ci(release): 允许无签名产物继续发布

Author: 27xk

.github/workflows/ci.yml

@@ -92,6 +92,7 @@ jobs:
           format: sarif
           output: trivy-results.sarif
           severity: 'CRITICAL,HIGH'
+          ignore-unfixed: true
           exit-code: '0'
 
       - name: Upload Trivy SARIF

.github/workflows/release.yml

@@ -176,33 +176,43 @@ jobs:
         with:
           gradle-home-cache-cleanup: true
 
-      - name: Decode Android signing key
-        shell: bash
-        run: |
-          if [ -n "$ANDROID_KEYSTORE_BASE64" ]; then
-            echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > release.keystore
-          fi
-        env:
-          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-
-      - name: Validate Android signing secrets
+      - name: Prepare Android signing key
         shell: bash
         run: |
+          signing_values=(
+            "$ANDROID_KEYSTORE_BASE64"
+            "$ANDROID_KEYSTORE_PASSWORD"
+            "$ANDROID_KEY_ALIAS"
+            "$ANDROID_KEY_PASSWORD"
+          )
+          configured=0
+          for value in "${signing_values[@]}"; do
+            if [ -n "$value" ]; then
+              configured=1
+            fi
+          done
           missing=()
           for name in ANDROID_KEYSTORE_BASE64 ANDROID_KEYSTORE_PASSWORD ANDROID_KEY_ALIAS ANDROID_KEY_PASSWORD; do
             if [ -z "${!name}" ]; then
               missing+=("$name")
             fi
           done
+          if [ "$configured" -eq 0 ]; then
+            echo "::notice::Android signing secrets are not configured; building an unsigned release APK."
+            echo "TASKBRIDGE_ANDROID_SIGNED_RELEASE=false" >> "$GITHUB_ENV"
+            exit 0
+          fi
           if [ "${#missing[@]}" -gt 0 ]; then
-            echo "Missing Android signing secrets: ${missing[*]}" >&2
-            echo "Public release artifacts must be signed; configure all Android signing secrets." >&2
+            echo "::error::Incomplete Android signing secrets: ${missing[*]}."
+            echo "Configure all Android signing secrets or leave all of them empty for an unsigned APK." >&2
             exit 1
           fi
+          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > release.keystore
           if [ ! -s release.keystore ]; then
             echo "Decoded Android signing keystore is empty or missing." >&2
             exit 1
           fi
+          echo "TASKBRIDGE_ANDROID_SIGNED_RELEASE=true" >> "$GITHUB_ENV"
         env:
           ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
           ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
@@ -226,6 +236,10 @@ jobs:
       - name: Verify Android APK signature
         shell: bash
         run: |
+          if [ "$TASKBRIDGE_ANDROID_SIGNED_RELEASE" != "true" ]; then
+            echo "::notice::Skipping Android APK signature verification because this release is unsigned."
+            exit 0
+          fi
           apk_path="$(find app/build/outputs/apk/release -maxdepth 1 -type f -name 'app-release.apk' | head -n 1)"
           if [ -z "$apk_path" ]; then
             echo "No release APK was produced." >&2
@@ -248,12 +262,18 @@ jobs:
         run: |
           mkdir -p ../artifacts
           find app/build/outputs/apk -maxdepth 3 -type f -print
-          apk_path="$(find app/build/outputs/apk/release -maxdepth 1 -type f -name 'app-release.apk' | head -n 1)"
+          if [ "$TASKBRIDGE_ANDROID_SIGNED_RELEASE" = "true" ]; then
+            apk_path="$(find app/build/outputs/apk/release -maxdepth 1 -type f -name 'app-release.apk' | head -n 1)"
+            artifact_name="TaskBridge-${RELEASE_VERSION}-android.apk"
+          else
+            apk_path="$(find app/build/outputs/apk/release -maxdepth 1 -type f -name 'app-release-unsigned.apk' | head -n 1)"
+            artifact_name="TaskBridge-${RELEASE_VERSION}-android-unsigned.apk"
+          fi
           if [ -z "$apk_path" ]; then
             echo "No release APK was produced." >&2
             exit 1
           fi
-          cp "$apk_path" "../artifacts/TaskBridge-${RELEASE_VERSION}-android.apk"
+          cp "$apk_path" "../artifacts/${artifact_name}"
 
       - name: Upload Android artifact
         uses: actions/upload-artifact@v4
@@ -414,21 +434,28 @@ jobs:
       - name: Smoke test Web client shell
         run: node ..\scripts\smoke-web-client.mjs
 
