build(release): 加固 v0.1.0 桌面发布链路 (#3)

frontend/scripts/verify-desktop-release-readiness.mjs

@@ -11,13 +11,11 @@ const failures = [];
 const env = process.env;
 const fullShaPattern = /^[0-9a-f]{40}$/i;
 const expectedTag = `v${packageInfo.version}`;
-const requiredSecretLikeEnv = [
-  "TAURI_SIGNING_PRIVATE_KEY",
-  "TAURI_SIGNING_PRIVATE_KEY_PASSWORD",
-  "APPLE_ID",
-  "APPLE_PASSWORD",
-  "APPLE_TEAM_ID",
-];
+const requiresMacosSigning = env.REQUIRE_DESKTOP_SIGNING === "true";
+const requiresWindowsSigning = env.REQUIRE_WINDOWS_SIGNING === "true";
+const requiredUpdaterEnv = ["TAURI_SIGNING_PRIVATE_KEY", "TAURI_SIGNING_PRIVATE_KEY_PASSWORD"];
+const requiredMacosEnv = ["APPLE_ID", "APPLE_PASSWORD", "APPLE_TEAM_ID"];
+const requiredWindowsEnv = ["WINDOWS_CERTIFICATE", "WINDOWS_CERTIFICATE_PASSWORD"];
 
 const fail = (message) => failures.push(message);
 const assert = (condition, message) => {
@@ -65,6 +63,24 @@ const validateBaseUrl = () => {
   );
 };
 
+const validateWindowsTimestampUrl = () => {
+  const raw = env.WINDOWS_TIMESTAMP_URL;
+  requireEnv("WINDOWS_TIMESTAMP_URL");
+  if (!raw) return;
+
+  let url;
+  try {
+    url = new URL(raw);
+  } catch (error) {
+    fail(`WINDOWS_TIMESTAMP_URL is invalid: ${error.message}`);
+    return;
+  }
+
+  assert(["http:", "https:"].includes(url.protocol), "WINDOWS_TIMESTAMP_URL must use HTTP or HTTPS.");
+  assert(url.username === "" && url.password === "", "WINDOWS_TIMESTAMP_URL must not include credentials.");
+  assert(!/[?&]token=/i.test(url.search), "WINDOWS_TIMESTAMP_URL must not include token query parameters.");
+};
+
 const headSha = gitMaybe(["rev-parse", "HEAD"]);
 const exactTag = gitMaybe(["describe", "--tags", "--exact-match", "HEAD"]);
 const status = gitMaybe(["status", "--porcelain"]);
@@ -79,16 +95,39 @@ if (headSha && env.VITE_BUILD_COMMIT) {
   assert(env.VITE_BUILD_COMMIT === headSha, "VITE_BUILD_COMMIT must match the current release commit.");
 }
 
-for (const name of requiredSecretLikeEnv) {
+assert(
+  requiresMacosSigning || requiresWindowsSigning,
+  "Release readiness requires REQUIRE_DESKTOP_SIGNING=true or REQUIRE_WINDOWS_SIGNING=true.",
+);
+assert(
+  !(requiresMacosSigning && requiresWindowsSigning),
+  "macOS and Windows signing readiness must be checked in their native jobs.",
+);
+
+for (const name of requiredUpdaterEnv) {
   requireEnv(name);
 }
 
-assert(
-  Boolean(env.APPLE_CERTIFICATE || env.APPLE_SIGNING_IDENTITY),
-  "APPLE_CERTIFICATE or APPLE_SIGNING_IDENTITY must be configured for macOS signing.",
-);
-if (env.APPLE_CERTIFICATE) {
-  requireEnv("APPLE_CERTIFICATE_PASSWORD");
+if (requiresMacosSigning) {
+  assert(process.platform === "darwin", "Signed macOS desktop release readiness must run on macOS.");
+  for (const name of requiredMacosEnv) {
+    requireEnv(name);
+  }
+  assert(
+    Boolean(env.APPLE_CERTIFICATE || env.APPLE_SIGNING_IDENTITY),
+    "APPLE_CERTIFICATE or APPLE_SIGNING_IDENTITY must be configured for macOS signing.",
+  );
+  if (env.APPLE_CERTIFICATE) {
+    requireEnv("APPLE_CERTIFICATE_PASSWORD");
+  }
+}
+
+if (requiresWindowsSigning) {
+  assert(process.platform === "win32", "Signed Windows desktop release readiness must run on Windows.");
+  for (const name of requiredWindowsEnv) {
+    requireEnv(name);
+  }
+  validateWindowsTimestampUrl();
 }
 
 validateBaseUrl();