okooooooo/EasyCLIProxyAPI
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): streamline release workflow and bump core version

Browse Source
This commit is contained in:
lzt404 committed 2026-08-15 16:33:11 +08:00
1 parent 1936d6c5d5
commit 0d7139eedd
2 files changed
+14 -142
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/release.yml
+13 -141
View File
@@ -1,12 +1,9 @@
name: Build portable releases
run-name: >-
Portable release ${{ github.event.release.tag_name || (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag || github.ref_name }}
Portable release ${{ (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag || github.ref_name }}
on:
release:
types:
- published
workflow_dispatch:
inputs:
release_tag:
@@ -23,7 +20,7 @@ on:
- 'v*'
permissions:
contents: write
contents: read
jobs:
version:
@@ -35,12 +32,12 @@ jobs:
steps:
- uses: actions/checkout@v7
with:
ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }}
- name: Read and validate app version
ref: ${{ github.ref }}
- name: Resolve release version
id: resolve
shell: bash
env:
REQUESTED_VERSION: ${{ github.event.release.tag_name || (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag }}
REQUESTED_VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag }}
run: |
set -euo pipefail
@@ -63,7 +60,6 @@ jobs:
build:
name: Build ${{ matrix.os }}-${{ matrix.arch }}
needs: version
if: github.event_name != 'release' || github.event.release.prerelease == true
strategy:
fail-fast: false
matrix:
@@ -103,11 +99,11 @@ jobs:
steps:
- uses: actions/checkout@v7
with:
ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }}
ref: ${{ github.ref }}
- uses: oven-sh/setup-bun@v2
with:
bun-version: 1.3.14
- uses: dtolnay/rust-toolchain@stable
- uses: dtolnay/rust-toolchain@1.97.0
- name: Cache Bun packages
uses: actions/cache@v5
with:
@@ -158,21 +154,6 @@ jobs:
--arch "${{ matrix.arch }}"
--download true
shell: bash
- name: Verify archive-only core payload
shell: bash
env:
CORE_DIR: release/${{ steps.package.outputs.stem }}/cpa-core
run: |
node - <<'NODE'
const { readdirSync } = require('node:fs');
const entries = readdirSync(process.env.CORE_DIR, { withFileTypes: true });
const valid = entries.length === 1
&& entries[0].isFile()
&& /\.(zip|tar\.gz)$/.test(entries[0].name);
if (!valid) {
throw new Error(`cpa-core must contain exactly one archive; found: ${entries.map((entry) => entry.name).join(', ')}`);
}
NODE
- name: Prepare Windows legacy updater payload
if: matrix.os == 'windows'
shell: pwsh
@@ -181,15 +162,6 @@ jobs:
New-Item -ItemType Directory -Force -Path $updateDir | Out-Null
Copy-Item -LiteralPath "release/${{ steps.package.outputs.stem }}/EasyCLIProxyAPI.exe" -Destination $updateDir
Copy-Item -LiteralPath "release/${{ steps.package.outputs.stem }}/portable-app.json" -Destination $updateDir
$marker = Get-Content -Raw -LiteralPath "$updateDir/portable-app.json" | ConvertFrom-Json
if ($marker.schemaVersion -ne 1 -or
$marker.application -ne "EasyCLIProxyAPI" -or
$marker.version -ne "${{ steps.package.outputs.version }}" -or
$marker.platform -ne "windows" -or
$marker.arch -ne "${{ matrix.arch }}" -or
$marker.autoUpdate -ne $true) {
throw "Legacy updater payload does not match the Windows target"
}
- name: Build signed macOS DMG
if: matrix.os == 'darwin'
shell: bash
@@ -203,23 +175,13 @@ jobs:
run: |
set -euo pipefail
test -n "$APPLE_CERTIFICATE"
test -n "$APPLE_CERTIFICATE_PASSWORD"
test -n "$APPLE_ID"
test -n "$APPLE_PASSWORD"
test -n "$APPLE_SIGNING_IDENTITY"
test -n "$APPLE_TEAM_ID"
certificate_path="$RUNNER_TEMP/apple-signing-certificate.p12"
keychain_path="$RUNNER_TEMP/apple-signing.keychain-db"
keychain_password="$(uuidgen)"
signed_core_dir="$RUNNER_TEMP/signed-core"
verification_dir="$RUNNER_TEMP/verify-bundled-core"
staging_dir="$RUNNER_TEMP/easycli-dmg-staging"
