && route.preset === 'production' + && !/^zone-[a-z0-9]+$/u.test(env.DOWNLOAD_PROD_EO_ZONE_ID || '')) { + throw new Error('desktop publish: configure DOWNLOAD_PROD_EO_ZONE_ID before approving website upload') + } if (mode === '--check') { - if (env.GITHUB_OUTPUT) await appendFile(env.GITHUB_OUTPUT, `approval=${approval}\nlabel=${plan.version} → ${manifest.source.channel} / ${plan.target} / ${plan.environment}\n`) + if (env.GITHUB_OUTPUT) await appendFile(env.GITHUB_OUTPUT, `website-destination=${createHash('sha256').update(`${config.bucket}/${plan.target}`).digest('hex')}\nwebsite-approval=${websiteApproval(manifest, config.bucket)}\napproval=${approval}\nlabel=${plan.version} → ${manifest.source.channel} / ${plan.target} / ${plan.environment}\n`) if (env.GITHUB_STEP_SUMMARY && !env.DESKTOP_APPROVED_PACKAGE) await appendFile(env.GITHUB_STEP_SUMMARY, - await desktopPublicationSummary(manifest.source, plan, approval)) + await desktopPublicationSummary(manifest.source, plan, approval, env.DESKTOP_UPLOAD_WEBSITE === 'true')) if (env.GITHUB_OUTPUT && config.githubApp) await appendFile(env.GITHUB_OUTPUT, `app-client-id=${config.githubApp.clientId}\napp-key-file=${config.githubApp.privateKeyFile}\n`) process.stdout.write(`desktop publish: verified ${plan.target} ${plan.version}; no credentials read or COS requests made\n`) diff --git a/apps/desktop/scripts/publish-website-ci.ts b/apps/desktop/scripts/publish-website-ci.ts new file mode 100644 index 0000000000..bd3c32f517 --- /dev/null +++ b/apps/desktop/scripts/publish-website-ci.ts @@ -0,0 +1,130 @@ +/** Actions entrypoint for independently recoverable website upload and cache purge jobs. */ +import { createHash, randomUUID } from 'node:crypto' +import { appendFile, mkdir, readFile, rename, writeFile } from 'node:fs/promises' +import { dirname, join, resolve } from 'node:path' +import { setTimeout as sleep } from 'node:timers/promises' +import { z } from 'zod' +import { readDesktopPublishConfig, readDesktopUploadCredentials } from './desktop-publish-config.ts' +import { desktopReleasesRoot } from './retain-desktop-ci.ts' +import { readRetainedDesktopManifest, retainedDesktopPath } from './desktop-release-store.ts' +import { prepareWebsiteInstaller, uploadWebsiteInstaller } from './desktop-website-installer.ts' +import { desktopPublishCos } from './desktop-publish-cos.ts' +import { withDesktopChannelLock } from './desktop-publish-record.ts' +import { recoverDesktopPurge, type DesktopPurgeRecord } from './desktop-purge-recovery.ts' +import { desktopPublicationFailure } from './desktop-publication-failure.ts' + +const routeSchema = z.object({ runId: z.string().regex(/^[1-9]\d*$/u), attempt: z.string().regex(/^[1-9]\d*$/u), + commit: z.string().regex(/^[a-f0-9]{40}$/u), runnerName: z.string(), runnerLabel: z.string(), sourceRef: z.string(), + channel: z.enum(['nightly', 'stable']), target: z.enum(['mac-arm64', 'mac-x64', 'win-x64']), preset: z.literal('production') }) +const purgeSchema = z.object({ zoneId: z.string(), publicUrl: z.url(), submittedAt: z.iso.datetime(), + jobId: z.string().regex(/^[\w.-]{1,128}$/u).optional(), + status: z.enum(['pending', 'processing', 'success', 'failed', 'timeout', 'canceled', 'unknown']), + observedAt: z.iso.datetime().optional(), diagnostic: z.string().optional() }) +const stateSchema = z.object({ approval: z.string(), upload: z.enum(['pending', 'upload-intent', 'uploaded']), + uploadConfirmed: z.boolean().optional(), purge: purgeSchema.optional(), purgeAttempt: z.string().optional() }) + +/** + * Bind website approval to the retained manifest and exact production bucket. + * @param manifest Retained build metadata already matched to GitHub evidence. + * @param bucket Production COS destination. + * @returns Non-secret digest passed through the production approval job. + */ +export function websiteApproval(manifest: unknown, bucket: string): string { + return createHash('sha256').update(JSON.stringify({ manifest, bucket })).digest('hex') +} + +/** + * Upload a fixed installer or recover its cache purge, using a publication-run-owned journal. + * @param mode Explicit website operation; purge never opens or uploads installer bytes. + * @param env Actions identity, approved build and machine configuration. + * @returns Resolves on success or a prominently reported unknown purge result. + */ +export async function publishWebsiteCi(mode: 'upload' | 'purge', env: NodeJS.ProcessEnv): Promise { + const route = routeSchema.parse(JSON.parse(env.DESKTOP_PUBLISH_ROUTE || '{}')) + if (env.RUNNER_NAME !== route.runnerName || !/^[1-9]\d*$/u.test(env.GITHUB_RUN_ID || '') + || !/^[1-9]\d*$/u.test(env.GITHUB_RUN_ATTEMPT || '')) throw new Error('website publication: invalid Actions identity or original machine') + const root = desktopReleasesRoot(env) + const manifest = await readRetainedDesktopManifest(root, route.runId, route.attempt) + const config = await readDesktopPublishConfig(env.DSH_PACKAGING_CONFIG_DIR!, 'production') + const approval = websiteApproval(manifest, config.bucket) + if (!env.DESKTOP_WEBSITE_APPROVAL || env.DESKTOP_WEBSITE_APPROVAL !== approval) throw new Error('website publication: approved build or destination changed') + const zoneId = env.DOWNLOAD_PROD_EO_ZONE_ID + if (!zoneId || !/^zone-[a-z0-9]+$/u.test(zoneId)) throw new Error('website publication: configure DOWNLOAD_PROD_EO_ZONE_ID before uploading') + const directory = join(dirname(root), 'upload-records', `website-${env.GITHUB_RUN_ID}-${route.target}`) + await mkdir(directory, { recursive: true, mode: 0o700 }) + const stateFile = join(directory, 'state.json') + let state: z.infer = { approval, upload: 'pending' } + try { state = stateSchema.parse(JSON.parse(await readFile(stateFile, 'utf8'))) } + catch (error) { if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) throw error } + if (state.approval !== approval) throw new Error('website publication: journal belongs to another approved build') + const save = async () => { + const temporary = join(directory, `.state-${randomUUID()}.json`) + await writeFile(temporary, `${JSON.stringify(state)}\n`, { flag: 'wx', mode: 0o600, flush: true }) + await rename(temporary, stateFile) + } + if (env.GITHUB_OUTPUT) await appendFile(env.GITHUB_OUTPUT, `record=${directory}\n`) + const credentials = await readDesktopUploadCredentials(config) + if (mode === 'upload') { + const installer = await prepareWebsiteInstaller(retainedDesktopPath(root, route.runId, route.attempt), manifest, route, + env.GITHUB_REPOSITORY || '', config.bucket) + try { + const outcome = await withDesktopChannelLock(join(dirname(root), 'publish-locks'), `${config.bucket}/${installer.plan.artifacts[0]!.key}`, async () => { + const previouslyUploaded = state.uploadConfirmed === true || state.upload === 'uploaded' + return uploadWebsiteInstaller(installer, credentials, desktopPublishCos(installer.plan, credentials), async (event) => { + state = event === 'upload-intent' + ? { approval: state.approval, upload: event, uploadConfirmed: previouslyUploaded } + : { ...state, upload: event, uploadConfirmed: true } + await save() + }, { previouslyUploaded }) + }) + const disposition = outcome === 'present' ? 'identical remote bytes and download filename confirmed; skipped' : 'uploaded' + const text = `Website installer ${disposition}: ${installer.plan.publicUrl}; version ${installer.plan.version}\n` + process.stdout.write(text) + if (env.GITHUB_STEP_SUMMARY) await appendFile(env.GITHUB_STEP_SUMMARY, text) + } finally { await installer.handle.close() } + return + } + if (state.upload !