-      - name: Validate Windows signing secrets
+      - name: Prepare Windows signing certificate
         shell: pwsh
         run: |
-          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_BASE64)) {
-            throw "WINDOWS_CERTIFICATE_BASE64 must be configured for public release artifacts."
+          $hasCertificate = -not [string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_BASE64)
+          $hasPassword = -not [string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_PASSWORD)
+          if (-not $hasCertificate -and -not $hasPassword) {
+            "TASKBRIDGE_WINDOWS_SIGNED_RELEASE=false" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+            "CSC_IDENTITY_AUTO_DISCOVERY=false" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+            Write-Host "::notice::Windows signing certificate is not configured; building an unsigned installer."
+            exit 0
           }
-          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_PASSWORD)) {
-            throw "WINDOWS_CERTIFICATE_PASSWORD must be configured for public release artifacts."
+          if (-not $hasCertificate -or -not $hasPassword) {
+            throw "Incomplete Windows signing secrets. Configure both WINDOWS_CERTIFICATE_BASE64 and WINDOWS_CERTIFICATE_PASSWORD, or leave both empty for an unsigned installer."
           }
           $certificatePath = Join-Path $env:RUNNER_TEMP "taskbridge-codesign.pfx"
           [IO.File]::WriteAllBytes($certificatePath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_BASE64))
           if ((Get-Item -LiteralPath $certificatePath).Length -le 0) {
             throw "Decoded Windows signing certificate is empty."
           }
           "CSC_LINK=$certificatePath" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "CSC_KEY_PASSWORD=$env:WINDOWS_CERTIFICATE_PASSWORD" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "TASKBRIDGE_WINDOWS_SIGNED_RELEASE=true" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
         env:
           WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
           WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
@@ -438,14 +465,16 @@ jobs:
         env:
           TASKBRIDGE_BASE_URL: ${{ env.TASKBRIDGE_BASE_URL }}
           TASKBRIDGE_WS_URL: ${{ env.TASKBRIDGE_WS_URL }}
-          CSC_LINK: ${{ runner.temp }}\\taskbridge-codesign.pfx
-          CSC_KEY_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
           ELECTRON_CACHE: ${{ github.workspace }}\\.cache\\electron
           ELECTRON_BUILDER_CACHE: ${{ github.workspace }}\\.cache\\electron-builder
 
       - name: Verify Windows installer signatures
         shell: pwsh
         run: |
+          if ($env:TASKBRIDGE_WINDOWS_SIGNED_RELEASE -ne "true") {
+            Write-Host "::notice::Skipping Windows installer signature verification because this release is unsigned."
+            exit 0
+          }
           $installers = @(Get-ChildItem -Path release -File | Where-Object { $_.Extension -eq '.exe' })
           if ($installers.Count -eq 0) {
             throw "No Windows installer .exe was produced."
@@ -569,6 +598,7 @@ jobs:
         with:
           image-ref: taskbridge:release-scan
           severity: 'CRITICAL,HIGH'
+          ignore-unfixed: true
           exit-code: '1'
 