bundle_dir="src-tauri/target/release/bundle"
output_dmg="${{ steps.package.outputs.stem }}.dmg"
mount_dir="$RUNNER_TEMP/easycli-dmg"
mounted=false
keychain_list="$(security list-keychains -d user)"
existing_keychains=()
while IFS= read -r existing_keychain; do
@@ -232,11 +194,8 @@ jobs:
cleanup() {
set +e
if [ "$mounted" = true ]; then
hdiutil detach "$mount_dir"
fi
rm -f "$certificate_path"
rm -rf "$mount_dir" "$signed_core_dir" "$verification_dir" "$staging_dir"
rm -rf "$signed_core_dir" "$staging_dir"
security delete-keychain "$keychain_path"
}
trap cleanup EXIT
@@ -252,32 +211,17 @@ jobs:
security unlock-keychain -p "$keychain_password" "$keychain_path"
security import "$certificate_path" -k "$keychain_path" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path"
if ! security find-identity -v -p codesigning "$keychain_path" | grep -F -- "$APPLE_SIGNING_IDENTITY"; then
echo "Signing identity was not imported into the temporary keychain" >&2
exit 1
fi
core_archive="$(find cpa-core -maxdepth 1 -type f -name 'CLIProxyAPI_*_darwin_${{ matrix.arch }}.tar.gz' -print -quit)"
test -n "$core_archive"
mkdir -p "$signed_core_dir"
tar -xzf "$core_archive" -C "$signed_core_dir"
core_binary="$(find "$signed_core_dir" -type f -name 'cli-proxy-api' -print -quit)"
test -n "$core_binary"
codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --keychain "$keychain_path" "$core_binary"
codesign --verify --strict --verbose=2 "$core_binary"
signed_archive="$RUNNER_TEMP/$(basename "$core_archive")"
COPYFILE_DISABLE=1 tar -czf "$signed_archive" -C "$signed_core_dir" .
mv "$signed_archive" "$core_archive"
cp "release/${{ steps.package.outputs.stem }}/portable-app.json" portable-app.json
node -e '
const marker = require("./portable-app.json");
if (marker.schemaVersion !== 1 || marker.application !== "EasyCLIProxyAPI"
|| marker.version !== process.argv[1] || marker.platform !== "darwin"
|| marker.arch !== process.argv[2] || marker.autoUpdate !== true) {
throw new Error("macOS auto-update marker does not match the release target");
}
' "${{ steps.package.outputs.version }}" "${{ matrix.arch }}"
# Build the notarized app with Tauri, then create the DMG with hdiutil.
# Tauri's generated create-dmg script is unreliable on GitHub's macOS runners.
@@ -285,8 +229,6 @@ jobs:
bun tauri bundle --bundles app --ci --config src-tauri/tauri.dmg.conf.json
app_path="$bundle_dir/macos/EasyCLIProxyAPI.app"
test -d "$app_path"
xcrun stapler validate "$app_path"
rm -rf "$staging_dir"
mkdir -p "$staging_dir"
@@ -298,52 +240,13 @@ jobs:
-format UDZO \
-ov \
"$output_dmg"
test -s "$output_dmg"
codesign --force --timestamp --sign "$APPLE_SIGNING_IDENTITY" --keychain "$keychain_path" "$output_dmg"
codesign --verify --strict --verbose=2 "$output_dmg"
xcrun notarytool submit "$output_dmg" \
--apple-id "$APPLE_ID" \
--password "$APPLE_PASSWORD" \
--team-id "$APPLE_TEAM_ID" \
--wait
xcrun stapler staple "$output_dmg"
xcrun stapler validate "$output_dmg"
mkdir -p "$mount_dir"
hdiutil attach "$output_dmg" -nobrowse -readonly -mountpoint "$mount_dir"
mounted=true
app_path="$mount_dir/EasyCLIProxyAPI.app"
resources_dir="$app_path/Contents/Resources"
test -d "$app_path"
test -s "$resources_dir/core-version.txt"
test -s "$resources_dir/portable-app.json"
core_count="$(find "$resources_dir/cpa-core" -maxdepth 1 -type f -name 'CLIProxyAPI_*.tar.gz' | wc -l | tr -d '[:space:]')"
if [ "$core_count" -ne 1 ]; then
echo "macOS app must contain exactly one bundled core archive" >&2
exit 1
fi
bundled_core_archive="$(find "$resources_dir/cpa-core" -maxdepth 1 -type f -name 'CLIProxyAPI_*.tar.gz' -print -quit)"
mkdir -p "$verification_dir"
tar -xzf "$bundled_core_archive" -C "$verification_dir"
bundled_core_binary="$(find "$verification_dir" -type f -name 'cli-proxy-api' -print -quit)"
test -n "$bundled_core_binary"