== 'uploaded') throw new Error('website publication: upload completion is not confirmed; recover the upload job first') + const { desktopWebsiteInstallerUrl } = await import('./desktop-auto-update-environment.mjs') + const publicUrl = desktopWebsiteInstallerUrl(route.target) + const { teo } = await import('tencentcloud-sdk-nodejs-teo') + const client = new teo.v20220901.Client({ credential: credentials, region: '', + profile: { httpProfile: { endpoint: 'teo.tencentcloudapi.com', reqTimeout: 30 } } }) + const previousAttempt = state.purgeAttempt + const result = await recoverDesktopPurge({ ...credentials, zoneId, publicUrl }, state.purge, client, { + intervalMs: 10_000, waitMs: 300_000, + allowResubmit: previousAttempt !== undefined && previousAttempt !== env.GITHUB_RUN_ATTEMPT, + now: Date.now, sleep, + save: async (purge: DesktopPurgeRecord) => { + const accepted = purge.jobId && purge.jobId !== state.purge?.jobId + state = { ...state, purge, purgeAttempt: env.GITHUB_RUN_ATTEMPT } + await save() + if (accepted) process.stdout.write(`Website cache purge accepted: ${publicUrl}; task ${purge.jobId}\n`) + }, + }) + const details = `${publicUrl}\nTask: ${result.jobId ?? 'unknown'}\nObserved: ${result.observedAt}\n${result.diagnostic ?? ''}\n` + if (result.status === 'unknown') { + const acceptance = result.jobId ? '刷新已提交，执行结果未确认' : '刷新提交未确认，可能尚未提交' + process.stdout.write(`::warning title=官网缓存刷新结果未确认::官网资源已上传；${acceptance}。请核对 EdgeOne 任务记录后人工恢复。\n${details}`) + if (env.GITHUB_STEP_SUMMARY) { + let existing = '' + try { existing = await readFile(env.GITHUB_STEP_SUMMARY, 'utf8') } + catch (error) { if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) throw error } + await writeFile(env.GITHUB_STEP_SUMMARY, `# ⚠ 官网资源已上传，缓存刷新结果未确认\n\n${acceptance}\n\n${details}${existing ? `\n${existing}` : ''}`) + } + } else { + process.stdout.write(`Website cache purge completed\n${details}`) + if (env.GITHUB_STEP_SUMMARY) await appendFile(env.GITHUB_STEP_SUMMARY, `Website cache purge completed\n\n${details}`) + } +} + +if (process.argv[1] !== undefined && resolve(process.argv[1]) === import.meta.filename) { + try { + const mode = process.argv[2] + if (process.argv.length !== 3 || (mode !== 'upload' && mode !== 'purge')) throw new Error('Usage: publish-website-ci.ts upload|purge') + await publishWebsiteCi(mode, process.env) + } catch (error) { + process.stderr.write(`${JSON.stringify(desktopPublicationFailure(error, 'website publication'))}\n`) + process.exitCode = 1 + } +} diff --git a/apps/desktop/scripts/resolve-desktop-publish-ci.ts b/apps/desktop/scripts/resolve-desktop-publish-ci.ts index 152369c49b..d1ad2264d4 100644 --- a/apps/desktop/scripts/resolve-desktop-publish-ci.ts +++ b/apps/desktop/scripts/resolve-desktop-publish-ci.ts @@ -8,11 +8,11 @@ import { desktopPublishRunnersSchema, desktopPackageWorkflows } from './desktop- const positiveId = z.string().regex(/^[1-9]\d*$/u) const inputsSchema = z.object({ package_run_id: positiveId, package_run_attempt: z.union([positiveId, z.literal('')]).optional() }) const runSchema = z.object({ id: z.number().int().positive(), run_attempt: z.number().int().positive(), - head_sha: z.string().regex(/^[a-f0-9]{40}$/u), status: z.literal('completed'), conclusion: z.literal('success'), + head_sha: z.string().regex(/^[a-f0-9]{40}$/u), status: z.literal('completed'), conclusion: z.string(), event: z.literal('workflow_dispatch'), path: z.enum(Object.values(desktopPackageWorkflows)), repository: z.object({ full_name: z.string() }) }) const jobsSchema = z.object({ jobs: z.array(z.object({ - name: z.string(), runner_name: z.string().nullable(), conclusion: z.string().nullable(), + name: z.string(), run_attempt: z.number().int().positive(), runner_name: z.string().nullable(), conclusion: z.string().nullable(), })) }) /** @@ -29,12 +29,29 @@ export function selectDesktopPackage(repository: string, inputsValue: unknown, r const inputs = inputsSchema.parse(inputsValue) const base = `repos/${repository}/actions/runs/${inputs.package_run_id}` const attempt = inputs.package_run_attempt || String(z.object({ run_attempt: z.number().int().positive() }).parse(api(base)).run_attempt) - const run = runSchema.parse(api(`${base}/attempts/${attempt}`)) + let run = runSchema.parse(api(`${base}/attempts/${attempt}`)) if (String(run.id) !