       - name: Build and push backend image

android/README.md

@@ -84,9 +84,9 @@ Release APK：
 .\gradlew.bat :app:assembleRelease
 ```
 
-Release 构建必须配置正式签名。缺少 keystore、密码、alias 或 key 密码时，`assembleRelease` 会直接失败，避免误发布 debug 签名 APK。
+Release 构建会优先使用正式签名。配置完整 keystore、密码、alias 和 key 密码时会生成已签名 APK；缺少签名配置时，`assembleRelease` 会生成 unsigned release APK，不会回退到 debug signing。
 
-本机临时验证请使用 debug 构建；release 产物必须具备正式签名，不再提供未签名绕过入口。
+本机临时验证仍建议使用 debug 构建；如果需要发布 unsigned release，请在文件名和说明中明确标注，避免用户把它当作已签名正式 APK。
 
 ## Release 签名
 

android/app/build.gradle.kts

@@ -120,12 +120,6 @@ android {
                 it.name == "bundleRelease" ||
                 it.name == "packageRelease"
         }
-        if (requiresSignedRelease && !hasReleaseSigning) {
-            throw org.gradle.api.GradleException(
-                "Release signing is required. Configure ANDROID_KEYSTORE_PATH, " +
-                    "ANDROID_KEYSTORE_PASSWORD, ANDROID_KEY_ALIAS and ANDROID_KEY_PASSWORD.",
-            )
-        }
         if (requiresSignedRelease && releaseEndpointLooksPlaceholder) {
             throw org.gradle.api.GradleException(
                 "Release endpoints must be configured with TASKBRIDGE_BASE_URL and TASKBRIDGE_WS_URL.",

backend/requirements.txt

@@ -1,5 +1,6 @@
 alembic>=1.13,<2.0
 fastapi>=0.115,<1.0
+jaraco.context>=6.1.0,<7.0
 passlib[bcrypt]>=1.7,<2.0
 bcrypt>=3.2,<4.0
 pydantic>=2.9,<3.0

desktop/scripts/check-production-hardening-config.mjs

@@ -50,16 +50,18 @@ for (const [workflowName, source] of [
 }
 
 assert.match(backendDockerfileSource, /\/ready/, "backend container healthcheck must use the readiness endpoint");
-assert.match(releaseSource, /Validate Windows signing secrets/, "release workflow must validate Windows signing secrets");
-assert.match(releaseSource, /WINDOWS_CERTIFICATE_BASE64/, "release workflow must require a Windows signing certificate");
-assert.match(releaseSource, /CSC_LINK/, "release workflow must pass a signing certificate to electron-builder");
-assert.match(releaseSource, /CSC_KEY_PASSWORD/, "release workflow must pass the Windows signing password to electron-builder");
+assert.match(releaseSource, /Prepare Windows signing certificate/, "release workflow must prepare optional Windows signing");
+assert.match(releaseSource, /TASKBRIDGE_WINDOWS_SIGNED_RELEASE/, "release workflow must track whether Windows artifacts are signed");
+assert.match(releaseSource, /CSC_IDENTITY_AUTO_DISCOVERY=false/, "release workflow must explicitly disable Windows signing when no certificate is configured");
+assert.match(releaseSource, /CSC_LINK/, "release workflow must pass a signing certificate to electron-builder when configured");
+assert.match(releaseSource, /CSC_KEY_PASSWORD/, "release workflow must pass the Windows signing password to electron-builder when configured");
 assert.match(
   releaseSource,
-  /Verify Windows installer signatures[\s\S]*Get-AuthenticodeSignature[\s\S]*Status -ne 'Valid'/,
-  "release workflow must verify Windows Authenticode signatures before uploading artifacts",
+  /Verify Windows installer signatures[\s\S]*TASKBRIDGE_WINDOWS_SIGNED_RELEASE[\s\S]*Get-AuthenticodeSignature[\s\S]*Status -ne 'Valid'/,
+  "release workflow must verify Windows Authenticode signatures when Windows signing is configured",
 );
-assert.match(releaseSource, /Validate Android signing secrets/, "release workflow must validate Android signing secrets");
+assert.match(releaseSource, /Prepare Android signing key/, "release workflow must prepare optional Android signing");
+assert.match(releaseSource, /TASKBRIDGE_ANDROID_SIGNED_RELEASE/, "release workflow must track whether Android artifacts are signed");
 for (const token of [
   "ANDROID_KEYSTORE_BASE64",
   "ANDROID_KEYSTORE_PASSWORD",
@@ -71,39 +73,17 @@ for (const token of [
 }
 assert.match(
   releaseSource,
-  /Verify Android APK signature[\s\S]*apksigner[\s\S]*verify --verbose --print-certs/,
-  "release workflow must verify the Android APK signature before uploading artifacts",
+  /Verify Android APK signature[\s\S]*TASKBRIDGE_ANDROID_SIGNED_RELEASE[\s\S]*apksigner[\s\S]*verify --verbose --print-certs/,
+  "release workflow must verify the Android APK signature when Android signing is configured",
 );
-assert.doesNotMatch(
-  releaseSource,
-  /TASKBRIDGE_ALLOW_UNSIGNED_RELEASE/,
-  "public release workflow must not allow unsigned Android release artifacts",
-);
-assert.doesNotMatch(
-  androidBuildSource,
-  /TASKBRIDGE_ALLOW_UNSIGNED_RELEASE|allowUnsignedRelease/,
