release.yml

name: 发布 / Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "要构建的已有版本 tag，例如 v0.1.1 / Existing release tag"
        required: true
        type: string

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  validate:
    name: 校验版本与源码 / Validate version and source
    runs-on: ubuntu-latest
    timeout-minutes: 20
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      version: ${{ steps.version.outputs.version }}
      prerelease: ${{ steps.version.outputs.prerelease }}
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

    steps:
      - name: 检出 tag / Checkout tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ env.RELEASE_TAG }}
          fetch-depth: 0

      - name: 安装 pnpm / Setup pnpm
        uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6

      - name: 安装 Node.js / Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
          cache: pnpm

      - name: 校验 tag 并解析版本 / Validate tag and resolve version
        id: version
        shell: bash
        run: |
          set -euo pipefail

          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)*$ ]]; then
            echo "无效的版本 tag / Invalid release tag: $RELEASE_TAG" >&2
            exit 1
          fi
          if ! git rev-parse --verify --quiet "refs/tags/$RELEASE_TAG^{commit}" >/dev/null; then
            echo "该引用不是已有 tag / Release ref is not an existing tag: $RELEASE_TAG" >&2
            exit 1
          fi

          # 版本号以 tag 为准，构建时写入 package.json，不再要求源码提前同步。
          # The tag is the source of truth; builds write it into package.json.
          VERSION="${RELEASE_TAG#v}"
          PRERELEASE=false
          [[ "$VERSION" == *-* ]] && PRERELEASE=true
          echo "tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"

      - name: 安装依赖 / Install dependencies
        run: pnpm install --frozen-lockfile

      # Two file reads, before anything is built: a manifest overwritten by a
      # stray tool run still typechecks, lints and packages — it just ships the
      # Electron default app instead of this client.
      - name: 校验客户端身份指纹 / Verify client identity fingerprint
        run: pnpm run check:identity

      - name: 校验 Web UI 权限策略 / Verify Web UI permission policy
        run: pnpm run check:permissions

      - name: 验证安全故障恢复 / Verify safety regressions
        run: pnpm run check:safety

      - name: 验证浏览器认证格式 / Verify browser-session format
        run: pnpm run check:dsh-browser-session

      # The download table, latest.json and electron-builder all encode the same
      # filename convention. A partial drift between them still builds, still
      # uploads, and still publishes — it just names files nobody built and
      # drops a platform from the feed, which the updater reads as "up to date".
      - name: 校验发布产物命名约定 / Verify release artifact naming
        run: pnpm run check:release-artifacts

      - name: 校验 NSIS 安装详情接线 / Verify NSIS install-details wiring
        run: pnpm run check:nsis-details

      - name: 类型检查 / Typecheck
        run: pnpm run typecheck

      - name: 代码检查 / Lint
        run: pnpm run lint

      - name: 构建主进程 / Build shell
        run: pnpm run build

      - name: 验证运行时环境隔离 / Verify runtime environment isolation
        run: pnpm run check:runtime-env

      - name: 验证 pnpm spawn 改写 / Verify pnpm spawn rewrite
        run: pnpm run check:runtime-spawn

      - name: 验证 dsh 网关分类 / Verify dsh CLI gateway policy
        run: pnpm run check:dsh-cli

      - name: 验证智能连接来源契约 / Verify Smart-mode source preference
        run: pnpm run check:smart-runtimes

      - name: 验证本地服务端口契约 / Verify local-bind port preference
        run: pnpm run check:local-web-port

      - name: 验证数据环境与迁移契约 / Verify data-home and migration contract
        run: pnpm run check:data-home

      - name: 验证内置插件接入 / Verify bundled plugin seat
        run: pnpm run check:bundled-plugin

      # The pure-Node contract checks are offline, fast, and assert exactly the
      # invariants a release must not break (single-writer lock, platform
      # resolution). They used to run nowhere. The updater contract check also
      # drives a real Electron window, so it lives in the build matrix below
      # where a desktop session exists.
      - name: 验证运行时锁契约 / Verify runtime lock contract
        run: pnpm run check:runtime-lock