== inputs.package_run_id || String(run.run_attempt) !== attempt || run.repository.full_name !== repository) { throw new Error('desktop publish: selected run or attempt does not match GitHub evidence') } - const jobs = z.array(jobsSchema).parse(api(`${base}/attempts/${attempt}/jobs?per_page=100`, true)).flatMap(page => page.jobs) - const packages = jobs.filter(job => job.name === 'package' && job.conclusion === 'success' && job.runner_name) + let jobs = z.array(jobsSchema).parse(api(`${base}/attempts/${attempt}/jobs?per_page=100`, true)).flatMap(page => page.jobs) + let packages = jobs.filter(job => job.name === 'package') + if (packages.length === 0 || packages.every(job => job.run_attempt < Number(attempt))) { + // An archival-only attempt owns no new build; select the latest actual package job, never a prior success over a failed build. + const history = z.array(jobsSchema).parse(api(`${base}/jobs?filter=all&per_page=100`, true)).flatMap(page => page.jobs) + .filter(job => job.name === 'package' && job.run_attempt <= Number(attempt)) + .sort((left, right) => right.run_attempt - left.run_attempt) + const original = history[0] + if (!original || original.conclusion !== 'success') throw new Error('desktop publish: latest original package job was not successful') + const selected = run + run = runSchema.parse(api(`${base}/attempts/${original.run_attempt}`)) + if (String(run.id) !== inputs.package_run_id || run.run_attempt !== original.run_attempt || run.repository.full_name !== repository + || run.head_sha !== selected.head_sha || run.path !== selected.path) { + throw new Error('desktop publish: original build identity differs from GitHub evidence') + } + jobs = z.array(jobsSchema).parse(api(`${base}/attempts/${original.run_attempt}/jobs?per_page=100`, true)).flatMap(page => page.jobs) + packages = jobs.filter(job => job.name === 'package') + } + packages = packages.filter(job => job.run_attempt === run.run_attempt && job.conclusion === 'success' && job.runner_name) if (packages.length !== 1) throw new Error('desktop publish: expected one successful package job') const runnerName = packages[0]!.runner_name! const routes = desktopPublishRunnersSchema.parse(routesValue) diff --git a/apps/desktop/scripts/retain-desktop-ci.ts b/apps/desktop/scripts/retain-desktop-ci.ts index 69bade9712..e672274992 100644 --- a/apps/desktop/scripts/retain-desktop-ci.ts +++ b/apps/desktop/scripts/retain-desktop-ci.ts @@ -6,6 +6,7 @@ import { desktopBuildRecordFilename, desktopUpdateMetadataFilename, resolveDeskt import { loadDesktopPackageEnvironment } from './desktop-package-environment.mjs' import { retainDesktopRelease, type DesktopRetainedSource } from './desktop-release-store.ts' import { validateDesktopBuildVersion } from './desktop-build-version.mjs' +import { desktopPublishRunnersSchema } from './desktop-publish-targets.ts' import { desktopPublishQualificationError } from './desktop-publish-qualification.mjs' function required(env: NodeJS.ProcessEnv, name: string): string { @@ -26,6 +27,22 @@ export function desktopReleasesRoot(env: NodeJS.ProcessEnv): string { return root } +/** + * Resolve the original machine's unique label before expensive packaging work. + * @param env Machine identity, target and administrator-owned runner mapping. + * @returns The exact label used by the later GitHub archival job. + */ +export function resolveDesktopRetentionRunner(env: NodeJS.ProcessEnv): string { + const target = resolveDesktopBuildTarget(env) + const routes = desktopPublishRunnersSchema.parse(JSON.parse(required(env, 'DESKTOP_PUBLISH_RUNNERS'))) + const route = routes[required(env, 'RUNNER_NAME')] + if (!route || !route.target.includes(target) + || new Set(Object.values(routes).map(item => item.label)).size !