-  "Android release builds must not expose an unsigned release escape hatch",
-);
-assert.doesNotMatch(
-  androidReadmeSource,
-  /TASKBRIDGE_ALLOW_UNSIGNED_RELEASE|unsigned release/i,
-  "Android docs must not teach unsigned release builds",
-);
-assert.doesNotMatch(
-  troubleshootingSource,
-  /unsigned release APK/i,
-  "troubleshooting docs must direct local experiments to debug builds, not unsigned release APKs",
-);
-assert.doesNotMatch(
-  releaseSource,
-  /app-release-unsigned\.apk/,
-  "public release workflow must not publish unsigned Android release artifacts",
-);
-assert.doesNotMatch(
+assert.match(
   releaseSource,
-  /CSC_IDENTITY_AUTO_DISCOVERY:\s*["']false["']/,
-  "public release workflow must not disable Windows signing",
+  /app-release-unsigned\.apk[\s\S]*android-unsigned\.apk/,
+  "release workflow must publish a clearly named unsigned Android APK when signing is not configured",
 );
+assert.doesNotMatch(androidBuildSource, /Release signing is required/, "Android release builds must not fail solely because signing is not configured");
+assert.match(androidReadmeSource, /unsigned release/i, "Android docs must explain unsigned release artifacts");
+assert.match(troubleshootingSource, /unsigned release APK/i, "troubleshooting docs must explain unsigned release APKs");
 
 for (const token of [
   "docker compose",
@@ -144,6 +124,7 @@ for (const token of [
   "WINDOWS_CERTIFICATE_BASE64",
   "WINDOWS_CERTIFICATE_PASSWORD",
   "unsigned Android",
+  "unsigned Windows",
 ]) {
   assert.match(releaseDocsSource, new RegExp(escapeRegExp(token)), `release docs must document ${token}`);
 }
@@ -171,4 +152,3 @@ for (const token of [
 }
 
 console.log("production hardening config check passed");
-

desktop/scripts/check-security-config.mjs

@@ -47,15 +47,30 @@ assert.doesNotMatch(
   /signingConfigs\.getByName\("debug"\)/,
   "Android release builds must not fall back to the debug signing key",
 );
-assert.match(
+assert.doesNotMatch(
   androidBuildSource,
   /Release signing is required/,
-  "Android release assemble/bundle tasks must fail clearly when signing secrets are missing",
+  "Android release assemble/bundle tasks must allow explicitly unsigned release APKs",
+);
+assert.match(
+  androidBuildSource,
+  /if \(hasReleaseSigning\)[\s\S]*signingConfig = signingConfigs\.getByName\("release"\)/,
+  "Android release builds must use the release signing config when signing secrets are configured",
+);
+assert.match(
+  releaseWorkflowSource,
+  /Prepare Android signing key/,
+  "GitHub release workflow must prepare Android signing before publishing an APK",
+);
+assert.match(
+  releaseWorkflowSource,
+  /TASKBRIDGE_ANDROID_SIGNED_RELEASE/,
+  "GitHub release workflow must track signed and unsigned Android artifacts",
 );
 assert.match(
   releaseWorkflowSource,
-  /Validate Android signing secrets/,
-  "GitHub release workflow must validate Android signing secrets before publishing an APK",
+  /Incomplete Android signing secrets/,
+  "GitHub release workflow must fail clearly when only part of the Android signing secrets are configured",
 );
 
 for (const [name, source] of [

desktop/scripts/check-security-governance-config.mjs

@@ -102,6 +102,8 @@ for (const token of [
 }
 assert.match(releaseSource, /aquasecurity\/trivy-action@/, "release workflow must scan the backend Docker image before publishing");
 assert.match(releaseSource, /severity:\s*'CRITICAL,HIGH'/, "release Docker scan must fail on high and critical findings");
+assert.match(releaseSource, /ignore-unfixed:\s*true/, "release Docker scan must ignore vulnerabilities that do not have a fixed version");
+assert.match(ciSource, /ignore-unfixed:\s*true/, "CI Docker scan must ignore vulnerabilities that do not have a fixed version");
 
 for (const token of [
   "SECURITY.md",

docs/architecture.md

@@ -132,6 +132,6 @@ Android 和 Windows 都需要维护：
 - 后端所有业务数据按 `user_id` 过滤，任务父子关系也必须校验归属。
 - Refresh Token 绑定设备；删除设备会撤销该设备登录态。
 - WebSocket 使用短期 Ticket，连接后仍校验 `device_id`。
-- Android Release 必须使用正式签名，缺少签名配置时构建失败。
+- Android Release 优先使用正式签名；缺少签名配置时可构建明确标注的 unsigned release APK。
 - Windows Electron renderer 启用 sandbox，IPC 会校验调用方窗口。
 - Docker release 部署默认只暴露 API，MySQL 和 Redis 保持在 Compose 内部网络。

docs/development-roadmap.md

@@ -112,7 +112,7 @@
 - CI 工作流：后端测试、Docker 构建、桌面端构建、Android 构建。
 - Release 工作流：Android APK、Windows 安装包和后端 Docker 镜像。
 - GHCR 后端镜像发布。
-- Android release 签名强校验，缺少签名配置时发布失败。
+- Android release 支持正式签名校验；缺少签名配置时发布明确标注的 unsigned APK。
 - 发布说明文档。
 - 安全说明和常见问题文档。
 - 后端响应增加 `X-Request-ID`、基础安全头和数据库 readiness 探针。