okooooooo/biliup
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: 修复发布与 CI 工作流的权限、死代码及供应链问题 (#1679)

Browse Source 
release.yml：
- Windows 归档条件比较 matrix.os 与 windows-2019 永远为假，实际
  依赖 MSYS 的 .exe 兜底才能工作，改为按 runner.os 判断
- publish 归档循环中 exe 变量不重置，目录顺序变化时会污染后续平台
- 替换已归档的 actions-rs/toolchain、actions-rs/cargo，改用
  dtolnay/rust-toolchain 与 cross；checkout@v2（node12 已下线）升 v4
- 弃用的 ::set-output 改为 GITHUB_OUTPUT
- 顶层收紧为 contents: read，仅 publish 任务授予写权限

ci.yml：
- tag 触发从 '*' 收紧为 v[0-9]+.[0-9]+.[0-9]+，任意 tag 不再能
  触发 PyPI 正式发布
- setup-node@v3 升 v4

docker-publish.yml：
- 顶层 packages: write 会授予 pull_request 触发的 test 任务，收紧
  为顶层只读、build/merge 任务单独授予
- 移除 buildx 已弃用的 install: true；docker-compose v1 命令改为
  compose v2 子命令

docs-publish.yml：补 paths 过滤与显式权限。
Termux-publish.yml：setup-node@v3 升 v4。

新增 test.yml：PR 与 master push 运行
cargo test -p biliup -p biliup-cli -p danmaku，合并前有真实测试门禁。

Dockerfile：FFmpeg 从滚动的 latest tag 改为固定 autobuild 版本并
强制 SHA-256 校验，下载被篡改或损坏时构建失败。