      - name: 验证托盘重启杀进程表 / Verify tray-restart stop table
        run: pnpm run check:restart

      - name: 验证运行时解析契约 / Verify runtime resolution contract
        run: pnpm run check:runtime-resolution

  prepare-release:
    name: 创建草稿 Release / Create draft release
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
      RELEASE_TAG: ${{ needs.validate.outputs.tag }}
      IS_PRERELEASE: ${{ needs.validate.outputs.prerelease }}

    steps:
      - name: 检出发布文案来源 / Checkout release-note sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ env.RELEASE_TAG }}
          sparse-checkout: |
            CHANGELOG.md
            scripts/write-release-notes.mjs

      - name: 按需创建草稿 Release / Create draft release if needed
        shell: bash
        env:
          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail

          node scripts/write-release-notes.mjs \
            --version "$RELEASE_VERSION" \
            --changelog CHANGELOG.md \
            --out release-notes.md

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release edit "$RELEASE_TAG" \
              --title "DSH Desktop $RELEASE_TAG" \
              --notes-file release-notes.md
            echo "Release $RELEASE_TAG 已存在，正文已刷新 / already exists; notes refreshed"
            exit 0
          fi

          FLAGS=(--draft --verify-tag --title "DSH Desktop $RELEASE_TAG" --notes-file release-notes.md)
          if [[ "$IS_PRERELEASE" == "true" ]]; then
            FLAGS+=(--prerelease)
          fi
          gh release create "$RELEASE_TAG" "${FLAGS[@]}"

  build:
    name: 构建 ${{ matrix.name }} / Build ${{ matrix.name }}
    needs:
      - validate
      - prepare-release
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS Apple Silicon
            id: macos-arm64
            os: macos-15
            command: pnpm exec electron-builder --mac dmg --arm64 --publish never
            runtime_target: darwin-arm64
          - name: macOS Intel
            id: macos-x64
            os: macos-15-intel
            command: pnpm exec electron-builder --mac dmg --x64 --publish never
            runtime_target: darwin-x64
          - name: Windows x64
            id: windows-x64
            os: windows-latest
            command: pnpm exec electron-builder --win nsis --x64 --publish never
            runtime_target: win32-x64

    steps:
      - name: 检出 tag / Checkout tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ needs.validate.outputs.tag }}

      - name: 安装 pnpm / Setup pnpm
        uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6

      - name: 安装 Node.js / Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
          cache: pnpm

      - name: 写入发布版本号 / Write release version
        shell: bash
        env:
          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
        run: npm pkg set "version=$RELEASE_VERSION"

      # The bundled runtime is tens of thousands of small files, written once by
      # the packager and again by the installer smoke. Real-time scanning of
      # every one of them dominates this job; excluding the two directories the
      # build owns is a runner-local change that never reaches an artifact.
      - name: 排除 Defender 实时扫描 / Exclude build paths from Defender
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          foreach ($path in @($env:GITHUB_WORKSPACE, $env:RUNNER_TEMP)) {
            try {
              Add-MpPreference -ExclusionPath $path -ErrorAction Stop
              Write-Host "excluded $path"
            } catch {
              # An unavailable Defender API is a lost optimisation, not a
              # release blocker: the build is correct either way.
              Write-Host "could not exclude ${path}: $($_.Exception.Message)"
            }
          }

      - name: 安装依赖 / Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 构建应用 / Build application
        run: pnpm run build

      - name: 准备内置 dsh 运行时 / Prepare bundled dsh runtime
        run: pnpm run prepare:runtime && pnpm run check:market-boot
        env:
          # node-pty ships every platform's prebuilds in one tarball; keep only
          # the matrix entry's own target (see scripts/prepare-runtime.mjs).
          DSH_RUNTIME_TARGET: ${{ matrix.runtime_target }}

      - name: 验证 Windows 命令控制台补丁 / Verify Windows command console patch
        run: pnpm run check:win32-console

      - name: 验证 Windows 目录选择器兼容补丁 / Verify Win32 picker compatibility patch
        run: pnpm run check:picker

