Files
Noah 01a33213b8 ci: 修复发布与 CI 工作流的权限、死代码及供应链问题 (#1679)
release.yml:
- Windows 归档条件比较 matrix.os 与 windows-2019 永远为假,实际
  依赖 MSYS 的 .exe 兜底才能工作,改为按 runner.os 判断
- publish 归档循环中 exe 变量不重置,目录顺序变化时会污染后续平台
- 替换已归档的 actions-rs/toolchain、actions-rs/cargo,改用
  dtolnay/rust-toolchain 与 cross;checkout@v2(node12 已下线)升 v4
- 弃用的 ::set-output 改为 GITHUB_OUTPUT
- 顶层收紧为 contents: read,仅 publish 任务授予写权限

ci.yml:
- tag 触发从 '*' 收紧为 v[0-9]+.[0-9]+.[0-9]+,任意 tag 不再能
  触发 PyPI 正式发布
- setup-node@v3 升 v4

docker-publish.yml:
- 顶层 packages: write 会授予 pull_request 触发的 test 任务,收紧
  为顶层只读、build/merge 任务单独授予
- 移除 buildx 已弃用的 install: true;docker-compose v1 命令改为
  compose v2 子命令

docs-publish.yml:补 paths 过滤与显式权限。
Termux-publish.yml:setup-node@v3 升 v4。

新增 test.yml:PR 与 master push 运行
cargo test -p biliup -p biliup-cli -p danmaku,合并前有真实测试门禁。

Dockerfile:FFmpeg 从滚动的 latest tag 改为固定 autobuild 版本并
强制 SHA-256 校验,下载被篡改或损坏时构建失败。

docker-compose.yml:占位符 <HOST_PORT> 等使解析必然失败,改为
带默认值的环境变量;移除已废弃的 version 字段。

新增 .dockerignore:排除 .git、构建产物及本地数据库/凭据/日志,
避免进入构建上下文。
2026-08-30 15:00:16 +00:00

206 lines
5.9 KiB
YAML

name: Release
on:
# schedule:
# - cron: '0 0 * * *' # midnight UTC
push:
tags:
- 'v[0-9]+.[0-9]+.[0-9]+'
## - release
env:
BIN_NAME: biliup
PROJECT_NAME: biliupR
# REPO_NAME: spectralops/rust-ci-release-template
# BREW_TAP: jondot/homebrew-tap
permissions:
contents: read
jobs:
dist:
name: Dist
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false # don't fail other jobs if one fails
matrix:
build: [x86_64-linux, x86_64-linux-musl, aarch64-linux, arm-linux, x86_64-macos, x86_64-windows, aarch64-macos] #, x86_64-win-gnu, win32-msvc
include:
- build: x86_64-linux
os: ubuntu-22.04
rust: stable
target: x86_64-unknown-linux-gnu
cross: false
- build: x86_64-linux-musl
os: ubuntu-latest
rust: stable
target: x86_64-unknown-linux-musl
cross: true
- build: aarch64-linux
os: ubuntu-latest
rust: stable
target: aarch64-unknown-linux-gnu
cross: true
- build: arm-linux
os: ubuntu-latest
rust: stable
target: arm-unknown-linux-gnueabi
cross: true
- build: x86_64-macos
os: macos-latest
rust: stable
target: x86_64-apple-darwin
cross: false
- build: x86_64-windows
os: windows-latest
rust: stable
target: x86_64-pc-windows-msvc
cross: false
- build: aarch64-macos
os: macos-latest
rust: stable
target: aarch64-apple-darwin
cross: false
# - build: x86_64-win-gnu
# os: windows-2019
# rust: stable-x86_64-gnu
# target: x86_64-pc-windows-gnu
# - build: win32-msvc
# os: windows-2019
# rust: stable
# target: i686-pc-windows-msvc
steps:
- name: Checkout sources
uses: actions/checkout@v4
with:
submodules: true
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build frontend
run: |
npm install
npm run build
- name: Install stable toolchain
uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
# actions-rs/cargo 已归档多年,改用 cross 官方安装方式
- name: Install cross
if: matrix.cross
uses: taiki-e/install-action@v2
with:
tool: cross
- name: Run cargo test
if: matrix.build != 'aarch64-macos'
shell: bash
run: ${{ matrix.cross && 'cross' || 'cargo' }} test --release --locked --target ${{ matrix.target }} -p biliup
- name: Build release binary
shell: bash
run: ${{ matrix.cross && 'cross' || 'cargo' }} build --release --locked --target ${{ matrix.target }} --bin biliup
- name: Strip release binary (linux and macos)
if: matrix.build == 'x86_64-linux' || matrix.build == 'x86_64-macos'
run: strip "target/${{ matrix.target }}/release/$BIN_NAME"
- name: Strip release binary (arm)
if: matrix.build == 'aarch64-linux'
run: |
docker run --rm -v \
"$PWD/target:/target:Z" \
rustembedded/cross:${{ matrix.target }} \
aarch64-linux-gnu-strip \
/target/${{ matrix.target }}/release/$BIN_NAME
- name: Build archive
shell: bash
run: |
mkdir dist
# 按运行器操作系统判断,matrix.os 的取值(windows-latest)永远不等于 windows-2019
if [ "${{ runner.os }}" = "Windows" ]; then
cp "target/${{ matrix.target }}/release/$BIN_NAME.exe" "dist/"
else
cp "target/${{ matrix.target }}/release/$BIN_NAME" "dist/"
fi
- uses: actions/upload-artifact@v4
with:
name: bins-${{ matrix.build }}
path: dist
publish:
name: Publish
needs: [dist]
runs-on: ubuntu-latest
permissions:
# 向 Release 上传产物需要写权限
contents: write
steps:
- name: Checkout sources
uses: actions/checkout@v4
with:
submodules: false
- uses: actions/download-artifact@v4
# with:
# path: dist
# - run: ls -al ./dist
- run: ls -al bins-*
- name: Calculate tag name
run: |
name=dev
if [[ $GITHUB_REF == refs/tags/v* ]]; then
name=${GITHUB_REF:10}
fi
echo "val=$name" >> "$GITHUB_OUTPUT"
echo TAG=$name >> $GITHUB_ENV
id: tagname
- name: Build archive
shell: bash
run: |
set -ex
rm -rf tmp
mkdir tmp
mkdir dist
for dir in bins-* ; do
platform=${dir#"bins-"}
# 每次迭代重置,否则 exe 会从 windows 平台泄漏到后续平台
exe=""
if [[ $platform =~ "windows" ]]; then
exe=".exe"
fi
pkgname=$PROJECT_NAME-$TAG-$platform
mkdir tmp/$pkgname
# cp LICENSE README.md tmp/$pkgname
mv bins-$platform/$BIN_NAME$exe tmp/$pkgname
chmod +x tmp/$pkgname/$BIN_NAME$exe
if [ "$exe" = "" ]; then
tar cJf dist/$pkgname.tar.xz -C tmp $pkgname
else
(cd tmp && 7z a -r ../dist/$pkgname.zip $pkgname)
fi
done
- name: Upload binaries to release
uses: svenstaro/upload-release-action@v2
with:
repo_token: ${{ secrets.GITHUB_TOKEN }}
file: dist/*
file_glob: true
tag: ${{ steps.tagname.outputs.val }}
overwrite: true
- name: Extract version
id: extract-version
run: |
echo "tag-name=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"