== Object.keys(routes).length) { + throw new Error('desktop retention: original machine requires a unique artifact routing label') + } + return route.label +} + /** * Save the complete installer inventory for a successful package job, without reading signing secrets. * @param env Actions identity, resolved package version and machine preset selection. @@ -34,6 +51,7 @@ export function desktopReleasesRoot(env: NodeJS.ProcessEnv): string { */ export async function retainDesktopCi(env: NodeJS.ProcessEnv, appRoot = resolve(import.meta.dirname, '..')): Promise { const target = resolveDesktopBuildTarget(env) + const runnerLabel = resolveDesktopRetentionRunner(env) const windows = target === 'win-x64' const platform = windows ? 'win32' : 'darwin' const settings = loadDesktopPackageEnvironment(platform, env, appRoot, { unsigned: true }) @@ -66,7 +84,7 @@ export async function retainDesktopCi(env: NodeJS.ProcessEnv, appRoot = resolve( names.push(`${base}.${windows ? 'exe' : 'zip'}.blockmap`, desktopBuildRecordFilename(target), desktopUpdateMetadataFilename(version, platform, source.channel)) } const retained = await retainDesktopRelease(desktopReleasesRoot(env), source, names.map(name => join(artifacts, name))) - if (env.GITHUB_OUTPUT) await appendFile(env.GITHUB_OUTPUT, `directory=${retained}\n`) + if (env.GITHUB_OUTPUT) await appendFile(env.GITHUB_OUTPUT, `directory=${retained}\nrunner=${runnerLabel}\nrunner-name=${source.runnerName}\nattempt=${source.attempt}\n`) const nextStep = desktopPublishQualificationError(qualification) ?? `Publish separately with package_run_id=${env.GITHUB_RUN_ID} and package_run_attempt=${env.GITHUB_RUN_ATTEMPT}` if (env.GITHUB_STEP_SUMMARY) await appendFile(env.GITHUB_STEP_SUMMARY, @@ -75,5 +93,7 @@ export async function retainDesktopCi(env: NodeJS.ProcessEnv, appRoot = resolve( } if (process.argv[1] !== undefined && resolve(process.argv[1]) === import.meta.filename) { - await retainDesktopCi(process.env) + if (process.argv[2] === '--check-runner' && process.argv.length === 3) resolveDesktopRetentionRunner(process.env) + else if (process.argv.length === 2) await retainDesktopCi(process.env) + else throw new Error('Usage: retain-desktop-ci.ts [--check-runner]') } diff --git a/apps/desktop/tests/desktop-auto-update-environment.spec.ts b/apps/desktop/tests/desktop-auto-update-environment.spec.ts index 4e2e7f9c70..74fabee903 100644 --- a/apps/desktop/tests/desktop-auto-update-environment.spec.ts +++ b/apps/desktop/tests/desktop-auto-update-environment.spec.ts @@ -1,6 +1,7 @@ import { describe, expect, it } from 'vitest' import { desktopBuildRecordFilename, + desktopWebsiteInstallerUrl, desktopUpdateMetadataFilename, resolveDesktopAutoUpdateConfig, resolveDesktopAutoUpdateEnvironment, @@ -120,6 +121,13 @@ describe('desktop auto-update environment', () => { }) }) +it.each([ + ['mac-arm64', 'dsh-latest-macos-arm64.dmg'], + ['mac-x64', 'dsh-latest-macos-x64.dmg'], + ['win-x64', 'dsh-latest-windows-x64.exe'], +] as const)('uses the production origin for website target %s', (target, filename) => { + expect(desktopWebsiteInstallerUrl(target)).toBe(`https://download.deepseek.com/desktop/${filename}`) +}) it.each([['darwin', 'arm64', 'mac-arm64', 'stable-mac.yml'], ['darwin', 'x64', 'mac-x64', 'stable-mac.yml'], ['win32', 'x64', 'win-x64', 'stable.yml']] as const) ('routes stable metadata and binaries separately for %s %s', (platform, arch, target, filename) => { diff --git