docker-compose.yml：占位符 <HOST_PORT> 等使解析必然失败，改为
带默认值的环境变量；移除已废弃的 version 字段。

新增 .dockerignore：排除 .git、构建产物及本地数据库/凭据/日志，
避免进入构建上下文。
This commit is contained in:
Noah authored and GitHub committed 2026-08-30 15:00:16 +00:00
1 parent 8a19c05c06
commit 01a33213b8
9 files changed
+124 -40
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.dockerignore
+25
View File
@@ -0,0 +1,25 @@
# 版本控制与 CI
.git
.github
# 构建产物（镜像内会重新构建）
target
node_modules
.next
out
dist
tauri-app/node_modules
tauri-app/src-tauri/target
# 本地运行时数据与凭据，绝不能进入构建上下文
data
*.sqlite3
*.sqlite3-*
cookies.json
*.log
.env.local
.env.*.local
# 文档站与桌面端与镜像无关
docs
tauri-app
.github/workflows/Termux-publish.yml
+1 -1
View File
@@ -12,7 +12,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
.github/workflows/ci.yml
+8 -6
View File
@@ -11,7 +11,9 @@ on:
- main
- master
tags:
- '*'
# 只有严格的版本号 tag 才触发构建与 PyPI 发布，
# 避免测试/拼错 tag 误发正式包
- 'v[0-9]+.[0-9]+.[0-9]+'
pull_request:
workflow_dispatch:
@@ -45,7 +47,7 @@ jobs:
target: ppc64le
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
@@ -90,7 +92,7 @@ jobs:
target: armv7
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
@@ -131,7 +133,7 @@ jobs:
target: x86
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
@@ -175,7 +177,7 @@ jobs:
target: aarch64
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
@@ -207,7 +209,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
.github/workflows/docker-publish.yml
+10 -4
View File
@@ -13,9 +13,10 @@ on:
# Run tests for any PRs.
pull_request:
# 顶层只保留读权限：test 任务会在 pull_request 事件下检出并构建
# PR 代码，不应持有 packages 写权限
permissions:
contents: read
packages: write
env:
IMAGE_NAME: ghcr.io/biliup/caution
@@ -47,8 +48,9 @@ jobs:
- name: Run tests
run: |
if [ -f docker-compose.test.yml ]; then
docker-compose --file docker-compose.test.yml build
docker-compose --file docker-compose.test.yml run sut
# runner 已移除 docker-compose v1，统一使用 compose v2 子命令
docker compose --file docker-compose.test.yml build
docker compose --file docker-compose.test.yml run sut
else
docker build \
--build-arg repo_url=$REPO_URL \
@@ -62,6 +64,9 @@ jobs:
name: Build for ${{ matrix.platform }}
runs-on: ${{ matrix.runner }}
if: github.event_name == 'push'
permissions:
contents: read
packages: write
strategy:
matrix:
include:
@@ -78,7 +83,6 @@ jobs:
uses: docker/setup-buildx-action@v3
with:
driver-opts: network=host
install: true
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
@@ -131,6 +135,8 @@ jobs:
needs: build
runs-on: ubuntu-latest
if: github.event_name == 'push'
permissions:
packages: write
steps:
- name: Download digests
.github/workflows/docs-publish.yml
+10 -2
View File
@@ -3,11 +3,16 @@ name: Zola on GitHub Pages
on:
push:
branches:
- master
- master
paths:
- docs/**
pull_request:
paths:
- docs/**
permissions:
contents: read
jobs:
build:
runs-on: ubuntu-latest
@@ -27,6 +32,9 @@ jobs:
build_and_deploy:
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/master'
permissions:
# 推送 gh-pages 分支需要写权限
contents: write
steps:
- name: Checkout main
uses: actions/checkout@v4
.github/workflows/release.yml
+29 -22
View File
@@ -14,6 +14,9 @@ env:
# REPO_NAME: spectralops/rust-ci-release-template
# BREW_TAP: jondot/homebrew-tap
permissions:
contents: read
jobs:
dist:
name: Dist
@@ -69,39 +72,37 @@ jobs:
steps:
- name: Checkout sources
uses: actions/checkout@v2
uses: actions/checkout@v4
with:
submodules: true
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
run: |
npm install
npm run build
- name: Install ${{ matrix.rust }} toolchain
uses: actions-rs/toolchain@v1
- name: Install stable toolchain
uses: dtolnay/rust-toolchain@stable
with:
profile: minimal
toolchain: ${{ matrix.rust }}
target: ${{ matrix.target }}
override: true
targets: ${{ matrix.target }}
# actions-rs/cargo 已归档多年，改用 cross 官方安装方式
- name: Install cross
if: matrix.cross
uses: taiki-e/install-action@v2
with:
tool: cross
- name: Run cargo test
if: matrix.build != 'aarch64-macos'
uses: actions-rs/cargo@v1
with:
use-cross: ${{ matrix.cross }}
command: test
args: --release --locked --target ${{ matrix.target }} -p biliup
shell: bash
run: ${{ matrix.cross && 'cross' || 'cargo' }} test --release --locked --target ${{ matrix.target }} -p biliup
- name: Build release binary
uses: actions-rs/cargo@v1
with:
use-cross: ${{ matrix.cross }}
command: build
args: --release --locked --target ${{ matrix.target }} --bin biliup
shell: bash
run: ${{ matrix.cross && 'cross' || 'cargo' }} build --release --locked --target ${{ matrix.target }} --bin biliup
- name: Strip release binary (linux and macos)
if: matrix.build == 'x86_64-linux' || matrix.build == 'x86_64-macos'
@@ -120,7 +121,8 @@ jobs:
shell: bash
run: |
mkdir dist
if [ "${{ matrix.os }}" = "windows-2019" ]; then
# 按运行器操作系统判断，matrix.os 的取值（windows-latest）永远不等于 windows-2019
if [ "${{ runner.os }}" = "Windows" ]; then
cp "target/${{ matrix.target }}/release/$BIN_NAME.exe" "dist/"
else
cp "target/${{ matrix.target }}/release/$BIN_NAME" "dist/"
@@ -135,9 +137,12 @@ jobs:
name: Publish
needs: [dist]
runs-on: ubuntu-latest
permissions:
# 向 Release 上传产物需要写权限
contents: write
steps:
- name: Checkout sources
uses: actions/checkout@v2
uses: actions/checkout@v4
with:
submodules: false
@@ -153,7 +158,7 @@ jobs:
if [[ $GITHUB_REF == refs/tags/v* ]]; then
name=${GITHUB_REF:10}
fi
echo ::set-output name=val::$name
echo "val=$name" >> "$GITHUB_OUTPUT"
echo TAG=$name >> $GITHUB_ENV
id: tagname
@@ -168,6 +173,8 @@ jobs:
for dir in bins-* ; do
platform=${dir#"bins-"}
# 每次迭代重置，否则 exe 会从 windows 平台泄漏到后续平台
exe=""
if [[ $platform =~ "windows" ]]; then
exe=".exe"
fi
@@ -196,4 +203,4 @@ jobs:
- name: Extract version
id: extract-version
run: |
printf "::set-output name=%s::%s\n" tag-name "${GITHUB_REF#refs/tags/}"
echo "tag-name=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
.github/workflows/test.yml
+30
View File
@@ -0,0 +1,30 @@
name: Test
on:
push:
branches:
- master
pull_request:
permissions:
contents: read
jobs:
rust:
name: Rust tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
# biliup-cli 通过 rust-embed 嵌入 out/ 前端产物，需要先构建
- name: Build frontend
run: |
npm install
npm run build
- name: Install stable toolchain
uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: Run tests
run: cargo test --locked -p biliup -p biliup-cli -p danmaku
Dockerfile
+6 -1
View File
@@ -80,13 +80,17 @@ RUN set -eux; \
apt-mark manual curl wget; \
\
arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
url='https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-n8.1-latest-'; \
# 固定 FFmpeg 到确定版本并校验 SHA-256：
# latest 是滚动 tag，资产每日重建，既不可复现也无法防篡改
url='https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-29-13-12/ffmpeg-n8.1.2-50-g1a748fe2cd-'; \
case "$arch" in \
'amd64') \
url="${url}linux64-gpl-8.1.tar.xz"; \
sha256='be243f2520d6e7e92c82b015ed72a3f5b57c7970801c0d51f031457122653c76'; \
;; \
'arm64') \
url="${url}linuxarm64-gpl-8.1.tar.xz"; \
sha256='0df9277976f71f36b31a4de9f6657a1fbbf32ce2273594c18f19b92fbbbde1ce'; \
;; \
*) \
useApt=true; \
@@ -99,6 +103,7 @@ RUN set -eux; \
; \
else \
wget -O ffmpeg.tar.xz "$url" --progress=dot:giga; \
echo "$sha256 ffmpeg.tar.xz" | sha256sum -c -; \
tar -xJf ffmpeg.tar.xz -C /usr/local --strip-components=1; \
rm -rf \
/usr/local/doc \
docker-compose.yml
+5 -4
View File
@@ -1,12 +1,13 @@
version: '3'
services:
biliup:
image: ghcr.io/biliup/caution:latest
container_name: biliup
restart: unless-stopped
ports:
- "<HOST_ADDRESS>:<HOST_PORT>:19159"
# 可通过环境变量覆盖宿主机端口，例如 BILIUP_PORT=8080 docker compose up -d
- "${BILIUP_PORT:-19159}:19159"
volumes:
- /path/to/save_folder:/opt
# 录播与数据保存目录，默认使用当前目录下的 data/
- ${BILIUP_DATA:-./data}:/opt
# 容器内必须监听 0.0.0.0，否则上面的端口映射无法转发进容器
command: server --bind 0.0.0.0 --auth
command: server --bind 0.0.0.0 --auth