      - name: 验证运行时环境隔离 / Verify runtime environment isolation
        run: pnpm run check:runtime-env
        env:
          # 这一步在 prepare:runtime 之后，闭包一定在场；缺席即是环境出了问题，
          # 而不是「这条腿没有闭包可扫」——静默跳过正是它要防的那种绿。
          # validate 作业里的同名步骤没有闭包，那里的跳过是有意的。
          DSH_DESKTOP_REQUIRE_RUNTIME_CLOSURE: "1"

      - name: 验证 pnpm spawn 改写 / Verify pnpm spawn rewrite
        run: pnpm run check:runtime-spawn

      - name: 验证 dsh 网关分类 / Verify dsh CLI gateway policy
        run: pnpm run check:dsh-cli

      - name: 验证智能连接来源契约 / Verify Smart-mode source preference
        run: pnpm run check:smart-runtimes

      - name: 验证运行时来源批量选择 / Verify runtime source batch selection
        run: pnpm run check:runtime-selection

      - name: 验证本地服务端口契约 / Verify local-bind port preference
        run: pnpm run check:local-web-port

      - name: 验证 pnpm 与 Electron Node 耦合 / Verify pnpm engine against Electron Node
        run: pnpm run check:pnpm-engine

      - name: 生成安装包 / Package application
        run: ${{ matrix.command }}
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"

      - name: 验证打包产物中的 pnpm / Verify packaged pnpm
        run: pnpm run check:pnpm-runtime

      # Electron-driven integration checks, run where a real desktop session
      # exists (the same reason smoke runs here rather than in validate).
      - name: 验证更新器契约 / Verify updater contract
        run: pnpm run check:updater

      - name: 验证认证占用保护 / Verify authenticated occupancy
        if: ${{ !cancelled() }}
        run: pnpm run check:auth-occupancy

      - name: 验证浏览器认证隔离 / Verify browser admission isolation
        if: ${{ !cancelled() }}
        run: pnpm run check:browser-admission

      - name: 验证智能模式回落恢复 / Verify smart-mode fallback recovery
        run: pnpm run check:auto-fallback

      - name: 验证连接失败界面 / Verify connection failure surface
        run: pnpm run check:error-surface

      - name: 验证插件故障隔离恢复 / Verify plugin-failure isolation recovery
        run: pnpm run check:plugin-isolation

      - name: 验证插件恢复对话框 / Verify plugin recovery dialog
        run: pnpm run check:plugin-recovery

      - name: 验证安装包内置运行时 / Smoke packaged runtime
        run: pnpm run smoke:package

      # 三个场景合起来才说明问题。安装器退出码 0 不能证明任何事：直接解压把写不
      # 进去的文件直接丢掉且不置错误标志，所以守卫失效的表现是「装完了、能启动、
      # 少了几个文件」。脚本因此断言两件真正有区别的事——实际走的是哪条分支（暂
      # 存复制会在 %TEMP% 的 ns*.tmp 下建出 7z-out，快速路径不会），以及装出来
      # 的树是否包含 win-unpacked 的每一个文件。
      - name: 验证 NSIS 安装（空目录，直接解压）/ Smoke install, direct extract
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./scripts/check-nsis-install.ps1 -Scenario fast -Smoke

      # 卸载没能删干净时必须回退，否则旧版已卸载、新版只解压一半。
      - name: 验证 NSIS 安装（有残留，暂存复制）/ Smoke install, staged fallback
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./scripts/check-nsis-install.ps1 -Scenario dirty -Smoke

      # 安装路径深到最长打包路径会越过 MAX_PATH 时也必须回退。这一条是唯一只有
      # 暂存复制才可能通过的场景：直接解压在这里会静默丢文件。
      - name: 验证 NSIS 安装（超长路径，暂存复制）/ Smoke install, over-budget path
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./scripts/check-nsis-install.ps1 -Scenario deep