a/apps/desktop/tests/desktop-package-selection.spec.ts b/apps/desktop/tests/desktop-package-selection.spec.ts index 1da8dde6e8..54d2aaec13 100644 --- a/apps/desktop/tests/desktop-package-selection.spec.ts +++ b/apps/desktop/tests/desktop-package-selection.spec.ts @@ -9,7 +9,7 @@ import { retainDesktopRelease, verifyRetainedDesktopRelease } from '../scripts/d function fixture() { const run = { id: 42, run_attempt: 2, head_sha: 'a'.repeat(40), status: 'completed', conclusion: 'success', event: 'workflow_dispatch', path: '.github/workflows/macos-package.yml', repository: { full_name: 'owner/repo' } } - const jobs = [{ name: 'package', runner_name: 'mini', conclusion: 'success' }] + const jobs = [{ name: 'package', run_attempt: 2, runner_name: 'mini', conclusion: 'success' }] const routes = { mini: { label: 'dsh-mini', target: 'mac-arm64' } } const calls: string[] = [] const api = (path: string, paginate?: boolean) => { @@ -39,6 +39,7 @@ it('routes a Windows package through its own configured machine target', () => { it('selects an explicit old attempt without consulting the latest attempt', () => { const f = fixture() f.run.run_attempt = 1 + f.jobs[0]!.run_attempt = 1 selectDesktopPackage('owner/repo', { package_run_id: '42', package_run_attempt: '1' }, f.routes, f.api) expect(f.calls).not.toContain('repos/owner/repo/actions/runs/42') expect(f.calls).toContain('repos/owner/repo/actions/runs/42/attempts/1') @@ -47,8 +48,8 @@ it('selects an explicit old attempt without consulting the latest attempt', () = it.each(['failed', 'cancelled', 'running', 'workflow', 'repository', 'attempt', 'run', 'job', 'ambiguous', 'route', 'label'])( 'rejects %s evidence without falling back to a different attempt', (kind) => { const f = fixture() - if (kind === 'failed') f.run.conclusion = 'failure' - if (kind === 'cancelled') f.run.conclusion = 'cancelled' + if (kind === 'failed') { f.run.conclusion = 'failure'; f.jobs[0]!.conclusion = 'failure' } + if (kind === 'cancelled') { f.run.conclusion = 'cancelled'; f.jobs[0]!.conclusion = 'cancelled' } if (kind === 'running') f.run.status = 'in_progress' if (kind === 'workflow') f.run.path = '.github/workflows/ci.yml' if (kind === 'repository') f.run.repository.full_name = 'other/repo' @@ -135,3 +136,24 @@ it('routes both Mac architectures to one machine without authorizing an unlisted expect(() => selectDesktopPackage('owner/repo', { package_run_id: '42' }, { mini: { label: 'dsh-mini', target } }, f.api)).toThrow() } }) + +it.each([false, true])('keeps original build after archival retry with reused job listed: %s', (includesReused) => { + const f = fixture() + const selected = selectDesktopPackage('owner/repo', { package_run_id: '42' }, f.routes, (path) => { + if (path.endsWith('/42')) return { run_attempt: 3 } + if (path.endsWith('/attempts/3')) return { ...f.run, run_attempt: 3 } + if (path.endsWith('/attempts/3/jobs?per_page=100')) return [{ jobs: [{ name: 'upload-artifact', run_attempt: 3, runner_name: 'mini', conclusion: 'success' }, ...(includesReused ? f.jobs : [])] }] + if (path.includes('filter=all')) return [{ jobs: [{ ...f.jobs[0], run_attempt: 2 }] }] + if (path.endsWith('/attempts/2')) return { ...f.run, conclusion: 'failure' } + return [{ jobs: f.jobs }] + }) + expect(selected.run.run_attempt).toBe(2) + expect(selected.runnerName).toBe('mini') +}) + +it('accepts a successful package when only archival failed', () => { + const f = fixture() + f.run.conclusion = 'failure' + f.jobs.push({ name: 'upload-artifact', run_attempt: 3, runner_name: 'mini', conclusion: 'failure' }) + expect(selectDesktopPackage('owner/repo', { package_run_id: '42' }, f.routes, f.api).run.run_attempt).toBe(2) +}) diff --git a/apps/desktop/tests/desktop-publication-failure.spec.ts b/apps/desktop/tests/desktop-publication-failure.spec.ts index 6f9e8d05e6..80daeab539 