codesign --verify --strict --verbose=2 "$bundled_core_binary"
signature_details="$(codesign -d --verbose=4 "$bundled_core_binary" 2>&1)"
grep -F 'Authority=Developer ID Application' <<< "$signature_details"
grep -F 'Timestamp=' <<< "$signature_details"
grep -F 'Runtime Version=' <<< "$signature_details"
case "${{ matrix.arch }}" in
amd64) expected_core_arch="x86_64" ;;
aarch64) expected_core_arch="arm64" ;;
*) echo "Unsupported macOS architecture: ${{ matrix.arch }}" >&2; exit 1 ;;
esac
file "$bundled_core_binary" | grep -F -- "$expected_core_arch"
codesign --verify --deep --strict --verbose=2 "$app_path"
xcrun stapler validate "$app_path"
hdiutil detach "$mount_dir"
mounted=false
- name: Archive Linux release
if: matrix.os == 'linux'
run: tar -czf "${{ steps.package.outputs.stem }}.tar.gz" -C release "${{ steps.package.outputs.stem }}"
@@ -352,34 +255,8 @@ jobs:
shell: pwsh
run: |
Compress-Archive -Path "release/${{ steps.package.outputs.stem }}" -DestinationPath "${{ steps.package.outputs.stem }}.zip"
Add-Type -AssemblyName System.IO.Compression.FileSystem
$releaseArchive = "${{ steps.package.outputs.stem }}.zip"
$zip = [System.IO.Compression.ZipFile]::OpenRead((Resolve-Path $releaseArchive))
try {
$entries = @($zip.Entries | ForEach-Object { $_.FullName.Replace('\', '/') })
$root = "${{ steps.package.outputs.stem }}"
if ($entries -notcontains "$root/EasyCLIProxyAPI.exe" -or
$entries -notcontains "$root/portable-app.json" -or
$entries -notcontains "$root/core-version.txt" -or
-not ($entries | Where-Object { $_ -match "^$([regex]::Escape($root))/cpa-core/CLIProxyAPI_.+_windows_${{ matrix.arch }}\.zip$" })) {
throw "Full Windows release ZIP is incomplete: $($entries -join ', ')"
}
} finally {
$zip.Dispose()
}
$updateArchive = "EasyCLIProxyAPI-update-v${{ steps.package.outputs.version }}-Windows-${{ matrix.arch }}.zip"
Compress-Archive -Path "release/update-${{ matrix.arch }}/*" -DestinationPath $updateArchive
$updateZip = [System.IO.Compression.ZipFile]::OpenRead((Resolve-Path $updateArchive))
try {
$updateEntries = @($updateZip.Entries | ForEach-Object { $_.FullName.Replace('\', '/') })
if ($updateEntries.Count -ne 2 -or
$updateEntries -notcontains "EasyCLIProxyAPI.exe" -or
$updateEntries -notcontains "portable-app.json") {
throw "Legacy updater ZIP contains unexpected entries: $($updateEntries -join ', ')"
}
} finally {
$updateZip.Dispose()
}
- uses: actions/upload-artifact@v7
with:
name: ${{ steps.package.outputs.stem }}
@@ -396,18 +273,19 @@ jobs:
publish:
name: Publish GitHub release
if: >-
(github.event_name == 'release' && github.event.release.prerelease == true)
|| startsWith(github.ref, 'refs/tags/')
startsWith(github.ref, 'refs/tags/')
|| inputs.release_tag != ''
needs:
- version
- build
runs-on: ubuntu-24.04
timeout-minutes: 15
permissions:
contents: write
steps:
- uses: actions/checkout@v7
with:
ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }}
ref: ${{ github.ref }}
- uses: actions/download-artifact@v8
with:
path: artifacts
@@ -433,7 +311,7 @@ jobs:
GH_TOKEN: ${{ github.token }}
GH_REPO: ${{ github.repository }}
RELEASE_TAG: ${{ needs.version.outputs.tag }}
MANUAL_PRERELEASE: ${{ github.event_name == 'release' && github.event.release.prerelease || inputs.prerelease }}
MANUAL_PRERELEASE: ${{ inputs.prerelease }}
run: |
set -euo pipefail
@@ -442,15 +320,9 @@ jobs:
*) RELEASE_TAG="v$RELEASE_TAG" ;;
esac
if ! node -e 'process.exit(/^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(process.argv[1]) ? 0 : 1)' "$RELEASE_TAG"; then
echo "Invalid release tag: $RELEASE_TAG" >&2
exit 1
fi
prerelease="$MANUAL_PRERELEASE"
release_args=(--title "EasyCLIProxyAPI $RELEASE_TAG" --generate-notes)
if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
release_args+=(--verify-tag)
if [[ "$RELEASE_TAG" == *-* ]]; then
prerelease=true
else