      # Run last on Windows: this deliberately mutates the product's HKCU
      # installer state and desktop shortcuts; cleanup failures fail the step.
      - name: 缓存 v0.3.0 NSIS 升级夹具 / Cache v0.3.0 NSIS upgrade fixture
        if: runner.os == 'Windows'
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}\dsh-desktop-upgrade-fixtures
          key: dsh-desktop-nsis-upgrade-v0.3.0-win-x64

      - name: 验证 v0.3.0 升级 / Smoke upgrade from v0.3.0
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./scripts/check-nsis-upgrade.ps1

      # macOS 侧的等价门禁：挂载刚生成的 DMG，把 .app 拷出来再跑一遍冒烟。
      # 此前 smoke:package 跑的是未打包的 .app 目录，DMG 本身从没被挂载过。
      #
      # CI 已为 arm64 和 Intel 配置相同的 DMG 安装检查。
      - name: 验证 macOS DMG 实际安装结果 / Smoke installed macOS runtime
        if: runner.os == 'macOS'
        run: pnpm run smoke:dmg

      # 只有本平台全部冒烟测试通过后，安装包才会进入草稿 Release。
      # Packages reach the draft release only after every smoke check passed.
      - name: 上传安装包到草稿 Release / Upload packages to draft release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
        run: |
          set -euo pipefail
          shopt -s nullglob

          files=(release/*.dmg release/*.exe)
          if (( ${#files[@]} == 0 )); then
            echo "release/ 下没有找到安装包 / No packages found under release/" >&2
            exit 1
          fi

          gh release upload "$RELEASE_TAG" "${files[@]}" --clobber

      # Keep packages for diagnosis when any step above failed, including the
      # Release upload itself. Successful runs already have their only copy on
      # the draft Release and do not need a duplicate Actions artifact.
      - name: 上传失败构建产物 / Upload failed build artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dsh-desktop-${{ matrix.id }}
          if-no-files-found: warn
          retention-days: 14
          path: |
            release/*.dmg
            release/*.exe

  publish:
    name: 发布 GitHub Release / Publish GitHub Release
    needs:
      - validate
      - build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
      RELEASE_TAG: ${{ needs.validate.outputs.tag }}
      IS_PRERELEASE: ${{ needs.validate.outputs.prerelease }}

    steps:
      - name: 检出更新清单与发布文案脚本 / Checkout update-feed and release-note scripts
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ needs.validate.outputs.tag }}
          sparse-checkout: |
            CHANGELOG.md
            scripts/write-release-notes.mjs
            scripts/write-update-feed.mjs

      - name: 下载 Release 资产 / Download release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p assets
          gh release download "$RELEASE_TAG" --dir assets --pattern '*' --clobber

      - name: 生成并上传 SHA-256 校验文件 / Generate and upload checksums
        shell: bash
        run: |
          set -euo pipefail
          cd assets
          rm -f SHA256SUMS.txt latest.json
          find . -maxdepth 1 -type f ! -name SHA256SUMS.txt ! -name latest.json ! -name release-notes.md -printf '%P\0' \
            | sort -z \
            | xargs -0 -r sha256sum > SHA256SUMS.txt
          gh release upload "$RELEASE_TAG" SHA256SUMS.txt --clobber

      - name: 生成并上传在线更新清单 / Generate and upload update feed
        shell: bash
        env:
          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          node scripts/write-release-notes.mjs \
            --version "$RELEASE_VERSION" \
            --changelog CHANGELOG.md \
            --out assets/release-notes.md \
            --changes-out assets/release-changes.md
          node scripts/write-update-feed.mjs \
            --dir assets \
            --version "$RELEASE_VERSION" \
            --repo "$GH_REPO" \
            --notes-file assets/release-changes.md \
            --out assets/latest.json
          gh release upload "$RELEASE_TAG" assets/latest.json --clobber

      - name: 将草稿转为正式发布 / Publish completed release
        shell: bash
        run: |
          set -euo pipefail

          FLAGS=(--draft=false)
          if [[ "$IS_PRERELEASE" == "true" ]]; then
            FLAGS+=(--prerelease)
          else
            FLAGS+=(--latest)
          fi
          gh release edit "$RELEASE_TAG" "${FLAGS[@]}"