100644 --- a/apps/desktop/tests/desktop-publication-failure.spec.ts +++ b/apps/desktop/tests/desktop-publication-failure.spec.ts @@ -44,3 +44,15 @@ it('omits malformed provider receipt fields and never copies raw errors into COS expect(failure).not.toHaveProperty('httpStatus') expect(JSON.stringify(failure)).not.toContain('fixture-secret') }) + +it('prints structured archival failure through the real CLI', () => { + const result = spawnSync(process.execPath, ['--import', 'tsx/esm', + fileURLToPath(new URL('../scripts/archive-desktop-ci.ts', import.meta.url))], { + encoding: 'utf8', timeout: 30_000, env: { ...process.env, RUNNER_NAME: '', DESKTOP_PACKAGE_RUNNER: '' }, + }) + expect(result.error).toBeUndefined() + expect(result.signal).toBeNull() + expect(result.status).toBe(1) + expect(JSON.parse(result.stderr)).toEqual({ phase: 'artifact archival', code: 'validation', + message: 'desktop archival: wrong original machine' }) +}) diff --git a/apps/desktop/tests/desktop-publication-preflight.spec.ts b/apps/desktop/tests/desktop-publication-preflight.spec.ts index 39e717a827..04402925a5 100644 --- a/apps/desktop/tests/desktop-publication-preflight.spec.ts +++ b/apps/desktop/tests/desktop-publication-preflight.spec.ts @@ -39,6 +39,7 @@ it.each(['mac-arm64', 'win-x64'] as const)('preflights a complete retained %s bu })) const env = { DSH_PACKAGING_CONFIG_DIR: configRoot, DSH_PACKAGING_PRESET: 'test', + DESKTOP_PUBLISH_RUNNERS: JSON.stringify({ 'fixture-runner': { label: 'dsh-fixture', target: [target] } }), DSH_DESKTOP_TARGET_PLATFORM: target === 'win-x64' ? 'win32' : 'darwin', DSH_DESKTOP_TARGET_ARCH: target === 'win-x64' ? 'x64' : 'arm64', PACKAGE_SOURCE_REF: 'master', PACKAGE_SOURCE_SHA: 'b'.repeat(40), PACKAGE_VERSION: '1.0.0', PACKAGE_SIGNING: 'signed', PACKAGE_SKIP_NOTARIZATION: 'false', GITHUB_RUN_ID: '10', GITHUB_RUN_ATTEMPT: '2', GITHUB_REPOSITORY: 'owner/repo', GITHUB_SHA: commit, RUNNER_NAME: 'fixture-runner', @@ -52,7 +53,7 @@ it.each(['mac-arm64', 'win-x64'] as const)('preflights a complete retained %s bu expect(prepared.plan.version).toBe('1.0.0') expect(prepared.plan.artifacts.every(file => file.path.startsWith(retained))).toBe(true) expect(signatureChecks).toBe(1) - const summary = await desktopPublicationSummary(prepared.manifest.source, prepared.plan, 'c'.repeat(64)) + const summary = await desktopPublicationSummary(prepared.manifest.source, prepared.plan, 'c'.repeat(64), false) await expect(summary).toMatchFileSnapshot(`./expected/publication-${target}.md`) const feed = prepared.plan.artifacts.find(file => file.channelMetadata)! expect(summary).toContain(createHash('sha256').update(feed.contents!).digest('hex')) diff --git a/apps/desktop/tests/desktop-publication-summary.spec.ts b/apps/desktop/tests/desktop-publication-summary.spec.ts index bfb5beb483..11ca2d064e 100644 --- a/apps/desktop/tests/desktop-publication-summary.spec.ts +++ b/apps/desktop/tests/desktop-publication-summary.spec.ts @@ -21,7 +21,7 @@ const plan: DesktopUploadPlan = { } it('shows production destinations and tag after approval with upload-byte fingerprints', async () => { - const summary = await desktopPublicationSummary(source, plan, 'c'.repeat(64)) + const summary = await desktopPublicationSummary(source, plan, 'c'.repeat(64), false) await expect(summary).toMatchFileSnapshot('./expected/publication-production.md') expect(summary).toContain('/stable/deepseek-harness-1.0.0-win-x64.exe') expect(summary).toContain('https://download.example.com/dsh-desk/feeds/win-x64/stable.yml') @@ -32,7 +32,7 @@ it('shows production destinations and tag after approval with upload-byte finger }) it('escapes runner display text without adding Markdown rows or HTML elements', async () => { - const summary = await desktopPublicationSummary({ ...source, runnerName: 'runner|\n