Commit Graph
20 Commits
Author SHA1 Message Date
7418andClaude Sonnet 4.6 5629da9571 fix: arm64 打包脚本改用 if/else 分支替代 EXTRA_ARGS 数组
bash 数组展开在 GitHub Actions 中不稳定,
改为 NOTARIZE 变量 + if/else 直接调用不同命令行。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 11:45:10 +08:00
7418andClaude Sonnet 4.6 db86644c7e feat: macOS 双架构分离构建 — x64 只签名,arm64 签名+条件公证
CI:
- 拆分为 x64 和 arm64 两个独立构建步骤
- x64: 签名但不公证(-c.mac.notarize=false),timeout 15min
- arm64: 签名 + 按版本号条件公证(vX.Y.0 公证,vX.Y.Z 只签名),timeout 35min
- 先跑 x64,stash 产物后跑 arm64,确保 latest-mac.yml 来自 arm64

Electron:
- electron/main.ts: darwin+x64 跳过 initAutoUpdater
- electron/preload.ts: darwin+x64 不暴露 updater bridge
- 前端 AppShell 已有运行时检测(!!window.electronAPI?.updater),
  x64 自动 fallback 到 browser 模式更新检查

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 11:35:50 +08:00
7418andClaude Sonnet 4.6 2c76b04729 feat: macOS 公证策略 — 大版本公证,小版本只签名
- workflow_dispatch 新增 mac_notarize 输入(auto/on/off)
- auto 模式:vX.Y.0 签名+公证,vX.Y.Z(Z>0) 只签名不公证
- 打包超时调整为 35 分钟,notarize=false 时传 -c.mac.notarize=false
- 凭证校验步骤仅在需要公证时执行

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 11:17:28 +08:00
7418andClaude Sonnet 4.6 0ac424f408 fix: macOS 打包步骤添加 25 分钟超时限制
避免 notarization 排队无限等待消耗 CI 额度。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 11:08:37 +08:00
7418andClaude Sonnet 4.6 f50a8879db fix: macOS 打包步骤添加 notarization 重试(最多 3 次)
Apple notarization 服务偶发网络超时,加递增间隔重试(60s/120s)。
同时启用 DEBUG=electron-notarize* 方便排查 notarization 日志。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 09:56:42 +08:00
7418andClaude Sonnet 4.6 c24dedcffe fix: CI 添加 notarization 凭证预校验步骤
在打包前用 xcrun notarytool history 验证 APPLE_ID / APP_SPECIFIC_PASSWORD / TEAM_ID
凭证组合是否有效,提前暴露凭证配置问题。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 01:30:09 +08:00
7418andClaude Sonnet 4.6 8749adaeb9 fix: CI 证书解码去除换行 + openssl 预校验
printf + tr -d 去除 base64 中可能的 \r\n,
openssl pkcs12 -noout 在签名前验证 .p12 格式和密码正确。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 01:14:42 +08:00
7418andClaude Sonnet 4.6 261d17c059 fix: CI 解码 base64 证书为 .p12 文件后传给 CSC_LINK
electron-builder 把 base64 字符串当文件路径解析导致构建失败。
改为先 base64 --decode 写入 /tmp/cert.p12,CSC_LINK 指向文件路径。
同时加 HAS_CERT 环境变量控制签名/验证步骤的条件执行。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 00:57:57 +08:00
7418andClaude Sonnet 4.6 0e38e4460e feat: macOS Developer ID 签名 + notarization + 原生热更新
签名 & 公证:
- build/entitlements.mac.plist, build/entitlements.mac.inherit.plist — Electron hardened runtime 所需权限(JIT、unsigned memory、disable library validation)
- electron-builder.yml — 启用 hardenedRuntime、entitlements、notarize: true
- scripts/after-sign.js — 环境变量 + codesign -d 双重检测,有 Developer ID 时跳过 ad-hoc;无证书时 fallback ad-hoc
- .github/workflows/build.yml — 映射签名 secrets(MAC_CERT_P12_BASE64 等),验证步骤断言 Developer ID Authority + TeamIdentifier,遍历双架构 .app

原生热更新:
- electron/updater.ts — 从 no-op 重写为完整 electron-updater 实现(autoDownload:false, IPC handlers, 启动 10s 延迟检查)
- electron/preload.ts — 恢复 updater IPC bridge
- src/components/layout/AppShell.tsx — 运行时检测 native updater,useEffect 监听 updater:status 事件,native 优先 + browser fallback

其他:
- README_CN.md — 更新自动更新功能描述
- package.json — 版本号升至 0.23.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 00:46:51 +08:00
7418andClaude Opus 4.6 5dda2ea1e3 fix: CI release 步骤处理含空格的文件名
Windows 安装包文件名 "CodePilot Setup x.x.x.exe" 含空格,
$FILES 变量展开时被 bash word splitting 拆成多个参数导致
gh release create 找不到文件。改用 bash 数组 + "${FILES[@]}"
安全展开。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 14:55:51 +08:00
7418andClaude Opus 4.6 b5e5645702 fix: CI 产物丢失 — 改为 release job 统一上传
之前各 build job 用 --publish always 并发上传到同一个 draft release,
存在竞争条件:后完成的 job overwrite 时先删后传,如果 release job
在上传未完成时执行 --draft=false,已删除的产物就丢了(DMG 丢失)。

