release(main): 同步 dev 最新候选改动

2026-07-16 17:15:50 +08:00
parent 32167fba02
commit d5279b124f
393 changed files with 51630 additions and 9711 deletions
@@ -0,0 +1,126 @@
+name: Desktop Windows Internal Build
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: desktop-windows-internal-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  windows-internal:
+    name: Windows NSIS internal validation
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.13"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Resolve internal build metadata
+        id: build-metadata
+        shell: pwsh
+        run: |
+          if ($env:GITHUB_REF_TYPE -eq "tag") {
+            throw "Windows internal validation builds must run from a branch, not a release tag."
+          }
+
+          $channel = "dev"
+          if ($env:GITHUB_REF_NAME -in @("dev", "main", "release")) {
+            $channel = $env:GITHUB_REF_NAME
+          }
+
+          "channel=$channel" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          "commit=$env:GITHUB_SHA" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check release build metadata
+        run: npm run release:env:check
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Check synchronized client version
+        run: npm run version:check
+
+      - name: Check runtime boundary
+        run: npm run runtime:check
+
+      - name: Check desktop release and security gate
+        run: npm run desktop:release:check
+
+      - name: Check UI contract
+        run: npm run ui:contract
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Unit tests
+        run: npm run test:unit
+
+      - name: Build Web artifact
+        run: npm run build
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Write Windows internal Tauri config
+        shell: pwsh
+        run: |
+          $config = @{
+            bundle = @{
+              createUpdaterArtifacts = $false
+            }
+          } | ConvertTo-Json -Depth 8
+          Set-Content -Path "tauri.windows.internal.conf.json" -Value $config -Encoding utf8
+          Get-Content "tauri.windows.internal.conf.json"
+
+      - name: Build unsigned Windows NSIS internal installer
+        timeout-minutes: 30
+        run: npm run desktop:build -- --config tauri.windows.internal.conf.json --bundles nsis --ci
+        env:
+          VITE_BUILD_CHANNEL: ${{ steps.build-metadata.outputs.channel }}
+          VITE_BUILD_COMMIT: ${{ steps.build-metadata.outputs.commit }}
+
+      - name: Create Windows installer checksum manifest
+        shell: pwsh
+        run: |
+          $bundleDir = "src-tauri/target/release/bundle/nsis"
+          $installers = Get-ChildItem -Path $bundleDir -Filter "*.exe" -File
+          if ($installers.Count -eq 0) {
+            throw "No Windows NSIS EXE installer was produced."
+          }
+
+          $checksums = foreach ($installer in $installers) {
+            $hash = Get-FileHash -Path $installer.FullName -Algorithm SHA256
+            "$($hash.Hash.ToLowerInvariant())  $($installer.Name)"
+          }
+
+          $manifest = Join-Path $bundleDir "SHA256SUMS.txt"
+          $checksums | Set-Content -Path $manifest -Encoding utf8
+          Get-Content $manifest
+
+      - name: Upload Windows internal installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: ctms-windows-internal-${{ steps.build-metadata.outputs.channel }}-${{ steps.build-metadata.outputs.commit }}
+          path: |
+            frontend/src-tauri/target/release/bundle/nsis/*.exe
+            frontend/src-tauri/target/release/bundle/nsis/SHA256SUMS.txt
+          if-no-files-found: error