改为:
- 各 build job 用 --publish never,产物通过 upload-artifact 上传
- release job 用 download-artifact 收集所有产物
- gh release create 一次性创建 release 并上传全部文件

同时将 .claude/rules/ 内容合回 CLAUDE.md(rules 文件与 CLAUDE.md
优先级相同,都会全量加载,拆分不减少上下文消耗)。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-01 23:40:31 +08:00
7418andClaude Opus 4.6 495319fe1f fix: macOS 热更新 code signature 校验失败
根因:CI 上没有 Apple Developer 证书,electron-builder 跳过签名,
生成完全未签名的 .app。electron-updater 的 ShipIt 进程在应用更新时
校验 code signature,未签名的 app 被拒绝:
  "Code signature did not pass validation: 代码未能满足指定的代码要求"

修复:
1. scripts/after-pack.js — 在所有文件修改(better-sqlite3 替换)
   完成后,对 macOS .app 执行 ad-hoc 签名(codesign --force --deep -s -)。
   Ad-hoc 签名不需要证书,但能通过 ShipIt 的基本校验。
   如果将来配置了真实证书,electron-builder 的签名步骤会覆盖 ad-hoc。

2. .github/workflows/build.yml — macOS 构建添加
   CSC_IDENTITY_AUTO_DISCOVERY=false,防止 electron-builder
   尝试查找不存在的证书时产生不可预期的行为。

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 16:06:54 +08:00
7418 c14fdb07ae fix: resolve mac updater no-response by shipping zip and surfacing errors 2026-02-27 14:35:22 +08:00
7418andClaude Opus 4.6 762953b2ad feat: integrate electron-updater for in-app auto-update
Replace the manual "jump to GitHub Release" update flow with native
in-app auto-update powered by electron-updater. The app now silently
downloads updates in the background and prompts the user to restart
when ready. Browser mode (`npm run dev`) retains the existing polling
fallback via `/api/app/updates`.

Main process (electron/updater.ts — new):
- Wrap electron-updater's autoUpdater, forward lifecycle events
  (checking / available / downloading / downloaded / error) to the
  renderer via IPC channel `updater:status`
- Register `updater:check` and `updater:quit-and-install` IPC handlers
- Auto-check 10s after launch, then every 4 hours
- Only initialized in packaged mode (!isDev)

Preload bridge (electron/preload.ts):
- Expose `updater` namespace with checkForUpdates, quitAndInstall,
  and onStatus callback (same pattern as install.onProgress)

Type declarations (src/types/electron.d.ts):
- Add UpdateStatusEvent, ElectronUpdaterAPI interfaces
- Add optional `updater` field to ElectronAPI

Update hook (src/hooks/useUpdate.ts):
- Extend UpdateInfo with downloadProgress, readyToInstall, isNativeUpdate
- Add quitAndInstall to UpdateContextValue

Renderer — dual-mode logic (src/components/layout/AppShell.tsx):
- Detect `window.electronAPI?.updater` to choose between native IPC
  subscription (Electron) and HTTP polling (browser)
- Map IPC events to UpdateInfo state, including download progress

UI components:
- UpdateDialog: three footer states — View Release (browser), progress
  bar + disabled button (downloading), Restart to Update (ready)
- UpdateBanner (new): persistent top banner when update is downloaded,
  shown even after dialog is dismissed
- NavRail: settings dot turns green + pulse when readyToInstall
- GeneralSection: UpdateCard shows download %, restart button, or
  View Release depending on mode

Build & CI:
- electron-builder.yml: add `publish` config (github provider) to
  generate latest-mac.yml / latest.yml metadata + blockmap files
- build.yml: change --publish never to --publish always with GH_TOKEN;
  release job now uses `gh release edit` instead of create

i18n:
- Add 6 translation keys (en + zh) for update UI strings

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 11:16:41 +08:00
7418andClaude Opus 4.6 d2c6964fd8 fix: CI changelog echo breaks on special chars in commit messages
Use heredoc instead of single-quoted echo to write changelog into
release notes, preventing shell syntax errors from quotes/pipes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-13 01:47:43 +08:00
7418andClaude Opus 4.6 41f08c37cf fix(ci): add author/description for Linux deb/rpm, allow partial release
Linux deb/rpm packaging requires maintainer email. Also make release
job run even if some platform builds fail (e.g. partial release with
available artifacts).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-10 22:24:32 +08:00
7418andClaude Opus 4.6 3e56d358b7 ci: publish release directly instead of draft
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-10 22:04:46 +08:00
7418andClaude Opus 4.6 a346ef230b ci: auto-create GitHub Release on tag push
When a v* tag is pushed, all platforms build in parallel then
a release job collects artifacts and creates a draft GitHub
Release with changelog and download instructions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-10 22:03:48 +08:00
7418andClaude Opus 4.6 5d80969b3b fix(ci): add --publish never and simplify Windows matrix
electron-builder auto-publishes in CI without GH_TOKEN, causing
failure. Also remove redundant Windows arch matrix since NSIS
bundles both x64 and arm64 in a single installer.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-10 21:56:23 +08:00
7418andClaude Opus 4.6 57f1679585 ci: add GitHub Actions workflow for multi-platform builds
Supports Windows (NSIS), macOS (DMG), and Linux (AppImage/deb/rpm)
builds via native runners. Triggered manually or on version tags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-10 21:50:46 +08:00